From a9f7ea7d52326eb5ff6ed488cf31fefc571b9170 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:12 +0800
Subject: [PATCH 01/44] fix(config): cancel settings writes waiting for HMR

---
 packages/boot/config-editor/README.i18n.yaml |  4 ++--
 packages/boot/config-editor/README.md        |  2 +-
 packages/boot/config-editor/README.zh.md     |  2 +-
 packages/boot/config-editor/src/index.ts     |  5 ++++-
 packages/boot/hmr/README.i18n.yaml           |  4 ++--
 packages/boot/hmr/README.md                  |  2 +-
 packages/boot/hmr/README.zh.md               |  2 +-
 packages/boot/hmr/src/index.ts               | 12 ++++++++++--
 packages/boot/hmr/tests/coordination.spec.ts | 19 +++++++++++++++++++
 packages/settings/settings/README.i18n.yaml  |  4 ++--
 packages/settings/settings/README.md         |  2 ++
 packages/settings/settings/README.zh.md      |  2 ++
 packages/settings/settings/src/index.ts      |  9 +++++----
 13 files changed, 52 insertions(+), 17 deletions(-)

diff --git a/packages/boot/config-editor/README.i18n.yaml b/packages/boot/config-editor/README.i18n.yaml
index 5727bdff08..a04b21d3e8 100644
--- a/packages/boot/config-editor/README.i18n.yaml
+++ b/packages/boot/config-editor/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 23386452a66b2fbd
   zh: 70bba862b949b652
 /deepseek-ai-dsh-config-editor/use-this-package:
-  en: 1eedaa5d72b48177
-  zh: 39abc1d927a692d2
+  en: be26ec7aef6c7cb4
+  zh: 3ade4ba48cdf1fc1
 /deepseek-ai-dsh-config-editor/understand-the-implementation:
   en: baa887b5ecfa7001
   zh: d3e03c2b1d10c67e
diff --git a/packages/boot/config-editor/README.md b/packages/boot/config-editor/README.md
index 17da6551f9..912413eebb 100644
--- a/packages/boot/config-editor/README.md
+++ b/packages/boot/config-editor/README.md
@@ -30,7 +30,7 @@ Mount this service in a profile application with Loader and `profileContext`. It
   name: '@deepseek-ai/dsh-config-editor'
 ```
 
-Use [settings](../../settings/settings/README.md) for forms restricted to live fields. Callers that edit complete configuration can use `ctx.configEditor.edit()`; ordinary fields retain Loader’s normal lifecycle.
+Use [settings](../../settings/settings/README.md) for forms restricted to live fields. Callers that edit complete configuration can use `ctx.configEditor.edit()`; ordinary fields retain Loader’s normal lifecycle. The optional `signal` cancels a write waiting for HMR admission without changing the file; an admitted write finishes normally.
 
 <a id="understand-the-implementation"></a>
 ## Understand the implementation
diff --git a/packages/boot/config-editor/README.zh.md b/packages/boot/config-editor/README.zh.md
index d1ff18344f..cc66180ff6 100644
--- a/packages/boot/config-editor/README.zh.md
+++ b/packages/boot/config-editor/README.zh.md
@@ -30,7 +30,7 @@ kind: "package-reference"
   name: '@deepseek-ai/dsh-config-editor'
 ```
 
-使用 [settings](../../settings/settings/README.zh.md) 提供只编辑即时字段的表单。编辑完整配置的调用方可使用 `ctx.configEditor.edit()`；普通字段保留 Loader 的正常生命周期。
+使用 [settings](../../settings/settings/README.zh.md) 提供只编辑即时字段的表单。编辑完整配置的调用方可使用 `ctx.configEditor.edit()`；普通字段保留 Loader 的正常生命周期。可选 `signal` 可取消等待 HMR 调度的写入，文件保持不变；已经开始的写入仍会完成。
 
 <a id="understand-the-implementation"></a>
 ## 理解实现
diff --git a/packages/boot/config-editor/src/index.ts b/packages/boot/config-editor/src/index.ts
index ffec879f40..fefc0503c1 100644
--- a/packages/boot/config-editor/src/index.ts
+++ b/packages/boot/config-editor/src/index.ts
@@ -82,13 +82,16 @@ export class ConfigEditor extends Service {
   /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
    * @param entry Current Loader entry, also used to detect replacement during the write.
    * @param change Derive a raw config from the current entry and its inherited layer.
+   * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
    * @returns Fulfillment after Loader reconciliation completes.
    */
   async edit(
     entry: Entry,
     change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>,
+    signal?: AbortSignal,
   ): Promise<void> {
     const run = async (): Promise<void> => {
+      signal?.throwIfAborted()
       const path = this.documentPath
       await withFileLock(join(this.ownerContext.profileContext.dir, 'package.json'), async () => {
         if (!this.entries().includes(entry) || entry.fiber === undefined) throw new Error('Configuration entry is no longer available')
@@ -150,7 +153,7 @@ export class ConfigEditor extends Service {
       })
     }
     const hmr = this.ownerContext.get('hmr')
-    await (hmr === undefined ? run() : hmr.runExclusive(run))
+    await (hmr === undefined ? run() : hmr.runExclusive(run, signal))
   }
 }
 
diff --git a/packages/boot/hmr/README.i18n.yaml b/packages/boot/hmr/README.i18n.yaml
index 776c0d0fe7..7480a8b3f7 100644
--- a/packages/boot/hmr/README.i18n.yaml
+++ b/packages/boot/hmr/README.i18n.yaml
@@ -21,8 +21,8 @@
   en: 11ef18c6d08f39f3
   zh: 2911cdd03ff3747d
 /deepseek-ai-dsh-hmr/understand-the-implementation:
-  en: bd608f418630317f
-  zh: 053fa77a3fa571a9
+  en: 5ca2a7d68d7c189d
+  zh: 773ffb08d7cbfd0f
 /deepseek-ai-dsh-hmr/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90
diff --git a/packages/boot/hmr/README.md b/packages/boot/hmr/README.md
index 8d2270b4a1..9a2d9ccdc9 100644
--- a/packages/boot/hmr/README.md
+++ b/packages/boot/hmr/README.md
@@ -56,7 +56,7 @@ Profile recompositions run by HMR's profile watches and by Plugin Manager also r
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-`watchConfig()` registers an awaited configuration handler and watches only its target path and required parent directories; sibling files, including temporary writer locks, are excluded before native watcher creation. `runExclusive()` serializes configuration changes and Loader updates with automatic reloads and rejects nested transactions. Package installation and removal run outside this queue. HMR does not acquire the package writer lock; manifest notifications reload only when the ordered `dsh.profile.bundles` list changes. Profile and home patch changes also trigger recomposition. File events received during a configuration transaction are processed afterward. Include refreshes and profile reconciliation reach plugins through ordinary Loader entry updates; Loader commits volatile-only changes in place.
+`watchConfig()` registers an awaited configuration handler and watches only its target path and required parent directories; sibling files, including temporary writer locks, are excluded before native watcher creation. `runExclusive()` serializes configuration changes and Loader updates with automatic reloads and rejects nested transactions. Its optional `signal` cancels a queued operation before admission; an admitted operation still completes before the queue advances. Package installation and removal run outside this queue. HMR does not acquire the package writer lock; manifest notifications reload only when the ordered `dsh.profile.bundles` list changes. Profile and home patch changes also trigger recomposition. File events received during a configuration transaction are processed afterward. Include refreshes and profile reconciliation reach plugins through ordinary Loader entry updates; Loader commits volatile-only changes in place.
 
 App-boot owns profile parsing and patch precedence. HMR reads the launcher’s data-only `profileContext`, registers the profile manifest and both user patch watches during initialization, and waits for application readiness before processing changes. Its disposal closes the watchers and cancels reloads waiting for startup. Configuration watchers start outside the active transaction context so later notifications can enter the queue.
 
diff --git a/packages/boot/hmr/README.zh.md b/packages/boot/hmr/README.zh.md
index 21044fe7d1..9fb05b544e 100644
--- a/packages/boot/hmr/README.zh.md
+++ b/packages/boot/hmr/README.zh.md
@@ -56,7 +56,7 @@ HMR 的 profile 监听和 Plugin Manager 执行的 profile 重新组合，还会
 <details>
 <summary>实现细节——点击展开</summary>
 
-`watchConfig()` 注册会被等待的配置处理器，仅监听目标路径及必要的父目录；同级文件（包括临时写锁）在创建原生 watcher 前即被排除。`runExclusive()` 将配置变更、Loader 更新与自动重载串行化，并拒绝嵌套事务。包安装和删除在该队列之外执行。HMR 不获取包操作写锁；manifest 通知仅在有序的 `dsh.profile.bundles` 列表变化时触发重载。profile 与 home patch 变化也会触发重新组合。配置事务期间收到的文件事件在事务结束后处理。 Include 刷新和 profile 重载都通过普通的 Loader 条目更新到达插件；仅 volatile 变化由 Loader 就地提交。
+`watchConfig()` 注册会被等待的配置处理器，仅监听目标路径及必要的父目录；同级文件（包括临时写锁）在创建原生 watcher 前即被排除。`runExclusive()` 将配置变更、Loader 更新与自动重载串行化，并拒绝嵌套事务。可选 `signal` 只取消尚未开始的排队操作；已经开始的操作仍会执行完毕，队列才继续。包安装和删除在该队列之外执行。HMR 不获取包操作写锁；manifest 通知仅在有序的 `dsh.profile.bundles` 列表变化时触发重载。profile 与 home patch 变化也会触发重新组合。配置事务期间收到的文件事件在事务结束后处理。 Include 刷新和 profile 重载都通过普通的 Loader 条目更新到达插件；仅 volatile 变化由 Loader 就地提交。
 
 App-boot 负责 profile 解析和 patch 优先级规则。HMR 读取启动器提供的纯数据 `profileContext`，在初始化时注册 profile manifest 和两份用户 patch 的监听，并等待应用就绪后处理更改。销毁 HMR 时会关闭监听器并取消等待启动的重载。配置监听器在当前事务上下文之外启动，使后续通知可以进入队列。
 
diff --git a/packages/boot/hmr/src/index.ts b/packages/boot/hmr/src/index.ts
index 47d71d9109..f494ce96ae 100644
--- a/packages/boot/hmr/src/index.ts
+++ b/packages/boot/hmr/src/index.ts
@@ -263,16 +263,24 @@ class Hmr extends Service {
 
   /** Serialize a caller-owned mutation with all automatic reload paths.
    * @param operation Work that must not overlap module or configuration replacement.
+   * @param signal Cancel admission while queued; an operation already running must finish.
    * @returns The operation result after its asynchronous work completes.
    */
-  runExclusive<T>(operation: () => Promise<T>): Promise<T> {
+  runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T> {
     if (this.executing.getStore()) return Promise.reject(new Error('HMR transactions cannot be nested'))
+    if (signal?.aborted) return Promise.reject(signal.reason)
+    const result = Promise.withResolvers<T>()
+    const cancel = () => { result.reject(signal?.reason) }
+    signal?.addEventListener('abort', cancel, { once: true })
     const task = this.operations.then(async () => {
+      signal?.removeEventListener('abort', cancel)
+      signal?.throwIfAborted()
       if (this.closing) throw new Error('HMR is disposed')
       return this.executing.run(true, operation)
     })
     this.operations = task.catch(() => {})
-    return task
+    void task.then(result.resolve, result.reject)
+    return result.promise
   }
 
   private runReload(operation: () => Promise<void>): Promise<void> {
diff --git a/packages/boot/hmr/tests/coordination.spec.ts b/packages/boot/hmr/tests/coordination.spec.ts
index b3660828e9..a3ade63286 100644
--- a/packages/boot/hmr/tests/coordination.spec.ts
+++ b/packages/boot/hmr/tests/coordination.spec.ts
@@ -59,6 +59,25 @@ it('serializes mutations, rejects nesting and keeps the queue usable after failu
   expect(order).toEqual([1, 2])
 })
 
+it('cancels queued mutations without cancelling an admitted transaction', async () => {
+  const { hmr } = await fixture()
+  const release = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(() => { release.resolve(undefined) })
+  const running = new AbortController(), waiting = new AbortController()
+  const first = hmr.runExclusive(async () => { entered.resolve(undefined); await release.promise; return 'committed' }, running.signal)
+  await entered.promise
+  const operation = vi.fn(async () => 'unwanted')
+  const cancelled = hmr.runExclusive(operation, waiting.signal)
+  waiting.abort(new Error('owner unloaded'))
+  running.abort(new Error('too late to cancel admission'))
+  await expect(cancelled).rejects.toThrow('owner unloaded')
+  await expect(hmr.runExclusive(operation, waiting.signal)).rejects.toThrow('owner unloaded')
+  release.resolve(undefined)
+  await expect(first).resolves.toBe('committed')
+  await hmr.runExclusive(async () => {})
+  expect(operation).not.toHaveBeenCalled()
+})
+
 it('holds configuration handlers behind configuration mutations', async () => {
   const { hmr, dir } = await fixture()
   const filename = join(dir, 'package.json')
diff --git a/packages/settings/settings/README.i18n.yaml b/packages/settings/settings/README.i18n.yaml
index 46348fd8da..190c34df59 100644
--- a/packages/settings/settings/README.i18n.yaml
+++ b/packages/settings/settings/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 23386452a66b2fbd
   zh: 70bba862b949b652
 /deepseek-ai-dsh-settings/use-this-package:
-  en: e0f5e49cf8137839
-  zh: bdd8aff9b7773e5a
+  en: ae4733d0b646cc71
+  zh: 86a1fa8d8d1fa077
 /deepseek-ai-dsh-settings/understand-the-implementation:
   en: d8eae17e891ff44e
   zh: 05189989b2786002
diff --git a/packages/settings/settings/README.md b/packages/settings/settings/README.md
index 740996e34b..70e855128f 100644
--- a/packages/settings/settings/README.md
+++ b/packages/settings/settings/README.md
@@ -30,6 +30,8 @@ Mount this plugin with Loader and [config-editor](../../boot/config-editor/READM
   name: '@deepseek-ai/dsh-settings'
 ```
 
+`mutate()` accepts an optional `signal` to cancel a write waiting for HMR admission. Admitted writes finish normally.
+
 This plugin has no configuration fields. Forms expose only volatile fields from active, uniquely addressed profile entries. Ordinary configuration remains editable through Cordis configuration files.
 
 Once the Loader has settled every entry after Settings starts, a `settings.yaml` left in the harness home by earlier releases is imported once: each section is written into the entry of the same id (`ui-developer-tools` → `ui-settings`, `ui-onboarding` → `ui-settings-general`, `shell` → the platform's shell executor entry), the file is renamed to `settings.yaml.imported` before the first write, and a section the running composition rejects is logged and stays only in the renamed file.
diff --git a/packages/settings/settings/README.zh.md b/packages/settings/settings/README.zh.md
index c8fae11993..ab1d6f73b1 100644
--- a/packages/settings/settings/README.zh.md
+++ b/packages/settings/settings/README.zh.md
@@ -30,6 +30,8 @@ kind: "package-reference"
   name: '@deepseek-ai/dsh-settings'
 ```
 
+`mutate()` 接受可选 `signal`，用于取消等待 HMR 调度的写入。已经开始的写入仍会完成。
+
 此插件没有配置字段。表单只展示活动且可唯一定位的 profile 条目中的 volatile 字段。普通配置仍通过 Cordis 配置文件编辑。
 
 Settings 启动后、Loader 完成所有条目的加载时，早期版本留在 harness home 中的 `settings.yaml` 会被导入一次：每个 section 写入同名条目（`ui-developer-tools` → `ui-settings`、`ui-onboarding` → `ui-settings-general`、`shell` → 当前平台的 shell 执行器条目），文件在第一次写入前改名为 `settings.yaml.imported`，被当前组合拒绝的 section 会记录日志并只保留在改名后的文件中。
diff --git a/packages/settings/settings/src/index.ts b/packages/settings/settings/src/index.ts
index e0586ecb24..9dc30c54b6 100644
--- a/packages/settings/settings/src/index.ts
+++ b/packages/settings/settings/src/index.ts
@@ -363,21 +363,22 @@ export class SettingsForms extends Service {
    * @param ns Profile entry id.
    * @param ops Ordered form edits.
    * @param expectedRevision Revision returned by describe.
+   * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
    */
-  async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void> {
+  async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void> {
     await this.write(ns, (current, base, schema) => ops.reduce((value, op) => {
       if (op.op === 'set') return applyPathOp(value, op, schema)
       const parent = op.path.slice(0, -1).reduce<unknown>((node, key) => member(node, key), value)
       if (Array.isArray(parent)) return applyPathOp(value, op, schema)
       const inherited = op.path.reduce<unknown>((node, key) => member(node, key, true), base)
       return applyPathOp(value, inherited === undefined ? op : { op: 'set', path: op.path, value: inherited }, schema)
-    }, current), expectedRevision, ops.map(op => op.path))
+    }, current), expectedRevision, ops.map(op => op.path), signal)
   }
 
   private async write(
     ns: string,
     change: (current: Record<string, unknown>, base: Record<string, unknown>, schema: z) => Record<string, unknown>,
-    expected?: number, paths: readonly (readonly string[])[] = [],
+    expected?: number, paths: readonly (readonly string[])[] = [], signal?: AbortSignal,
   ): Promise<void> {
     const entry = this.ownerContext.configEditor.entries().find(row => row.options.id === ns)
     const schema = entry === undefined ? undefined : this.schema(entry)
@@ -418,7 +419,7 @@ export class SettingsForms extends Service {
         return result
       }
       return mergeLayers(strip(raw, form), next) as Record<string, unknown>
-    })
+    }, signal)
     this.describe()
   }
 

From eb8efe84e46e8eaacb739fe6d8e003c7a211b93b Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:12 +0800
Subject: [PATCH 02/44] feat(plugins): support platform-aware bundle activation

---
 packages/boot/app-boot/README.i18n.yaml       |   4 +-
 packages/boot/app-boot/README.md              |   2 +
 packages/boot/app-boot/README.zh.md           |   2 +
 packages/boot/app-boot/src/bundle-platform.ts |  28 +++++
 packages/boot/app-boot/src/index.ts           |   1 +
 packages/boot/app-boot/src/profile-plugins.ts |   6 +-
 packages/boot/app-boot/src/profile.ts         |   6 +-
 .../app-boot/tests/bundle-platform.spec.ts    |  18 +++
 .../app-boot/tests/profile-plugins.spec.ts    |  12 ++
 packages/boot/app-boot/tests/profile.spec.ts  |  22 +++-
 packages/boot/plugin-manager/README.i18n.yaml |   4 +-
 packages/boot/plugin-manager/README.md        |   4 +
 packages/boot/plugin-manager/README.zh.md     |   4 +
 packages/boot/plugin-manager/src/index.ts     |  23 +++-
 .../boot/plugin-manager/src/operations.ts     |   3 +-
 packages/boot/plugin-manager/src/patch.ts     | 101 ++++++++++++++---
 packages/boot/plugin-manager/src/tools.ts     |   1 +
 packages/boot/plugin-manager/src/types.ts     |   4 +-
 .../boot/plugin-manager/tests/manager.spec.ts |  78 +++++++++++++
 .../plugin-manager/tests/operations.spec.ts   |  11 ++
 .../boot/plugin-manager/tests/patch.spec.ts   |  94 +++++++++++++++-
 .../boot/plugin-manager/tests/tools.spec.ts   |   2 +
 .../client/ui-plugin-manager/README.i18n.yaml |  16 +--
 packages/client/ui-plugin-manager/README.md   |  12 +-
 .../client/ui-plugin-manager/README.zh.md     |  12 +-
 .../src/client/PluginManagerPage.module.css   |  19 +++-
 .../src/client/PluginManagerPage.tsx          |  51 ++++++---
 .../ui-plugin-manager/src/client/locales.ts   |   4 +
 .../src/client/manager-store.ts               |   6 +
 .../src/client/presentation.ts                |   5 +-
 .../src/client/slot-contract.ts               |   2 +
 .../tests/components.client.spec.tsx          | 104 +++++++++++++++++-
 .../tests/manager-store.client.spec.ts        |  10 ++
 .../host/plugin-inventory/README.i18n.yaml    |   4 +-
 packages/host/plugin-inventory/README.md      |   2 +
 packages/host/plugin-inventory/README.zh.md   |   2 +
 packages/host/plugin-inventory/src/index.ts   |   9 +-
 packages/host/plugin-inventory/src/types.ts   |   2 +
 .../plugin-inventory/tests/inventory.spec.ts  |  24 ++++
 .../util/package-manifest/README.i18n.yaml    |   4 +-
 packages/util/package-manifest/README.md      |   3 +
 packages/util/package-manifest/README.zh.md   |   3 +
 packages/util/package-manifest/src/types.ts   |   8 ++
 43 files changed, 662 insertions(+), 70 deletions(-)
 create mode 100644 packages/boot/app-boot/src/bundle-platform.ts
 create mode 100644 packages/boot/app-boot/tests/bundle-platform.spec.ts

diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml
index c13fb647d1..943014d70c 100644
--- a/packages/boot/app-boot/README.i18n.yaml
+++ b/packages/boot/app-boot/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: 4a424cd401556f20
   zh: 0b34dd18e0db6cea
 /deepseek-ai-dsh-app-boot/use-this-package/profiles:
-  en: d2d520668668292c
-  zh: b7deeab27032a3ad
+  en: db1d1b9474a58bef
+  zh: 14ad991227af6695
 /deepseek-ai-dsh-app-boot/use-this-package/previewing-the-effective-configuration:
   en: 646a0ccdd7881ad1
   zh: e3696acb1573dd7b
diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md
index 59c38476da..6cc1b3ff91 100644
--- a/packages/boot/app-boot/README.md
+++ b/packages/boot/app-boot/README.md
@@ -55,6 +55,8 @@ Admission happens only at composition boundaries DSH owns, and a denied row is d
 
 Exact-version exemptions live in the profile's own `compatibility.json`, not in its `package.json`, so an exemption write never touches the dependency manifest, the bundle list, or Cordis patch files. It maps exact `package-name@version` keys to lists of exact DSH runtime versions; neither a plugin upgrade nor a DSH upgrade inherits permission. A missing file means no exemptions. A malformed one never stops the profile from starting: records the reader accepts still apply, each rejected record is reported on stderr beside the plugin denials, and the file is then treated as read-only, so a grant or revocation refuses and asks the user to repair it by hand instead of overwriting their content. [Plugin Manager](../plugin-manager/README.md#version-compatibility-and-exemptions) owns the grant, revocation, and risk confirmation each change requires.
 
+A bundle may declare `dsh.bundle.platforms` as a nonempty list of Node Host platform names, such as `["darwin"]`. The launcher validates this declaration before reading the bundle patch. An unsupported Host skips the entire layer, retains its saved selection, and reports the reason through `skippedBundles`; other layers remain effective. Omission permits every platform. Browser clients do not determine Host support.
+
 Your machine-local preferences also live in the Harness home:
 
 - **`.env`** — your ordinary environment layers: the invoking directory's file outranks the Harness-home file, and both sit below the inherited environment. Variables that decide how the process starts (`PATH`, `DSH_*`, `XDG_*` and similar) are rejected from files: export them instead. The four proxy names (`HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY`) are accepted from the Harness-home file only, never from the invoking directory's, which arrives with a clone. For a non-product bin that just wants one directory's `.env`, a missing file is fine and an unloadable one prints one labelled warning line.
diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md
index 73e383e04a..39260193d9 100644
--- a/packages/boot/app-boot/README.zh.md
+++ b/packages/boot/app-boot/README.zh.md
@@ -55,6 +55,8 @@ profile 导入插件前，DSH 会将其声明的 DSH 版本要求与 `getDshRunt
 
 精确版本豁免保存在 profile 自己的 `compatibility.json` 中，而不是 `package.json`，因此写豁免不会触及依赖清单、组合包列表或 Cordis patch 文件。它把精确的 `package-name@version` 键映射到精确 DSH 运行时版本列表；插件升级和 DSH 升级都不继承授权。文件缺失表示没有豁免。文件损坏绝不会阻止 profile 启动：读取器接受的记录仍然生效，每条被拒绝的记录会与插件拒绝信息一起输出到 stderr，此后该文件被视为只读，因此授予或撤销会拒绝执行并要求用户手工修复，而不是覆盖用户的内容。[插件管理器](../plugin-manager/README.zh.md#version-compatibility-and-exemptions)负责每次变更所需的授权、撤销与风险确认。
 
+组合包可以用 `dsh.bundle.platforms` 声明非空的 Node Host 平台名称列表，例如 `["darwin"]`。启动器在读取组合包 patch 前验证此声明。Host 不受支持时会跳过整个配置层，保留已保存的选择，并通过 `skippedBundles` 报告原因；其他配置层继续生效。省略此字段时允许所有平台。浏览器所在机器的平台不决定 Host 是否受支持。
+
 你的机器本地偏好同样位于 harness home 中：
 
 - **`.env`**——你的普通环境层：调用目录的文件优先于 harness home 的文件，两者都低于继承环境。在文件中设置的进程启动变量（如 `PATH`、`DSH_*`、`XDG_*`）会被拒绝：请改为导出这些变量。四个代理名（`HTTP_PROXY`、`HTTPS_PROXY`、`ALL_PROXY`、`NO_PROXY`）只从 harness home 的文件接受，绝不从调用目录的文件接受——后者随 clone 一起到来。对于只想加载某个目录 `.env` 的非产品 bin，文件缺失不影响启动，文件无法加载时输出一行带标签的警告。
diff --git a/packages/boot/app-boot/src/bundle-platform.ts b/packages/boot/app-boot/src/bundle-platform.ts
new file mode 100644
index 0000000000..4d3f41e23e
--- /dev/null
+++ b/packages/boot/app-boot/src/bundle-platform.ts
@@ -0,0 +1,28 @@
+/** Host operating-system admission for optional bundle layers. */
+
+/** A valid bundle declaration excludes the operating system running DSH. */
+export class UnsupportedBundlePlatformError extends Error {
+  /**
+   * @param platforms Node platform names supported by the bundle.
+   * @param platform Operating system of the DSH Host.
+   */
+  constructor(platforms: readonly string[], platform: string) {
+    super(`Bundle supports Host platforms ${platforms.join(', ')}; the DSH Host is running ${platform}`)
+    this.name = 'UnsupportedBundlePlatformError'
+  }
+}
+
+/**
+ * Validate package metadata and reject an unsupported Host before selecting or composing a bundle.
+ * @param platforms The optional `dsh.bundle.platforms` field read from package.json.
+ * @param platform Operating system of the DSH Host, from Node's `process.platform`.
+ * @throws When the declaration is malformed or excludes the Host; omission allows every platform.
+ */
+export function assertBundlePlatform(platforms: unknown, platform: string): void {
+  if (platforms === undefined) return
+  if (!Array.isArray(platforms) || platforms.length === 0
+    || !platforms.every((value): value is string => typeof value === 'string' && /^[a-z][a-z0-9]*$/.test(value))) {
+    throw new Error('dsh.bundle.platforms must be a nonempty list of Node platform names')
+  }
+  if (!platforms.includes(platform)) throw new UnsupportedBundlePlatformError(platforms, platform)
+}
diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts
index fded02c9c8..0dc2791df2 100644
--- a/packages/boot/app-boot/src/index.ts
+++ b/packages/boot/app-boot/src/index.ts
@@ -55,6 +55,7 @@ declare module '@deepseek-ai/cordis' {
   }
 }
 
+export { assertBundlePlatform, UnsupportedBundlePlatformError } from './bundle-platform.ts'
 export {
   composeEntries,
   createRuntimeResolution,
diff --git a/packages/boot/app-boot/src/profile-plugins.ts b/packages/boot/app-boot/src/profile-plugins.ts
index 1cd55e9135..24d3ae5355 100644
--- a/packages/boot/app-boot/src/profile-plugins.ts
+++ b/packages/boot/app-boot/src/profile-plugins.ts
@@ -1,6 +1,7 @@
 /** Installed profile dependencies and their bundle activation after package-manager operations. */
 
 import { join } from 'node:path'
+import { assertBundlePlatform } from './bundle-platform.ts'
 import { readProfileManifest, resolveBundleDir, writeProfileManifest, type ProfileManifest } from './profile.ts'
 
 /** Profile directory and installation used by the shared bundle resolver. */
@@ -112,7 +113,10 @@ export function reconcileProfilePlugins(options: ProfilePluginLocation & {
   const previous = after.manifest.dsh?.profile?.bundles ?? []
   const bundles = previous.filter(name => !(beforeNames.has(name) || afterNames.has(name)) || bundleNames.has(name))
   for (const dependency of after.dependencies) {
-    if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) bundles.push(dependency.name)
+    if (dependency.bundle && !disabled.has(dependency.name) && !bundles.includes(dependency.name)) {
+      assertBundlePlatform(bundleManifest(options, dependency.name)?.dsh?.bundle?.platforms, process.platform)
+      bundles.push(dependency.name)
+    }
   }
   const changed = bundles.length !== previous.length || bundles.some((name, index) => name !== previous[index])
   const manifest = changed ? writeProfileBundles(options.profileDir, after.manifest, bundles) : after.manifest
diff --git a/packages/boot/app-boot/src/profile.ts b/packages/boot/app-boot/src/profile.ts
index 3c7aa74762..27e1e3082e 100644
--- a/packages/boot/app-boot/src/profile.ts
+++ b/packages/boot/app-boot/src/profile.ts
@@ -28,6 +28,7 @@ import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
 import { applyEntryPatches, type PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
 import type { DshBundleManifest, DshPackageManifest } from '@deepseek-ai/dsh-package-manifest'
+import { assertBundlePlatform } from './bundle-platform.ts'
 import { evaluatePluginCompatibility, pluginCompatibilityWarning } from './plugin-compatibility.ts'
 import { readProfileVersionExemptions } from './profile-compatibility.ts'
 import { loadOverlayPatches } from './index.ts'
@@ -221,6 +222,7 @@ export const DEFAULT_PROFILE_BUNDLES: readonly string[] = ['@deepseek-ai/dsh-bas
  * [admission](../../../../.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md)).
  */
 export const OPTIONAL_BUNDLES: readonly string[] = [
+  '@deepseek-ai/dsh-cua-bundle',
   '@deepseek-ai/dsh-experimental-session-search',
   '@deepseek-ai/dsh-experimental-ralph-bundle',
   '@deepseek-ai/dsh-experimental-terminal-bundle',
@@ -729,7 +731,8 @@ export function resolveBundleDir(
  * the shared Harness home. This is used by application-owned profiles whose
  * package project and lifecycle belong to that application.
  * Retired bundles are removed from the stored bundle list first, rewriting the
- * manifest when it listed one. Unreadable bundles, and bundles whose own dsh requirements the profile does not exempt, are skipped
+ * manifest when it listed one. Unreadable bundles, unsupported Host platforms, and bundles whose own dsh requirements
+ * the profile does not exempt are skipped
  * without changing the manifest and listed in `skippedBundles`; nothing is printed.
  * @param binName - the diagnostic prefix on thrown errors.
  * @param dir - absolute profile package directory.
@@ -756,6 +759,7 @@ export function loadProfileDirectory(
       if (bundle === undefined) {
         throw new Error(`${binName}: profile bundle ${JSON.stringify(packageName)} declares no dsh.bundle in its package.json`)
       }
+      assertBundlePlatform(bundle.platforms, process.platform)
       // A bundle is not a plugin row, so row admission never reads its own dsh requirements.
       const issue = evaluatePluginCompatibility(bundleManifest, exemptions)
       if (issue !== undefined && !issue.exempted) throw new Error(pluginCompatibilityWarning(issue))
diff --git a/packages/boot/app-boot/tests/bundle-platform.spec.ts b/packages/boot/app-boot/tests/bundle-platform.spec.ts
new file mode 100644
index 0000000000..cdb7a75edf
--- /dev/null
+++ b/packages/boot/app-boot/tests/bundle-platform.spec.ts
@@ -0,0 +1,18 @@
+/** Bundle declarations admit the Host operating system independently of browser clients. */
+import { expect, it } from 'vitest'
+import { assertBundlePlatform, UnsupportedBundlePlatformError } from '../src/bundle-platform.ts'
+
+it.each(['darwin', 'win32', 'linux'])('allows undeclared platforms and an explicit %s Host', (platform) => {
+  expect(() => { assertBundlePlatform(undefined, platform) }).not.toThrow()
+  expect(() => { assertBundlePlatform([platform], platform) }).not.toThrow()
+  expect(() => { assertBundlePlatform(['darwin', 'win32', 'linux'], platform) }).not.toThrow()
+})
+
+it.each(['win32', 'linux'])('rejects macOS-only bundles on %s Hosts', (platform) => {
+  expect(() => { assertBundlePlatform(['darwin'], platform) }).toThrow(UnsupportedBundlePlatformError)
+  expect(() => { assertBundlePlatform(['darwin'], platform) }).toThrow(`the DSH Host is running ${platform}`)
+})
+
+it.each([null, true, 'darwin', [], [1], [''], ['Darwin'], [' darwin'], ['darwin', false]].map(platforms => ({ platforms })))('rejects malformed platform metadata $platforms', ({ platforms }) => {
+  expect(() => { assertBundlePlatform(platforms, 'darwin') }).toThrow('dsh.bundle.platforms must be a nonempty list')
+})
diff --git a/packages/boot/app-boot/tests/profile-plugins.spec.ts b/packages/boot/app-boot/tests/profile-plugins.spec.ts
index 04950b4812..223754fc71 100644
--- a/packages/boot/app-boot/tests/profile-plugins.spec.ts
+++ b/packages/boot/app-boot/tests/profile-plugins.spec.ts
@@ -31,6 +31,18 @@ function installed(location: ProfilePluginLocation, name: string, bundle = true)
   })
 }
 
+it('refuses automatic activation on an unsupported Host without changing the bundle selection', () => {
+  const location = fixture()
+  const before = readProfilePlugins(location)
+  writeManifest(location.profileDir, { dependencies: { restricted: '1.0.0' }, dsh: { profile: { bundles: [] } } })
+  writeManifest(join(location.profileDir, 'node_modules/restricted'), { name: 'restricted', dsh: { bundle: {
+    patch: 'unused.yml', platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'],
+  } } })
+  const saved = readFileSync(join(location.profileDir, 'package.json'), 'utf8')
+  expect(() => reconcileProfilePlugins({ ...location, before, preserveDisabled: true })).toThrow('Host is running')
+  expect(readFileSync(join(location.profileDir, 'package.json'), 'utf8')).toBe(saved)
+})
+
 describe('profile plugin inventory', () => {
   it('uses dependency alias keys, installed versions, and the loader installation precedence', () => {
     const location = fixture()
diff --git a/packages/boot/app-boot/tests/profile.spec.ts b/packages/boot/app-boot/tests/profile.spec.ts
index fbd47c20bf..0187836abc 100644
--- a/packages/boot/app-boot/tests/profile.spec.ts
+++ b/packages/boot/app-boot/tests/profile.spec.ts
@@ -47,7 +47,7 @@ const tmp = (): string => {
 
 /** Stage a fake installed app: package.json with deps and a node_modules holding bundles. */
 function stageInstallation(
-  bundles: Record<string, { patch?: string; deps?: Record<string, string> }>,
+  bundles: Record<string, { patch?: string; deps?: Record<string, string>; platforms?: string[] }>,
   appName = 'dsh-app',
 ): string {
   const root = tmp()
@@ -64,7 +64,7 @@ function stageInstallation(
       type: 'module',
       main: './index.js',
       dependencies: spec.deps ?? {},
-      ...spec.patch === undefined ? {} : { dsh: { bundle: { patch: './cordis.patch.yml' } } },
+      ...spec.patch === undefined ? {} : { dsh: { bundle: { patch: './cordis.patch.yml', ...spec.platforms === undefined ? {} : { platforms: spec.platforms } } } },
     }))
     writeFileSync(join(dir, 'index.js'), `export const packageName = ${JSON.stringify(name)}\n`)
     if (spec.patch !== undefined) writeFileSync(join(dir, 'cordis.patch.yml'), spec.patch)
@@ -76,6 +76,24 @@ function stageInstallation(
   return join(appDir, 'package.json')
 }
 
+it('skips an unsupported saved bundle before composing any runtime overrides and retains the selection', () => {
+  const unsupported = process.platform === 'darwin' ? 'win32' : 'darwin'
+  const anchor = stageInstallation({
+    base: { patch: '- insert:\n  - id: ptc-runtime\n    name: runtime\n    config: { executionMode: isolated }\n' },
+    restricted: { platforms: [unsupported], patch: '- id: ptc-runtime\n  config: { executionMode: persistent-in-memory }\n' },
+  })
+  const dir = join(tmp(), 'profile')
+  initProfile(dir, ['base', 'restricted'])
+  const before = readFileSync(join(dir, 'package.json'), 'utf8')
+  const profile = loadProfileDirectory('test', dir, anchor)
+  expect(profile.layers.map(layer => layer.packageName)).toEqual(['base'])
+  expect(profile.skippedBundles).toHaveLength(1)
+  expect(profile.skippedBundles[0]?.packageName).toBe('restricted')
+  expect(profile.skippedBundles[0]?.reason).toContain(`Host is running ${process.platform}`)
+  expect(composeEntries(profile.layers.map(layer => layer.patches))).toMatchObject([{ id: 'ptc-runtime', config: { executionMode: 'isolated' } }])
+  expect(readFileSync(join(dir, 'package.json'), 'utf8')).toBe(before)
+})
+
 /** Represent one resolved external bundle as a loaded profile layer. */
 function stageProfile(home: string, name: string, bundleAnchor: string): Profile {
   const dir = resolveProfileDir(name, home)
diff --git a/packages/boot/plugin-manager/README.i18n.yaml b/packages/boot/plugin-manager/README.i18n.yaml
index ad3660e390..f9267bfc4b 100644
--- a/packages/boot/plugin-manager/README.i18n.yaml
+++ b/packages/boot/plugin-manager/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 87679c51aa3693f5
   zh: 11684a48a5806afb
 /deepseek-ai-dsh-plugin-manager/use-this-package:
-  en: 95c1b18f8432090a
-  zh: 213e54a1547a1da1
+  en: 8e8a34186b091682
+  zh: c94654f370a1baa1
 /deepseek-ai-dsh-plugin-manager/use-this-package/version-compatibility-and-exemptions:
   en: 483285658e267dd5
   zh: 846bec2daac59a96
diff --git a/packages/boot/plugin-manager/README.md b/packages/boot/plugin-manager/README.md
index c12c12bc47..84bb313bba 100644
--- a/packages/boot/plugin-manager/README.md
+++ b/packages/boot/plugin-manager/README.md
@@ -39,6 +39,10 @@ For a deployment without agent presets, enable the tool in the profile patch. Pr
 
 A plugin toggle updates only `disabled` in the last matching override in the profile's `cordis.patch.yml`, or appends an override when none matches. Matching uses the entry id and any module-name assertion. An override holding only `id` and `disabled` is removed, and none is appended, when the bundle layers and the remaining profile patches already give the entry the requested state, so the profile patch records only departures from the bundles. Home and invocation patches are left out of that comparison; they apply after the profile patch and do not decide what it records. A bundle toggle changes `package.json`'s ordered `dsh.profile.bundles` list. Disabling retains the dependency; enabling appends the bundle at the end, which can change configuration precedence. Installation enables a new bundle by default. Home and invocation patches retain their higher priority.
 
+Bundle platform declarations are checked before saving an enabled selection. Unsupported Hosts return `unsupported-platform` without applying runtime overrides. The bundle remains visible with its display metadata and can still be deselected. Automatic activation after a package operation uses the same check. The agent-facing next step asks the user to run the bundle on a supported Host.
+
+Bundles may declare `dsh.bundle.configureOnEnable`, mapping existing profile entry ids to top-level config fields. Explicit enablement merges changed fields into the user patch before the ordinary HMR reconciliation, preserving unrelated settings. Missing or ambiguous entries, whole-config `!!js` expressions, and conflicting home or launch overlays reject the operation before saving. Express the target config as a literal mapping to allow enablement edits; expressions on fields being set are replaced by the requested literals, while unrelated field expressions are preserved. Configuration anchors remain available to other entries; anchored overrides are retained and followed by the activation override. Matching values cause no rewrite. Disablement retains these settings. The CLI and manual bundle-list edits do not apply these enablement settings.
+
 A selected bundle that cannot load remains in `listBundles` with an `error`; `enabled` records the saved selection, not successful loading. The plugin page shows the error and allows deselection. A broken bundle cannot be enabled. Management bundles remain protected if their files become unreadable.
 
 `listBundles` includes optional display `meta` for each bundle and its declared plugin rows, including disabled bundles. The Client selects a language from these values. The separate `description` field is the bundle's raw `package.json.description`; a metadata diagnostic does not block management. `source` gives a profile dependency as a spec `pnpm add` accepts: a git address or URL as recorded without the user information of an http(s) URL (a query string stays as recorded), a `file:` or `link:` path made absolute against the profile or the home directory for `~`, and a registry range, tag, or alias after the package name, as is any spec of a package installed under another name; a bundle the installation supplies has none, even when the profile also depends on it, because the installation's copy is the one that loads. The `plugin_manager` tool omits UI display metadata from list results.
diff --git a/packages/boot/plugin-manager/README.zh.md b/packages/boot/plugin-manager/README.zh.md
index 17fcf8eefd..847915a523 100644
--- a/packages/boot/plugin-manager/README.zh.md
+++ b/packages/boot/plugin-manager/README.zh.md
@@ -39,6 +39,10 @@ kind: "package-reference"
 
 插件开关只更新 profile 的 `cordis.patch.yml` 中最后一条匹配覆盖项的 `disabled`；没有匹配项时追加。匹配依据是条目 id，以及覆盖项声明的模块名称。如果组合包层和其余 profile patch 已使条目处于所请求的状态，仅含 `id` 与 `disabled` 的覆盖项会被移除，也不会追加覆盖项，因此 profile patch 只记录与组合包不同的设置。该比较不计入 home 和单次启动 patch；它们在 profile patch 之后应用，不决定 profile patch 记录什么。组合包开关修改 `package.json` 的有序 `dsh.profile.bundles` 列表。关闭保留依赖；开启追加到列表末尾，可能改变配置优先级。安装新组合包默认启用。home 和单次启动 patch 保留更高优先级。
 
+组合包的平台声明会在保存启用选择前检查。Host 不受支持时返回 `unsupported-platform`，不应用运行时配置覆盖。组合包仍保留显示信息，并允许取消选择。包操作后的自动启用执行同一检查。给模型的下一步说明会提示用户在受支持的 Host 上运行该组合包。
+
+组合包可声明 `dsh.bundle.configureOnEnable`，将现有 profile 条目 id 映射到配置顶层字段。显式启用先将变化的字段合并到用户 patch，再通过正常 HMR 重组应用，保留无关设置；条目缺失、存在歧义、整段 config 使用 `!!js` 表达式，或 home、启动覆盖层冲突时，写入前拒绝操作。启用设置需要将目标 config 写成普通映射，目标字段上的表达式会被指定值替换，无关字段的表达式保留。配置中的锚点继续供其他条目引用；含锚点的覆盖项保留，启用覆盖项追加在后。值已匹配时不改写。关闭保留这些设置。CLI 和手动修改组合包列表不应用这些启用设置。
+
 已选择但无法加载的组合包仍会出现在 `listBundles` 中，并携带 `error`；`enabled` 表示保存的选择，不代表加载成功。插件页面显示错误并允许取消选择。损坏的组合包无法启用。管理组合包的文件变得不可读后仍受保护。
 
 `listBundles` 为各组合包及其声明的插件行提供可选的展示 `meta`，包括已禁用的组合包。Client 从这些值中选择语言。单独的 `description` 字段是该组合包原始的 `package.json.description`；元信息诊断不会阻止管理操作。`source` 以 `pnpm add` 接受的 spec 给出 profile 依赖：git 地址或 URL 按记录给出，但去掉 http(s) URL 的 user information（查询字符串保持原样）；`file:` 或 `link:` 路径按 profile 目录解析为绝对路径，`~` 展开为主目录；注册表版本范围、标签或别名接在包名的 `@` 之后，以别名安装的包的 spec 也是如此。安装提供的组合包没有该字段，即使 profile 也依赖它，因为实际加载的是安装中的副本。`plugin_manager` 工具的列表结果不包含 UI 展示元信息。
diff --git a/packages/boot/plugin-manager/src/index.ts b/packages/boot/plugin-manager/src/index.ts
index 6734d2872b..ac0ee3c5fd 100644
--- a/packages/boot/plugin-manager/src/index.ts
+++ b/packages/boot/plugin-manager/src/index.ts
@@ -17,6 +17,7 @@ import {
   evaluatePluginCompatibility, readProfileCompatibility, readProfileVersionExemptions,
   setProfileVersionExemption, PROFILE_COMPATIBILITY_FILENAME,
   OFFICIAL_ON_DEMAND_CATALOG, getDshRuntimeVersion, ResolutionRestartRequired,
+  assertBundlePlatform, UnsupportedBundlePlatformError,
 } from '@deepseek-ai/dsh-app-boot'
 import type {} from '@deepseek-ai/dsh-hmr'
 import type { ProfileContext, ProfileManifest } from '@deepseek-ai/dsh-app-boot'
@@ -25,7 +26,7 @@ import { classifyInstallFailure } from './install-failure.ts'
 import { officialBundleInstallTarget } from './official-install-target.ts'
 import { dependencySpec, InvalidInstallSpecError, parseInstallSpec, type ParsedInstallSpec } from './install-spec.ts'
 import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from './registry.ts'
-import { flatten, writePluginEnabled } from './patch.ts'
+import { flatten, prepareBundleConfiguration, writePluginEnabled } from './patch.ts'
 import { incompatiblePlugin, ManagementFailure } from './failure.ts'
 import { approveBuilds, recordPendingBuilds } from './build-approval.ts'
 import { checkGithubConnection } from './github-connection.ts'
@@ -88,6 +89,7 @@ function messageOf(error: unknown): string { return error instanceof Error ? err
 
 /** An expected refusal keeps its code; anything else becomes an operation error carrying its exact diagnostic. */
 function managementError(error: unknown): ManagementError {
+  if (error instanceof UnsupportedBundlePlatformError) return { code: 'unsupported-platform' }
   if (!(error instanceof ManagementFailure)) return { code: 'operation-error', diagnostic: messageOf(error) }
   return { code: error.code, ...error.incompatible === undefined ? {} : { incompatible: error.incompatible } }
 }
@@ -361,18 +363,25 @@ export class PluginManager extends TypertRemoteService {
             ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: targetError ?? { code: 'not-bundle' }, rows: [], overrides: [] })
           continue
         }
+        const experimental = info.dsh?.bundle?.experimental
+        if (experimental !== undefined && typeof experimental !== 'boolean') throw new Error('bundle experimental must be a boolean')
         version = info.version
         const compatibility = evaluatePluginCompatibility(info, exemptions)
         if (compatibility !== undefined && !compatibility.exempted) throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)])
         const dir = resolveBundleDir('dsh', name, this.profile.installAnchor, this.profile.dir)
         const meta = offered?.meta ?? readPluginMeta(info.name ?? name, pathToFileURL(join(dir, 'package.json')).href)
-        bundles.push({ name, official, availability, ...target, ...(version === undefined ? {} : { version }),
+        let platformError: ManagementError | undefined
+        try { assertBundlePlatform(info.dsh?.bundle?.platforms, process.platform) }
+        catch (error) { platformError = managementError(error) }
+        const error = targetError ?? platformError
+        bundles.push({ name, official, availability, ...target, ...experimental === undefined ? {} : { experimental },
+          ...(version === undefined ? {} : { version }),
           ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
           ...meta === undefined ? {} : { meta },
           ...sourceOf(info.name), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
           ...(readOnlyReason === undefined ? {} : { readOnlyReason }),
           ...this.declaredRows(name, info),
-          ...targetError === undefined ? {} : { error: targetError } })
+          ...error === undefined ? {} : { error } })
       } catch (error) {
         if (enabled || installed || optional || offered !== undefined) {
           bundles.push({ name, official, availability, ...catalogMeta, ...target, ...(version === undefined ? {} : { version }),
@@ -808,19 +817,27 @@ export class PluginManager extends TypertRemoteService {
   private async selectBundle(name: string, enabled: boolean): Promise<void> {
     const manifest = readProfileManifest('dsh', this.profile.dir)
     const previous = bundleSelection(manifest)
+    let enableConfiguration: string | undefined
     if (enabled || !previous.includes(name)) {
       const metadata = bundleManifest(name, this.profile.dir, this.profile.installAnchor)
       if (metadata === undefined) throw new ManagementFailure('not-bundle')
       if (enabled) {
+        assertBundlePlatform(metadata.dsh?.bundle?.platforms, process.platform)
         const compatibility = evaluatePluginCompatibility(metadata, readProfileVersionExemptions(this.profile.dir))
         if (compatibility !== undefined && !compatibility.exempted) throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)])
         this.bundleRows(name)
+        if (metadata.dsh?.bundle?.configureOnEnable !== undefined) {
+          enableConfiguration = await prepareBundleConfiguration(this.profile, metadata.dsh.bundle.configureOnEnable)
+        }
       }
     }
     if (!enabled && previous.includes(name)) {
       if (this.protectsManager(name)) throw new ManagementFailure('management-required')
     }
     const bundles = enabled ? [...previous, ...previous.includes(name) ? [] : [name]] : previous.filter(item => item !== name)
+    if (enableConfiguration !== undefined) {
+      await writeFileAtomic(this.profile.patchPath, enableConfiguration, { mode: 0o600 })
+    }
     if (JSON.stringify(previous) === JSON.stringify(bundles)) return
     manifest.dsh = { ...manifest.dsh, profile: { ...manifest.dsh?.profile, bundles } }
     await saveManifest(this.profile.dir, manifest)
diff --git a/packages/boot/plugin-manager/src/operations.ts b/packages/boot/plugin-manager/src/operations.ts
index b9a36d6083..2bb102c255 100644
--- a/packages/boot/plugin-manager/src/operations.ts
+++ b/packages/boot/plugin-manager/src/operations.ts
@@ -7,7 +7,7 @@ import { execa } from 'execa'
 import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
 import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
 import {
-  DEFAULT_PROFILE_BUNDLES, bundlePatchPaths, initProfile, PROFILE_TEMPLATES, readProfileManifest,
+  DEFAULT_PROFILE_BUNDLES, assertBundlePlatform, bundlePatchPaths, initProfile, PROFILE_TEMPLATES, readProfileManifest,
   resolveBundleDir, resolveProfileDir, loadOverlayPatches, composeEntries, readProfileVersionExemptions,
   evaluatePluginCompatibility, pluginCompatibilityWarning, type ProfileManifest,
 } from '@deepseek-ai/dsh-app-boot'
@@ -102,6 +102,7 @@ async function reconcile(before: ProfileManifest, dir: string, anchor: string, o
       options.onOutput?.(`dsh: warning: ${name} declares no dsh.bundle — installed as a plain dependency, not a profile layer\n`, 'stderr')
       continue
     }
+    assertBundlePlatform(metadata.dsh.bundle.platforms, process.platform)
     for (const file of bundlePatchPaths(resolveBundleDir('dsh', name, anchor, dir), metadata.dsh.bundle)) loadOverlayPatches('dsh', file)
     if (!bundles.includes(name)) {
       bundles.push(name)
diff --git a/packages/boot/plugin-manager/src/patch.ts b/packages/boot/plugin-manager/src/patch.ts
index 0dfacb2de6..26e41b7001 100644
--- a/packages/boot/plugin-manager/src/patch.ts
+++ b/packages/boot/plugin-manager/src/patch.ts
@@ -1,8 +1,10 @@
 /** Comment-preserving profile plugin enablement edits and the entry flattening they compare against. */
 import { readFile } from 'node:fs/promises'
-import { isMap, isNode, isScalar, isSeq, parseDocument } from 'yaml'
-import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
-import { composeEntries, loadOptionalPatches, readBundlePatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
+import { isMap, isNode, isScalar, isSeq, parseDocument, Scalar, visit } from 'yaml'
+import { isDeepStrictEqual } from 'node:util'
+import { z } from 'zod'
+import { isJsExpr, type EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
+import { composeEntries, loadOptionalPatches, loadProfileDirectory, readBundlePatches, readProfilePatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
 
 /** Flatten only the groups addressable by the profile's patch composer.
@@ -13,17 +15,8 @@ export function flatten(rows: EntryOptions[]): EntryOptions[] {
   return rows.flatMap(row => [row, ...(row.group && Array.isArray(row.config) ? flatten(row.config as EntryOptions[]) : [])])
 }
 
-/** Replace the last matching override or append one after existing insertions. An override that holds only `id` and
- * `disabled`, without anchors, is removed, or not appended, when the bundle layers and the remaining profile patches
- * already give the entry the requested literal `disabled` value; home patches and launch overlays are not consulted.
- * @param profile Profile whose patch file is edited and whose selected bundles supply the compared composition.
- * @param id Unique composition entry id.
- * @param name Module name used to match name-qualified overrides.
- * @param enabled Desired entry enablement.
- * @returns Whether the file changed.
- */
-export async function writePluginEnabled(profile: ProfileContext, id: string, name: string, enabled: boolean): Promise<boolean> {
-  const filename = profile.patchPath
+/** Read the shared profile patch dialect while retaining comments and expression tags. */
+async function readPatchDocument(filename: string) {
   let text: string
   try {
     text = await readFile(filename, 'utf8')
@@ -37,9 +30,85 @@ export async function writePluginEnabled(profile: ProfileContext, id: string, na
   const error = document.errors[0]
   if (error !== undefined) throw error
   if (!isSeq(document.contents)) throw new Error('Profile patch must be a YAML sequence')
+  return { document, sequence: document.contents }
+}
+
+/**
+ * Prepare persistent settings for explicit bundle enablement.
+ * @param profile Profile whose existing entries receive top-level field overrides.
+ * @param input Untrusted bundle manifest declaration, keyed by profile entry id.
+ * @returns Complete profile patch text, or undefined when the requested settings already match.
+ * @throws Invalid declarations, missing or ambiguous entries, whole-config expressions, and higher-layer overrides.
+ */
+export async function prepareBundleConfiguration(
+  profile: ProfileContext, input: unknown,
+): Promise<string | undefined> {
+  const configuration = z.record(z.string().min(1), z.record(z.string(), z.json())).parse(input)
+  const loaded = loadProfileDirectory('dsh', profile.dir, profile.installAnchor)
+  const rows = flatten(composeEntries([...loaded.layers.map(layer => layer.patches), loaded.patches]))
+  const patches = Object.entries(configuration).map(([id, fields]) => {
+    const matches = rows.filter(row => row.id === id)
+    const entry = matches[0]
+    const current: unknown = entry?.config
+    if (isJsExpr(current)) {
+      throw new Error(`Bundle enablement cannot edit the whole-config expression for "${id}"; use a literal config mapping`)
+    }
+    if (matches.length !== 1 || entry === undefined || entry.group
+      || (current !== undefined && (current === null || typeof current !== 'object' || Array.isArray(current)))) {
+      throw new Error(`Bundle enablement requires one configurable profile entry "${id}"`)
+    }
+    const config = { ...current, ...fields }
+    return { id, name: entry.name, config }
+  })
+  const effective = flatten(composeEntries([readProfilePatches('dsh', profile, {
+    ...loaded, patches: [...loaded.patches, ...patches],
+  })]))
+  for (const [id, fields] of Object.entries(configuration)) {
+    const config: unknown = effective.find(row => row.id === id)?.config
+    if (config === null || typeof config !== 'object' || Array.isArray(config)
+      || Object.entries(fields).some(([key, value]) => !isDeepStrictEqual((config as Record<string, unknown>)[key], value))) {
+      throw new Error(`Bundle enablement configuration for "${id}" is overridden by a home patch or command-line overlay`)
+    }
+  }
+  if (patches.every(patch => isDeepStrictEqual(rows.find(row => row.id === patch.id)?.config, patch.config))) return undefined
+  const { document, sequence } = await readPatchDocument(profile.patchPath)
+  sequence.flow = false
+  for (const { id, name, config } of patches) {
+    const index = sequence.items.findLastIndex((item, index) => isMap(item)
+      && document.getIn([index, 'id']) === id && !item.has('insert')
+      && (!item.has('name') || document.getIn([index, 'name']) === name))
+    const previous = sequence.items[index]
+    let anchored = false
+    if (isNode(previous)) visit(previous, { Node(_key, node) {
+      if ('anchor' in node && node.anchor) anchored = true
+    } })
+    if (index < 0 || anchored) document.add(document.createNode({ id, name, config }))
+    else document.setIn([index, 'config'], document.createNode(config))
+  }
+  visit(document, { Map(_key, node) {
+    if (node.items.length !== 1 || typeof node.get('__jsExpr') !== 'string') return
+    const expression = new Scalar(node.get('__jsExpr'))
+    expression.tag = 'tag:yaml.org,2002:js'
+    return expression
+  } })
+  return String(document)
+}
+
+/** Replace the last matching override or append one after existing insertions. An override that holds only `id` and
+ * `disabled`, without anchors, is removed, or not appended, when the bundle layers and the remaining profile patches
+ * already give the entry the requested literal `disabled` value; home patches and launch overlays are not consulted.
+ * @param profile Profile whose patch file is edited and whose selected bundles supply the compared composition.
+ * @param id Unique composition entry id.
+ * @param name Module name used to match name-qualified overrides.
+ * @param enabled Desired entry enablement.
+ * @returns Whether the file changed.
+ */
+export async function writePluginEnabled(profile: ProfileContext, id: string, name: string, enabled: boolean): Promise<boolean> {
+  const filename = profile.patchPath
+  const { document, sequence } = await readPatchDocument(filename)
   const patches = loadOptionalPatches('dsh', filename) ?? []
   const bundlePatches = readBundlePatches('dsh', profile)
-  const items = document.contents.items
+  const items = sequence.items
   const target = items.findLast((item, index) => {
     if (!isMap(item) || document.getIn([index, 'id']) !== id || item.has('insert')) return false
     const expectedName = document.getIn([index, 'name'])
@@ -62,7 +131,7 @@ export async function writePluginEnabled(profile: ProfileContext, id: string, na
       const comment = target.commentBefore
       const next = items[index]
       if (comment && isNode(next)) next.commentBefore = next.commentBefore ? `${comment}\n${next.commentBefore}` : comment
-      else if (comment && items.length === 0) document.contents.commentBefore = comment
+      else if (comment && items.length === 0) sequence.commentBefore = comment
       else if (comment) document.comment = document.comment ? `${comment}\n${document.comment}` : comment
     } else if (document.getIn([index, 'disabled']) === !enabled) {
       return false
diff --git a/packages/boot/plugin-manager/src/tools.ts b/packages/boot/plugin-manager/src/tools.ts
index 824deb261b..41e6a86a62 100644
--- a/packages/boot/plugin-manager/src/tools.ts
+++ b/packages/boot/plugin-manager/src/tools.ts
@@ -23,6 +23,7 @@ const ERROR_STEPS: Record<ManagementError['code'], string> = {
   'bundle-in-use': 'Call list_plugins, disable the entries from other layers that still use this bundle, then retry.',
   'stale-approval': 'Call install_bundle again without approvedBuilds to read the current pendingBuilds.',
   'incompatible-version': 'Install a version compatible with the running DSH. A version exemption needs the user\'s explicit acceptance of crash and data-loss risk.',
+  'unsupported-platform': 'This bundle cannot run on the current Host platform; ask the user to use a supported Host.',
   'operation-error': 'Report the diagnostic to the user; retry only after its cause is addressed.',
 }
 
diff --git a/packages/boot/plugin-manager/src/types.ts b/packages/boot/plugin-manager/src/types.ts
index 4cd9d9bfe3..c80dc66ca8 100644
--- a/packages/boot/plugin-manager/src/types.ts
+++ b/packages/boot/plugin-manager/src/types.ts
@@ -19,7 +19,7 @@ export interface IncompatiblePlugin {
 
 /** Localizable management failure and optional external diagnostic. */
 export interface ManagementError {
-  code: ReadOnlyReason | 'unknown-plugin' | 'invalid-spec' | 'already-installed' | 'ambiguous-install' | 'not-bundle' | 'not-removable' | 'stop-profile' | 'bundle-in-use' | 'stale-approval' | 'incompatible-version' | 'operation-error'
+  code: ReadOnlyReason | 'unknown-plugin' | 'invalid-spec' | 'already-installed' | 'ambiguous-install' | 'not-bundle' | 'not-removable' | 'stop-profile' | 'bundle-in-use' | 'stale-approval' | 'incompatible-version' | 'unsupported-platform' | 'operation-error'
   diagnostic?: string
   /** Present with `incompatible-version`: the packages the running DSH version rejects. */
   incompatible?: IncompatiblePlugin[]
@@ -55,6 +55,8 @@ export interface BundleRowInfo {
 /** One shipped, profile-installed, or discoverable on-demand bundle. */
 export interface BundleInfo {
   name: string
+  /** Explicit experimental feature status declared by the bundle. */
+  experimental?: boolean
   /** Project-maintained shipped optional bundle or on-demand catalog entry, independent of installation and selection. */
   official: boolean
   /** Readable package location; on-demand catalog entries exclude undeclared transitive copies, and declared files may be missing. */
diff --git a/packages/boot/plugin-manager/tests/manager.spec.ts b/packages/boot/plugin-manager/tests/manager.spec.ts
index da58379bef..ad1aa0b8d6 100644
--- a/packages/boot/plugin-manager/tests/manager.spec.ts
+++ b/packages/boot/plugin-manager/tests/manager.spec.ts
@@ -89,6 +89,70 @@ async function fixture(reload: 'live' | 'startup' = 'live', overlay = false, pre
   return { ctx, dir, manager: ctx.pluginManager, bundle, profile, stopHmr, overlays, connection }
 }
 
+it.each(['live', 'startup'] as const)('persists enablement settings, applies them with %s reload and retains them after disablement', async (reload) => {
+  const { manager, dir, ctx } = await fixture(reload, false, undefined, {}, undefined, (dir) => {
+    const core = join(dir, 'node_modules/core/cordis.patch.yml')
+    const patches = JSON.parse(readFileSync(core, 'utf8')) as Array<{ insert: object[] }>
+    patches[0]!.insert.push({ id: 'runtime', name: join(dir, 'node_modules/extra/plugin.mjs'),
+      config: { service: 'activationProbe', executionMode: 'per-call', timeout: 42 } })
+    writeFileSync(core, JSON.stringify(patches))
+    const path = join(dir, 'node_modules/extra/package.json')
+    const meta = JSON.parse(readFileSync(path, 'utf8')) as { dsh: { bundle: object } }
+    meta.dsh.bundle = { ...meta.dsh.bundle, configureOnEnable: { runtime: { executionMode: 'persistent-in-memory' } } }
+    writeFileSync(path, JSON.stringify(meta))
+  })
+  await manager.setBundleEnabled('extra', false)
+  const runtime = [...ctx.loader.entries()].find(entry => entry.options.id === 'runtime')!
+  expect(await manager.setBundleEnabled('extra', true)).toMatchObject({
+    application: reload === 'live' ? 'applied' : 'restart-required', changed: true,
+  })
+  expect(runtime.options.config).toEqual({ service: 'activationProbe', executionMode: reload === 'live' ? 'persistent-in-memory' : 'per-call', timeout: 42 })
+  const appliedFiber = runtime.fiber
+  const saved = readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')
+  expect(parse(saved)).toContainEqual({ id: 'runtime', name: pathToFileURL(join(dir, 'node_modules/extra/plugin.mjs')).href,
+    config: { service: 'activationProbe', executionMode: 'persistent-in-memory', timeout: 42 } })
+  await manager.setBundleEnabled('extra', false)
+  expect(readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')).toBe(saved)
+  expect(runtime.fiber === appliedFiber).toBe(true)
+  await manager.setBundleEnabled('extra', true)
+  expect(readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')).toBe(saved)
+  expect(runtime.fiber === appliedFiber).toBe(true)
+})
+
+it.each(['live', 'startup'] as const)('refuses an unsupported bundle before saving or applying it with %s reload', async (reload) => {
+  const { manager, dir, ctx } = await fixture(reload, false, undefined, {}, undefined, (dir) => {
+    const path = join(dir, 'node_modules/extra/package.json')
+    writeFileSync(path, JSON.stringify({ name: 'extra', version: '1.0.0', description: 'Platform-limited bundle',
+      dsh: { bundle: { patch: './cordis.patch.yml', experimental: true, configureOnEnable: { absent: { mode: 'new' } }, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
+    const manifest = readProfileManifest('test', dir)
+    manifest.dsh = { profile: { bundles: ['core'] } }
+    writeFileSync(join(dir, 'package.json'), JSON.stringify(manifest))
+  })
+  const before = readFileSync(join(dir, 'package.json'), 'utf8')
+  const patchBefore = readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')
+  expect((await manager.listBundles()).find(row => row.name === 'extra')).toMatchObject({
+    enabled: false, experimental: true, description: 'Platform-limited bundle', error: { code: 'unsupported-platform' },
+  })
+  expect(await manager.setBundleEnabled('extra', true)).toMatchObject({ changed: false, application: 'failed', error: { code: 'unsupported-platform' } })
+  expect(readFileSync(join(dir, 'package.json'), 'utf8')).toBe(before)
+  expect(ctx.get('managedProbe')).toBeUndefined()
+  expect(readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')).toBe(patchBefore)
+  expect(await manager.setBundleEnabled('extra', false)).toMatchObject({ changed: false })
+})
+
+it('allows supported bundle activation and permits deselecting an unsupported saved bundle', async () => {
+  const { manager, dir } = await fixture()
+  const path = join(dir, 'node_modules/extra/package.json')
+  const metadata = readProfileManifest('test', join(dir, 'node_modules/extra'))
+  metadata.dsh = { bundle: { patch: './cordis.patch.yml', platforms: [process.platform] } }
+  writeFileSync(path, JSON.stringify(metadata))
+  expect(await manager.setBundleEnabled('extra', false)).toMatchObject({ changed: true, application: 'applied' })
+  expect(await manager.setBundleEnabled('extra', true)).toMatchObject({ changed: true, application: 'applied' })
+  metadata.dsh.bundle!.platforms = [process.platform === 'darwin' ? 'win32' : 'darwin']
+  writeFileSync(path, JSON.stringify(metadata))
+  expect(await manager.setBundleEnabled('extra', false)).toMatchObject({ changed: true, application: 'applied' })
+})
+
 it.each(['network', 'timeout'] as const)('stops a GitHub %s before pnpm and attributes it to the repository', async (kind) => {
   const { manager, dir, connection } = await fixture()
   const before = readFileSync(join(dir, 'package.json'), 'utf8')
@@ -1515,6 +1579,20 @@ it.each([false, true])('rechecks installed bundle peers before accepting a disab
   expect(readProfileManifest('test', dir).dsh?.profile?.bundles).toEqual(['core', 'extra'])
 })
 
+it.each([true, false])('projects the explicit experimental flag %s independently of package naming', async (experimental) => {
+  const { manager, dir } = await fixture()
+  const path = join(dir, 'node_modules/extra/package.json')
+  const manifest = JSON.parse(readFileSync(path, 'utf8')) as { dsh: { bundle: { experimental?: boolean | string } } }
+  manifest.dsh.bundle.experimental = experimental
+  writeFileSync(path, JSON.stringify(manifest))
+  expect((await manager.listBundles()).find(row => row.name === 'extra')).toMatchObject({ experimental })
+  manifest.dsh.bundle.experimental = 'yes'
+  writeFileSync(path, JSON.stringify(manifest))
+  const error = (await manager.listBundles()).find(row => row.name === 'extra')?.error
+  expect(error?.code).toBe('operation-error')
+  expect(error?.diagnostic).toContain('must be a boolean')
+})
+
 
 it('lists absent Official entries offline without resolving their packages or consulting registries', async () => {
   const { manager } = await fixture()
diff --git a/packages/boot/plugin-manager/tests/operations.spec.ts b/packages/boot/plugin-manager/tests/operations.spec.ts
index 014c314e28..382cc0dd2d 100644
--- a/packages/boot/plugin-manager/tests/operations.spec.ts
+++ b/packages/boot/plugin-manager/tests/operations.spec.ts
@@ -169,6 +169,17 @@ function install(dir: string, name: string) {
   writeFileSync(join(dir, 'package.json'), JSON.stringify(manifest))
 }
 
+it('keeps a newly installed unsupported bundle out of the saved selection', async () => {
+  const { dir, context, pnpm } = fixture()
+  pnpm.mutate = (target) => {
+    install(target, 'restricted')
+    writeFileSync(join(target, 'node_modules/restricted/package.json'), JSON.stringify({ name: 'restricted', version: '1',
+      dsh: { bundle: { patch: './cordis.patch.yml', platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
+  }
+  await expect(runProfilePnpm(context, ['add', 'restricted'], { execution: 'service', outputBytes: 8192 })).rejects.toThrow('Host is running')
+  expect(readProfileManifest('test', dir).dsh?.profile?.bundles).toEqual([])
+})
+
 function installGuarded(dir: string, dependency: string, name = dependency, version = '1.0.0', peer = '>=999.0.0') {
   install(dir, dependency)
   writeFileSync(join(dir, 'node_modules', dependency, 'package.json'), JSON.stringify({
diff --git a/packages/boot/plugin-manager/tests/patch.spec.ts b/packages/boot/plugin-manager/tests/patch.spec.ts
index 9580da1e52..0522173c3e 100644
--- a/packages/boot/plugin-manager/tests/patch.spec.ts
+++ b/packages/boot/plugin-manager/tests/patch.spec.ts
@@ -5,10 +5,102 @@ import { tmpdir } from 'node:os'
 import { expect, it, onTestFinished } from 'vitest'
 import { applyEntryPatches } from '@deepseek-ai/cordis-plugin-include'
 import { initProfile, loadOptionalPatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
-import { writePluginEnabled } from '../src/patch.ts'
+import { prepareBundleConfiguration, writePluginEnabled } from '../src/patch.ts'
 
 const TOOL = { id: 'tool', name: 'package' }
 
+it('prepares durable activation settings while preserving prior fields, expressions and comments', async () => {
+  const profile = await fixture('# personal\n- id: runtime\n  config:\n    timeout: 42\n    command: !!js process.execPath\n- id: locale\n  config: { preference: zh }\n', [
+    { id: 'runtime', name: 'runtime-package', config: { executionMode: 'per-call' } },
+    { id: 'presets', name: 'preset-package', config: { default: 'standard' } },
+    { id: 'locale', name: 'locale-package' },
+  ])
+  const before = await readFile(profile.patchPath, 'utf8')
+  const input = { runtime: { executionMode: 'persistent-in-memory' }, presets: { selectedDefault: 'ptc' } }
+  const prepared = await prepareBundleConfiguration(profile, input)
+  expect(await readFile(profile.patchPath, 'utf8')).toBe(before)
+  expect(prepared).toContain('# personal')
+  expect(prepared).toContain('!!js process.execPath')
+  if (prepared === undefined) throw new Error('Expected changed enablement settings')
+  await writeFile(profile.patchPath, prepared)
+  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
+    { id: 'runtime', config: { timeout: 42, command: { __jsExpr: 'process.execPath' }, executionMode: 'persistent-in-memory' } },
+    { id: 'locale', config: { preference: 'zh' } },
+    { id: 'presets', name: 'preset-package', config: { default: 'standard', selectedDefault: 'ptc' } },
+  ])
+  expect(await prepareBundleConfiguration(profile, input)).toBeUndefined()
+})
+
+it('accepts unrelated launch overrides when the requested field has the intended effective value', async () => {
+  const profile = await fixture('[]\n', [{ id: 'runtime', name: 'runtime-package', config: { timeout: 42 } }])
+  const launch = { ...profile, overlays: [{ id: 'runtime', config: { executionMode: 'persistent-in-memory', timeout: 10 } }] }
+  const prepared = await prepareBundleConfiguration(launch, { runtime: { executionMode: 'persistent-in-memory' } })
+  if (prepared === undefined) throw new Error('Expected saved runtime configuration')
+  await writeFile(profile.patchPath, prepared)
+  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
+    { id: 'runtime', name: 'runtime-package', config: { timeout: 42, executionMode: 'persistent-in-memory' } },
+  ])
+})
+
+it('refuses a whole-config expression without evaluating it or replacing the user patch', async () => {
+  const before = '- id: runtime\n  config: !!js "(() => { throw new Error(\'must not evaluate\') })()"\n'
+  const profile = await fixture(before, [{ id: 'runtime', name: 'runtime-package' }])
+  await expect(prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } }))
+    .rejects.toThrow('Bundle enablement cannot edit the whole-config expression for "runtime"; use a literal config mapping')
+  expect(await readFile(profile.patchPath, 'utf8')).toBe(before)
+})
+
+it('replaces a target field expression while preserving unrelated expressions', async () => {
+  const profile = await fixture('- id: runtime\n  config:\n    executionMode: !!js process.env.MODE\n    timeout: !!js process.env.TIMEOUT\n', [
+    { id: 'runtime', name: 'runtime-package' },
+  ])
+  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
+  expect(prepared).toContain('executionMode: persistent-in-memory')
+  expect(prepared).toContain('timeout: !!js process.env.TIMEOUT')
+  expect(prepared).not.toContain('process.env.MODE')
+})
+
+it('retains configuration anchors referenced by other entries', async () => {
+  const profile = await fixture('- id: runtime\n  config: &runtimeConfig\n    timeout: &timeout 30000\n- id: other\n  config:\n    timeout: *timeout\n    inherited: *runtimeConfig\n', [
+    { id: 'runtime', name: 'runtime-package' }, { id: 'other', name: 'other-package' },
+  ])
+  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
+  if (prepared === undefined) throw new Error('Expected activation settings')
+  await writeFile(profile.patchPath, prepared)
+  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
+    { id: 'runtime', config: { timeout: 30000 } },
+    { id: 'other', config: { timeout: 30000, inherited: { timeout: 30000 } } },
+    { id: 'runtime', name: 'runtime-package', config: { timeout: 30000, executionMode: 'persistent-in-memory' } },
+  ])
+  expect(await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })).toBeUndefined()
+})
+
+it.each(['runtime-package', 'retired-runtime'])('keeps name-qualified activation overrides for %s', async (name) => {
+  const profile = await fixture(`- id: runtime\n  name: ${name}\n  config: { timeout: 42 }\n`, [
+    { id: 'runtime', name: 'runtime-package', config: { timeout: 10 } },
+  ])
+  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
+  if (prepared === undefined) throw new Error('Expected activation settings')
+  await writeFile(profile.patchPath, prepared)
+  const patch = { id: 'runtime', name: 'runtime-package', config: {
+    timeout: name === 'runtime-package' ? 42 : 10, executionMode: 'persistent-in-memory',
+  } }
+  expect(loadOptionalPatches('test', profile.patchPath)).toEqual(name === 'runtime-package' ? [patch] : [
+    { id: 'runtime', name, config: { timeout: 42 } }, patch,
+  ])
+})
+
+it('refuses invalid activation settings, absent entries and higher-layer overrides before writing', async () => {
+  const profile = await fixture('[]\n', [{ id: 'runtime', name: 'runtime-package', config: {} }])
+  for (const input of [[], { runtime: false }, { absent: { mode: 'new' } }]) {
+    await expect(prepareBundleConfiguration(profile, input)).rejects.toThrow()
+    expect(await readFile(profile.patchPath, 'utf8')).toBe('[]\n')
+  }
+  await writeFile(join(profile.home, 'cordis.patch.yml'), '- id: runtime\n  config: { executionMode: per-call }\n')
+  await expect(prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })).rejects.toThrow('overridden')
+  expect(await readFile(profile.patchPath, 'utf8')).toBe('[]\n')
+})
+
 /** Create a profile whose patch file holds `text` (none when omitted) and whose one selected bundle inserts `rows`. */
 async function fixture(text?: string, rows: object[] = []): Promise<ProfileContext> {
   const home = await mkdtemp(join(tmpdir(), 'manager-patch-'))
diff --git a/packages/boot/plugin-manager/tests/tools.spec.ts b/packages/boot/plugin-manager/tests/tools.spec.ts
index c7981e2296..fbf33dc919 100644
--- a/packages/boot/plugin-manager/tests/tools.spec.ts
+++ b/packages/boot/plugin-manager/tests/tools.spec.ts
@@ -303,4 +303,6 @@ it('tells the agent the next step for each change outcome it can act on', async
   expect(await outcome({ changed: false, application: 'failed', packageResult: { kind: 'unknown' }, error: { code: 'operation-error' } }))
     .toContain('Report the diagnostic')
   expect(await outcome({ changed: false, application: 'failed' })).toContain('Report the diagnostic')
+  expect(await outcome({ changed: false, application: 'failed', error: { code: 'unsupported-platform' } }))
+    .toBe('This bundle cannot run on the current Host platform; ask the user to use a supported Host.')
 })
diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index dbb4836fb5..9815652654 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -15,14 +15,14 @@
   en: d152484eb41ac6b4
   zh: 09388d293f9be9cb
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package:
-  en: 8d8c0fcd9320761a
-  zh: 087473d318680403
+  en: 44e8986a8b52a1ef
+  zh: fd28da304d11ea52
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/installing-a-bundle:
   en: fcb2e69c8b028c0a
   zh: d505a075679974eb
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-a-bundle:
-  en: 59e12480cf0c3e70
-  zh: f230ea8c752475d5
+  en: 997455148b3f60e2
+  zh: 37c2be69e6dc7c13
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-one-row-of-a-bundle:
   en: d3627d4dba5e6cc2
   zh: e0d0eada4c20331f
@@ -30,8 +30,8 @@
   en: e9da90f03691101b
   zh: 902cda935a4ce3c8
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/detail-page-extension-points:
-  en: 5266d86638cc5cd7
-  zh: 398d710df9806cea
+  en: 1c98fe13ab6109fc
+  zh: 4c382a353e8de820
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/page-tabs:
   en: 76e0908903ab8fde
   zh: ce6ae1cdd6aea971
@@ -45,8 +45,8 @@
   en: 21a0bbe8eb92229c
   zh: 096ff63db61992bb
 /deepseek-ai-dsh-client-ui-plugin-manager/understand-the-implementation/configuration-slots:
-  en: c1338ea1bf004954
-  zh: 8dba2a39e619d3c3
+  en: 4406ecf602ebad0e
+  zh: c0f3d5c34ac82bb3
 /deepseek-ai-dsh-client-ui-plugin-manager/further-exploration:
   en: f9a42dfed0360d6a
   zh: 455a70bcb6c69624
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index 21d56214a4..c5e9c07db8 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -27,7 +27,7 @@ Use the **Plugins** entry in the Web sidebar to manage the profile's installed b
 <a id="use-this-package"></a>
 ## Use this package
 
-Select **Plugins** in the sidebar. The information button uses an 11px caption-colored icon in a 20px square hover area, with a 4px gap after the subtitle. It explains that this page configures official plugins and installs or manages other plugins, while **Settings → Built-in plugins** shows the built-in inventory and runtime status. Hover or focus shows the shared tooltip; clicking keeps it open until another click, Escape, Tab, or an outside click. The page reads the inventory and the bundles through `api-remotes` when first opened; a Host without a managed profile shows the page as unavailable. **Built-in plugin settings** lists official configuration pages by their configured order: Subagent, web search, agent loop, then shell. **Experimental plugins** shows the primary optional bundles, with **More** beside its heading opening a separate page of the same title. That page lists all offered official bundles, including those on the main list, with Codex and Claude Code subagents last. Its back button returns to the main list, where **Installed plugins** remains below Experimental plugins. Bundle details return to the list they were opened from. Catalog entries keep their position after installation or removal. **Installed plugins** lists other profile bundles. Installation-carried optional bundles have no uninstall action. Experimental packages retain the **Experimental** marker on both lists. Bundle details can show a feature preview below the description, also while the bundle is disabled; **DSH badge skill** shows one in English or Chinese following the UI language, and a decode failure shows a short notice without blocking management. Switching on a bundle that page holds back adds it to the main list in the position that page shows it, and switching it off leaves it on that page alone; other bundles keep their place on both. A dependency without a bundle patch is not a plugin and is not listed unless the profile selects it, in which case it carries a problem tag. Global configuration remains in the Settings **Built-in plugins** section.
+Select **Plugins** in the sidebar. The information button uses an 11px caption-colored icon in a 20px square hover area, with a 4px gap after the subtitle. It explains that this page configures official plugins and installs or manages other plugins, while **Settings → Built-in plugins** shows the built-in inventory and runtime status. Hover or focus shows the shared tooltip; clicking keeps it open until another click, Escape, Tab, or an outside click. The page reads the inventory and the bundles through `api-remotes` when first opened; a Host without a managed profile shows the page as unavailable. **Built-in plugin settings** lists official configuration pages by their configured order: Subagent, web search, agent loop, then shell. **Experimental plugins** shows the primary optional bundles, with **More** beside its heading opening a separate page of the same title. That page lists all offered official bundles, including those on the main list, with Codex and Claude Code subagents last. Its back button returns to the main list, where **Installed plugins** remains below Experimental plugins. Bundle details return to the list they were opened from. Switching pages or tabs starts at the top; refreshing the current page preserves its scroll position. Catalog entries keep their position after installation or removal. **Installed plugins** lists other profile bundles. Installation-carried optional bundles have no uninstall action. Experimental packages retain the **Experimental** marker on both lists. Bundle details can show a feature preview below the description, also while the bundle is disabled; **DSH badge skill** shows one in English or Chinese following the UI language, and a decode failure shows a short notice without blocking management. Switching on a bundle that page holds back adds it to the main list in the position that page shows it, and switching it off leaves it on that page alone; other bundles keep their place on both. A dependency without a bundle patch is not a plugin and is not listed unless the profile selects it, in which case it carries a problem tag. Global configuration remains in the Settings **Built-in plugins** section.
 
 The heading moves its complete action group to another line when space is insufficient. Action labels stay on one line, and the information button follows the subtitle text.
 
@@ -37,6 +37,8 @@ On-demand Official cards are visible offline before installation. Turning one On
 
 The first list read shows a short group-heading placeholder and four skeleton cards, using the real cards' row, icon, and text-line spacing, with the action area left blank. They use the same opacity pulse as Session search and remain static with reduced motion. The accessible loading label and read timing are unchanged; refreshes retain the existing list, and installation and component-loading indicators keep their own states.
 
+A bundle unavailable on the DSH Host operating system shows the reason on its card and details page. Its disabled switch prevents enabling it; an already selected bundle can still be switched off. [Plugin Manager](../../boot/plugin-manager/README.md#use-this-package) enforces the same restriction for direct requests.
+
 The **Refresh** button shows its tooltip after 500 ms of hovering or keyboard focus. During a manual refresh, the button shows a spinner and stays disabled until all pending reads settle and at least 400 ms have elapsed, preventing a brief spinner flash; repeated refresh requests are ignored and the existing list remains visible. Success shows no toast. With a loaded list, a failed manual refresh keeps the cached content and shows a failure toast, including after leaving Plugins; select **Refresh** again to retry. Before any successful list read, failures show an in-place message with **Retry**. Background reads do not show the refresh spinner.
 
 ### Installing a bundle
@@ -62,7 +64,9 @@ When the Host attributes a network failure or timeout to a GitHub address and of
 
 ### Switching a bundle
 
-A bundle's page shows its full package name under the title. Its **Source** section, after the rows, names the spec that installs it elsewhere, as `pnpm add` accepts it, or **Built in** for an official bundle the installation ships, then its current version. A bundle's switch changes its layer selection. A profile with HMR recomposes before the operation completes; one without HMR, and a bundle a higher layer overrides, say so in a toast. A bundle the Host cannot read carries a problem tag and its reason on its page and cannot be switched on; one that provides the management components stays locked. The Host answers with error codes, which the page's dictionary words; pnpm's and the Loader's own diagnostics are shown as they are. The page excludes built-in profile bundles from cards even when the profile holds them as dependencies or the Host reports an error. The Host inventory remains complete; the Settings Plugins section's Plugin list tab inspects their plugins.
+A bundle can declare `dsh.bundle.experimental: true` to display the experimental tag independently of its directory or package name; existing experimental package names retain that tag.
+
+A bundle's page shows its full package name under the title. Its **Source** section, after the rows, names the spec that installs it elsewhere, as `pnpm add` accepts it, or **Built in** for an official bundle the installation ships, then its current version. A bundle's switch changes its layer selection. While the Host applies the change, the switch stays disabled and a spinner appears beside it; the reserved space keeps the controls from shifting. A profile with HMR recomposes before the operation completes; one without HMR, and a bundle a higher layer overrides, say so in a toast. A bundle the Host cannot read carries a problem tag and its reason on its page and cannot be switched on; one that provides the management components stays locked. The Host answers with error codes, which the page's dictionary words; pnpm's and the Loader's own diagnostics are shown as they are. The page excludes built-in profile bundles from cards even when the profile holds them as dependencies or the Host reports an error. The Host inventory remains complete; the Settings Plugins section's Plugin list tab inspects their plugins.
 
 ### Switching one row of a bundle
 
@@ -96,6 +100,8 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 A row's page exists only while a `plugins.row.config` entry names the row, so a contribution meant for a row renders on the page that configuration opens.
 
+Component lists and detail pages show current startup diagnostics from the Host inventory. The diagnostic remains visible after reopening the page and disappears when the component recovers.
+
 ### Page tabs
 
 Another plugin adds a tab after the page's own **Installed** tab by registering into the `plugins.tab` list slot; the entry's `label` names the tab and `order` places it. The tabs appear under the page header once one entry exists and are hidden on a bundle's, row's, or official plugin's page; the selected tab survives leaving **Plugins**, and a tab whose entry leaves falls back to **Installed**. The page renders the selected entry in place of its groups and hides its own refresh and add buttons there. The owner props carry `install({ spec, registry?, title, version })` and `openPackage(name)`. `install` is for a version the person already confirmed in the tab: the install dialog opens at its check screen, without the spec form, names the plugin with `title` and `version` above the spec, which it shows in smaller monospace text, keeps that name on the progress and result screens, with the installed version once done, asks `registry` first for that install only and never remembers it, and offers **Retry** after a refusal; a hidden installation reopens instead. `openPackage` switches to **Installed** and opens the bundle's page when that tab lists it; a bundle the page leaves out, such as a built-in profile bundle, leaves the Installed list open. A confirmed install offers no GitHub mirror recovery, since that recovery reopens the spec form, and its back button cancels a running install. [`ui-plugin-market`](../ui-plugin-market/README.md) contributes the **Discover** tab here.
@@ -130,7 +136,7 @@ Custom item pages use the Host entry id as their registration id; row pages use
 
 The page's `main` registration declares `plugins.item`, `plugins.bundle.config`, and `plugins.row.config` as its children, so the slots exist while the page does and a registrant's `ctx.slots.inject` waits for them. `configLedgerSource` projects the three ledgers into one observable — the official items in ledger order with their labels resolved in the active locale, and the bundle and row keys — cached until a ledger or the locale moves; the page binds it as `useConfigLedger` beside the store and never names a configurable plugin itself. The registration-owned navigation store selects the main list, the full experimental plugin list, a bundle, an official plugin, or a bundle row; switching away from the Plugins panel resets it to the list, while React remounts preserve the selected target. A fresh registration starts on the main list. Installation highlighting scrolls to a card only when it is on the current page; it does not change the selected page. Other Client plugins inject `pluginNavigation` and call `ctx.pluginNavigation.openBundle(packageName)` to open bundle details without changing the current Session. The target survives the initial inventory load; an absent bundle displays the list. A registration lives with the browser half that made it. `dsh-client-modules` attaches a package's browser half to the Loader row whose specifier is the bare package name, so every page a bundle registers, for itself or for any of its rows, goes away when that row is switched off; a sub-plugin whose page must outlive the other rows ships as its own package. Official packages whose names begin with `@deepseek-ai/dsh-experimental-` display the Experimental marker. Feature previews are SVG files under `src/client/assets/`, keyed by package name in the page and embedded in the Client bundle; packages cannot declare their own ([rationale](../../../.agents/notes/implemented/feature/2026-10-14-built-in-plugin-feature-previews.md)).
 
-`plugins.bundle.config` supplies bundle detail configuration, keyed by npm package name. `plugins.bundle.activation` offers bundle-owned guidance after explicit enablement from the list, with callbacks to dismiss it or open the bundle details. It does not appear merely because an enabled bundle was listed.
+`plugins.bundle.config` supplies bundle detail configuration, keyed by npm package name, and receives `busy` while the owning bundle is being changed. `plugins.bundle.activation` offers bundle-owned guidance after explicit enablement from either the list or detail page, with callbacks to dismiss it or open the bundle details. It does not appear merely because an enabled bundle was listed.
 
 </details>
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 2d4e6f72ca..0797350ed4 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -27,7 +27,7 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用本包
 
-在侧栏选择**插件**。信息按钮使用 11px 的 caption 色图标和 20px 方形悬停区域，与副标题间隔 4px。它说明当前页用于配置官方插件、安装和管理其他插件，**设置 → 内置插件**则展示内置插件列表及运行状态。悬停或聚焦显示共享 tooltip；点击后保持展开，直至再次点击、Escape、Tab 或外部点击。页面首次打开时通过 `api-remotes` 读取清单与组合包；没有受管 profile 的 Host 上页面显示为不可用。**内置插件配置**按配置的顺序列出官方配置页：子智能体、网页搜索、Agent 循环、终端。**实验性插件**展示主要的可选组合包，标题旁的**更多**打开同名的独立页面。该页列出全部官方组合包，也包含主列表已有的条目，Codex 和 Claude Code 子智能体排在最后。返回按钮回到主列表，**已安装插件**保持在实验性插件下方。组合包详情返回打开它的列表。目录条目在安装或移除后保持原位置。**已安装插件**列出其他 profile 组合包。安装随附的可选组合包没有卸载操作。实验性包在两个列表中均保留**实验性**标签。组合包详情可在说明下方展示功能配图，未启用时也可查看；**DSH 徽章技能**按界面语言展示中文或英文配图，解码失败时显示简短提示，不影响管理操作。开启仅在该页列出的组合包会按该页中的位置把它加入主列表，关闭后它只留在该页；其他组合包在两个列表中均保持原位。没有组合包 patch 的依赖不是插件，除非 profile 选中了它才会带异常标签列出。全局配置仍在设置的**内置插件**分区中编辑。
+在侧栏选择**插件**。信息按钮使用 11px 的 caption 色图标和 20px 方形悬停区域，与副标题间隔 4px。它说明当前页用于配置官方插件、安装和管理其他插件，**设置 → 内置插件**则展示内置插件列表及运行状态。悬停或聚焦显示共享 tooltip；点击后保持展开，直至再次点击、Escape、Tab 或外部点击。页面首次打开时通过 `api-remotes` 读取清单与组合包；没有受管 profile 的 Host 上页面显示为不可用。**内置插件配置**按配置的顺序列出官方配置页：子智能体、网页搜索、Agent 循环、终端。**实验性插件**展示主要的可选组合包，标题旁的**更多**打开同名的独立页面。该页列出全部官方组合包，也包含主列表已有的条目，Codex 和 Claude Code 子智能体排在最后。返回按钮回到主列表，**已安装插件**保持在实验性插件下方。组合包详情返回打开它的列表。切换页面或标签时从顶部开始，同一页面刷新数据时保留滚动位置。目录条目在安装或移除后保持原位置。**已安装插件**列出其他 profile 组合包。安装随附的可选组合包没有卸载操作。实验性包在两个列表中均保留**实验性**标签。组合包详情可在说明下方展示功能配图，未启用时也可查看；**DSH 徽章技能**按界面语言展示中文或英文配图，解码失败时显示简短提示，不影响管理操作。开启仅在该页列出的组合包会按该页中的位置把它加入主列表，关闭后它只留在该页；其他组合包在两个列表中均保持原位。没有组合包 patch 的依赖不是插件，除非 profile 选中了它才会带异常标签列出。全局配置仍在设置的**内置插件**分区中编辑。
 
 空间不足时，页头将整个操作组移到下一行。操作文案保持单行，信息按钮紧随副标题文字。
 
@@ -37,6 +37,8 @@ kind: "package-reference"
 
 首次读取列表时，页面显示一条较短的分组标题占位和四行骨架卡片，沿用真实卡片的行、图标和文字间距，操作区域留白。骨架使用与 Session 搜索相同的透明度呼吸动效，在减少动态效果模式下保持静止。无障碍加载文案和读取时机不变；刷新时保留已有列表，安装及组件加载仍使用各自的状态提示。
 
+组合包不支持 DSH Host 的操作系统时，卡片和详情页会显示原因，关闭状态的开关不可启用；已选中的组合包仍可关闭。[插件管理器](../../boot/plugin-manager/README.zh.md#use-this-package)对直接请求执行同一限制。
+
 **刷新**按钮在悬停或键盘聚焦 500 毫秒后显示提示。手动刷新期间，按钮显示旋转加载指示并保持禁用，直到所有待处理读取结束且至少经过 400 毫秒，避免加载指示一闪而过；重复刷新请求会被忽略，已有列表保持可见。成功不显示 toast。已有列表时，手动刷新失败保留缓存内容并显示失败 toast，即使已离开插件页也能看到；再次选择**刷新**即可重试。在首次成功读取列表之前，失败仍原位显示提示与**重试**。后台读取不显示刷新按钮的加载指示。
 
 ### 安装一个组合包
@@ -62,7 +64,9 @@ Host 将网络失败或超时归因于 GitHub 地址，且提供 npmmirror 时
 
 ### 切换一个组合包
 
-组合包页面在标题下方显示完整包名。组件列表之后的「来源信息」给出在别处安装它所需的 spec（`pnpm add` 接受的形式），安装随附的官方组合包显示「内置」，随后是当前版本。组合包开关改变其层选择。启用了 HMR 的 profile 在操作完成前重组；没有 HMR 的 profile，以及被更高层覆盖的组合包，会以 toast 说明。Host 读不了的组合包带异常标签，其页面给出原因，且不能打开；提供管理组件的组合包保持锁定。Host 以错误码作答，由页面字典措辞；pnpm 与 Loader 自己的诊断原样显示。页面从卡片中排除内置 profile 组合包，即使 profile 将它们列为依赖或 Host 报告了异常。Host 清单仍保留完整数据；设置中「插件」分区的「插件列表」标签页负责查看它们的插件。
+组合包可通过 `dsh.bundle.experimental: true` 显示实验性标签，代码目录和包名不必包含 experimental；已有实验性包名也保留标签。
+
+组合包页面在标题下方显示完整包名。组件列表之后的「来源信息」给出在别处安装它所需的 spec（`pnpm add` 接受的形式），安装随附的官方组合包显示「内置」，随后是当前版本。组合包开关改变其层选择。Host 应用更改期间，开关保持禁用，旁边显示加载动画；动画位置预留空间，避免控件移动。启用了 HMR 的 profile 在操作完成前重组；没有 HMR 的 profile，以及被更高层覆盖的组合包，会以 toast 说明。Host 读不了的组合包带异常标签，其页面给出原因，且不能打开；提供管理组件的组合包保持锁定。Host 以错误码作答，由页面字典措辞；pnpm 与 Loader 自己的诊断原样显示。页面从卡片中排除内置 profile 组合包，即使 profile 将它们列为依赖或 Host 报告了异常。Host 清单仍保留完整数据；设置中「插件」分区的「插件列表」标签页负责查看它们的插件。
 
 ### 切换组合包里的一行
 
@@ -96,6 +100,8 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 行页只在某个 `plugins.row.config` 条目点名这一行时存在，因此给行的贡献渲染在该配置打开的页面上。
 
+组件列表和详情页显示 Host 清单中的当前启动诊断。重新打开页面后仍能看到原因，组件恢复后诊断消失。
+
 ### 页面标签页
 
 其他插件向 `plugins.tab` 列表 slot 注册条目，即可在页面自带的**已安装**标签页之后添加一个标签页；条目的 `label` 为标签页命名，`order` 决定其位置。至少存在一个条目时，标签页显示在页头下方；在组合包、行或官方插件的页面上隐藏。离开**插件**后，所选标签页保持不变；所选标签页的条目被移除时，回到**已安装**。页面渲染所选条目以代替自身的分组，并在此时隐藏自身的刷新和添加按钮。owner props 提供 `install({ spec, registry?, title, version })` 和 `openPackage(name)`。`install` 用于用户已在标签页中确认的版本：安装对话框在检查界面打开，不显示 spec 表单，在以较小等宽字显示的 spec 上方用 `title` 和 `version` 标明插件，并在进度和结果界面保持该名称，完成后显示已安装的版本；只在这一次安装中首先使用 `registry`，且从不记住它；被拒绝后提供**重试**；如果有隐藏中的安装任务，则改为重新打开该任务。`openPackage` 切换到**已安装**，并在该标签页列出该组合包时打开其页面；页面不列出的组合包（例如内置 profile 组合包）只打开「已安装」列表。已确认的安装不提供 GitHub 镜像恢复，因为该恢复会重新打开 spec 表单；其返回按钮用于取消正在进行的安装。[`ui-plugin-market`](../ui-plugin-market/README.zh.md) 在这里贡献**发现**标签页。
@@ -130,7 +136,7 @@ Host 入口通过生成的 Remote 接口暴露 `pluginRegistryProbe.fastest()`
 
 页面的 `main` 注册把 `plugins.item`、`plugins.bundle.config` 与 `plugins.row.config` 声明为子 slot，因此它们与页面同生，注册方的 `ctx.slots.inject` 会等到它们出现。`configLedgerSource` 把三份账本投影成一个可观察对象——按账本顺序排列、标签按当前语言解析的官方条目，以及组合包与行的键——在账本或语言变化前保持缓存；页面把它作为 `useConfigLedger` 绑在 store 旁边，自身从不点名任何可配置插件。注册拥有的导航 store 选择主列表、完整的实验性插件列表、某个组合包、某个官方插件或组合包的某一行；切换离开插件面板时重置为列表，React 重新挂载则保留所选目标。新的注册从主列表开始。安装后的高亮仅在当前页面有对应卡片时滚动定位，不改变所选页面。其他 Client 插件注入 `pluginNavigation`，调用 `ctx.pluginNavigation.openBundle(packageName)` 即可打开组合包详情，不改变当前 Session。首次读取清单期间保留导航目标；组合包不存在时显示列表。注册与做出它的浏览器半侧同生共死。`dsh-client-modules` 只把一个包的浏览器半侧挂在说明符恰为包名的那一行 Loader 行上，所以组合包为自己或任一行注册的页面，都会在那一行被关闭时一起消失；需要在其他行关闭时仍保留页面的子插件，应作为独立的包发布。 名称以 `@deepseek-ai/dsh-experimental-` 开头的官方包显示实验性标记。功能配图是 `src/client/assets/` 下的 SVG 文件，由页面按包名指定并嵌入 Client bundle；包不能自行声明配图（[决策依据](../../../.agents/notes/implemented/feature/2026-10-14-built-in-plugin-feature-previews.zh.md)）。
 
-`plugins.bundle.config` 以 npm 包名为 key，提供 Bundle 详情配置。`plugins.bundle.activation` 在用户从列表显式启用后提供 Bundle 自有引导，并传入关闭引导和打开详情的回调。仅列出已启用的 Bundle 不会触发引导。
+`plugins.bundle.config` 以 npm 包名为 key，提供 Bundle 详情配置，并通过 `busy` 接收所属 Bundle 正在变更的状态。`plugins.bundle.activation` 在用户从列表或详情页显式启用后提供 Bundle 自有引导，并传入关闭引导和打开详情的回调。仅列出已启用的 Bundle 不会触发引导。
 
 </details>
 
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index efb3fb04f7..19e932d475 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -283,6 +283,7 @@
   gap: 4px;
 }
 
+
 .titleRow {
   display: flex;
   align-items: center;
@@ -345,12 +346,13 @@
 }
 
 .cardDesc {
+  min-height: 2lh;
   font-size: 13px;
   line-height: 18px;
   color: var(--dsw-alias-label-tertiary);
   display: -webkit-box;
   -webkit-box-orient: vertical;
-  -webkit-line-clamp: 1;
+  -webkit-line-clamp: 2;
   overflow: hidden;
 }
 
@@ -378,9 +380,9 @@
 .skeletonDescription { width: min(280px, 85%); }
 .skeletonIcon { border-color: transparent; }
 
-/* Keep text-column metrics while leaving the action area blank. */
+/* Reserve the switch and its pending indicator without painting controls. */
 .skeletonActions {
-  width: 36px;
+  width: calc(36px + 8px + 14px);
   height: 20px;
 }
 
@@ -403,6 +405,17 @@
   gap: 8px;
 }
 
+.bundleToggle {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.toggleProgress {
+  display: inline-flex;
+  width: 14px;
+}
+
 /* The toolbar's icon action, round like the message-row actions. */
 .iconButton {
   display: inline-flex;
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
index 77be2faf9f..9545d05f90 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
@@ -8,7 +8,7 @@
  * the page declares.
  */
 
-import { useEffect, useId, useRef, useState, type ReactNode } from 'react'
+import { useEffect, useId, useLayoutEffect, useRef, useState, type ReactNode } from 'react'
 import { createPortal } from 'react-dom'
 import type { PluginInstallFailureKind, Registry } from '@deepseek-ai/dsh-api-remotes/client'
 import {
@@ -293,6 +293,11 @@ function MetadataError({ error, t }: { readonly error: string | undefined; reado
   return error === undefined ? null : <p className={css.reason} role="status" data-package-meta-error>{t('metadataError', { error })}</p>
 }
 
+/** A failed component keeps its current Host diagnostic beside its controls. */
+function RuntimeError({ error, t }: { readonly error: string | undefined; readonly t: Translate }): ReactNode {
+  return error === undefined ? null : <p className={css.reason} role="status" data-plugin-runtime-error>{t('reasonLabel')}: {error}</p>
+}
+
 /**
  * A pack's rows as a list in the order the pack declares them: a state dot,
  * the row id, one line saying its state, a configure control for a row that
@@ -369,6 +374,7 @@ function RowsSection({ rows, t, resolveText, toggle, configure }: {
                     />}
                 </div>
                 <MetadataError error={row.meta?.error} t={t} />
+                <RuntimeError error={row.diagnostic} t={t} />
               </li>
             ))}
           </ul>
@@ -426,19 +432,25 @@ function EnableSwitch({ pkg, title, t, busy, onSetEnabled }: {
   readonly onSetEnabled: (enabled: boolean) => void
 }): ReactNode {
   return (
-    <Switch
-      checked={pkg.enabled}
-      label={t('enableToggle', { name: title })}
-      disabled={busy || pkg.readOnlyReason !== undefined || (!pkg.enabled && pkg.error !== undefined && !(pkg.availability === 'missing' && pkg.installTarget !== undefined))}
-      {...pkg.readOnlyReason === undefined ? {} : { title: managementText({ code: pkg.readOnlyReason }, t) }}
-      onChange={onSetEnabled}
-    />
+    <span className={css.bundleToggle}>
+      <span className={css.toggleProgress} role={busy ? 'status' : undefined}
+        aria-label={busy ? t('applyingChange', { name: title }) : undefined}>
+        {busy ? <StateDot state="ongoing" /> : null}
+      </span>
+      <Switch
+        checked={pkg.enabled}
+        label={t('enableToggle', { name: title })}
+        disabled={busy || pkg.readOnlyReason !== undefined || (!pkg.enabled && pkg.error !== undefined && !(pkg.availability === 'missing' && pkg.installTarget !== undefined))}
+        {...pkg.readOnlyReason === undefined ? {} : { title: managementText({ code: pkg.readOnlyReason }, t) }}
+        onChange={onSetEnabled}
+      />
+    </span>
   )
 }
 
 /** The status one card carries: running, off, or a problem the Host reported. */
 function packageStatus(pkg: PackageView): 'running' | 'disabled' | 'problem' {
-  if (pkg.error !== undefined) return 'problem'
+  if (pkg.error !== undefined || (pkg.enabled && pkg.rows.some(row => row.phase === 'failed'))) return 'problem'
   return pkg.enabled ? 'running' : 'disabled'
 }
 
@@ -567,6 +579,7 @@ function PackageCard({ pkg, t, resolveText, busy, highlighted, onOpen, onSetEnab
         end={<EnableSwitch pkg={pkg} title={title} t={t} busy={busy} onSetEnabled={onSetEnabled} />}
       />
       <MetadataError error={pkg.meta?.error} t={t} />
+      {pkg.error?.code === 'unsupported-platform' && <p className={css.reason} role="status">{managementText(pkg.error, t)}</p>}
     </li>
   )
 }
@@ -681,6 +694,7 @@ function RowDetail({ pkg, row, t, resolveText, onBack, renderSlot, form }: {
         <p className={css.detailDesc}>{description ?? renderSlot('plugins.row.config', { view: 'summary' }, { entryKey: key })}</p>
       </div>
       <MetadataError error={row.meta?.error} t={t} />
+      <RuntimeError error={row.diagnostic} t={t} />
       <div className={css.detailSections} data-plugin-config>
         {renderSlot('plugins.row.config', { view: 'page', form }, { entryKey: key })}
         {renderSlot('plugins.detail.section', { subject })}
@@ -779,7 +793,7 @@ function PackageDetail({
         {configured
           ? (
             <section className={css.detailSection} data-plugin-config>
-              {renderSlot('plugins.bundle.config', { view: 'page' }, { entryKey: pkg.name })}
+              {renderSlot('plugins.bundle.config', { view: 'page', busy }, { entryKey: pkg.name })}
             </section>
           )
           : null}
@@ -1515,6 +1529,11 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
   const selectedTab = props.useStore(state => state.tab)
   // A contributed tab that left the ledger falls back to Installed, and stays there when it returns.
   const tab = tabs.some(item => item.id === selectedTab) ? selectedTab : INSTALLED_TAB
+  const pageRef = useRef<HTMLElement>(null)
+  useLayoutEffect(() => {
+    /* v8 ignore else -- The unconditional section attaches its ref before this layout effect. */
+    if (pageRef.current !== null) pageRef.current.scrollTop = 0
+  }, [view, tab])
   useEffect(() => { if (tab !== selectedTab) setTab(tab) }, [tab, selectedTab, setTab])
   // A bundle an install just enabled is shown where its card is.
   useEffect(() => { if (state.highlight !== null) setTab(INSTALLED_TAB) }, [state.highlight, setTab])
@@ -1564,6 +1583,10 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
     ? {}
     : { role: 'tabpanel', id: `${tabsId}-${INSTALLED_TAB}-panel`, 'aria-labelledby': `${tabsId}-${INSTALLED_TAB}` }
   const activated = listed.find(pkg => pkg.name === activation && pkg.enabled && !state.busy.includes(pkg.name))
+  const setBundleEnabled = (name: string, enabled: boolean): void => {
+    setActivation(enabled ? name : null)
+    props.setEnabled(name, enabled)
+  }
   const setRowEnabled = (row: PackageRow, enabled: boolean): void => {
     /* v8 ignore next -- a row without a live entry has its switch disabled */
     if (row.entryId !== undefined) props.setRowEnabled(row.entryId, enabled)
@@ -1583,7 +1606,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
       busy={packageBusy(pkg)}
       highlighted={state.highlight === pkg.name}
       onOpen={() => { setActivation(null); setView({ kind: 'package', name: pkg.name, ...showsMoreList ? { from: 'more' } : {} }) }}
-      onSetEnabled={(enabled) => { setActivation(enabled ? pkg.name : null); props.setEnabled(pkg.name, enabled) }}
+      onSetEnabled={(enabled) => { setBundleEnabled(pkg.name, enabled) }}
     />
   )
   const basicCards = ledger.items.map(item => (
@@ -1608,7 +1631,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
   }
 
   return (
-    <section className={css.page} data-plugin-panel aria-busy={state.status === 'loading' || refreshing}>
+    <section ref={pageRef} className={css.page} data-plugin-panel aria-busy={state.status === 'loading' || refreshing}>
       {showsMainList
         ? (
           <header className={css.pageHead} data-window-drag>
@@ -1731,7 +1754,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
             renderSlot={renderSlot}
             inMore={openPkgInMore}
             onBack={() => { setView({ kind: openPkgInMore ? 'more' : 'list' }) }}
-            onSetEnabled={(enabled) => { props.setEnabled(openPkg.name, enabled) }}
+            onSetEnabled={(enabled) => { setBundleEnabled(openPkg.name, enabled) }}
             onUninstall={() => { props.uninstall(openPkg.name) }}
             onUpdate={() => { props.update(openPkg.name) }}
             onSetRowEnabled={setRowEnabled}
@@ -1772,7 +1795,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
             </div>
           )
         : null}
-      {showsCards && activated !== undefined && !state.install.open
+      {onInstalled && activated !== undefined && !state.install.open
         ? renderSlot('plugins.bundle.activation', {
           packageName: activated.name,
           onDismiss: () => { setActivation(null) },
diff --git a/packages/client/ui-plugin-manager/src/client/locales.ts b/packages/client/ui-plugin-manager/src/client/locales.ts
index b0cb0c1dfb..25d17c4ed7 100644
--- a/packages/client/ui-plugin-manager/src/client/locales.ts
+++ b/packages/client/ui-plugin-manager/src/client/locales.ts
@@ -64,6 +64,7 @@ export const zh = {
   rowPhaseFailed: '异常',
   rowPhaseUnloading: '卸载中',
   enableToggle: '启用 {name}',
+  applyingChange: '正在应用 {name} 的更改',
   openDetail: '查看 {name}',
   backToList: '返回插件',
   crumbRoot: '插件',
@@ -225,6 +226,7 @@ export const zh = {
   reasonStaleApproval: '待允许的安装脚本列表已变化，请重新安装以刷新',
   reasonIncompatibleVersion: '{plugin} 与 DSH {runtime} 不兼容（要求 {requirements}），运行它可能导致崩溃或数据丢失。',
   reasonIncompatibleVersionUnnamed: '这个插件与当前 DSH 版本不兼容，运行它可能导致崩溃或数据丢失。',
+  reasonUnsupportedPlatform: '此插件不支持运行 DSH 的主机操作系统',
   reasonIncompatibleInstall: '请安装与当前 DSH 兼容的插件版本。',
   reasonIncompatibleInstalled: '请卸载后重新安装与当前 DSH 兼容的版本。',
   reasonOperationError: 'Host 报告了一个错误',
@@ -292,6 +294,7 @@ export const en = {
   rowPhaseFailed: 'Problem',
   rowPhaseUnloading: 'Unloading',
   enableToggle: 'Enable {name}',
+  applyingChange: 'Applying changes to {name}',
   openDetail: 'View {name}',
   backToList: 'Back to plugins',
   crumbRoot: 'Plugins',
@@ -453,6 +456,7 @@ export const en = {
   reasonStaleApproval: 'The pending script approvals changed; install again to refresh them.',
   reasonIncompatibleVersion: '{plugin} is incompatible with DSH {runtime} (requires {requirements}); running it may cause crashes or data loss.',
   reasonIncompatibleVersionUnnamed: 'This plugin is incompatible with the running DSH version; running it may cause crashes or data loss.',
+  reasonUnsupportedPlatform: 'This plugin does not support the operating system running DSH.',
   reasonIncompatibleInstall: 'Install a plugin version compatible with this DSH.',
   reasonIncompatibleInstalled: 'Uninstall it and install a version compatible with this DSH.',
   reasonOperationError: 'The Host reported an error.',
diff --git a/packages/client/ui-plugin-manager/src/client/manager-store.ts b/packages/client/ui-plugin-manager/src/client/manager-store.ts
index 49bb36b67d..c46b86d639 100644
--- a/packages/client/ui-plugin-manager/src/client/manager-store.ts
+++ b/packages/client/ui-plugin-manager/src/client/manager-store.ts
@@ -75,6 +75,8 @@ export interface PackageRow {
   readonly enabled: boolean
   /** The entry's fiber phase, null without a live fiber. */
   readonly phase: PluginInfo['fiberPhase']
+  /** Current startup failure projected by the Host inventory. */
+  readonly diagnostic?: string
   /** Why the Host refuses to switch the row, when it does. */
   readonly readOnlyReason?: ReadOnlyReason
 }
@@ -82,6 +84,8 @@ export interface PackageRow {
 /** One bundle as the page shows it: the Host's bundle joined with the entries its rows run as. */
 export interface PackageView {
   readonly name: string
+  /** Experimental feature marker supplied by the bundle manifest. */
+  readonly experimental?: boolean
   /** Official catalog identity is independent of installation and selection. */
   readonly official: boolean
   /** Readable package location, separately from the profile dependency declaration. */
@@ -453,6 +457,7 @@ export function packageView(bundle: BundleInfo, plugins: readonly PluginInfo[]):
       moduleName: row.moduleName,
       enabled: live?.enabled ?? false,
       phase: live?.fiberPhase ?? null,
+      ...live?.diagnostic === undefined ? {} : { diagnostic: live.diagnostic },
       ...row.meta === undefined ? {} : { meta: row.meta },
       ...row.entryId === undefined ? {} : { entryId: row.entryId },
       ...live?.readOnlyReason === undefined ? {} : { readOnlyReason: live.readOnlyReason },
@@ -465,6 +470,7 @@ export function packageView(bundle: BundleInfo, plugins: readonly PluginInfo[]):
     ...bundle.installTarget === undefined ? {} : { installTarget: bundle.installTarget },
     installed: bundle.installed,
     optional: bundle.optional,
+    ...bundle.experimental === undefined ? {} : { experimental: bundle.experimental },
     removable: bundle.removable,
     enabled: bundle.enabled,
     rows,
diff --git a/packages/client/ui-plugin-manager/src/client/presentation.ts b/packages/client/ui-plugin-manager/src/client/presentation.ts
index 35100e32df..fd6bb2df1f 100644
--- a/packages/client/ui-plugin-manager/src/client/presentation.ts
+++ b/packages/client/ui-plugin-manager/src/client/presentation.ts
@@ -58,6 +58,7 @@ const CODE_KEYS = {
   'bundle-in-use': 'reasonBundleInUse',
   'stale-approval': 'reasonStaleApproval',
   'incompatible-version': 'reasonIncompatibleVersionUnnamed',
+  'unsupported-platform': 'reasonUnsupportedPlatform',
   'operation-error': 'reasonOperationError',
 } satisfies Record<ManagementError['code'], PluginManagerLocaleKey>
 
@@ -115,12 +116,12 @@ export function shortName(name: string): string {
  * @returns localized copy with a technical-name fallback and the independent beta status.
  */
 export function packageText(
-  pkg: Pick<PackageView, 'name' | 'meta'>, resolveText: PluginManagerFace['resolveText'],
+  pkg: Pick<PackageView, 'name' | 'meta' | 'experimental'>, resolveText: PluginManagerFace['resolveText'],
 ): { title: string; description: string | undefined; beta: boolean } {
   return {
     title: pkg.meta?.title === undefined ? pkg.name : resolveText(pkg.meta.title),
     description: pkg.meta?.description === undefined ? undefined : resolveText(pkg.meta.description) || undefined,
-    beta: pkg.name.startsWith('@deepseek-ai/dsh-experimental-'),
+    beta: pkg.experimental === true || pkg.name.startsWith('@deepseek-ai/dsh-experimental-'),
   }
 }
 
diff --git a/packages/client/ui-plugin-manager/src/client/slot-contract.ts b/packages/client/ui-plugin-manager/src/client/slot-contract.ts
index ff37603568..07609aa616 100644
--- a/packages/client/ui-plugin-manager/src/client/slot-contract.ts
+++ b/packages/client/ui-plugin-manager/src/client/slot-contract.ts
@@ -26,6 +26,8 @@ import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-
 export interface PluginConfigViewProps {
   /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */
   readonly view: 'summary' | 'page'
+  /** Whether the owning bundle is being changed; supplied on bundle configuration pages. */
+  readonly busy?: boolean
   /** Host-owned configuration values and write actions for this page's entry. */
   readonly form?: ConfigPageForm | undefined
 }
diff --git a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
index be382f110b..cf72293c94 100644
--- a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
+++ b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
@@ -206,6 +206,23 @@ function renderTab(
 }
 
 describe('PluginManagerPage', () => {
+  it('starts each page at the top and keeps scroll position during a refresh', () => {
+    const { set } = renderTab({ packages: [pkg()] })
+    const open = screen.getByRole('button', { name: 'View dsh-better-sidebar' })
+    const panel = open.closest<HTMLElement>('[data-plugin-panel]')!
+    panel.scrollTop = 350
+    fireEvent.click(open)
+    expect(panel.scrollTop).toBe(0)
+    panel.scrollTop = 120
+    set({ refreshStatus: 'refreshing' })
+    expect(panel.scrollTop).toBe(120)
+    set({ refreshStatus: 'idle', packages: [pkg({ version: '0.17.0' })] })
+    expect(panel.scrollTop).toBe(120)
+    fireEvent.click(screen.getByRole('button', { name: en.backToList }))
+    expect(panel.scrollTop).toBe(0)
+    expect(screen.getByRole('heading', { name: en.title, level: 1 })).toBeTruthy()
+  })
+
   it('shows no tabs without contributions, and switches between Installed and a contributed tab', () => {
     const { actions, navigation, setTabs, set } = renderTab({ packages: [pkg()] }, {}, {
       'plugins.tab:discover': (_view, owner) => {
@@ -707,6 +724,26 @@ describe('PluginManagerPage', () => {
     expect(actions.setEnabled).toHaveBeenCalledExactlyOnceWith('@deepseek-ai/dsh-experimental-agent-team-profile', true)
   })
 
+  it('keeps the persisted selection while marking a failed component as a problem', () => {
+    renderTab({ packages: [pkg({ name: 'cua', enabled: true, rows: [row({ phase: 'failed', diagnostic: 'native preparation unavailable' })] })] })
+    expect(document.querySelector('[data-plugin-package="cua"]')?.getAttribute('data-plugin-status')).toBe('problem')
+    expect(screen.getByRole('switch', { name: en.enableToggle.replace('{name}', 'cua') }).getAttribute('aria-checked')).toBe('true')
+    fireEvent.click(screen.getByRole('button', { name: en.openDetail.replace('{name}', 'cua') }))
+    expect(screen.getByText(`${en.reasonLabel}: native preparation unavailable`)).toBeTruthy()
+  })
+
+  it('marks a normally named Computer Use bundle experimental and explains persistent PTC before enabling', () => {
+    const description = 'Enabling switches this profile to persistent PTC.'
+    const { actions } = renderTab({ packages: [pkg({
+      name: '@deepseek-ai/dsh-cua-bundle', experimental: true, enabled: false, optional: true, installed: false,
+      meta: { title: 'Computer Use', description },
+    })] })
+    expect(screen.getByText(en.statusBeta)).toBeTruthy()
+    expect(screen.getByText(description)).toBeTruthy()
+    fireEvent.click(screen.getByRole('switch', { name: en.enableToggle.replace('{name}', 'Computer Use') }))
+    expect(actions.setEnabled).toHaveBeenCalledExactlyOnceWith('@deepseek-ai/dsh-cua-bundle', true)
+  })
+
   it.each([
     '@deepseek-ai/dsh-experimental-agent-team-profile',
     '@deepseek-ai/dsh-experimental-auto-review',
@@ -1357,6 +1394,11 @@ describe('PluginManagerPage', () => {
     expect(within(detail).getByText(`${en.reasonLabel}: ${en.reasonIncompatibleVersionUnnamed} ${en.reasonIncompatibleInstalled}`)).toBeTruthy()
     fireEvent.click(within(detail).getByRole('button', { name: en.backToList }))
     expect(document.querySelector('[data-plugin-detail]')).toBeNull()
+    set({ packages: [pkg({ enabled: false, error: { code: 'unsupported-platform' } })] })
+    expect(screen.getByText(en.reasonUnsupportedPlatform)).toBeTruthy()
+    expect(screen.getByRole('switch', { name: en.enableToggle.replace('{name}', 'dsh-better-sidebar') })).toHaveProperty('disabled', true)
+    set({ packages: [pkg({ enabled: true, error: { code: 'unsupported-platform' } })] })
+    expect(screen.getByRole('switch', { name: en.enableToggle.replace('{name}', 'dsh-better-sidebar') })).toHaveProperty('disabled', false)
     // A bundle that leaves the list drops back to the cards.
     const { version: _version, ...unversioned } = pkg()
     set({ packages: [unversioned] })
@@ -1398,7 +1440,7 @@ describe('PluginManagerPage', () => {
     fireEvent.click(toggle('row-2'))
     expect(actions.setRowEnabled).toHaveBeenCalledTimes(1)
     expect(toggle('include:row-5')).toHaveProperty('disabled', true)
-    expect(within(detail).getByText(en.rowPhaseFailed)).toBeTruthy()
+    expect(within(detail.querySelector<HTMLElement>('[data-plugin-row="include:row-3"]')!).getByText(en.rowPhaseFailed)).toBeTruthy()
     expect(within(detail).getByText(en.rowPhaseLoading)).toBeTruthy()
     expect(within(detail).getByText(en.rowPhaseUnloading)).toBeTruthy()
     expect(document.querySelector('[data-plugin-row="include:row-3"]')?.getAttribute('data-state')).toBe('failed')
@@ -2267,6 +2309,28 @@ describe('PluginManagerPage', () => {
   })
 })
 
+it.each([false, true])('shows progress only for the changing bundle and clears it when settled (enabled=%s)', (enabled) => {
+  const name = 'dsh-better-sidebar'
+  const { set, setLanguage, actions } = renderTab({ packages: [pkg({ enabled }), pkg({ name: 'dsh-other' })] })
+  const toggle = screen.getByRole('switch', { name: `Enable ${name}` })
+  expect(screen.queryByRole('status')).toBeNull()
+  fireEvent.click(toggle)
+  expect(actions.setEnabled).toHaveBeenCalledExactlyOnceWith(name, !enabled)
+  set({ busy: [name] })
+  for (const dict of [en, zh]) {
+    setLanguage(dict)
+    const status = screen.getByRole('status', { name: dict.applyingChange.replace('{name}', name) })
+    expect(status.querySelector('[data-state="ongoing"]')).not.toBeNull()
+  }
+  expect(toggle).toHaveProperty('disabled', true)
+  fireEvent.click(toggle)
+  expect(actions.setEnabled).toHaveBeenCalledOnce()
+  expect(screen.getByRole('switch', { name: '启用 dsh-other' })).toHaveProperty('disabled', false)
+  set({ busy: [] })
+  expect(screen.queryByRole('status')).toBeNull()
+  expect(toggle).toHaveProperty('disabled', false)
+})
+
 it.each([false, true])('opens activation guidance details and returns to the originating list (experimental: %s)', (fromMore) => {
   const name = fromMore ? '@deepseek-ai/dsh-experimental-terminal-bundle' : 'dsh-better-sidebar'
   const bundle = pkg({ name, official: fromMore })
@@ -2323,7 +2387,6 @@ it('supplies the accepted entry values and atomic mutation action to a custom pl
   expect(mutate).toHaveBeenCalledWith([{ op: 'set', path: ['count'], value: 3 }], 7)
 })
 
-
 describe('on-demand Official bundles', () => {
   const name = '@deepseek-ai/dsh-subagent-codex'
   const title = 'Codex subagent'
@@ -2430,3 +2493,40 @@ describe('on-demand Official bundles', () => {
     expect(detail.querySelector('[data-plugin-rows]')).toBeNull()
   })
 })
+
+it('uses the same activation guidance from a package detail switch', () => {
+  const name = 'dsh-better-sidebar'
+  const { set, actions } = renderTab({ packages: [pkg({ enabled: false })] }, { bundles: new Set([name]) }, {
+    [`plugins.bundle.activation:${name}`]: (_view, owner) => <button onClick={(owner as PluginActivationOwnerProps).onDismiss}>Finish setup</button>,
+    [`plugins.bundle.config:${name}`]: () => <div>Bundle setup</div>,
+  })
+  fireEvent.click(screen.getByRole('button', { name: `View ${name}` }))
+  expect(screen.getByText('Bundle setup')).toBeTruthy()
+  fireEvent.click(screen.getByRole('switch'))
+  expect(actions.setEnabled).toHaveBeenCalledWith(name, true)
+  set({ packages: [pkg()], busy: [name] })
+  expect(screen.queryByText('Finish setup')).toBeNull()
+  set({ busy: [] })
+  fireEvent.click(screen.getByText('Finish setup'))
+  expect(screen.queryByText('Finish setup')).toBeNull()
+  expect(screen.getByText('Bundle setup')).toBeTruthy()
+  fireEvent.click(screen.getByRole('switch'))
+  set({ packages: [pkg({ enabled: false })] })
+  expect(screen.queryByText('Finish setup')).toBeNull()
+})
+
+
+it('keeps bundle configuration mounted while reporting its pending operation', () => {
+  const name = 'dsh-better-sidebar'
+  const { set } = renderTab({ packages: [pkg()] }, { bundles: new Set([name]) }, {
+    [`plugins.bundle.config:${name}`]: (_view, owner) => <div data-testid="bundle-config">{String((owner as { busy?: boolean }).busy)}</div>,
+  })
+  fireEvent.click(screen.getByRole('button', { name: en.openDetail.replace('{name}', name) }))
+  const panel = screen.getByTestId('bundle-config')
+  expect(panel.textContent).toBe('false')
+  set({ busy: [name] })
+  expect(screen.getByTestId('bundle-config')).toBe(panel)
+  expect(panel.textContent).toBe('true')
+  set({ busy: [] })
+  expect(panel.textContent).toBe('false')
+})
diff --git a/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts b/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
index c4592690da..b652639a21 100644
--- a/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
+++ b/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
@@ -119,6 +119,13 @@ it('hands a custom page the shared configuration form of its entry', () => {
 })
 
 describe('packageView', () => {
+  it('carries the current inventory failure into a component row', () => {
+    const plugins = PLUGINS.map(plugin => plugin.entryId === ROW_ENTRY
+      ? { ...plugin, fiberPhase: 'failed' as const, diagnostic: 'native preparation unavailable' } : plugin)
+    expect(packageView(BUNDLE, plugins).rows[0]?.diagnostic).toBe('native preparation unavailable')
+    expect(packageView(BUNDLE, PLUGINS).rows[0]?.diagnostic).toBeUndefined()
+  })
+
   it('joins a bundle with the entries its rows run as', () => {
     expect(packageView(BUNDLE, PLUGINS)).toEqual({
       name: 'dsh-better-sidebar', version: '0.16.0', description: 'A sidebar.', source: 'dsh-better-sidebar@^0.16.0',
@@ -1730,6 +1737,9 @@ it('recognizes the official registry without a trailing slash and with uppercase
   await vi.waitFor(() => { expect(state().install.registry).toEqual({ kind: 'offered', registry: MIRROR }) })
 })
 
+it('retains the bundle experimental marker in its client projection', () => {
+  expect(packageView({ ...BUNDLE, experimental: true }, PLUGINS)).toMatchObject({ experimental: true })
+})
 
 describe('desktop analytics outcomes', () => {
   it('redacts authenticated installer URLs from click and failed-result events', async () => {
diff --git a/packages/host/plugin-inventory/README.i18n.yaml b/packages/host/plugin-inventory/README.i18n.yaml
index 28b07168b3..436960c853 100644
--- a/packages/host/plugin-inventory/README.i18n.yaml
+++ b/packages/host/plugin-inventory/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: dfc89b14d4c0d21e
   zh: 062b233951ed157b
 /deepseek-ai-dsh-host-plugin-inventory/use-this-package/what-you-can-and-cannot-do-with-it:
-  en: 387f87777eef7ec5
-  zh: badcd90c8840f870
+  en: 0243819e8404c74a
+  zh: 05dab926c0ecff34
 /deepseek-ai-dsh-host-plugin-inventory/understand-the-implementation:
   en: 42b15ac6321706aa
   zh: 4ed0861911abaf5d
diff --git a/packages/host/plugin-inventory/README.md b/packages/host/plugin-inventory/README.md
index 5dbd882172..cd9ce7c0fa 100644
--- a/packages/host/plugin-inventory/README.md
+++ b/packages/host/plugin-inventory/README.md
@@ -41,6 +41,8 @@ With a roster composed, `agentPresets` carries one group per preset in roster or
 
 The inventory is a snapshot for display and diagnostics: a client can render the roster, flag failed entries, and detect changes by comparing snapshots. It cannot enable, disable, add, or remove plugins, and it carries no history — a fiber that already failed and was removed is absent. Because the service reads the Loader on every call, the answer always reflects the current composition rather than a cached view.
 
+Failed entries include the current startup diagnostic read from their Cordis fiber. Recovery removes it; inventory reads do not wait for loading entries or retain a separate error cache.
+
 -----
 
 <a id="understand-the-implementation"></a>
diff --git a/packages/host/plugin-inventory/README.zh.md b/packages/host/plugin-inventory/README.zh.md
index 9e63575f23..8392526a96 100644
--- a/packages/host/plugin-inventory/README.zh.md
+++ b/packages/host/plugin-inventory/README.zh.md
@@ -41,6 +41,8 @@ Loader 行与预设行可以携带可选的 `meta`，其中包含标题、描述
 
 该清单是供展示与诊断的快照：客户端可以渲染名单、标出失败条目，并通过比较快照检测变化。它不能启用、停用、添加或移除插件，也不携带历史——已经失败并被移除的 fiber 缺席。由于服务每次调用都读取 Loader，答案总是反映当前组合，而不是缓存视图。
 
+失败条目包含从 Cordis fiber 读取的当前启动诊断。恢复后移除该诊断；清单查询不等待仍在加载的条目，也不另存错误缓存。
+
 -----
 
 <a id="understand-the-implementation"></a>
diff --git a/packages/host/plugin-inventory/src/index.ts b/packages/host/plugin-inventory/src/index.ts
index b122998414..a47c673ba9 100644
--- a/packages/host/plugin-inventory/src/index.ts
+++ b/packages/host/plugin-inventory/src/index.ts
@@ -86,11 +86,18 @@ export async function readPluginInventory(ctx: Context): Promise<PluginInventory
     if (entry.options.group) continue
     const base = entry.parent.tree.ctx.baseUrl
     const meta = base === undefined ? undefined : packages?.metaOf(entry.options.name, base)
+    const fiber = entry.fiber
+    const fiberPhase = fiber === undefined ? null : FIBER_PHASE[fiber.state]
+    let diagnostic: string | undefined
+    if (fiber !== undefined && fiberPhase === 'failed') {
+      try { await fiber.await() } catch (error) { diagnostic = error instanceof Error ? error.message : String(error) }
+    }
     entries.push({
       entryId: pluginEntryId(entry.id),
       moduleName: entry.options.name,
       enabled: !entry.disabled,
-      fiberPhase: entry.fiber === undefined ? null : FIBER_PHASE[entry.fiber.state],
+      fiberPhase,
+      ...diagnostic === undefined ? {} : { diagnostic },
       ...meta === undefined ? {} : { meta },
     })
   }
diff --git a/packages/host/plugin-inventory/src/types.ts b/packages/host/plugin-inventory/src/types.ts
index b6ebc2d3ce..c79de21ec1 100644
--- a/packages/host/plugin-inventory/src/types.ts
+++ b/packages/host/plugin-inventory/src/types.ts
@@ -23,6 +23,8 @@ export interface PluginInventoryEntry {
   /** Effective Loader enablement, including disabled ancestor groups. */
   readonly enabled: boolean
   readonly fiberPhase: PluginFiberPhase
+  /** Current startup failure message; absent when this entry has no failed fiber. */
+  readonly diagnostic?: string
 }
 
 /** Effective enablement of one preset composition row. */
diff --git a/packages/host/plugin-inventory/tests/inventory.spec.ts b/packages/host/plugin-inventory/tests/inventory.spec.ts
index 667d8ac66f..6e022ea922 100644
--- a/packages/host/plugin-inventory/tests/inventory.spec.ts
+++ b/packages/host/plugin-inventory/tests/inventory.spec.ts
@@ -149,6 +149,30 @@ describe('PluginInventoryGateway', () => {
     ])
   })
 
+  it.each(['error', 'stack object'] as const)('reads %s startup diagnostics from failed fibers and clears them after recovery', async (kind) => {
+    const { ctx, inventory } = await harness()
+    const failure: unknown = kind === 'error' ? new Error('native preparation unavailable')
+      : { stack: 'plugin startup failure', toString: () => 'native preparation unavailable' }
+    ctx.loader.builtins.failing = {
+      async apply(_ctx: Context, config: { fail: boolean }) {
+        if (config.fail) throw failure
+      },
+    }
+    const entry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:failing', config: { fail: true } }))
+    await expect(entry.fiber!.await()).rejects.toBe(failure)
+    for (let index = 0; index < 2; index++) {
+      expect((await inventory.list()).entries).toContainEqual({
+        entryId: entry.id, moduleName: 'cordis:failing', enabled: true,
+        fiberPhase: 'failed', diagnostic: 'native preparation unavailable',
+      })
+    }
+    await entry.update({ config: { fail: false } })
+    await entry.fiber!.await()
+    expect((await inventory.list()).entries).toContainEqual({
+      entryId: entry.id, moduleName: 'cordis:failing', enabled: true, fiberPhase: 'active',
+    })
+  })
+
   it('projects current non-group Loader entries without a second cache', async () => {
     const { ctx, inventory } = await harness()
     const activeId = await ctx.loader.create({ name: 'cordis:active' })
diff --git a/packages/util/package-manifest/README.i18n.yaml b/packages/util/package-manifest/README.i18n.yaml
index 2ce3905fcf..56cd1cdc13 100644
--- a/packages/util/package-manifest/README.i18n.yaml
+++ b/packages/util/package-manifest/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: d152484eb41ac6b4
   zh: 1db86285abf6c499
 /deepseek-ai-dsh-package-manifest/use-this-package:
-  en: f275964a8845888a
-  zh: b284e09aacea079b
+  en: c4bbd42bbe88fd5b
+  zh: f948c43f2eb44b18
 /deepseek-ai-dsh-package-manifest/understand-the-implementation:
   en: 41ec449dee927f04
   zh: ec1b583bd9025d84
diff --git a/packages/util/package-manifest/README.md b/packages/util/package-manifest/README.md
index d50312947e..9e60708836 100644
--- a/packages/util/package-manifest/README.md
+++ b/packages/util/package-manifest/README.md
@@ -50,6 +50,9 @@ The following metadata fields are optional. Omitting them leaves the format vers
 | Field | Meaning |
 |---|---|
 | `dsh.manifestVersion` | Manifest format identifier; the declared format is `1`, independent of the npm package version and Session format version. |
+| `dsh.bundle.platforms` | Optional nonempty list of Node Host platform names, such as `["darwin"]`; omission allows every operating system. The launcher and plugin manager enforce it before composing or selecting the bundle. |
+| `dsh.bundle.experimental` | Explicit experimental feature label in plugin management; independent of the package name and enabled state. |
+| `dsh.bundle.configureOnEnable` | Entry-id map of JSON config fields that Plugin Manager saves on explicit enablement. Settings use ordinary profile reconciliation and remain after disablement; see [Plugin Manager](../../boot/plugin-manager/README.md). |
 | `engines.dsh` | Author-declared compatible DSH versions as a SemVer range, including exact prerelease versions. This field sits beside `engines.node` and `engines.npm`; an engines object may omit `dsh`. |
 
 `LocalizedText` carries literal text or a language map with a required English fallback. `PluginLocalizedMeta` carries optional display title, description, an image data URL resolved from a package root's `package.json.icon` or an exported `<specifier>/icon`, and metadata diagnostics for installed plugins. [App boot](../../boot/app-boot/README.md) reads these values; this package only supplies their types.
diff --git a/packages/util/package-manifest/README.zh.md b/packages/util/package-manifest/README.zh.md
index 9a535a094a..d7cb9b6d3d 100644
--- a/packages/util/package-manifest/README.zh.md
+++ b/packages/util/package-manifest/README.zh.md
@@ -50,6 +50,9 @@ const manifest: DshPackageManifest = {
 | 字段 | 含义 |
 |---|---|
 | `dsh.manifestVersion` | manifest（元数据清单）格式标识；声明的格式为 `1`，独立于 npm 包版本和 Session 格式版本。 |
+| `dsh.bundle.platforms` | 可选的非空 Node Host 平台名称列表，例如 `["darwin"]`；省略时允许所有操作系统。启动器和插件管理器在组合或选择该组合包前检查此字段。 |
+| `dsh.bundle.experimental` | 在插件页显示实验性标签，不改变包名或启用状态。 |
+| `dsh.bundle.configureOnEnable` | 以条目 id 为键的 JSON 配置字段映射，由插件管理器在显式启用时保存。通过正常 profile 重组生效，关闭保留；见[插件管理器](../../boot/plugin-manager/README.zh.md)。 |
 | `engines.dsh` | 作者声明的兼容 DSH 版本，使用 SemVer 范围，也可填写精确的预发布版本。此字段与 `engines.node`、`engines.npm` 并列；engines 对象可省略 `dsh`。 |
 
 `LocalizedText` 携带字面文本或带必需英文回退值的语言映射。`PluginLocalizedMeta` 携带已安装插件的可选展示标题、描述、从包根 `package.json.icon` 或导出的 `<标识>/icon` 解析的图片 data URL，以及元信息诊断。[App boot](../../boot/app-boot/README.zh.md) 读取这些值；本包只提供其类型。
diff --git a/packages/util/package-manifest/src/types.ts b/packages/util/package-manifest/src/types.ts
index e5289ad1e2..c3a50bd224 100644
--- a/packages/util/package-manifest/src/types.ts
+++ b/packages/util/package-manifest/src/types.ts
@@ -67,6 +67,14 @@ export interface DshEnginesManifest {
 
 /** The configuration layer exported by a bundle package. */
 export interface DshBundleManifest {
+  /** Top-level fields saved to existing profile entries on explicit enablement.
+   * Settings remain after disablement.
+   */
+  configureOnEnable?: Record<string, Record<string, unknown>>
+  /** Supported Node Host platform names; omission allows every operating system. */
+  platforms?: string[]
+  /** Mark this optional feature as experimental in plugin management. */
+  experimental?: boolean
   /** One patch file path, or an ordered list applied in sequence, each relative to the declaring package root. */
   patch: string | string[]
 }

From ca081d5658b438b4e29f7763889c21cfc10f641f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:12 +0800
Subject: [PATCH 03/44] fix(session): restore presence when sessions return

---
 .../api/session-controller/README.i18n.yaml   |  4 +-
 packages/api/session-controller/README.md     |  2 +-
 packages/api/session-controller/README.zh.md  |  2 +-
 .../src/client/sessions/manager.ts            |  4 +-
 .../src/client/sessions/session.ts            | 10 +++--
 .../tests/session.client.spec.ts              |  9 ++++-
 .../tests/sessions-service.client.spec.ts     | 37 +++++++++++++++++++
 7 files changed, 59 insertions(+), 9 deletions(-)

diff --git a/packages/api/session-controller/README.i18n.yaml b/packages/api/session-controller/README.i18n.yaml
index 46f670802e..74de656850 100644
--- a/packages/api/session-controller/README.i18n.yaml
+++ b/packages/api/session-controller/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 1fdf707322fb6996
   zh: 0204f7e9d4aa3cce
 /session-controller/use-this-package:
-  en: f9e4042fae88f801
-  zh: f379f78966d57c2e
+  en: ad1074f2e0991d16
+  zh: cbef260e5c6d4ac3
 /session-controller/client-references:
   en: 41bdda1ac32df558
   zh: aa5d0e325924066b
diff --git a/packages/api/session-controller/README.md b/packages/api/session-controller/README.md
index 02dff176ba..3deac01352 100644
--- a/packages/api/session-controller/README.md
+++ b/packages/api/session-controller/README.md
@@ -43,7 +43,7 @@ Client list rows and resident Sessions use the current `sessionListMetadata` pro
 
 `session.create` returns a Session for a new conversation, and its response names the Session actually used. A named `sessionId` is reused while it is blank (no turn has started), belongs to the requested directory, is an unarchived member of the requested Workspace, and is not written by another owner; a live Session is reused in place, and a persisted one is resumed while retaining its writer lock. The reused Session runs the requested `agentPreset`, or the configured default when the request names none: its recorded preset is not resolved, and a change is logged as `agent-preset/selected` before the Agent is published. A named Session that has started, fails the Workspace placement, or is written by another owner stays unchanged, and a new Session is created instead. A `sessionId` with no stored Session becomes the new Session's identity. A named Session in another directory fails with `session/conflict`, and one owned by subagent routing with `session/agent-busy`; both checks precede preset resolution. Creations naming one identity run in arrival order, including their preset resolution, and each response reports the preset its own request left the Session running. `session.list` includes persisted blanks using cached metadata, without opening cold log bodies.
 
-Client list refreshes retain unchanged row objects and reuse the items array when order and values match. Each row's `retainedBy` contains positive local reference-source counts; Host metadata refreshes cannot overwrite them. Cache membership checks use a per-refresh ID set, so reconciliation grows linearly with the current list and retained cache sizes. Host summary updates replace running and Agent availability; local create/fork responses only fill missing metadata on existing rows. Removed ordinary Sessions retain projection stores only when their catalogs contain children.
+Client list refreshes retain unchanged row objects and reuse the items array when order and values match. Each row's `retainedBy` contains positive local reference-source counts; Host metadata refreshes cannot overwrite them. Cache membership checks use a per-refresh ID set, so reconciliation grows linearly with the current list and retained cache sizes. Host summary updates replace running and Agent availability; local create/fork responses only fill missing metadata on existing rows. Removed ordinary Sessions retain projection stores only when their catalogs contain children. A current Host addition or reconciled list restores a retained Session after plugin reload, preserving its draft and clearing the removed state; a removal received during a list request takes precedence over that response.
 
 Background-job rows and observation streams belong to [`dsh-api-job-controller`](../job-controller/README.md); the control stream carries projections only.
 
diff --git a/packages/api/session-controller/README.zh.md b/packages/api/session-controller/README.zh.md
index b01a99cc1f..1f76f32f37 100644
--- a/packages/api/session-controller/README.zh.md
+++ b/packages/api/session-controller/README.zh.md
@@ -43,7 +43,7 @@ Client 列表行和驻留 Session 使用当前 `sessionListMetadata` 投影纠
 
 `session.create` 返回一个用于新对话的 Session，响应指明实际使用的 Session。请求指明的 `sessionId` 在满足以下条件时被复用：仍为空白（尚未开始任何轮次）、属于请求的目录、是请求的工作区中未归档的成员，且未被其他写者占用；活动 Session 原地复用，持久化 Session 被恢复并持续持有其写锁。被复用的 Session 运行请求的 `agentPreset`，请求未指明时运行配置的默认 preset：不解析它记录的 preset，变更在 Agent 发布前记录为 `agent-preset/selected`。指明的 Session 若已开始、不满足工作区归属，或被其他写者占用，则保持不变，改为新建 Session。没有对应已存储 Session 的 `sessionId` 成为新 Session 的标识。指明其他目录中的 Session 返回 `session/conflict`，指明由 subagent 路由拥有的 Session 返回 `session/agent-busy`；这两项检查先于 preset 解析。指明同一标识的创建请求按到达顺序执行，preset 解析也包含在内，每个响应报告其自身请求完成时该 Session 运行的 preset。`session.list` 根据缓存元数据列出持久化空白会话，不打开冷日志正文。
 
-Client 列表刷新保留未变化的行对象，并在顺序和值均相同时复用条目数组。每行的 `retainedBy` 包含正数的本地引用来源计数，Host 元数据刷新不能覆盖它们。缓存成员检查使用每次刷新构建的 ID 集合，因此对账成本随当前列表和保留缓存的规模线性增长。 Host 摘要更新会替换运行状态与 Agent 可用性；本地 create/fork 响应只补充已有行缺失的元数据。普通 Session 被移除后，仅在目录仍有子项时保留其投影 store。
+Client 列表刷新保留未变化的行对象，并在顺序和值均相同时复用条目数组。每行的 `retainedBy` 包含正数的本地引用来源计数，Host 元数据刷新不能覆盖它们。缓存成员检查使用每次刷新构建的 ID 集合，因此对账成本随当前列表和保留缓存的规模线性增长。 Host 摘要更新会替换运行状态与 Agent 可用性；本地 create/fork 响应只补充已有行缺失的元数据。普通 Session 被移除后，仅在目录仍有子项时保留其投影 store。 当前 Host 新增事件或对账后的列表会恢复插件重载前保留的 Session，清除移除状态并保留草稿；列表请求期间收到的移除事件优先于该次响应。
 
 后台 job 的名册行与观测流属于 [`dsh-api-job-controller`](../job-controller/README.zh.md)；控制流只承载投影。
 
diff --git a/packages/api/session-controller/src/client/sessions/manager.ts b/packages/api/session-controller/src/client/sessions/manager.ts
index b8bec9be8a..dc90ea978f 100644
--- a/packages/api/session-controller/src/client/sessions/manager.ts
+++ b/packages/api/session-controller/src/client/sessions/manager.ts
@@ -446,6 +446,7 @@ export class SessionManager {
           for (const s of this.summaries) {
             const session = this.sessions.get(s.sessionId)
             if (session === undefined) continue
+            session.handlePresence(true)
             session.handleBlank(this.effectiveBlank(s))
             session.handleRunning(s.running)
           }
@@ -667,6 +668,7 @@ export class SessionManager {
   handleSessionAdded(summary: SessionSummary): void {
     this.mergeSummary(summary)
     if (!this.disposed && summary.running) this.engagedSessions.add(summary.sessionId)
+    this.sessions.get(summary.sessionId)?.handlePresence(true)
     this.sessions.get(summary.sessionId)?.handleBlank(this.effectiveBlank(summary))
     if (summary.projections !== undefined) this.applyListBlock(summary.sessionId, summary.projections)
   }
@@ -706,7 +708,7 @@ export class SessionManager {
       ? { kind: 'status', sessionId, running: false, agentAvailable: false }
       : { kind: 'remove', sessionId })
     if (durableSubagent) this.sessions.get(sessionId)?.handleRunning(false)
-    else this.sessions.get(sessionId)?.handleRemoved()
+    else this.sessions.get(sessionId)?.handlePresence(false)
     const catalog = this.projectionStores.get(sessionId)?.values().subagentCatalog
     if (!durableSubagent && (catalog === undefined || catalog.length === 0)) {
       this.projectionStores.delete(sessionId)
diff --git a/packages/api/session-controller/src/client/sessions/session.ts b/packages/api/session-controller/src/client/sessions/session.ts
index 09494e01ab..7fd67057cc 100644
--- a/packages/api/session-controller/src/client/sessions/session.ts
+++ b/packages/api/session-controller/src/client/sessions/session.ts
@@ -577,9 +577,13 @@ export class Session implements SessionFace {
     this.notifier.markDirty()
   }
 
-  /** `api-session/removed` relay: flag the snapshot while retaining the resident instance. */
-  handleRemoved(): void {
-    this.removed = true
+  /**
+   * Update Host membership while retaining the resident instance and its draft.
+   * @param present - Whether a current Host event or reconciled list contains this Session.
+   */
+  handlePresence(present: boolean): void {
+    if (present === !this.removed) return
+    this.removed = !present
     this.notifier.markDirty()
   }
 
diff --git a/packages/api/session-controller/tests/session.client.spec.ts b/packages/api/session-controller/tests/session.client.spec.ts
index 8d1838e40f..69846236d3 100644
--- a/packages/api/session-controller/tests/session.client.spec.ts
+++ b/packages/api/session-controller/tests/session.client.spec.ts
@@ -840,10 +840,17 @@ describe('remaining branches', () => {
   it('deduplicates repeated running flips and records removal', async ({ mock, start }) => {
     const session = await sessionBench(mock, start, SID)
     const before = session.getSnapshot()
+    session.handlePresence(true)
+    expect(session.getSnapshot()).toBe(before)
     session.handleRunning(false) // already false: dedup branch
     expect(session.getSnapshot()).toBe(before)
-    session.handleRemoved()
+    session.handlePresence(false)
     expect(session.getSnapshot().removed).toBe(true)
+    const removed = session.getSnapshot()
+    session.handlePresence(false)
+    expect(session.getSnapshot()).toBe(removed)
+    session.handlePresence(true)
+    expect(session.getSnapshot().removed).toBe(false)
   })
 
   it('drops live events while cold/error (no window upkeep)', async ({ mock, start }) => {
diff --git a/packages/api/session-controller/tests/sessions-service.client.spec.ts b/packages/api/session-controller/tests/sessions-service.client.spec.ts
index d92a83198e..13d736320f 100644
--- a/packages/api/session-controller/tests/sessions-service.client.spec.ts
+++ b/packages/api/session-controller/tests/sessions-service.client.spec.ts
@@ -1072,6 +1072,43 @@ describe('catalog arrival', () => {
   })
 })
 
+describe('Host membership recovery', () => {
+  it.for(['event', 'list'] as const)('restores a retained Session through a current %s after plugin reload', async (source, { bench }) => {
+    const b = bench()
+    await feedList(b, [{ id: 's1' }])
+    using reference = b.svc.retain(sid('s1'), { source: 'controllerOperation' })
+    await reference.ready
+    const session = reference.binding.session
+    b.svc.handleSessionRemoved(sid('s1'))
+    expect(session.getSnapshot().removed).toBe(true)
+    if (source === 'event') {
+      b.svc.handleSessionAdded({ agentAvailable: true, sessionId: sid('s1'), updatedAt: 2, running: false, blank: false })
+    } else {
+      await feedList(b, [{ id: 's1' }])
+    }
+    expect(b.svc.binding(sid('s1'))).toBe(reference.binding)
+    expect(session.getSnapshot().removed).toBe(false)
+  })
+
+  it('keeps a removal newer than an in-flight list response', async ({ bench }) => {
+    const b = bench()
+    await feedList(b, [{ id: 's1' }])
+    using reference = b.svc.retain(sid('s1'), { source: 'controllerOperation' })
+    await reference.ready
+    const gate: PromiseWithResolvers<void> = Promise.withResolvers()
+    b.unblock.push(() => { gate.resolve() })
+    b.mock.remote.session.list.mockImplementation(async () => {
+      await gate.promise
+      return ok({ items: [{ agentAvailable: true, sessionId: sid('s1'), updatedAt: 1, running: false, blank: false }] })
+    })
+    const refresh = b.svc.refresh()
+    b.svc.handleSessionRemoved(sid('s1'))
+    gate.resolve()
+    await refresh
+    expect(reference.binding.session.getSnapshot().removed).toBe(true)
+  })
+})
+
 describe('blank mirror', () => {
   it('flips blank=false from the running:true status frame (cross-client conversion)', async ({ bench }) => {
     const b = bench()

From 2d46f347017db5e99fadb9c1ebccac51b96ea063 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 04/44] feat(approval): share fixed-action approval cards

---
 packages/client/ui-approval/README.i18n.yaml  |  8 +-
 packages/client/ui-approval/README.md         |  4 +-
 packages/client/ui-approval/README.zh.md      |  4 +-
 .../ui-approval/src/client/ApprovalCard.tsx   | 89 ++++++++++++++++++
 .../src/client/ApprovalPanel.module.css       | 22 +++++
 .../ui-approval/src/client/ApprovalPanel.tsx  | 92 +++----------------
 .../ui-approval/src/client/contract/slots.ts  | 38 +++++++-
 .../client/ui-approval/src/client/index.ts    |  9 +-
 .../client/ui-approval/src/client/locales.ts  |  2 +
 .../tests/ui-approval.client.spec.tsx         | 39 +++++++-
 .../client/ui-user-questions/README.i18n.yaml |  4 +-
 packages/client/ui-user-questions/README.md   |  2 +
 .../client/ui-user-questions/README.zh.md     |  2 +
 .../client/ui-user-questions/package.json     |  6 +-
 .../src/client/QuestionApproval.tsx           | 31 +++++++
 .../src/client/QuestionComposer.tsx           |  3 +
 .../src/client/contract/slots.ts              |  4 +-
 .../ui-user-questions/src/client/index.ts     |  5 +-
 .../tests/browser-plugin.client.spec.ts       |  9 +-
 .../tests/plan-review-panel.client.spec.tsx   |  2 +
 .../tests/question-approval.client.spec.tsx   | 50 ++++++++++
 .../user-questions-composer.client.spec.tsx   |  2 +
 .../client/ui-user-questions/tsconfig.json    |  3 +
 .../user-questions/README.i18n.yaml           |  4 +-
 packages/interaction/user-questions/README.md |  2 +-
 .../interaction/user-questions/README.zh.md   |  2 +-
 .../interaction/user-questions/src/index.ts   | 26 +++---
 .../interaction/user-questions/src/types.ts   | 17 ++++
 .../tests/user-questions.spec.ts              | 31 +++++++
 29 files changed, 390 insertions(+), 122 deletions(-)
 create mode 100644 packages/client/ui-approval/src/client/ApprovalCard.tsx
 create mode 100644 packages/client/ui-user-questions/src/client/QuestionApproval.tsx
 create mode 100644 packages/client/ui-user-questions/tests/question-approval.client.spec.tsx

diff --git a/packages/client/ui-approval/README.i18n.yaml b/packages/client/ui-approval/README.i18n.yaml
index 1b646cd6a8..206aa36eb9 100644
--- a/packages/client/ui-approval/README.i18n.yaml
+++ b/packages/client/ui-approval/README.i18n.yaml
@@ -12,8 +12,8 @@
   en: 8d6c7c6e63f849f6
   zh: d89fa273e30b99d3
 /deepseek-ai-dsh-client-ui-approval/table-of-contents:
-  en: 2bfa677a50bd924c
-  zh: 2f4b55ab42747bea
+  en: 4d8f80fd7fb1b422
+  zh: 286100dd6b607ed7
 /deepseek-ai-dsh-client-ui-approval/model-experience:
   en: 8161dce49e9f899c
   zh: a17401e1e78ba6be
@@ -21,8 +21,8 @@
   en: adf7112e0691b89e
   zh: 14eeddcff985119f
 /deepseek-ai-dsh-client-ui-approval/known-limitations-and-deferred-work:
-  en: ae644102ed52f7ee
-  zh: e109de1d517a3a94
+  en: 96d9b96df10e88eb
+  zh: cdeab788ad08bb33
 /deepseek-ai-dsh-client-ui-approval/known-limitations-and-deferred-work/dev-note:
   en: e67f633dc6fe7773
   zh: e88aeb617ffb74ea
diff --git a/packages/client/ui-approval/README.md b/packages/client/ui-approval/README.md
index ca21af33fb..0d8a384c53 100644
--- a/packages/client/ui-approval/README.md
+++ b/packages/client/ui-approval/README.md
@@ -20,6 +20,8 @@ Browser approval presentation over the Agent-scoped Remote Event waterfall. The
 
 Focus the approval detail region to approve with Enter or reject with Escape. The mounted plugin reserves both keys against editable shortcuts. Enter on the focused Reject button retains its native reject action. Input controls and IME candidates keep their own keys. Keyboard and pointer actions share one pending-request lock; a withdrawn or replaced request cannot accept another answer, and an earlier failed answer cannot unlock its replacement.
 
+When offered, **Always allow** is the highlighted primary button. Otherwise, the current-request allow action is primary.
+
 <a id="model-experience"></a>
 ## Model Experience
 
@@ -33,7 +35,7 @@ None; approval request and response rendering does not alter a model request.
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- **The panel exposes transient decisions only** — it supports allow-once and reject; persistent permission policy remains owned by Host-side approval packages. Requester-supplied localized presentation copy follows the UI language without changing the audit reason or translating model-generated text.
+- The shared `conversation.approval.card` Factory presents reject, allow and an optional always-allow action, with caller-owned scope, subject metadata and answer callbacks. Tool approvals retain their two outcomes. Application consent can reuse the card without adopting tool-approval policy. Icons and labels identify the subject visually; the caller owns identity verification and saved grants.
 
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-approval/README.zh.md b/packages/client/ui-approval/README.zh.md
index a9a714ef68..1474190a22 100644
--- a/packages/client/ui-approval/README.zh.md
+++ b/packages/client/ui-approval/README.zh.md
@@ -20,6 +20,8 @@ kind: "package-reference"
 
 聚焦审批详情区域后，Enter 批准，Esc 拒绝。插件挂载期间，这两个按键不能分配给可编辑快捷键。聚焦“拒绝”按钮后，Enter 保留按钮原生拒绝操作。输入控件与输入法候选保留各自的按键。键盘和指针操作共用同一待处理请求锁；已撤销或替换的请求不能再次作答，较早请求的失败也不会解锁替代请求。
 
+提供“始终允许”时，将它显示为高亮主按钮；否则高亮当前请求的允许按钮。
+
 <a id="model-experience"></a>
 ## 模型体验
 
@@ -33,7 +35,7 @@ kind: "package-reference"
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- **面板只提供临时决定**——它支持仅本次允许和拒绝；持久权限策略仍由 Host 侧审批包拥有。请求方提供的本地化展示文案跟随界面语言，不改写审计原因，也不翻译模型生成的文本。
+- 共用的 `conversation.approval.card` Factory 展示拒绝、允许和可选的始终允许操作，授权范围、对象信息和回答回调由调用方提供。工具审批保留原来的两种选择。应用授权可以复用卡片，同时保留独立的授权规则。图标和名称用于识别对象，身份校验和授权保存由调用方负责。
 
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-approval/src/client/ApprovalCard.tsx b/packages/client/ui-approval/src/client/ApprovalCard.tsx
new file mode 100644
index 0000000000..a4cf3cd0f3
--- /dev/null
+++ b/packages/client/ui-approval/src/client/ApprovalCard.tsx
@@ -0,0 +1,89 @@
+/** Shared approval presentation; each caller retains its decision policy and answer channel. */
+import { useEffect, useRef, useState, type KeyboardEvent } from 'react'
+import { Button, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
+import type { FactoryComponentPropsOf } from '@deepseek-ai/dsh-client-ui-slots'
+import type {} from './contract/slots.ts'
+import css from './ApprovalPanel.module.css'
+
+/**
+ * Render one decision with caller-owned actions and an optional persistent choice.
+ * @param props Request identity, copy, actions and correlated detail.
+ * @returns The shared approval card, reset for each request.
+ */
+export function ApprovalCard(props: FactoryComponentPropsOf<'conversation.approval.card'>) {
+  return <ApprovalFlow key={props.requestKey} {...props} />
+}
+
+function ApprovalFlow(props: FactoryComponentPropsOf<'conversation.approval.card'>) {
+  const { requestKey, title, description, subject, allowLabel, canAnswer, onAllow, onReject, onAlways, t } = props
+  const detail = props.callId === undefined ? null : props.renderSlot('conversation.approval.detail', { callId: props.callId })
+  const [answered, setAnswered] = useState(false)
+  const waiting = useRef(false)
+  const active = useRef(true)
+  const composing = useRef(false)
+  const compositionEnded = useRef(false)
+  useEffect(() => {
+    active.current = true
+    return () => { active.current = false }
+  }, [])
+  const answer = (send: () => Promise<void>): void => {
+    if (waiting.current || !canAnswer()) return
+    waiting.current = true
+    setAnswered(true)
+    void send().catch(() => {
+      if (!active.current || !canAnswer()) return
+      waiting.current = false
+      setAnswered(false)
+    })
+  }
+  const keydown = (event: KeyboardEvent<HTMLDivElement>): void => {
+    const element = event.target as Element
+    if (event.defaultPrevented || !event.currentTarget.contains(document.activeElement)
+      || element.closest('input, textarea, select, [contenteditable="true"], [contenteditable=""]') !== null) return
+    if (event.key !== 'Enter' && event.key !== 'Escape') return
+    if (event.key === 'Enter' && element.closest('button, a[href], [role="button"]') !== null) return
+    if (event.ctrlKey || event.metaKey || event.altKey || event.shiftKey) return
+    event.preventDefault()
+    event.stopPropagation()
+    // oxlint-disable-next-line typescript/no-deprecated -- IME 229 covers engines without isComposing.
+    if (event.repeat || composing.current || compositionEnded.current || event.nativeEvent.isComposing || event.keyCode === 229) return
+    answer(event.key === 'Enter' ? onAllow : onReject)
+  }
+  return (
+    <div className={css.root} data-approval-key={requestKey} aria-busy={answered}
+      onKeyDown={keydown}
+      onKeyUpCapture={() => { compositionEnded.current = false }}
+      onCompositionStartCapture={() => { composing.current = true }}
+      onCompositionEndCapture={() => { composing.current = false; compositionEnded.current = true }}>
+      <div className={css.card}>
+        <div className={css.strip}><StateDot state={answered ? 'ongoing' : 'warning'} />{t('waiting')}</div>
+        <div
+          className={css.body}
+          data-approval-scroll=""
+          tabIndex={0}
+          role="group"
+          aria-label={t('detail.aria')}
+        >
+          {subject !== undefined && <div className={css.subject}>
+            {subject.icon !== undefined && <img src={subject.icon} alt="" width={40} height={40} draggable={false} />}
+            <strong>{subject.name}</strong>
+          </div>}
+          <div className={css.headline}>{title}</div>
+          {description !== undefined && <p className={css.description}>{description}</p>}
+          {detail !== null && <div className={css.command}>{detail}</div>}
+        </div>
+        <div className={css.actionRow}>
+          <Button variant="outline" className={css.reject} disabled={answered} onClick={() => { answer(onReject) }}>
+            {t('reject')}
+          </Button>
+          <Button variant={onAlways === undefined ? 'primary' : 'outline'} disabled={answered} onClick={() => { answer(onAllow) }}>
+            {allowLabel ?? t('allowOnce')}
+          </Button>
+          {onAlways !== undefined && <Button variant="primary" disabled={answered} onClick={() => { answer(onAlways) }}>
+            {t('allowAlways')}
+          </Button>}
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/packages/client/ui-approval/src/client/ApprovalPanel.module.css b/packages/client/ui-approval/src/client/ApprovalPanel.module.css
index edf5a7bf79..90c9a87d5c 100644
--- a/packages/client/ui-approval/src/client/ApprovalPanel.module.css
+++ b/packages/client/ui-approval/src/client/ApprovalPanel.module.css
@@ -34,6 +34,7 @@
   gap: 6px;
   box-sizing: border-box;
   max-height: var(--dsh-composer-text-max-height);
+  text-align: left;
   overflow-y: auto;
   padding: 12px 16px 0;
 }
@@ -56,6 +57,7 @@
 .actionRow {
   display: flex;
   justify-content: flex-end;
+  flex-wrap: wrap;
   gap: 8px;
   padding: 14px 16px;
 }
@@ -65,3 +67,23 @@
   color: var(--dsw-alias-state-error-primary);
   border-color: transparent;
 }
+
+.subject {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  color: var(--dsw-alias-label-primary);
+  font-size: 16px;
+}
+
+.subject img {
+  flex-shrink: 0;
+  object-fit: contain;
+}
+
+.description {
+  margin: 0;
+  color: var(--dsw-alias-label-secondary);
+  font-size: 13px;
+  line-height: 20px;
+}
diff --git a/packages/client/ui-approval/src/client/ApprovalPanel.tsx b/packages/client/ui-approval/src/client/ApprovalPanel.tsx
index bdfcba3f02..b77a757bab 100644
--- a/packages/client/ui-approval/src/client/ApprovalPanel.tsx
+++ b/packages/client/ui-approval/src/client/ApprovalPanel.tsx
@@ -1,88 +1,20 @@
-/** Composer takeover for one pending approval waterfall. */
-import { useEffect, useRef, useState, type KeyboardEvent, type ReactNode } from 'react'
-import { Button, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
-import type { ApprovalComposerProps, PendingApproval } from './contract/slots.ts'
-import css from './ApprovalPanel.module.css'
+/** Composer adapter for one pending tool-approval waterfall. */
+import type { ApprovalComposerProps } from './contract/slots.ts'
 
 /**
- * Render one pending approval and its optional Tool-owned detail.
- * @param props - selector-matched request and standard Slot props.
+ * Render the shared card using the tool approval's one-shot decision policy.
+ * @param props Selector-matched request and standard Slot props.
  * @returns The approval composer takeover.
  */
 export function ApprovalPanel(props: ApprovalComposerProps) {
   const approval = props.matched
-  const detail = approval.callId === undefined
-    ? null
-    : props.renderSlot('conversation.approval.detail', { callId: approval.callId })
   const reason = approval.displayReason === undefined ? approval.reason : props.resolveReason(approval.displayReason)
-  return <ApprovalFlow key={approval.key} pending={approval} reason={reason} detail={detail} t={props.t} />
-}
-
-function ApprovalFlow({ pending, reason, detail, t }: {
-  pending: PendingApproval
-  reason: string | undefined
-  detail: ReactNode
-  t: ApprovalComposerProps['t']
-}) {
-  const [answered, setAnswered] = useState(false)
-  const waiting = useRef(false)
-  const active = useRef(true)
-  const composing = useRef(false)
-  const compositionEnded = useRef(false)
-  useEffect(() => {
-    active.current = true
-    return () => { active.current = false }
-  }, [])
-  const answer = (outcome: 'allowed-once' | 'rejected'): void => {
-    if (waiting.current || !pending.answerable) return
-    waiting.current = true
-    setAnswered(true)
-    void pending.answer(outcome).catch(() => {
-      if (!active.current || !pending.answerable) return
-      waiting.current = false
-      setAnswered(false)
-    })
-  }
-  const keydown = (event: KeyboardEvent<HTMLDivElement>): void => {
-    const element = event.target as Element
-    if (event.defaultPrevented || !event.currentTarget.contains(document.activeElement)
-      || element.closest('input, textarea, select, [contenteditable="true"], [contenteditable=""]') !== null) return
-    if (event.key !== 'Enter' && event.key !== 'Escape') return
-    if (event.key === 'Enter' && element.closest('button, a[href], [role="button"]') !== null) return
-    if (event.ctrlKey || event.metaKey || event.altKey || event.shiftKey) return
-    event.preventDefault()
-    event.stopPropagation()
-    // oxlint-disable-next-line typescript/no-deprecated -- IME 229 covers engines without isComposing.
-    if (event.repeat || composing.current || compositionEnded.current || event.nativeEvent.isComposing || event.keyCode === 229) return
-    answer(event.key === 'Enter' ? 'allowed-once' : 'rejected')
-  }
-  return (
-    <div className={css.root} data-approval-key={pending.key} aria-busy={answered}
-      onKeyDown={keydown}
-      onKeyUpCapture={() => { compositionEnded.current = false }}
-      onCompositionStartCapture={() => { composing.current = true }}
-      onCompositionEndCapture={() => { composing.current = false; compositionEnded.current = true }}>
-      <div className={css.card}>
-        <div className={css.strip}><StateDot state={answered ? 'ongoing' : 'warning'} />{t('waiting')}</div>
-        <div
-          className={css.body}
-          data-approval-scroll=""
-          tabIndex={0}
-          role="group"
-          aria-label={t('detail.aria')}
-        >
-          <div className={css.headline}>{reason ?? t('escalation', { toolName: pending.toolName })}</div>
-          {detail !== null && <div className={css.command}>{detail}</div>}
-        </div>
-        <div className={css.actionRow}>
-          <Button variant="outline" className={css.reject} disabled={answered} onClick={() => { answer('rejected') }}>
-            {t('reject')}
-          </Button>
-          <Button variant="primary" disabled={answered} onClick={() => { answer('allowed-once') }}>
-            {t('allowOnce')}
-          </Button>
-        </div>
-      </div>
-    </div>
-  )
+  return props.renderFactorySlot('conversation.approval.card', {
+    requestKey: approval.key,
+    title: reason ?? props.t('escalation', { toolName: approval.toolName }),
+    ...(approval.callId === undefined ? {} : { callId: approval.callId }),
+    canAnswer: () => approval.answerable,
+    onAllow: () => approval.answer('allowed-once'),
+    onReject: () => approval.answer('rejected'),
+  })
 }
diff --git a/packages/client/ui-approval/src/client/contract/slots.ts b/packages/client/ui-approval/src/client/contract/slots.ts
index 2558b40ea4..e2b88d474b 100644
--- a/packages/client/ui-approval/src/client/contract/slots.ts
+++ b/packages/client/ui-approval/src/client/contract/slots.ts
@@ -2,7 +2,7 @@
 import type { ToolCallId } from '@deepseek-ai/dsh-llm'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import type {
-  PropsLocale, PropsRenderSlots, PropsRuntime,
+  PropsLocale, PropsRenderFactories, PropsRuntime,
 } from '@deepseek-ai/dsh-client-ui-slots'
 import type { ApprovalKey } from '../locales.ts'
 
@@ -32,6 +32,16 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
     approval: ApprovalKey
   }
 
+  interface SlotFactoryMap {
+    /** Shared decision card; the caller owns authorization and persistence. */
+    'conversation.approval.card': {
+      scope: 'session'
+      props: ApprovalCardInput
+      locale: 'approval'
+      children: { 'conversation.approval.detail': { kind: 'single'; scope: 'session' } }
+    }
+  }
+
   interface SlotMap {
     /** Optional detail for the Tool call correlated with an approval request. */
     'conversation.approval.detail': {
@@ -188,7 +198,31 @@ export interface ApprovalInjected {
 /** Full props of the approval composer takeover. */
 export type ApprovalComposerProps =
   PropsRuntime<'conversation.composer'>
-  & PropsRenderSlots<'conversation.approval.detail'>
+  & PropsRenderFactories
   & { matched: PendingApproval }
   & PropsLocale<'approval'>
   & ApprovalInjected
+
+/** Data and decisions accepted by the shared approval card. */
+export interface ApprovalCardInput {
+  /** Identity whose change resets the pending submission. */
+  requestKey: string
+  /** Localized question describing the requested operation. */
+  title: string
+  /** Localized scope or consequence of the decision. */
+  description?: string
+  /** Subject metadata for human recognition; never an authorization identity. */
+  subject?: { name: string; icon?: string }
+  /** Optional tool-owned detail rendered through the existing child slot. */
+  callId?: ToolCallId
+  /** Caller-specific scope label; ordinary approvals use Allow once. */
+  allowLabel?: string
+  /** Whether the caller still accepts an answer. */
+  canAnswer: () => boolean
+  /** Grant this request with the caller's stated scope. */
+  onAllow: () => Promise<void>
+  /** Refuse this request. */
+  onReject: () => Promise<void>
+  /** Explicit persistent choice; absent when the caller cannot save permission. */
+  onAlways?: () => Promise<void>
+}
diff --git a/packages/client/ui-approval/src/client/index.ts b/packages/client/ui-approval/src/client/index.ts
index ca6d674e36..fd0b04a599 100644
--- a/packages/client/ui-approval/src/client/index.ts
+++ b/packages/client/ui-approval/src/client/index.ts
@@ -8,11 +8,13 @@ import type { PendingInteractionPublisher } from '@deepseek-ai/dsh-client-ui-ses
 import type { TypertClientEventListener } from '@deepseek-ai/dsh-typert-protocol'
 import type {} from '@deepseek-ai/dsh-client-locale/client'
 import type { ShortcutCommandId } from '@deepseek-ai/dsh-client-shortcuts/client'
+import { ApprovalCard } from './ApprovalCard.tsx'
 import { ApprovalPanel } from './ApprovalPanel.tsx'
 import { PendingApproval } from './contract/slots.ts'
 import { en, zh } from './locales.ts'
 
 export type {
+  ApprovalCardInput,
   ApprovalComposerProps,
   ApprovalDecision,
   ApprovalDetailOwnerProps,
@@ -88,6 +90,10 @@ export function apply(ctx: ClientContext): void {
   const registerPendingInteraction = ctx.uiSession.registerPendingInteraction<PendingApproval>(
     () => 0,
   )
+  ctx.slots.registerFactory({
+    name: 'conversation.approval.card', scope: 'session', locale: NS,
+    children: { 'conversation.approval.detail': { kind: 'single', scope: 'session' } },
+  }, ApprovalCard)
   ctx.slots.inject('conversation.composer', () => ctx.slots.register({
     name: 'conversation.composer',
     priority: 1,
@@ -97,9 +103,6 @@ export function apply(ctx: ClientContext): void {
     inject: () => ({
       resolveReason: (reason: NonNullable<PendingApproval['displayReason']>) => ctx.locale.resolveText(reason),
     }),
-    children: {
-      'conversation.approval.detail': { kind: 'single', scope: 'session' },
-    },
   }, ApprovalPanel))
   ctx.remote.$on('approval/request', function (request, next) {
     return answerApproval(ctx, this, request, next, registerPendingInteraction)
diff --git a/packages/client/ui-approval/src/client/locales.ts b/packages/client/ui-approval/src/client/locales.ts
index e28f2ce74a..2a8aae7ec8 100644
--- a/packages/client/ui-approval/src/client/locales.ts
+++ b/packages/client/ui-approval/src/client/locales.ts
@@ -7,6 +7,7 @@ export const zh = {
   escalation: '工具 {toolName} 请求越权执行',
   reject: '拒绝',
   allowOnce: '允许一次',
+  allowAlways: '始终允许',
 } satisfies Record<string, string>
 
 /** Approval dictionary key union. */
@@ -19,4 +20,5 @@ export const en = {
   escalation: 'Tool {toolName} requests privileged execution',
   reject: 'Reject',
   allowOnce: 'Allow once',
+  allowAlways: 'Always allow',
 } satisfies Record<ApprovalKey, string>
diff --git a/packages/client/ui-approval/tests/ui-approval.client.spec.tsx b/packages/client/ui-approval/tests/ui-approval.client.spec.tsx
index e9edc316a5..753258b8f1 100644
--- a/packages/client/ui-approval/tests/ui-approval.client.spec.tsx
+++ b/packages/client/ui-approval/tests/ui-approval.client.spec.tsx
@@ -5,8 +5,10 @@ import type { ToolCallId } from '@deepseek-ai/dsh-llm'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, describe, expect, it, vi } from 'vitest'
+import { ApprovalCard } from '../src/client/ApprovalCard.tsx'
+import type { FactoryComponentPropsOf } from '@deepseek-ai/dsh-client-ui-slots'
 import { ApprovalPanel } from '../src/client/ApprovalPanel.tsx'
-import type { ApprovalComposerProps, ApprovalInjected } from '../src/client/contract/slots.ts'
+import type { ApprovalCardInput, ApprovalComposerProps, ApprovalInjected } from '../src/client/contract/slots.ts'
 import { PendingApproval } from '../src/client/contract/slots.ts'
 import { apply, inject } from '../src/client/index.ts'
 import { apply as nodeApply } from '../src/index.ts'
@@ -32,6 +34,7 @@ interface PluginBench {
   readonly disposeLocale: ReturnType<typeof vi.fn>
   readonly register: ReturnType<typeof vi.fn>
   readonly injectSlot: ReturnType<typeof vi.fn>
+  readonly shortcuts: ReturnType<typeof vi.fn<(entry: { label: () => string }) => () => void>>
   releasePending(): Promise<void>
   registration(): {
     options: {
@@ -82,8 +85,11 @@ async function setupPlugin(): Promise<PluginBench> {
   } as never)
   ctx.provide('sessions', { scopeOf } as never)
   ctx.provide('uiSession', { registerPendingInteraction } as never)
-  ctx.provide('slots', { inject: injectSlot, register } as never)
+  ctx.provide('slots', { inject: injectSlot, register, registerFactory: vi.fn() } as never)
+  const shortcuts = vi.fn((entry: { label: () => string }) => { entry.label(); return () => {} })
+  ctx.provide('shortcuts', { registerFixed: shortcuts } as never)
   ctx.provide('locale', {
+    bind: () => (key: string) => key,
     register: vi.fn(() => disposeLocale),
     resolveText: (reason: NonNullable<PendingApproval['displayReason']>) => reason.en,
   } as never)
@@ -100,6 +106,7 @@ async function setupPlugin(): Promise<PluginBench> {
     disposeLocale,
     register,
     injectSlot,
+    shortcuts,
     async releasePending() {
       const delegates = [...pending.values()]
       pending.clear()
@@ -211,6 +218,7 @@ describe('approval Remote Event consumer', () => {
     expect(next).toHaveBeenCalledOnce()
     expect(bench.pending.getSnapshot()).toEqual([])
     expect(bench.register).toHaveBeenCalledOnce()
+    expect(bench.shortcuts.mock.calls.map(([entry]) => entry.label())).toEqual(['allowOnce', 'reject'])
   })
 
   it('publishes one scoped takeover, returns the answer, and keeps stable registrations', async () => {
@@ -314,7 +322,7 @@ describe('approval Remote Event consumer', () => {
 
 function panelProps(
   pending: PendingApproval,
-  renderSlot: ApprovalComposerProps['renderSlot'] = vi.fn(() => null),
+  renderSlot: FactoryComponentPropsOf<'conversation.approval.card'>['renderSlot'] = vi.fn(() => null),
 ): ApprovalComposerProps {
   const messages: Record<string, string> = {
     waiting: 'Waiting',
@@ -322,10 +330,12 @@ function panelProps(
     escalation: `Tool ${pending.toolName} asks`,
     reject: 'Reject',
     allowOnce: 'Allow once',
+    allowAlways: 'Always allow',
   }
   return {
     matched: pending,
-    renderSlot,
+    renderFactorySlot: (_name: string, input: ApprovalCardInput) => <ApprovalCard {...{ ...input, renderSlot,
+      t: (key: string) => messages[key] ?? key } as FactoryComponentPropsOf<'conversation.approval.card'>} />,
     resolveReason: (reason: NonNullable<PendingApproval['displayReason']>) => reason.en,
     t: (key: string) => messages[key] ?? key,
   } as ApprovalComposerProps
@@ -340,7 +350,7 @@ describe('ApprovalPanel', () => {
     expect(screen.getByText('Tool bash asks')).toBeTruthy()
     expect(document.querySelector('[data-approval-key] [data-state="warning"]')).not.toBeNull()
     expect(screen.getByRole('group', { name: 'Approval details' })).toBeTruthy()
-    expect(props.renderSlot).not.toHaveBeenCalled()
+    expect(screen.queryByText('pnpm test')).toBeNull()
     fireEvent.click(screen.getByRole('button', { name: 'Reject' }))
 
     expect(document.querySelector('[data-approval-key]')?.getAttribute('aria-busy')).toBe('true')
@@ -503,3 +513,22 @@ describe('package entries', () => {
     expect(() => { nodeApply() }).not.toThrow()
   })
 })
+
+it.each(['allow', 'reject', 'always'] as const)('settles a fixed application decision through %s without free text', async (choice) => {
+  const onAllow = vi.fn(async () => {}), onReject = vi.fn(async () => {}), onAlways = vi.fn(async () => {})
+  const actions = { allow: onAllow, reject: onReject, always: onAlways }
+  render(<ApprovalCard {...{
+    requestKey: 'app-approval', title: 'Control this app?', description: 'Only for this task.',
+    subject: { name: 'Calculator', icon: 'data:image/png;base64,aWNvbg==' }, allowLabel: 'Allow for this task',
+    canAnswer: () => true, onAllow, onReject, onAlways, renderSlot: vi.fn(() => null),
+    t: (key: string) => ({ reject: 'Reject', allowAlways: 'Always allow' })[key] ?? key,
+  } as FactoryComponentPropsOf<'conversation.approval.card'>} />)
+  expect(screen.getByText('Calculator')).toBeTruthy()
+  expect(document.querySelector('img')?.getAttribute('src')).toBe('data:image/png;base64,aWNvbg==')
+  expect(screen.queryByRole('textbox')).toBeNull()
+  const label = { allow: 'Allow for this task', reject: 'Reject', always: 'Always allow' }[choice]
+  fireEvent.click(screen.getByRole('button', { name: label }))
+  fireEvent.click(screen.getByRole('button', { name: label }))
+  await waitFor(() => { expect(actions[choice]).toHaveBeenCalledOnce() })
+  expect(Object.values(actions).filter(action => action.mock.calls.length > 0)).toEqual([actions[choice]])
+})
diff --git a/packages/client/ui-user-questions/README.i18n.yaml b/packages/client/ui-user-questions/README.i18n.yaml
index 78ff5697f1..407fc475bd 100644
--- a/packages/client/ui-user-questions/README.i18n.yaml
+++ b/packages/client/ui-user-questions/README.i18n.yaml
@@ -12,8 +12,8 @@
   en: 1aa6291852d48a08
   zh: 414eed268fb2cf1f
 /deepseek-ai-dsh-client-ui-user-questions/table-of-contents:
-  en: d152484eb41ac6b4
-  zh: 09388d293f9be9cb
+  en: 9a599485cc9f47b9
+  zh: 17a17d7a943fb1b7
 /deepseek-ai-dsh-client-ui-user-questions/use-this-package:
   en: 8d3815c19858ac85
   zh: 94fc905fa202d334
diff --git a/packages/client/ui-user-questions/README.md b/packages/client/ui-user-questions/README.md
index d57e359de7..5603188fce 100644
--- a/packages/client/ui-user-questions/README.md
+++ b/packages/client/ui-user-questions/README.md
@@ -20,6 +20,8 @@ The Web client shows an agent's question beside the chat input. Users choose opt
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
+An `approval` intent reuses the shared approval card for fixed choices. It displays caller-supplied subject metadata and localized copy, with no text field or question pager; the existing question channel still delivers the selected label.
+
 -----
 
 <a id="use-this-package"></a>
diff --git a/packages/client/ui-user-questions/README.zh.md b/packages/client/ui-user-questions/README.zh.md
index 2145663976..959620b0b4 100644
--- a/packages/client/ui-user-questions/README.zh.md
+++ b/packages/client/ui-user-questions/README.zh.md
@@ -20,6 +20,8 @@ Web 客户端在聊天输入框旁显示 agent（智能体）的提问。用户
 - [已知限制与延期工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
+`approval` 意图复用共用审批卡片展示固定选项，显示调用方提供的对象信息和本地化文案，不提供文本输入或问题翻页，仍通过现有问答通道返回选中的标签。
+
 -----
 
 <a id="use-this-package"></a>
diff --git a/packages/client/ui-user-questions/package.json b/packages/client/ui-user-questions/package.json
index 19fd208e09..09eac415c4 100644
--- a/packages/client/ui-user-questions/package.json
+++ b/packages/client/ui-user-questions/package.json
@@ -35,7 +35,8 @@
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-renderer",
         "@deepseek-ai/dsh-client-ui-session",
-        "@deepseek-ai/dsh-client-ui-chat"
+        "@deepseek-ai/dsh-client-ui-chat",
+        "@deepseek-ai/dsh-client-ui-approval"
       ],
       "platform": "web"
     }
@@ -71,7 +72,8 @@
     "clsx": "^2.0.0",
     "@deepseek-ai/dsh-llm": "workspace:*",
     "@deepseek-ai/dsh-client-ui-chat": "workspace:*",
-    "@deepseek-ai/dsh-client-ui-tool": "workspace:*"
+    "@deepseek-ai/dsh-client-ui-tool": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-approval": "workspace:*"
   },
   "files": [
     "locale/*.json",
diff --git a/packages/client/ui-user-questions/src/client/QuestionApproval.tsx b/packages/client/ui-user-questions/src/client/QuestionApproval.tsx
new file mode 100644
index 0000000000..da255a8471
--- /dev/null
+++ b/packages/client/ui-user-questions/src/client/QuestionApproval.tsx
@@ -0,0 +1,31 @@
+/** Fixed-action question presentation using the shared approval card. */
+import type { AskUserQuestionItem, AskUserQuestionIntent } from '@deepseek-ai/dsh-user-questions/types'
+import type {} from '@deepseek-ai/dsh-client-ui-approval/client'
+import type { QuestionComposerProps } from './contract/slots.ts'
+
+/**
+ * Keep the question answer channel while rendering permission choices without a text field.
+ * @param props Blocking question, its approval presentation and renderer bindings.
+ * @returns The shared approval card with exactly the caller's offered actions.
+ */
+export function QuestionApproval(props: QuestionComposerProps & {
+  item: AskUserQuestionItem
+  intent: Extract<AskUserQuestionIntent, { kind: 'approval' }>
+}) {
+  const { matched: pending, item, intent, resolveText } = props
+  const always = intent.always
+  const answer = (label: string) => pending.answer({ answers: [{ id: item.id, selected: [label] }] })
+  return props.renderFactorySlot('conversation.approval.card', {
+    requestKey: pending.key,
+    title: intent.display === undefined ? item.question : resolveText(intent.display.question),
+    ...(item.detail === undefined ? {} : {
+      description: intent.display?.detail === undefined ? item.detail : resolveText(intent.display.detail),
+    }),
+    ...(intent.subject === undefined ? {} : { subject: intent.subject }),
+    allowLabel: intent.display?.approve === undefined ? intent.approve : resolveText(intent.display.approve),
+    canAnswer: () => pending.snapshot().channel !== 'none' && !pending.snapshot().closed,
+    onAllow: () => answer(intent.approve),
+    onReject: () => answer(intent.reject),
+    ...(always === undefined ? {} : { onAlways: () => answer(always) }),
+  })
+}
diff --git a/packages/client/ui-user-questions/src/client/QuestionComposer.tsx b/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
index 8d3ad551ba..906c92e726 100644
--- a/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
+++ b/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
@@ -11,6 +11,7 @@ import {
 import { planReviewOf, type QuestionAnswer, type QuestionCardSnapshot, type QuestionComposerProps } from './contract/slots.ts'
 import type { PendingQuestion } from './contract/slots.ts'
 import type { QuestionDraftAnswer, QuestionDraftProgress } from './draft-store.ts'
+import { QuestionApproval } from './QuestionApproval.tsx'
 import { PlanReviewPanel } from './PlanReviewPanel.tsx'
 import css from './QuestionComposer.module.css'
 
@@ -139,6 +140,8 @@ function AnswerField(props: AnswerFieldProps) {
 export function QuestionComposer(props: QuestionComposerProps) {
   const question = props.matched
   const review = useMemo(() => planReviewOf(question.questions), [question])
+  const item = question.questions[0]
+  if (item?.intent?.kind === 'approval') return <QuestionApproval {...props} item={item} intent={item.intent} />
   return review === undefined
     ? (
       <QuestionFlow
diff --git a/packages/client/ui-user-questions/src/client/contract/slots.ts b/packages/client/ui-user-questions/src/client/contract/slots.ts
index 4d1e9fd0e9..8d61f8c0e4 100644
--- a/packages/client/ui-user-questions/src/client/contract/slots.ts
+++ b/packages/client/ui-user-questions/src/client/contract/slots.ts
@@ -1,5 +1,5 @@
 /** Question composer props and one pending Remote waterfall response. */
-import type { InjectFace, PropsLocale, PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
+import type { InjectFace, PropsLocale, PropsRenderFactories, PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
 // The client module declares the conversation.composer SlotMap entry required by PropsRuntime.
 import type { ToolCallId } from '@deepseek-ai/dsh-llm/brand'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
@@ -569,6 +569,8 @@ export type QuestionComposerProps =
   PropsRuntime<'conversation.composer'>
   & PropsStore<ReturnType<typeof createQuestionDraftStore>>
   & PropsRenderSlots<'conversation.plan-review.actions'>
+  & PropsRenderFactories
+  & { resolveText: (text: { en: string; [locale: string]: string }) => string }
   & InjectFace<{ keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined } }>
   & { matched: QuestionWait }
   & PropsLocale<'question'>
diff --git a/packages/client/ui-user-questions/src/client/index.ts b/packages/client/ui-user-questions/src/client/index.ts
index 8ee3962c39..c7962a307e 100644
--- a/packages/client/ui-user-questions/src/client/index.ts
+++ b/packages/client/ui-user-questions/src/client/index.ts
@@ -15,6 +15,7 @@ import type { InboxWireState } from '@deepseek-ai/dsh-agent/types'
 import type {} from '@deepseek-ai/dsh-api-remotes/client'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import type {} from '@deepseek-ai/dsh-client-ui-chat/client'
+import type {} from '@deepseek-ai/dsh-client-ui-approval/client'
 import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type { PendingInteractionPublisher } from '@deepseek-ai/dsh-client-ui-session/client'
@@ -386,7 +387,9 @@ export function apply(ctx: ClientContext): void {
         pendingInteraction instanceof PendingQuestion ? pendingInteraction : null,
       locale: NS,
       store: questionDraftStore,
-      inject: () => ({ keyedHooks: { questionCard: (key: string) => cards.source(key) } }),
+      inject: () => ({ keyedHooks: { questionCard: (key: string) => cards.source(key) },
+        resolveText: (text: { en: string; [locale: string]: string }) => ctx.locale.resolveText(text),
+      }),
       children: { 'conversation.plan-review.actions': { kind: 'list', scope: 'session' } },
     },
     QuestionComposer,
diff --git a/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts b/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
index 84b5d04b21..2b0db5710e 100644
--- a/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
+++ b/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
@@ -370,7 +370,14 @@ describe('apply', () => {
     const store = entry.store as ReturnType<typeof createQuestionDraftStore>
     expect(store.create(SESSION_ID).getSnapshot()).toEqual({ progressByRequest: {} })
     const pending = b.pending.getSnapshot()[0]!
-    const face = (entry.inject as () => { keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined } })()
+    const face = (entry.inject as () => {
+      keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined }
+      resolveText: (text: { en: string; zh: string }) => string
+    })()
+    b.locale.setLocale('zh')
+    expect(face.resolveText({ en: 'Allow for this session', zh: '本会话允许' })).toBe('本会话允许')
+    b.locale.setLocale('en')
+    expect(face.resolveText({ en: 'Allow for this session', zh: '本会话允许' })).toBe('Allow for this session')
     expect(face.keyedHooks.questionCard(pending.key)).toBe(pending)
     expect(face.keyedHooks.questionCard('question:missing')).toBeUndefined()
     const select = entry.select as (
diff --git a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
index 2ed8e0c27a..dc4bd7eae1 100644
--- a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
@@ -114,6 +114,8 @@ const questionDraftStore = createQuestionDraftStore().create(SID)
 const kit: Omit<QuestionComposerProps, 'matched'> = {
   useQuestionCard: () => { throw new Error('plan review does not read question card state') },
   renderSlot: () => null,
+  renderFactorySlot: () => null,
+  resolveText: text => text.en,
   SessionProvider: ({ children }) => children,
   sessionId: SID,
   session: undefined,
diff --git a/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx b/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx
new file mode 100644
index 0000000000..0f9ba38744
--- /dev/null
+++ b/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx
@@ -0,0 +1,50 @@
+// @vitest-environment jsdom
+/** Fixed decisions retain the caller's answer labels and pending-question lifetime. */
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { SessionId } from '@deepseek-ai/dsh-session/types'
+import type { AskUserQuestionItem, AskUserQuestionIntent } from '@deepseek-ai/dsh-user-questions/types'
+import type { ApprovalCardInput } from '@deepseek-ai/dsh-client-ui-approval/client'
+import { PendingQuestion, createWaterfallRequest, type QuestionComposerProps } from '../src/client/contract/slots.ts'
+import { QuestionComposer } from '../src/client/QuestionComposer.tsx'
+
+afterEach(cleanup)
+
+it.each(['allow', 'reject', 'always'] as const)('returns the exact %s option from the shared card', async (choice) => {
+  const intent: Extract<AskUserQuestionIntent, { kind: 'approval' }> = {
+    kind: 'approval', approve: 'task-value', reject: 'deny-value', always: 'saved-value',
+    subject: { name: 'Calculator' }, display: { question: { en: 'Allow?', zh: '允许吗？' },
+      detail: { en: 'Scope', zh: '本次任务' }, approve: { en: 'Task', zh: '本次任务允许' } },
+  }
+  const item: AskUserQuestionItem = { id: 'access', question: 'English question', detail: 'English detail', intent }
+  const pending = new PendingQuestion('s1' as SessionId, [item])
+  const request = createWaterfallRequest(undefined, undefined, () => {})
+  pending.attachWaterfall(request.channel)
+  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
+  render(<QuestionComposer {...{ matched: pending, renderFactorySlot: factory,
+    resolveText: text => text.zh ?? text.en } as QuestionComposerProps} />)
+  const [name, card] = factory.mock.calls[0]!
+  expect(name).toBe('conversation.approval.card')
+  expect(card).toMatchObject({ title: '允许吗？', description: '本次任务', allowLabel: '本次任务允许', subject: { name: 'Calculator' } })
+  expect(card.canAnswer()).toBe(true)
+  await ({ allow: card.onAllow, reject: card.onReject, always: card.onAlways! })[choice]()
+  expect(await request.result).toEqual({ answers: [{ id: 'access', selected: [{ allow: 'task-value', reject: 'deny-value', always: 'saved-value' }[choice]] }] })
+  pending.close()
+  expect(card.canAnswer()).toBe(false)
+})
+
+it('keeps unsupported persistence absent and uses caller text when no localized metadata exists', () => {
+  const item: AskUserQuestionItem = { id: 'access', question: 'Allow?',
+    intent: { kind: 'approval', approve: 'Task', reject: 'Deny' } }
+  const pending = new PendingQuestion('s1' as SessionId, [item])
+  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
+  const props = { matched: pending, renderFactorySlot: factory, resolveText: text => text.en } as QuestionComposerProps
+  const view = render(<QuestionComposer {...props} />)
+  expect(factory.mock.calls[0]?.[1]).toMatchObject({ title: 'Allow?', allowLabel: 'Task' })
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('onAlways')
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('subject')
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('description')
+  expect(factory.mock.calls[0]?.[1].canAnswer()).toBe(false)
+  view.rerender(<QuestionComposer {...props} matched={new PendingQuestion('s1' as SessionId, [{ ...item, detail: 'Scope' }])} />)
+  expect(factory.mock.calls.at(-1)?.[1].description).toBe('Scope')
+})
diff --git a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
index 8ece0da777..a250f44481 100644
--- a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
@@ -113,6 +113,8 @@ const inputState: InputState = {
  *  plain stubs per the client testing discipline). */
 const kitBase: Omit<QuestionComposerProps, 'matched' | 'useStore' | 'useQuestionCard' | 'actions'> = {
   renderSlot: () => null,
+  renderFactorySlot: () => null,
+  resolveText: text => text.en,
   SessionProvider: ({ children }) => children,
   session: undefined,
   sessionId: SID,
diff --git a/packages/client/ui-user-questions/tsconfig.json b/packages/client/ui-user-questions/tsconfig.json
index 8368699f96..3a4bfbf9c4 100644
--- a/packages/client/ui-user-questions/tsconfig.json
+++ b/packages/client/ui-user-questions/tsconfig.json
@@ -58,6 +58,9 @@
     },
     {
       "path": "../../util/brand"
+    },
+    {
+      "path": "../ui-approval"
     }
   ]
 }
diff --git a/packages/interaction/user-questions/README.i18n.yaml b/packages/interaction/user-questions/README.i18n.yaml
index 7f8068bc63..5af5c57285 100644
--- a/packages/interaction/user-questions/README.i18n.yaml
+++ b/packages/interaction/user-questions/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 382a21c0ea17b2e4
   zh: 1a4335e571de92dd
 /deepseek-ai-dsh-user-questions/ask-a-question:
-  en: 0c45d3161b0df13a
-  zh: efff84a7917a799e
+  en: 2898b11dff62d4d9
+  zh: 09b6d9c75476a3a5
 /deepseek-ai-dsh-user-questions/role:
   en: 1a321b5a204dc4dd
   zh: 5e30055a3774e606
diff --git a/packages/interaction/user-questions/README.md b/packages/interaction/user-questions/README.md
index 3cdb0dd87c..d08f935fe7 100644
--- a/packages/interaction/user-questions/README.md
+++ b/packages/interaction/user-questions/README.md
@@ -28,7 +28,7 @@ Call `ask()` when work cannot continue without the answer. Call `askTimed()` whe
 
 For a single-select question, `custom` overrides the selected choice and `selected` is empty. For a multi-select question, `custom` may supplement the labels in `selected`. A UI may preserve a skipped item as `{ id, selected: [] }`, keeping the existing answer shape while retaining other answers in the batch.
 
-A question may carry a presentation `intent`, which declares that it IS a known kind of decision so a UI that recognises the tag may present it as such; the one tag is `plan-review`, whose `detail` is the plan under review and whose `approve` names the affirmative option. An intent changes presentation only: a UI honouring it answers with the same option labels a generic UI would send, and a UI that does not know the tag renders the generic option list. `ask()` rejects with `BAD_INTENT` the two assertions no type can carry: an `approve` naming none of that question's own options, and an intent on a question with no `detail`. `dsh-plan-mode` sets it on the `exit_plan_mode` review question.
+A question may carry a presentation `intent`. `plan-review` names the approve option and uses `detail` as the plan. `approval` presents one blocking question as fixed reject, allow and optional always-allow actions; it may include subject metadata and localized copy. Its action labels must be distinct and cover exactly the offered options, with no multi-select or timed wait. `ask()` rejects invalid intents with `BAD_INTENT`. Both presentations return the original option labels, and an older UI can render the same options generically. The caller continues to own authorization and persistence.
 
 When a request carries an agent, `ask()` authenticates its exact identity through the live `AgentRegistry` and admits only a runtime root. A live child cannot open a human interaction. An agentless programmatic request remains available to unscoped local waterfall listeners and fails with `NO_PROVIDER` when none accepts it.
 
diff --git a/packages/interaction/user-questions/README.zh.md b/packages/interaction/user-questions/README.zh.md
index cea78870d6..8d09fe2c48 100644
--- a/packages/interaction/user-questions/README.zh.md
+++ b/packages/interaction/user-questions/README.zh.md
@@ -28,7 +28,7 @@ kind: "package-reference"
 
 对于单选题，`custom` 会覆盖选中的选项，且 `selected` 为空。对于多选题，`custom` 可以补充 `selected` 中的标签。UI 可以把跳过的条目保留为 `{ id, selected: [] }`，既维持现有回答形态，也保留该批次中的其他回答。
 
-问题可以携带呈现意图 `intent`，声明它就是某种已知决策，识别该标记的 UI 可以按该决策呈现；目前唯一的标记是 `plan-review`，其 `detail` 是待审阅的计划，`approve` 指明表示同意的选项。意图只改变呈现：遵循它的 UI 回答的选项标签与通用 UI 相同，不认识该标记的 UI 则渲染通用选项列表。`ask()` 会以 `BAD_INTENT` 拒绝两种类型无法表达的断言：`approve` 未命名该问题自己的任何选项，以及没有 `detail` 的问题声明了意图。`dsh-plan-mode` 在 `exit_plan_mode` 的审阅问题上设置它。
+问题可以携带呈现意图 `intent`。`plan-review` 指定批准选项，并将 `detail` 作为待审阅计划。`approval` 将一个阻塞式问题显示为拒绝、允许和可选的始终允许操作，可附带对象信息和本地化文案。操作标签必须互不相同，并完整对应已提供的选项，不支持多选或计时等待。`ask()` 以 `BAD_INTENT` 拒绝无效意图。两种呈现都返回原始选项标签，旧界面仍可显示通用选项列表。授权与持久化仍由调用方负责。
 
 请求包含 agent 时，`ask()` 会通过当前 `AgentRegistry` 验证该 agent 与注册表中的存活实例是同一对象，并且只允许运行时根调用。存活子级不能发起人机交互。不含 agent 的程序化请求仍会交给本地未限定 scope 的 waterfall listener，若无人接受则以 `NO_PROVIDER` 失败。
 
diff --git a/packages/interaction/user-questions/src/index.ts b/packages/interaction/user-questions/src/index.ts
index 06cb67b8b6..f6ddfad702 100644
--- a/packages/interaction/user-questions/src/index.ts
+++ b/packages/interaction/user-questions/src/index.ts
@@ -293,26 +293,22 @@ export class UserQuestionService extends TypertRemoteService {
     }
     const agent = request.agent
     if (agent !== undefined) this.assertLiveRoot(agent)
-    // A presentation intent asserts two things the types cannot: that the
-    // named approve label is one of this question's own options, and that a
-    // plan-review carries the plan it is a review of. A UI honouring the
-    // intent answers with that label, and shows that detail as the plan, so
-    // either gap would put a choice the asker never offered — or an approval of
-    // something invisible — in front of the user. Caught at the asker, where
-    // the mistake is, rather than in each UI.
     for (const question of request.questions) {
       const intent = question.intent
       if (intent === undefined) continue
-      if (!(question.options ?? []).some(option => option.label === intent.approve)) {
-        throw new UserQuestionError(
-          `question ${question.id} declares intent ${intent.kind} whose approve label `
-          + `${JSON.stringify(intent.approve)} names none of its options`,
-          'BAD_INTENT')
+      const labels = intent.kind === 'approval'
+        ? [intent.approve, intent.reject, ...intent.always === undefined ? [] : [intent.always]]
+        : [intent.approve]
+      const options = question.options ?? []
+      if (labels.some(label => !options.some(option => option.label === label))) {
+        throw new UserQuestionError(`question ${question.id} declares intent ${intent.kind} with an unoffered action`, 'BAD_INTENT')
       }
       if (question.detail === undefined) {
-        throw new UserQuestionError(
-          `question ${question.id} declares intent ${intent.kind} without the detail it reviews`,
-          'BAD_INTENT')
+        throw new UserQuestionError(`question ${question.id} declares intent ${intent.kind} without the detail it reviews`, 'BAD_INTENT')
+      }
+      if (intent.kind === 'approval' && (request.questions.length !== 1 || question.multiSelect === true
+        || request.wait !== undefined || new Set(labels).size !== labels.length || options.length !== labels.length)) {
+        throw new UserQuestionError('approval presentation requires one blocking question with distinct fixed actions', 'BAD_INTENT')
       }
     }
     const noAnswerer = () => Promise.reject(new UserQuestionError(
diff --git a/packages/interaction/user-questions/src/types.ts b/packages/interaction/user-questions/src/types.ts
index 8cccf99c3c..b90dc8d70a 100644
--- a/packages/interaction/user-questions/src/types.ts
+++ b/packages/interaction/user-questions/src/types.ts
@@ -32,6 +32,23 @@ export type AskUserQuestionIntent = {
   approve: string
   /** Logged tool invocation whose arguments contain the reviewed plan. */
   callId?: ToolCallId
+} | {
+  /** A blocking permission decision with fixed actions and no free-text answer. */
+  kind: 'approval'
+  /** Option label granting the scope described by the caller. */
+  approve: string
+  /** Option label refusing the requested access. */
+  reject: string
+  /** Optional persistent grant offered only when the caller supports it. */
+  always?: string
+  /** Metadata for human recognition, independent of the caller's authorization identity. */
+  subject?: { name: string; icon?: string }
+  /** Localized presentation; option labels remain the wire answer values. */
+  display?: {
+    question: { en: string; [locale: string]: string }
+    detail?: { en: string; [locale: string]: string }
+    approve?: { en: string; [locale: string]: string }
+  }
 }
 
 /** One question in a user-questions request. */
diff --git a/packages/interaction/user-questions/tests/user-questions.spec.ts b/packages/interaction/user-questions/tests/user-questions.spec.ts
index f0f744259a..abb58cfabc 100644
--- a/packages/interaction/user-questions/tests/user-questions.spec.ts
+++ b/packages/interaction/user-questions/tests/user-questions.spec.ts
@@ -901,3 +901,34 @@ describe('late replies', () => {
     await ctx.fiber.dispose()
   })
 })
+
+describe('fixed approval presentation', () => {
+  const question = { id: 'access', question: 'Allow access?', detail: 'Scope of access',
+    options: [{ label: 'Task' }, { label: 'Deny' }, { label: 'Always' }],
+    intent: { kind: 'approval' as const, approve: 'Task', reject: 'Deny', always: 'Always' } }
+  it('preserves the explicit choices for an independent caller policy', async () => {
+    const ctx = new Context()
+    onTestFinished(() => ctx.fiber.dispose())
+    await ctx.plugin(UserQuestionService)
+    const p = provider('Always')
+    registerAnswerer(ctx, p)
+    expect(await ctx.userQuestions.ask({ questions: [question] })).toEqual({ answers: [{ id: 'access', selected: ['Always'] }] })
+    expect(p.seen[0]?.questions[0]?.intent).toEqual(question.intent)
+  })
+  it.each(['unoffered', 'duplicate', 'extra', 'multiple', 'multiselect', 'timed'] as const)('rejects %s approval actions before display', async (kind) => {
+    const ctx = new Context()
+    onTestFinished(() => ctx.fiber.dispose())
+    await ctx.plugin(UserQuestionService)
+    const p = provider()
+    registerAnswerer(ctx, p)
+    const item = structuredClone(question)
+    if (kind === 'unoffered') item.intent.approve = 'Unknown'
+    if (kind === 'duplicate') item.intent.always = 'Task'
+    if (kind === 'extra') item.options.push({ label: 'Something else' })
+    const questions = kind === 'multiple' ? [item, { ...item, id: 'other' }] : [{ ...item, multiSelect: kind === 'multiselect' }]
+    await expect(ctx.userQuestions.ask({ questions,
+      ...(kind === 'timed' ? { wait: { callId: ToolCallId('call') } } : {}),
+    })).rejects.toMatchObject({ code: 'BAD_INTENT' })
+    expect(p.seen).toEqual([])
+  })
+})

From 9802933c048076b03b281a3205232bb7a654b247 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 05/44] feat(cua): manage application grants and PTC session
 scopes

---
 packages/experimental/cua/README.i18n.yaml    |  12 +-
 packages/experimental/cua/README.md           |   6 +-
 packages/experimental/cua/README.zh.md        |   6 +-
 packages/experimental/cua/package.json        |  32 +-
 packages/experimental/cua/src/access-types.ts |  30 ++
 packages/experimental/cua/src/access.ts       | 142 ++++++
 .../cua/src/application-access.ts             | 143 ++++--
 packages/experimental/cua/src/index.ts        |  72 ++-
 packages/experimental/cua/src/protocol.ts     |  12 +-
 packages/experimental/cua/src/types.ts        |   1 +
 .../experimental/cua/tests/access.spec.ts     | 410 ++++++++++++++++++
 .../cua/tests/agent-scopes.spec.ts            |  95 ++++
 .../cua/tests/application-access.spec.ts      |  77 +++-
 packages/experimental/cua/tsconfig.json       |   9 +
 packages/experimental/cua/tsdown.config.ts    |   2 +-
 15 files changed, 979 insertions(+), 70 deletions(-)
 create mode 100644 packages/experimental/cua/src/access-types.ts
 create mode 100644 packages/experimental/cua/src/access.ts
 create mode 100644 packages/experimental/cua/tests/access.spec.ts
 create mode 100644 packages/experimental/cua/tests/agent-scopes.spec.ts

diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index a99f1eaf24..0f7b734afc 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -12,14 +12,14 @@
   en: f4d9cc48587d62a2
   zh: d1bac6c1fe7eb29e
 /deepseek-ai-dsh-cua/table-of-contents:
-  en: d152484eb41ac6b4
-  zh: 1db86285abf6c499
+  en: 400de8528e57cf00
+  zh: 1eb88c23eb4b511f
 /deepseek-ai-dsh-cua/use-this-package:
-  en: 52cacbe2d2aeb2bc
-  zh: b3c65814d9a17052
+  en: e230429b9e15efd8
+  zh: 10dcb9ba5194dc76
 /deepseek-ai-dsh-cua/understand-the-implementation:
-  en: effcee57d8854c32
-  zh: d02c6b76e7249051
+  en: 751fe580f79dfaae
+  zh: 3811db65f634ef5a
 /deepseek-ai-dsh-cua/further-exploration:
   en: b8b0aece886fadaa
   zh: ecd8c88d601f2179
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index dcd8dc186d..1aa09c4763 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -20,6 +20,8 @@ Inspect applications, retain window objects across PTC calls, and send actions t
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
+Application consent uses the fixed approval presentation of User Questions and remains independent of the session tool-approval policy. Native icons accompany the prompt and permission-page observations, but remain outside saved identities and model results. System checks, saved grants and refusals, and icons use separate queries so each result can appear without waiting for the others.
+
 -----
 
 <a id="use-this-package"></a>
@@ -33,7 +35,7 @@ Observation methods emit and return their result. Use `void await app.getAXState
 
 `tools.cua` returns operation values directly. Screenshot values retain the encoded image Base64 and add a durable `attachment` reference for the tool renderer; model content contains coordinate metadata and one image, without the encoded bytes. Before capture, the tool requires an attachment store and a resolved model route declaring image input. Admission and storage failures reject the call. The object bridge preserves the screenshot bytes and validated metadata without uploading or emitting the same image again.
 
-Application consent precedes launch, observation, capture, and input. Task access belongs to the selected instance; saved grants require platform-verified executable identity. Revocation closes affected Agent connections, so their old objects require fresh selection. No input is replayed after cancellation, timeout, or reconnect.
+Application consent precedes launch, observation, capture, and input. Session access is kept in memory by session and application identity, survives agent and helper replacement, and expires when DSH restarts or Computer Use is disabled. Saved grants require platform-verified executable identity. Refusal and revocation close affected Agent connections, so their old objects require fresh selection. No input is replayed after cancellation, timeout, or reconnect.
 
 Actions return `dispatched:true, verified:false`; read fresh state to verify the result. Coordinate actions default to pixels in the latest returned screenshot; `relative: true` accepts integers from 0 to 1000 after a successful window observation. The Host resolves attachment normalization and the selected model route’s image projection before returning the screenshot, then converts input to native window points. Resizing invalidates the screenshot mapping; `SCREENSHOT_REQUIRED` requires a new screenshot for absolute coordinates. Resizing rejects old coordinates with `WINDOW_CHANGED`; movement alone preserves window-local coordinates.
 
@@ -47,6 +49,8 @@ Actions return `dispatched:true, verified:false`; read fresh state to verify the
 
 The provider calls [installCua](src/index.ts) with its prepared helper, connection factory, and guidance. [NativeClient](src/native-client.ts) owns request correlation, byte limits, cancellation acknowledgement, and failure settlement. The platform connector owns startup and connection cleanup. The shared executor retains one connection per Agent and joins in-flight image writes during disposal.
 
+`agentPreset` defaults to `ptc`, restricting tools and guidance to Agents bound to that preset. The provider uses the existing `agent/created` and `agent-preset/selected` events and Agent-owned scopes, including Agents already present when it loads. Provider unload and Agent disposal release those registrations. Set `agentPreset: false` for global registration in standalone compositions without presets. The Host continues to own permissions, native connections and cancellation; preset definitions remain unchanged.
+
 [The operation schema](src/protocol.ts) is the authority for model parameters and separately declared Host-only fields. Native implementations enforce target identity, window geometry, resource limits, and operating-system access at execution. No invariant companion is published because this library has no separately projected registry or durable state.
 
 </details>
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index a526735ec5..104937e0b9 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -20,6 +20,8 @@ kind: "package-library"
 - [已知限制与后续工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
+应用授权使用 User Questions 的固定审批呈现，仍独立于会话的工具审批策略。本机图标用于授权提示和权限页展示，不进入保存的身份信息或模型结果。系统权限、持久授权与拒绝记录、图标分别查询，各项结果返回后即可显示。
+
 -----
 
 <a id="use-this-package"></a>
@@ -33,7 +35,7 @@ kind: "package-library"
 
 `tools.cua` 直接返回操作结果。截图结果保留图片 Base64，并增加供工具渲染使用的持久 `attachment` 引用；模型内容只包含坐标元数据和一张图片，不包含编码字节。截图前要求附件服务可用，并确认当前模型支持图片输入。图片接入或保存失败会拒绝调用。对象桥接保留截图字节和已校验的元数据，不重复上传或输出同一张图片。
 
-应用授权发生在启动、观察、截图和输入之前。任务许可绑定已选择的应用实例；长期许可要求平台验证可执行文件身份。撤销会关闭受影响的 Agent 连接，因此旧对象必须重新选择目标。取消、超时或重新连接后均不重放输入。
+应用授权发生在启动、观察、截图和输入之前。会话许可按会话和应用身份保存在内存中，Agent 或 helper 重建后仍可复用，重启 DSH 或关闭 Computer Use 后失效。长期许可要求平台验证可执行文件身份。拒绝或撤销会关闭受影响的 Agent 连接，因此旧对象必须重新选择目标。取消、超时或重新连接后均不重放输入。
 
 动作返回 `dispatched:true, verified:false`；请读取新状态以验证结果。坐标操作默认使用最近返回截图中的像素；成功观察窗口后，传入 `relative: true` 可使用 0～1000 的整数比例。Host 在返回截图前解析附件归一化和当前模型的图片缩放规则，再将输入换算为原生窗口 point。窗口尺寸变化会使截图映射失效，绝对坐标遇到 `SCREENSHOT_REQUIRED` 时需要重新截图。窗口缩放后以 `WINDOW_CHANGED` 拒绝旧坐标；单纯移动窗口不改变窗口内坐标。
 
@@ -47,6 +49,8 @@ kind: "package-library"
 
 提供方将准备好的 helper、连接工厂和指引传给 [installCua](src/index.ts)。[NativeClient](src/native-client.ts) 负责请求关联、字节上限、取消确认和失败处理。平台连接器负责启动和连接清理。共享执行器为每个 Agent 保留一个连接，并在销毁时等待进行中的图像写入。
 
+`agentPreset` 默认为 `ptc`，将工具和指引限制到绑定该 preset 的 Agent。提供方使用现有 `agent/created`、`agent-preset/selected` 事件及 Agent 拥有的作用域，也处理启用前已存在的 Agent。提供方卸载和 Agent 销毁都会释放这些注册。不使用 preset 的独立组合可设置 `agentPreset: false` 来全局注册。Host 仍拥有权限、本机连接和取消操作，preset 定义保持不变。
+
 [操作 schema](src/protocol.ts) 定义模型参数，并单独声明 Host 专用字段。原生实现在执行时检查目标身份、窗口几何、资源上限和操作系统访问条件。本库没有独立投影的注册表或持久状态，因此不发布 invariant 模块。
 
 </details>
diff --git a/packages/experimental/cua/package.json b/packages/experimental/cua/package.json
index a1fb346e0a..a28b368b46 100644
--- a/packages/experimental/cua/package.json
+++ b/packages/experimental/cua/package.json
@@ -28,6 +28,18 @@
       "types": "./lib/types/bridge.d.ts",
       "default": "./lib/bridge.js"
     },
+    "./typert": {
+      "types": "./lib/typert.host.d.ts",
+      "default": "./lib/typert.host.js"
+    },
+    "./remote": {
+      "types": "./lib/typert.remote-client.d.ts",
+      "default": "./lib/typert.remote-client.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types.js"
+    },
     "./native-client": {
       "types": "./lib/types/native-client.d.ts",
       "default": "./lib/native-client.js"
@@ -39,11 +51,16 @@
   },
   "files": [
     "lib/index.js",
+    "lib/types.js",
     "lib/api.js",
     "lib/bridge.js",
     "lib/native-client.js",
     "lib/protocol.js",
-    "lib/types/**/*.d.ts"
+    "lib/types/**/*.d.ts",
+    "lib/typert.host.js",
+    "lib/typert.host.d.ts",
+    "lib/typert.remote-client.js",
+    "lib/typert.remote-client.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
@@ -55,14 +72,17 @@
     "@deepseek-ai/dsh-subprocess": "workspace:*",
     "@deepseek-ai/dsh-user-questions": "workspace:*",
     "@deepseek-ai/dsh-attachment": "workspace:*",
-    "@deepseek-ai/dsh-llm": "workspace:*"
+    "@deepseek-ai/dsh-llm": "workspace:*",
+    "@deepseek-ai/dsh-scope": "workspace:*",
+    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*"
   },
   "dependencies": {
     "@deepseek-ai/dsh-util-values": "workspace:*",
     "@deepseek-ai/schemastery": "workspace:~",
     "zod": "^4.4.3",
     "@deepseek-ai/dsh-brand": "workspace:*",
-    "@deepseek-ai/dsh-atomic-write": "workspace:*"
+    "@deepseek-ai/dsh-atomic-write": "workspace:*",
+    "@deepseek-ai/dsh-typert-protocol": "workspace:*"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-working-directory": "workspace:*",
@@ -89,11 +109,13 @@
     "@deepseek-ai/dsh-sandbox-policy": "workspace:*",
     "sharp": "^0.35.3",
     "@deepseek-ai/dsh-ptc-runtime": "workspace:*",
-    "@deepseek-ai/dsh-user-questions": "workspace:*",
     "@deepseek-ai/dsh-settings": "workspace:*",
+    "@deepseek-ai/dsh-user-questions": "workspace:*",
     "@deepseek-ai/dsh-app-boot": "workspace:*",
     "@deepseek-ai/dsh-config-editor": "workspace:*",
     "@deepseek-ai/dsh-hmr": "workspace:*",
-    "@deepseek-ai/cordis-plugin-timer": "workspace:~"
+    "@deepseek-ai/cordis-plugin-timer": "workspace:~",
+    "@deepseek-ai/dsh-scope": "workspace:*",
+    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*"
   }
 }
diff --git a/packages/experimental/cua/src/access-types.ts b/packages/experimental/cua/src/access-types.ts
new file mode 100644
index 0000000000..1124ff5023
--- /dev/null
+++ b/packages/experimental/cua/src/access-types.ts
@@ -0,0 +1,30 @@
+/** Client-safe Computer Use permission observations and saved application decisions. */
+import type { CuaApplicationGrant } from './application-types.ts'
+export type { CuaApplicationGrant, CuaApplicationId } from './application-types.ts'
+
+/** macOS privileges used by the native provider. */
+export type CuaSystemPermission = 'accessibility' | 'screenRecording'
+/** Observed process; neither the helper nor its parent is assumed to be the TCC owner. */
+export interface CuaPermissionProcess {
+  pid: number
+  path?: string | undefined
+  name?: string | undefined
+}
+/** Fresh permission observations and startup metadata from the shared native helper. */
+export interface CuaSystemPermissionState {
+  accessibility: boolean
+  screenRecording: boolean
+  helper: CuaPermissionProcess
+  parent: CuaPermissionProcess
+  /** Application macOS reports as responsible for the helper, captured at startup; absent when it cannot be identified. */
+  launchApplication?: { name: string; path: string; icon?: string | undefined } | undefined
+}
+/** Saved grants and refused applications, independent of native permission checks and icons. */
+export interface CuaApplicationState {
+  /** Owning configuration entry for permission updates; null when this composition has no Loader entry. */
+  settingsNamespace: string | null
+  allowedApps: readonly CuaApplicationGrant[]
+  /** Refusals from any session, excluding saved grants; other sessions may still hold session access. */
+  blockedApps: readonly CuaApplicationGrant[]
+  persistentAvailable: boolean
+}
diff --git a/packages/experimental/cua/src/access.ts b/packages/experimental/cua/src/access.ts
new file mode 100644
index 0000000000..2553286a8b
--- /dev/null
+++ b/packages/experimental/cua/src/access.ts
@@ -0,0 +1,142 @@
+/** Browser controls for the provider's application decisions and native permission work. */
+import type { Context } from '@deepseek-ai/cordis'
+import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
+import { ApplicationAccess, type AccessOptions } from './application-access.ts'
+import type { JsonValue } from '@deepseek-ai/dsh-util-values'
+import { z } from 'zod'
+import { ApplicationIcon } from './protocol.ts'
+import { NativeClient, type NativeClientConfig, type NativeChannelFactory } from './native-client.ts'
+import type { CuaApplicationId, CuaApplicationState, CuaSystemPermission, CuaSystemPermissionState } from './access-types.ts'
+export { ApplicationAuthorizationResult } from './application-access.ts'
+export type * from './access-types.ts'
+
+interface ControlOptions extends AccessOptions {
+  native: NativeClientConfig
+  createChannel: NativeChannelFactory
+  settingsNamespace: string | null
+}
+type Control = (method: string, params: Record<string, JsonValue>) => Promise<JsonValue>
+const permissionProcess = z.object({ pid: z.number().int().positive(), path: z.string().optional(), name: z.string().optional() })
+const systemPermissions = z.object({
+  accessibility: z.boolean(), screenRecording: z.boolean(), helper: permissionProcess, parent: permissionProcess,
+  launchApplication: z.object({ name: z.string().min(1), path: z.string().min(1), icon: ApplicationIcon.optional() }).optional(),
+})
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    /** Native permission controls and executor-owned application consent. */
+    cuaAccess: CuaAccess
+  }
+}
+
+/** Browser controls for provider-owned native permission and application decisions. */
+export class CuaAccess extends TypertRemoteService {
+  /**
+   * @param ctx Provider context.
+   * @param policy Application decision owner.
+   * @param settingsNamespace Owning configuration entry.
+   * @param control Serialized native permission dispatch.
+   */
+  constructor(ctx: Context, private readonly policy: ApplicationAccess,
+    private readonly settingsNamespace: string | null, private readonly control: Control) { super(ctx, 'cuaAccess') }
+
+  /**
+   * Read application decisions without waiting for the native helper.
+   * @returns Saved grants and refused applications with their persistence owner.
+   */
+  @Remote
+  applications(): CuaApplicationState {
+    return { settingsNamespace: this.settingsNamespace, ...this.policy.status() }
+  }
+
+  /**
+   * Inspect system privileges independently of application decisions and icons.
+   * @returns Fresh native preflight and launch metadata.
+   */
+  @Remote
+  async systemStatus(): Promise<CuaSystemPermissionState> {
+    return systemPermissions.parse(await this.control('permissionStatus', {}))
+  }
+
+  /**
+   * Load presentation icons separately from application decisions.
+   * @returns Optional native PNG icons keyed by executable path for saved and blocked applications.
+   */
+  @Remote
+  async applicationIcons(): Promise<Record<string, string>> {
+    const state = this.policy.status()
+    const paths = [...new Set([...state.allowedApps, ...state.blockedApps].map(app => app.executablePath))]
+    return paths.length === 0 ? {} : z.record(z.string(), ApplicationIcon).parse(await this.control('applicationIcons', { paths }))
+  }
+
+  /**
+   * Request a system privilege explicitly selected by the user.
+   * @param permission macOS privilege to request.
+   * @returns Preflight state after requesting; a false value never implies consent.
+   */
+  @Remote
+  async requestPermission(permission: CuaSystemPermission): Promise<CuaSystemPermissionState> {
+    return systemPermissions.parse(await this.control('requestPermission', { permission }))
+  }
+
+  /**
+   * Open the macOS privacy pane selected by the user.
+   * @param permission Corresponding system privilege.
+   * @returns Completion after macOS accepted the open request.
+   */
+  @Remote
+  async openSettings(permission: CuaSystemPermission): Promise<void> {
+    z.object({ opened: z.literal(true) }).parse(await this.control('openPermissionSettings', { permission }))
+  }
+
+  /**
+   * Remove saved and session access and join affected operations.
+   * @param id Application identity displayed on the permission page.
+   * @returns Completion after persistence and cancellation; dispatched input cannot be undone.
+   */
+  @Remote
+  revoke(id: CuaApplicationId): Promise<void> { return this.policy.revoke(id) }
+
+  /**
+   * Clear this application's refusals across sessions so each session may ask for access again.
+   * @param id Refused or revoked application displayed on the permission page.
+   * @returns Completion after clearing refusals; no permission is granted and no action is replayed.
+   */
+  /* oxlint-disable typescript/require-await -- Remote callers receive policy failures as rejected promises. */
+  @Remote
+  async retryApproval(id: CuaApplicationId): Promise<void> { this.policy.retryApproval(id) }
+  /* oxlint-enable typescript/require-await */
+}
+
+/**
+ * Install human-facing controls while keeping executor capabilities private to the provider.
+ * @param ctx Provider context that owns decisions and operation lifetimes.
+ * @param options Native transport and profile persistence.
+ * @returns Consent selection, guarded dispatch, and task cleanup capabilities.
+ */
+export function installCuaAccess(ctx: Context, options: ControlOptions): Pick<ApplicationAccess, 'select' | 'run' | 'forget' | 'dispose'> {
+  const policy = new ApplicationAccess(ctx, options)
+  const lifetime = new AbortController()
+  let client: NativeClient | undefined
+  let tail: Promise<unknown> = Promise.resolve()
+  const control: Control = (method, params) => {
+    lifetime.signal.throwIfAborted()
+    const perform = async () => {
+      lifetime.signal.throwIfAborted()
+      if (client?.disposed) await client.dispose()
+      lifetime.signal.throwIfAborted()
+      if (!client || client.disposed) client = new NativeClient(ctx, options.native, options.createChannel)
+      return client.request(method, params, lifetime.signal)
+    }
+    const operation = tail.then(perform, perform)
+    tail = operation
+    return operation
+  }
+  const dispose = ctx.effect(() => async () => {
+    lifetime.abort()
+    await Promise.allSettled([policy.dispose(), tail])
+    await client?.dispose()
+  }, 'cua-access.dispose')
+  new CuaAccess(ctx, policy, options.settingsNamespace, control)
+  return { select: policy.select.bind(policy), run: policy.run.bind(policy), forget: policy.forget.bind(policy), dispose }
+}
diff --git a/packages/experimental/cua/src/application-access.ts b/packages/experimental/cua/src/application-access.ts
index 1412e0cc99..df75ceabd1 100644
--- a/packages/experimental/cua/src/application-access.ts
+++ b/packages/experimental/cua/src/application-access.ts
@@ -6,6 +6,7 @@ import { z } from 'zod'
 import { NativeError, type NativeClient } from './native-client.ts'
 import type { CuaAppHandle } from './types.ts'
 import type { CuaApplicationGrant, CuaApplicationId } from './application-types.ts'
+import type { CuaApplicationState } from './access-types.ts'
 
 /** Native identity admission occurs before any application observation or input. */
 export const ApplicationAuthorizationResult = z.object({
@@ -15,11 +16,12 @@ export const ApplicationAuthorizationResult = z.object({
 /** Current saved grants and their optional profile writer. */
 export interface AccessOptions {
   grants: () => readonly CuaApplicationGrant[]
-  save?: ((grants: readonly CuaApplicationGrant[]) => Promise<void>) | undefined
+  /** Cancel queued persistence on provider shutdown; admitted writes must settle before returning. */
+  save?: ((grants: readonly CuaApplicationGrant[], signal: AbortSignal) => Promise<void>) | undefined
 }
 interface Selection {
   identity: CuaApplicationGrant
-  scope: 'task' | 'persistent'
+  scope: 'session' | 'persistent'
   lifetime: AbortController
 }
 interface ClientSelections {
@@ -37,9 +39,9 @@ interface ActiveOperation {
 /** Owns application consent and cancels operations when saved access is removed. */
 export class ApplicationAccess {
   private readonly clients = new Map<NativeClient, ClientSelections>()
-  private readonly rejected = new Map<Agent, Map<CuaApplicationId, CuaApplicationGrant>>()
+  private readonly decisions = new Map<Agent['id'], Map<CuaApplicationId, { identity: CuaApplicationGrant; allowed: boolean }>>()
   private readonly active = new Set<ActiveOperation>()
-  private readonly selections = new WeakMap<Agent, Map<CuaApplicationId, Promise<void>>>()
+  private readonly selections = new Map<Agent['id'], Map<CuaApplicationId, Promise<void>>>()
   private readonly lifetime = new AbortController()
   private mutationTail: Promise<unknown> = Promise.resolve()
   private disposal: Promise<void> | undefined
@@ -59,39 +61,106 @@ export class ApplicationAccess {
       this.lifetime.abort()
       await Promise.allSettled([this.mutationTail, ...[...this.active].map(operation => operation.done.promise)])
       this.clients.clear()
-      this.rejected.clear()
+      this.decisions.clear()
     })()
   }
 
+  /**
+   * Project application decisions without requesting native permissions.
+   * @returns Current saved grants and refused applications for the permission page.
+   */
+  status(): Omit<CuaApplicationState, 'settingsNamespace'> {
+    const allowedApps = [...this.options.grants()]
+    const blockedApps = new Map<CuaApplicationId, CuaApplicationGrant>()
+    for (const decisions of this.decisions.values()) for (const [id, decision] of decisions) {
+      if (decision.allowed || allowedApps.some(grant => grant.id === id)) continue
+      blockedApps.set(id, decision.identity)
+    }
+    return { allowedApps,
+      blockedApps: [...blockedApps.values()], persistentAvailable: this.options.save !== undefined }
+  }
+
+  /**
+   * Remove saved and session consent and cancel affected native operations.
+   * @param id Application identity shown in the permission page.
+   * @returns Completion after persistence and affected operations settle; already dispatched input cannot be undone.
+   */
+  async revoke(id: CuaApplicationId): Promise<void> {
+    this.lifetime.signal.throwIfAborted()
+    let clients: readonly NativeClient[] = []
+    await this.mutate(async () => {
+      const grants = this.options.grants()
+      if (grants.some(grant => grant.id === id)) {
+        const save = this.options.save
+        if (!save) throw new Error('Application permissions cannot be saved in this composition')
+        await save(grants.filter(grant => grant.id !== id), this.lifetime.signal)
+      }
+      clients = this.invalidate(id)
+    })
+    const results = await Promise.allSettled([
+      ...clients.map(client => client.dispose()),
+      ...[...this.active].filter(operation => operation.identity.id === id).map(operation => operation.done.promise),
+    ])
+    const errors: unknown[] = []
+    for (const result of results) if (result.status === 'rejected') errors.push(result.reason)
+    if (errors.length) throw new AggregateError(errors, 'Application access was revoked, but helper cleanup failed')
+  }
+
+  /**
+   * Clear explicit refusal; the next getApp still requires a new user decision.
+   * @param id Application identity selected by the human.
+   */
+  retryApproval(id: CuaApplicationId): void {
+    this.lifetime.signal.throwIfAborted()
+    for (const decisions of this.decisions.values()) if (decisions.get(id)?.allowed === false) decisions.delete(id)
+    for (const state of this.clients.values()) for (const [handle, selected] of state.handles) {
+      if (selected.identity.id === id && selected.lifetime.signal.aborted) state.handles.delete(handle)
+    }
+  }
+
   /**
    * Obtain consent for a freshly selected native handle. Free text never grants access.
-   * @param agent Exact live task requesting access.
+   * @param agent Live agent whose session owns the decision.
    * @param client Helper that issued the handle.
    * @param handle Helper handle for a running instance or an approved pending launch.
    * @param identity Native executable/signing identity.
    * @param signal Calling tool lifetime.
+   * @param icon Native application icon for the permission card; never saved as an identity.
    * @returns Completion after consent; refusals reject before launch, AX, screenshots, or input.
    */
   async select(agent: Agent, client: NativeClient, handle: CuaAppHandle,
-    identity: CuaApplicationGrant & { persistable: boolean }, signal: AbortSignal): Promise<void> {
+    identity: CuaApplicationGrant & { persistable: boolean }, signal: AbortSignal, icon?: string): Promise<void> {
     await this.withOperation(agent, client, identity, signal, signal => this.selectInOrder(agent, identity.id, async () => {
       signal.throwIfAborted()
       const existing = this.clients.get(client)?.handles.get(handle)
       if (!client.disposed && existing && this.permitted(existing)) return
       const saved = identity.persistable && this.options.grants().some(grant => grant.id === identity.id)
-      let scope: Selection['scope'] = 'persistent'
-      if (!saved && this.rejected.get(agent)?.has(identity.id)) throw this.denied(identity)
+      const decision = this.decisions.get(agent.id)?.get(identity.id)
+      let scope: Selection['scope'] = saved ? 'persistent' : 'session'
+      if (!saved && decision?.allowed === false) throw this.denied(identity)
       if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
-      if (!saved) {
+      if (!saved && !decision?.allowed) {
         const questions = this.ctx.get('userQuestions')
         if (!questions) throw new NativeError('APP_APPROVAL_UNAVAILABLE', 'No human answerer is available for application access')
-        const options = [{ label: 'Allow for this task' }, { label: 'Deny' }]
+        const options = [{ label: 'Allow for this session' }, { label: 'Deny' }]
         if (identity.persistable && this.options.save) options.push({ label: 'Always allow' })
         let result: AskUserQuestionAnswer
         try {
           result = await questions.ask({ agent, signal, questions: [{ id: 'cua-app-access',
             question: `Allow Computer Use to launch if needed, read, capture, and control ${identity.name}?`,
-            detail: `Application: ${identity.executablePath}\nTask access applies to the selected application instance, including its launch if needed. macOS permissions and approval of sensitive actions remain separate. Saved access can be revoked by removing its allowedApps entry from this provider configuration. Task access ends with the task.`, options }] })
+            detail: 'Session access lasts until DSH restarts or Computer Use is disabled.',
+            options, intent: {
+              kind: 'approval', approve: 'Allow for this session', reject: 'Deny',
+              ...(identity.persistable && this.options.save ? { always: 'Always allow' } : {}),
+              subject: { name: identity.name, ...(icon === undefined ? {} : { icon }) },
+              display: {
+                question: { en: 'Allow Computer Use to launch, read, capture and control this application?',
+                  zh: '允许 Computer Use 启动、读取、截图和控制此应用吗？' },
+                detail: { en: 'Session access lasts until DSH restarts or Computer Use is disabled.',
+                  zh: '会话授权在重启 DSH 或关闭 Computer Use 后失效。' },
+                approve: { en: 'Allow for this session', zh: '本会话允许' },
+              },
+            } }] })
         } catch (error) {
           if (error instanceof UserQuestionError && error.code === 'ASK_CANCELLED') {
             this.invalidate(identity.id, agent)
@@ -105,8 +174,9 @@ export class ApplicationAccess {
         signal.throwIfAborted()
         const answer = result.answers.find(answer => answer.id === 'cua-app-access')
         const chosen = answer && !answer.custom?.trim() && answer.selected.length === 1 ? answer.selected[0] : undefined
-        if (chosen === 'Allow for this task') scope = 'task'
+        if (chosen === 'Allow for this session') scope = 'session'
         else if (chosen === 'Always allow' && identity.persistable && this.options.save) {
+          scope = 'persistent'
           const { persistable: _persistable, ...grant } = identity
           await this.persist((grants) => {
             signal.throwIfAborted()
@@ -129,7 +199,8 @@ export class ApplicationAccess {
       }
       state.handles.set(handle, { identity: grant, scope, lifetime: new AbortController() })
       this.clients.set(client, state)
-      this.rejected.get(agent)?.delete(identity.id)
+      if (scope === 'session') this.decide(agent.id, grant, true)
+      else this.decisions.get(agent.id)?.delete(identity.id)
     }))
   }
 
@@ -155,11 +226,14 @@ export class ApplicationAccess {
   }
 
   private async selectInOrder(agent: Agent, id: CuaApplicationId, select: () => Promise<void>): Promise<void> {
-    const selections = this.selections.get(agent) ?? new Map<CuaApplicationId, Promise<void>>()
-    this.selections.set(agent, selections)
+    const selections = this.selections.get(agent.id) ?? new Map<CuaApplicationId, Promise<void>>()
+    this.selections.set(agent.id, selections)
     const operation = (selections.get(id) ?? Promise.resolve()).then(select, select)
     selections.set(id, operation)
-    try { await operation } finally { if (selections.get(id) === operation) selections.delete(id) }
+    try { await operation } finally {
+      if (selections.get(id) === operation) selections.delete(id)
+      if (selections.size === 0) this.selections.delete(agent.id)
+    }
   }
 
   private async withOperation<T>(agent: Agent, client: NativeClient, identity: CuaApplicationGrant, signal: AbortSignal,
@@ -172,6 +246,9 @@ export class ApplicationAccess {
       const result = await dispatch(lifetime)
       lifetime.throwIfAborted()
       return result
+    } catch (error) {
+      if (operation.controller.signal.aborted) throw operation.controller.signal.reason
+      throw error
     } finally {
       this.active.delete(operation)
       operation.done.resolve()
@@ -179,40 +256,44 @@ export class ApplicationAccess {
   }
 
   /**
-   * Forget the disposed task's transient decisions and selected handles.
-   * @param agent Disposed task whose transient decisions are released.
+   * Release the disposed agent's handles while retaining its session decisions.
+   * @param agent Disposed agent whose selected handles are released.
    */
   forget(agent: Agent): void {
     for (const [client, state] of this.clients) if (state.agent === agent) this.clients.delete(client)
-    this.rejected.delete(agent)
   }
 
   private permitted(selection: Selection): boolean {
     return !selection.lifetime.signal.aborted
-      && (selection.scope === 'task' || this.options.grants().some(grant => grant.id === selection.identity.id))
+      && (selection.scope === 'session' || this.options.grants().some(grant => grant.id === selection.identity.id))
   }
   private denied(identity: CuaApplicationGrant): NativeError {
     return new NativeError('APP_ACCESS_DENIED', `The user denied access to ${identity.name}. Do not retry or use another tool to bypass this decision.`)
   }
-  private reject(agent: Agent, identity: CuaApplicationGrant): void {
-    const rejected = this.rejected.get(agent) ?? new Map<CuaApplicationId, CuaApplicationGrant>()
-    rejected.set(identity.id, { id: identity.id, name: identity.name, executablePath: identity.executablePath })
-    this.rejected.set(agent, rejected)
+  private decide(sessionId: Agent['id'], identity: CuaApplicationGrant, allowed: boolean): void {
+    const decisions = this.decisions.get(sessionId) ?? new Map<CuaApplicationId, { identity: CuaApplicationGrant; allowed: boolean }>()
+    decisions.set(identity.id, { identity: { id: identity.id, name: identity.name, executablePath: identity.executablePath }, allowed })
+    this.decisions.set(sessionId, decisions)
   }
-  private invalidate(id: CuaApplicationId, agent?: Agent): void {
+  private invalidate(id: CuaApplicationId, agent?: Agent): NativeClient[] {
     const clients = new Set<NativeClient>()
+    for (const [sessionId, decisions] of this.decisions) {
+      const decision = decisions.get(id)
+      if (decision && (agent === undefined || sessionId === agent.id)) this.decide(sessionId, decision.identity, false)
+    }
     for (const [client, state] of this.clients) for (const selection of state.handles.values()) if (selection.identity.id === id
-      && (agent === undefined || state.agent === agent)) {
+      && (agent === undefined || state.agent.id === agent.id)) {
       selection.lifetime.abort(new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application'))
-      this.reject(state.agent, selection.identity)
+      this.decide(state.agent.id, selection.identity, false)
       clients.add(client)
     }
-    for (const operation of this.active) if (operation.identity.id === id && (agent === undefined || operation.agent === agent)) {
-      this.reject(operation.agent, operation.identity)
+    for (const operation of this.active) if (operation.identity.id === id && (agent === undefined || operation.agent.id === agent.id)) {
+      this.decide(operation.agent.id, operation.identity, false)
       operation.controller.abort(this.denied(operation.identity))
       clients.add(operation.client)
     }
     for (const client of clients) client.invalidate()
+    return [...clients]
   }
   private reconcile(): void {
     for (const state of this.clients.values()) for (const selection of state.handles.values()) {
@@ -223,7 +304,7 @@ export class ApplicationAccess {
     return this.mutate(async () => {
       const save = this.options.save
       if (!save) throw new Error('Application permissions cannot be saved in this composition')
-      await save(update(this.options.grants()))
+      await save(update(this.options.grants()), this.lifetime.signal)
     })
   }
   private mutate(mutate: () => Promise<void>): Promise<void> {
diff --git a/packages/experimental/cua/src/index.ts b/packages/experimental/cua/src/index.ts
index 131e15c3ec..3e04953c7a 100644
--- a/packages/experimental/cua/src/index.ts
+++ b/packages/experimental/cua/src/index.ts
@@ -13,22 +13,28 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import { z } from 'zod'
 import { NativeClient, NativeError, type NativeClientConfig, type NativeChannelFactory } from './native-client.ts'
-import { ApplicationAuthorizationResult, ApplicationAccess } from './application-access.ts'
-import type { CuaApplicationGrant, CuaApplicationId } from './application-types.ts'
+import { ApplicationAuthorizationResult, installCuaAccess } from './access.ts'
+import type { CuaApplicationGrant, CuaApplicationId } from './access-types.ts'
 import type { CuaAppHandle, CuaOperation } from './types.ts'
-import { AppResult, NativeScreenshotResult, Request, ScreenshotResult, StateResult, WindowsResult } from './protocol.ts'
+import { ApplicationIcon, AppResult, NativeScreenshotResult, Request, ScreenshotResult, StateResult, WindowsResult } from './protocol.ts'
 import { CuaCoordinates } from './coordinates.ts'
-import type {} from '@deepseek-ai/dsh-system-prompt'
-import type { ToolExecution } from '@deepseek-ai/dsh-tools'
+import { createScope, type Scope } from '@deepseek-ai/dsh-scope'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
+import type { PromptSection } from '@deepseek-ai/dsh-system-prompt'
+import type { ToolDefinition, ToolExecution } from '@deepseek-ai/dsh-tools'
 import type {} from '@deepseek-ai/dsh-subprocess'
 import type {} from '@deepseek-ai/dsh-computer-use'
 import type {} from '@deepseek-ai/dsh-ptc-runtime'
 import type {} from '@deepseek-ai/dsh-settings'
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 
+export { CuaAccess } from './access.ts'
+export type * from './access-types.ts'
 
 /** Native executable and per-operation resource bounds. */
 export interface CuaConfig {
+  /** Register tools for Agents using this preset; defaults to ptc. False enables global registration. */
+  agentPreset: string | false
   /** Signed applications explicitly approved for future tasks in this profile. */
   allowedApps: Volatile<Array<Omit<CuaApplicationGrant, 'id'> & {
     /** Unbranded digest at the profile configuration boundary; admitted by the Config schema. */
@@ -72,6 +78,7 @@ export interface CuaConfig {
 
 /** Validated host configuration; no driver is downloaded at runtime. */
 export const CuaConfig = Schema.object({
+  agentPreset: Schema.union([Schema.string().min(1), Schema.const(false)]).default('ptc'),
   allowedApps: Schema.array(Schema.object({
     id: Schema.string().pattern(/^[a-f0-9]{64}$/).required(),
     name: Schema.string().required(), executablePath: Schema.string().min(1).required(),
@@ -157,15 +164,17 @@ export function installCua(ctx: Context, config: CuaConfig, backend: CuaBackend)
   }
   const entryId = ctx.fiber.entry?.options.id
   ctx.inject(['settings'], scope => scope.effect(() => scope.settings.configure({ auto: false }, ctx.fiber)))
-  const access = new ApplicationAccess(ctx, {
+  const access = installCuaAccess(ctx, {
+    settingsNamespace: entryId ?? null,
+    native, createChannel: backend.createChannel,
     grants: () => config.allowedApps.get().map(grant => ({ ...grant, id: grant.id as CuaApplicationId })),
     get save() {
       const settings = ctx.get('settings')
       if (entryId === undefined || settings === undefined) return undefined
       const descriptor = settings.describe().find(entry => entry.ns === entryId)
       if (!descriptor) return undefined
-      return async (grants: readonly CuaApplicationGrant[]) => {
-        await settings.mutate(entryId, [{ op: 'set', path: ['allowedApps'], value: grants }], descriptor.revision)
+      return async (grants: readonly CuaApplicationGrant[], signal: AbortSignal) => {
+        await settings.mutate(entryId, [{ op: 'set', path: ['allowedApps'], value: grants }], descriptor.revision, signal)
       }
     },
   })
@@ -256,8 +265,10 @@ export function installCua(ctx: Context, config: CuaConfig, backend: CuaBackend)
         : await requestNative()
       if (method === 'getApp') {
         const prepared = AppResult.extend({ pid: AppResult.shape.pid.nullable() }).parse(result)
-        const { authorization } = z.object({ authorization: ApplicationAuthorizationResult }).parse(result)
-        await access.select(agent, client, prepared.appHandle, authorization, signal)
+        const { authorization, applicationIcon } = z.object({ authorization: ApplicationAuthorizationResult,
+          applicationIcon: ApplicationIcon.optional(),
+        }).parse(result)
+        await access.select(agent, client, prepared.appHandle, authorization, signal, applicationIcon)
         signal.throwIfAborted()
         const selected = prepared.pid === null
           ? AppResult.parse(await access.run(client, prepared.appHandle, signal,
@@ -276,7 +287,7 @@ export function installCua(ctx: Context, config: CuaConfig, backend: CuaBackend)
       if (method === 'listWindows') execution.coordinates.observe(parsedParams.appHandle as CuaAppHandle, WindowsResult.parse(result))
       return result
     }
-    yield ctx.tools.register({
+    const tool: ToolDefinition = {
       name: 'cua', description: backend.description,
       parameters: { ...z.record(z.string(), z.json()).parse(z.toJSONSchema(Request)), type: 'object' },
       output: { schema: {}, render: renderResult },
@@ -319,14 +330,47 @@ export function installCua(ctx: Context, config: CuaConfig, backend: CuaBackend)
           pending.delete(operation)
         }
       },
-    })
-    yield ctx.systemPrompt.section({
+    }
+    const prompt: PromptSection = {
       name: 'computer-use:dsh-cua', order: ctx.systemPrompt.getSectionOrder('TOOL_COMPUTER_USE'),
       text: () => ctx.get('ptcRuntime')?.programFormat !== 'repl' ? backend.guidance : `${backend.guidance}
 
 Persistent PTC initialization:
 var { connectCua } = await import(${JSON.stringify(new URL('../lib/bridge.js', import.meta.url).href)});
 var cua = connectCua(() => tools.cua, text => console.log(text));`,
-    })
+    }
+    const register = (scope: Context): void => {
+      scope.tools.register(tool)
+      scope.systemPrompt.section(prompt)
+    }
+    if (config.agentPreset === false) register(ctx)
+    else {
+      const consumer = ctx.inject(['agentPresets'], async (presetCtx) => {
+        const scopes = new Map<Agent, Scope>()
+        const sync = async (agent: Agent): Promise<void> => {
+          const previous = scopes.get(agent)
+          if (presetCtx.agentPresets.composedPreset(agent.ctx) !== config.agentPreset) {
+            scopes.delete(agent)
+            await previous?.dispose()
+            return
+          }
+          if (previous !== undefined) return
+          const scope = createScope(agent.ctx, agent)
+          scopes.set(agent, scope)
+          scope.ctx.effect(() => () => {
+            if (scopes.get(agent) === scope) scopes.delete(agent)
+          }, 'cua.agent-tools')
+          register(scope.ctx)
+        }
+        presetCtx.effect(() => async () => { await Promise.all([...scopes.values()].map(scope => scope.dispose())) }, 'cua.agent-tools')
+        presetCtx.on('agent/created', async ({ agent }) => { await sync(agent) })
+        presetCtx.on('agent-preset/selected', (id) => {
+          const agent = presetCtx.agents.get(id)
+          if (agent !== undefined) void sync(agent).catch((error: unknown) => { presetCtx.logger.warn(`CUA tool scope update failed: ${String(error)}`) })
+        })
+        await Promise.all(presetCtx.agents.list().map(sync))
+      })
+      yield () => consumer.dispose()
+    }
   }, 'dsh-cua.runtime')
 }
diff --git a/packages/experimental/cua/src/protocol.ts b/packages/experimental/cua/src/protocol.ts
index 46eddd2e1c..f732e1bf82 100644
--- a/packages/experimental/cua/src/protocol.ts
+++ b/packages/experimental/cua/src/protocol.ts
@@ -78,8 +78,13 @@ export const NativeResourceParameters = {
   }).strict(),
   findApps: z.object({ maxAppMatches: z.number().int().min(1).max(1000) }).strict(),
 }
-/** Executor-only continuation after application consent; absent from the model Request union. */
-export const NativeOnlyOperations = [operation('launchApp', app)] as const
+/** Host-only launch continuation and user-facing system permission controls; absent from model arguments. */
+export const NativeOnlyOperations = [
+  operation('launchApp', app), operation('permissionStatus', {}),
+  operation('applicationIcons', { paths: z.array(z.string().min(1)) }),
+  operation('requestPermission', { permission: z.enum(['accessibility', 'screenRecording']) }),
+  operation('openPermissionSettings', { permission: z.enum(['accessibility', 'screenRecording']) }),
+] as const
 
 /** Process identity returned only after a successful app selection. */
 export const AppResult = z.object({
@@ -124,3 +129,6 @@ export const ActionResult = z.object({ dispatched: z.literal(true), verified: z.
 export const HoverResult = ActionResult.extend({ hoverRoute: z.enum(['accessibility', 'system-pointer']), systemPointerMoved: z.boolean() })
 /** Background restoration dispatch and sampled foreground changes; null means the observation was unavailable. */
 export const ShowResult = ActionResult.extend({ windowId: id.nullable(), foregroundChanged: z.boolean().nullable() })
+
+/** Bounded native PNG thumbnail for human presentation, excluded from model results and saved grants. */
+export const ApplicationIcon = z.string().max(65536).regex(/^data:image\/png;base64,[A-Za-z0-9+/]+={0,2}$/)
diff --git a/packages/experimental/cua/src/types.ts b/packages/experimental/cua/src/types.ts
index bb465c5e36..a413854609 100644
--- a/packages/experimental/cua/src/types.ts
+++ b/packages/experimental/cua/src/types.ts
@@ -1,4 +1,5 @@
 /** Native application objects independent of evaluator ownership and persistence. */
+export type * from './access-types.ts'
 import type { Branded } from '@deepseek-ai/dsh-brand'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import type { z } from 'zod'
diff --git a/packages/experimental/cua/tests/access.spec.ts b/packages/experimental/cua/tests/access.spec.ts
new file mode 100644
index 0000000000..0e15e0129d
--- /dev/null
+++ b/packages/experimental/cua/tests/access.spec.ts
@@ -0,0 +1,410 @@
+/** Application decisions are checked at dispatch and revocation cancels owned work. */
+import { setImmediate } from 'node:timers/promises'
+import { Context } from '@deepseek-ai/cordis'
+import { mountAgentLoopTestDependencies, mountAgentLoopTestHarness } from '@deepseek-ai/dsh-agent-loop-testkit'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import UserQuestions, { type AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-questions'
+import { expect, it, onTestFinished, vi } from 'vitest'
+import { ApplicationAuthorizationResult, installCuaAccess } from '../src/access.ts'
+import type { CuaApplicationGrant } from '../src/access-types.ts'
+import type { CuaAppHandle } from '../src/types.ts'
+import { NativeClient } from '../src/native-client.ts'
+
+const native = vi.hoisted(() => ({ instances: [] as Array<{
+  disposed: boolean
+  request: ReturnType<typeof vi.fn>
+  dispose: ReturnType<typeof vi.fn>
+}> }))
+
+vi.mock('../src/native-client.ts', async original => ({
+  ...await original<typeof import('../src/native-client.ts')>(),
+  NativeClient: class {
+    disposed = false
+    request = vi.fn(async (method: string) => method === 'openPermissionSettings' ? { opened: true }
+      : method === 'applicationIcons' ? {} : { accessibility: false, screenRecording: false, helper: { pid: 9 }, parent: { pid: 8 } })
+    invalidate() { this.disposed = true }
+    dispose = vi.fn(async () => { this.disposed = true })
+    constructor() { native.instances.push(this) }
+  },
+}))
+
+const unusedConnector = () => { throw new Error('Mocked native client does not connect') }
+
+const nativeConfig = { helperPath: '/fixture', cwd: '/', timeoutMs: 1000, connectTimeoutMs: 5000, screenshotTimeoutMs: 5000, axTimeoutMs: 100,
+  maxRequestBytes: 4096, maxResponseBytes: 4096, graceMs: 100, textEventIntervalMs: 1 }
+const identity = ApplicationAuthorizationResult.parse({ id: 'a'.repeat(64), name: 'Test application', executablePath: '/Applications/Fixture.app/Contents/MacOS/Fixture', persistable: true })
+const handle = 'fixture-app' as CuaAppHandle
+const signal = new AbortController().signal
+
+async function setup(choice = 'Allow for this session', options: { writable?: boolean; questions?: boolean; initial?: readonly CuaApplicationGrant[] } = {}) {
+  native.instances.length = 0
+  const ctx = new Context()
+  onTestFinished(() => ctx.fiber.dispose())
+  await mountAgentLoopTestDependencies(ctx)
+  await mountAgentLoopTestHarness(ctx)
+  if (options.questions !== false) await ctx.plugin(UserQuestions)
+  const owner = await ctx.agents.create({ sessionId: SessionId('cua-access-test') })
+  const answer = vi.fn<() => Promise<AskUserQuestionAnswer>>(async () => ({ answers: [{ id: 'cua-app-access', selected: [choice] }] }))
+  ctx.on('user-questions/request', answer)
+  let grants: readonly CuaApplicationGrant[] = options.initial ?? []
+  const save = vi.fn(async (next: readonly CuaApplicationGrant[]) => { grants = next })
+  let writable = options.writable !== false
+  const access = installCuaAccess(ctx, { native: nativeConfig, createChannel: unusedConnector, settingsNamespace: 'cua', grants: () => grants, get save() { return writable ? save : undefined } })
+  const client = new NativeClient(ctx, nativeConfig, unusedConnector)
+  return { ctx, owner, agent: owner.agent, answer, save, access, client, grants: () => grants,
+    setWritable(value: boolean) { writable = value },
+  }
+}
+
+it('requires another user decision after the permission page permits asking again', async () => {
+  const f = await setup('Deny')
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  expect(f.ctx.cuaAccess.applications().blockedApps).toHaveLength(1)
+  await f.ctx.cuaAccess.retryApproval(identity.id)
+  expect(f.ctx.cuaAccess.applications().blockedApps).toEqual([])
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
+  f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
+  const retryClient = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(f.agent, retryClient, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(2)
+  await f.ctx.cuaAccess.revoke(identity.id)
+  await f.ctx.cuaAccess.retryApproval(identity.id)
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
+})
+
+it('persists a signed identity and revokes it before further dispatch', async () => {
+  const f = await setup('Always allow')
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  expect(f.grants()).toEqual([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
+  await f.ctx.cuaAccess.revoke(identity.id)
+  expect(f.grants()).toEqual([])
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REVOKED')
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+})
+
+it('joins an in-flight native operation when application access is revoked', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const entered = Promise.withResolvers<undefined>()
+  const pending = f.access.run(f.client, handle, signal, async (operationSignal) => {
+    const done = Promise.withResolvers<null>()
+    operationSignal.addEventListener('abort', () => { done.reject(new Error('native cancelled')) }, { once: true })
+    entered.resolve(undefined)
+    return done.promise
+  })
+  const rejected = expect(pending).rejects.toThrow('APP_ACCESS_DENIED')
+  await entered.promise
+  await f.ctx.cuaAccess.revoke(identity.id)
+  await rejected
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REVOKED')
+})
+
+it.each(['revoke', 'dispose'] as const)('waits for native cancellation to finish during %s', async (action) => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const entered = Promise.withResolvers<AbortSignal>(), cancelled = Promise.withResolvers<undefined>()
+  const release = Promise.withResolvers<undefined>()
+  onTestFinished(() => { release.resolve(undefined) })
+  const pending = f.access.run(f.client, handle, signal, async (operationSignal) => {
+    operationSignal.addEventListener('abort', () => { cancelled.resolve(undefined) }, { once: true })
+    entered.resolve(operationSignal)
+    await release.promise
+  })
+  const rejected = expect(pending).rejects.toThrow()
+  const operationSignal = await entered.promise
+  let finished = false
+  const closing = (action === 'revoke' ? f.ctx.cuaAccess.revoke(identity.id) : f.access.dispose())
+    .then(() => { finished = true })
+  try {
+    await cancelled.promise
+    await setImmediate()
+    expect(operationSignal.aborted).toBe(true)
+    expect(finished).toBe(false)
+    release.resolve(undefined)
+    await closing
+    await rejected
+    expect(finished).toBe(true)
+  } finally {
+    release.resolve(undefined)
+    await Promise.all([closing, rejected])
+  }
+})
+
+it('fails closed without a human answerer and never offers persistence without its owner', async () => {
+  const f = await setup('Always allow', { writable: false, questions: false })
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_APPROVAL_UNAVAILABLE')
+  await f.ctx.plugin(UserQuestions)
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  expect(f.save).not.toHaveBeenCalled()
+  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
+})
+
+it('projects task decisions, observes live config removal, and forgets a disposed task', async () => {
+  const f = await setup('Always allow')
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  expect(f.ctx.cuaAccess.applications().allowedApps).toHaveLength(1)
+  await f.save([])
+  f.ctx.emit('loader/volatile-update', [['allowedApps']])
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REVOKED')
+  await f.owner.dispose()
+  f.access.forget(f.agent)
+})
+
+it('refuses to promise revocation of a saved decision without persistence', async () => {
+  const { persistable: _persistable, ...grant } = identity
+  const f = await setup('Deny', { initial: [grant], writable: false })
+  await expect(f.ctx.cuaAccess.revoke(identity.id)).rejects.toThrow('cannot be saved')
+  expect(f.grants()).toEqual([grant])
+})
+
+it('checks native permissions without converting an OS request into a grant', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const before = f.ctx.cuaAccess.applications()
+  expect(before).toEqual({ settingsNamespace: 'cua', allowedApps: [], blockedApps: [], persistentAvailable: true })
+  expect(await f.ctx.cuaAccess.systemStatus()).toMatchObject({ accessibility: false, screenRecording: false })
+  expect(await f.ctx.cuaAccess.requestPermission('accessibility')).toMatchObject({ accessibility: false })
+  await f.ctx.cuaAccess.openSettings('screenRecording')
+  const transport = native.instances[1]!
+  expect(transport.request).toHaveBeenCalledWith('openPermissionSettings', { permission: 'screenRecording' }, expect.any(AbortSignal))
+  transport.request.mockRejectedValueOnce(new Error('transport ended'))
+  await expect(f.ctx.cuaAccess.systemStatus()).rejects.toThrow('transport ended')
+  transport.disposed = true
+  expect((await f.ctx.cuaAccess.systemStatus()).screenRecording).toBe(false)
+  expect(transport.dispose).toHaveBeenCalledOnce()
+  await f.access.dispose()
+  await expect(f.ctx.cuaAccess.systemStatus()).rejects.toThrow()
+  await expect(f.ctx.cuaAccess.revoke(identity.id)).rejects.toThrow()
+})
+
+it('does not open a replacement control connection after provider disposal begins', async () => {
+  const f = await setup()
+  await f.ctx.cuaAccess.systemStatus()
+  const control = native.instances.at(-1)!
+  control.disposed = true
+  const released = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(() => { released.resolve(undefined) })
+  control.dispose.mockImplementationOnce(async () => { entered.resolve(undefined); await released.promise })
+  const pending = f.ctx.cuaAccess.systemStatus()
+  const rejected = expect(pending).rejects.toThrow()
+  await entered.promise
+  const count = native.instances.length
+  const closing = f.access.dispose()
+  released.resolve(undefined)
+  await Promise.all([closing, rejected])
+  expect(native.instances).toHaveLength(count)
+})
+
+
+it('isolates other tasks and applications while revoking and forgetting one decision', async () => {
+  const f = await setup()
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('another-cua-task') })
+  const otherClient = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  const other = { ...identity, id: 'b'.repeat(64) as typeof identity.id }
+  const otherHandle = 'other-app' as CuaAppHandle
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.access.select(f.agent, f.client, otherHandle, other, signal)
+  await f.access.select(owner.agent, otherClient, otherHandle, other, signal)
+  f.ctx.emit('loader/volatile-update', [['allowedApps']])
+  await f.ctx.cuaAccess.retryApproval(identity.id)
+  const started: PromiseWithResolvers<void> = Promise.withResolvers()
+  const release: PromiseWithResolvers<void> = Promise.withResolvers()
+  onTestFinished(() => { release.resolve() })
+  const continuing = f.access.run(otherClient, otherHandle, signal, async (operationSignal) => {
+    started.resolve()
+    await release.promise
+    return !operationSignal.aborted
+  })
+  await started.promise
+  await f.ctx.cuaAccess.revoke(identity.id)
+  release.resolve()
+  expect(await continuing).toBe(true)
+  f.access.forget(f.agent)
+  await expect(f.access.run(otherClient, otherHandle, signal, async () => 'still allowed')).resolves.toBe('still allowed')
+  await owner.dispose()
+})
+
+it('removes a grant whose save is already pending when another task revokes the application', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('cua-concurrent-save') })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  const entered: PromiseWithResolvers<void> = Promise.withResolvers()
+  const release: PromiseWithResolvers<void> = Promise.withResolvers()
+  onTestFinished(() => { release.resolve() })
+  const save = f.save.getMockImplementation()!
+  f.save.mockImplementationOnce(async (grants) => { entered.resolve(); await release.promise; await save(grants) })
+  f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] })
+  const selection = f.access.select(owner.agent, client, handle, identity, signal)
+  const settledSelection = Promise.allSettled([selection])
+  await entered.promise
+  const revoked = f.ctx.cuaAccess.revoke(identity.id)
+  release.resolve()
+  await revoked
+  await settledSelection
+  expect(f.grants()).toEqual([])
+  expect(f.save).toHaveBeenCalledTimes(2)
+  expect(client.disposed).toBe(true)
+  expect(f.client.disposed).toBe(true)
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await expect(f.access.select(owner.agent, replacement, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+})
+
+it('keeps revoked helper handles invalid after the application is approved again', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.ctx.cuaAccess.revoke(identity.id)
+  expect(f.client.disposed).toBe(true)
+  await f.ctx.cuaAccess.retryApproval(identity.id)
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('NATIVE_CLOSED')
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  const replacementHandle = 'replacement-app' as CuaAppHandle
+  await f.access.select(f.agent, replacement, replacementHandle, identity, signal)
+  const oldDispatch = vi.fn(async () => 'stale window')
+  await expect(f.access.run(f.client, handle, signal, oldDispatch)).rejects.toThrow('APP_ACCESS_REQUIRED')
+  expect(oldDispatch).not.toHaveBeenCalled()
+  await expect(f.access.run(replacement, replacementHandle, signal, async () => 'fresh window')).resolves.toBe('fresh window')
+})
+
+it('projects restored persistent grants without showing the same application as blocked', async () => {
+  const f = await setup('Deny')
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  const { persistable: _persistable, ...grant } = identity
+  await f.save([grant])
+  expect(f.ctx.cuaAccess.applications().blockedApps).toEqual([])
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(f.agent, replacement, handle, identity, signal)
+  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual([grant])
+  expect(f.answer).toHaveBeenCalledOnce()
+})
+
+it('keeps access revoked when stopping the helper reports a cleanup failure', async () => {
+  const f = await setup('Always allow')
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  vi.spyOn(f.client, 'dispose').mockRejectedValueOnce(new Error('process range did not exit'))
+  await expect(f.ctx.cuaAccess.revoke(identity.id)).rejects.toThrow('helper cleanup failed')
+  expect(f.grants()).toEqual([])
+  expect(f.client.disposed).toBe(true)
+  const dispatch = vi.fn(async () => 'unexpected input')
+  await expect(f.access.run(f.client, handle, signal, dispatch)).rejects.toThrow('APP_ACCESS_REVOKED')
+  expect(dispatch).not.toHaveBeenCalled()
+})
+
+it('rejects an answer for a helper that exits while the human question is pending', async () => {
+  const f = await setup()
+  const answer = Promise.withResolvers<AskUserQuestionAnswer>()
+  const entered: PromiseWithResolvers<void> = Promise.withResolvers()
+  onTestFinished(() => { answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Deny'] }] }) })
+  f.answer.mockImplementationOnce(() => { entered.resolve(); return answer.promise })
+  const selected = f.access.select(f.agent, f.client, handle, identity, signal)
+  const rejected = expect(selected).rejects.toThrow('NATIVE_CLOSED')
+  await entered.promise
+  f.client.invalidate()
+  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
+  await rejected
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(f.agent, replacement, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(2)
+})
+
+it('keeps other session grants after revocation while requiring fresh native handles', async () => {
+  const f = await setup()
+  const other = { ...identity, id: 'b'.repeat(64) as typeof identity.id }
+  const otherHandle = 'other-application' as CuaAppHandle
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.access.select(f.agent, f.client, otherHandle, other, signal)
+  await f.ctx.cuaAccess.revoke(identity.id)
+  await expect(f.access.run(f.client, otherHandle, signal, async () => 'old handle')).rejects.toThrow('NATIVE_CLOSED')
+  const state = f.ctx.cuaAccess.applications()
+  expect(state.blockedApps.map(app => app.id)).toEqual([identity.id])
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(f.agent, replacement, otherHandle, other, signal)
+  await expect(f.access.run(replacement, otherHandle, signal, async () => 'new handle')).resolves.toBe('new handle')
+  expect(f.answer).toHaveBeenCalledTimes(2)
+})
+
+it('does not let a stale revoked task invalidate another task after a saved grant is restored', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.ctx.cuaAccess.revoke(identity.id)
+  const { persistable: _persistable, ...grant } = identity
+  await f.save([grant])
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('cua-restored-grant') })
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(owner.agent, replacement, handle, identity, signal)
+  await expect(f.access.run(f.client, handle, signal, async () => 'stale')).rejects.toThrow('APP_ACCESS_REVOKED')
+  f.ctx.emit('loader/volatile-update', [['allowedApps']])
+  expect(replacement.disposed).toBe(false)
+  await expect(f.access.run(replacement, handle, signal, async () => 'restored')).resolves.toBe('restored')
+})
+
+it('offers fixed approval actions with native metadata while keeping icons out of saved grants', async () => {
+  const f = await setup('Always allow')
+  const ask = vi.spyOn(f.ctx.userQuestions, 'ask')
+  const icon = 'data:image/png;base64,aWNvbg=='
+  await f.access.select(f.agent, f.client, handle, identity, signal, icon)
+  expect(ask.mock.calls[0]?.[0].questions[0]?.intent).toMatchObject({
+    kind: 'approval', approve: 'Allow for this session', reject: 'Deny', always: 'Always allow',
+    subject: { name: identity.name, icon },
+  })
+  expect(f.grants()).toEqual([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
+})
+
+it('reads application decisions without native work and retrieves icons separately', async () => {
+  const f = await setup('Always allow')
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual(f.grants())
+  expect(native.instances).toHaveLength(1)
+  await f.ctx.cuaAccess.systemStatus()
+  const control = native.instances.at(-1)!
+  const pending = Promise.withResolvers<Record<string, string>>()
+  onTestFinished(() => { pending.resolve({}) })
+  control.request.mockReturnValueOnce(pending.promise)
+  const icons = f.ctx.cuaAccess.applicationIcons()
+  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual(f.grants())
+  pending.resolve({ [identity.executablePath]: 'data:image/png;base64,aWNvbg==' })
+  expect(await icons).toEqual({ [identity.executablePath]: 'data:image/png;base64,aWNvbg==' })
+  expect(f.grants()[0]).not.toHaveProperty('icon')
+})
+
+it('skips native icon work for an empty application list and propagates icon failures independently', async () => {
+  const f = await setup()
+  expect(await f.ctx.cuaAccess.applicationIcons()).toEqual({})
+  expect(native.instances).toHaveLength(1)
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  expect(await f.ctx.cuaAccess.applicationIcons()).toEqual({})
+  expect(native.instances).toHaveLength(1)
+  await f.save([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
+  await f.ctx.cuaAccess.systemStatus()
+  native.instances.at(-1)!.request.mockRejectedValueOnce(new Error('icons unavailable'))
+  await expect(f.ctx.cuaAccess.applicationIcons()).rejects.toThrow('icons unavailable')
+  expect(f.ctx.cuaAccess.applications().allowedApps).toHaveLength(1)
+  expect((await f.ctx.cuaAccess.systemStatus()).accessibility).toBe(false)
+})
+
+it('preserves captured launch metadata separately from the current helper parent', async () => {
+  const f = await setup()
+  await f.ctx.cuaAccess.systemStatus()
+  const control = native.instances.at(-1)!
+  const launchApplication = { name: 'Visual Studio Code', path: '/Applications/Visual Studio Code.app', icon: 'data:image/png;base64,aWNvbg==' }
+  control.request.mockResolvedValueOnce({ accessibility: false, screenRecording: false,
+    helper: { pid: 9 }, parent: { pid: 1, path: '/sbin/launchd' }, launchApplication })
+  expect(await f.ctx.cuaAccess.systemStatus()).toMatchObject({ parent: { pid: 1 }, launchApplication })
+})
+
+
+it('omits session-only grants from the permission page and retains their access after another session saves a grant', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const other = { ...identity, id: 'b'.repeat(64) as typeof identity.id, name: 'Another application', executablePath: '/Applications/Other.app' }
+  await f.access.select(f.agent, f.client, 'other-application' as CuaAppHandle, other, signal)
+  expect(f.ctx.cuaAccess.applications()).toEqual({ settingsNamespace: 'cua', allowedApps: [], blockedApps: [], persistentAvailable: true })
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('cua-always-allow') })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] })
+  await f.access.select(owner.agent, client, handle, identity, signal)
+  const state = f.ctx.cuaAccess.applications()
+  expect(state.allowedApps.map(app => app.id)).toEqual([identity.id])
+  expect(state.blockedApps).toEqual([])
+  await expect(f.access.run(f.client, handle, signal, async () => 'still allowed')).resolves.toBe('still allowed')
+})
diff --git a/packages/experimental/cua/tests/agent-scopes.spec.ts b/packages/experimental/cua/tests/agent-scopes.spec.ts
new file mode 100644
index 0000000000..c561d11a6e
--- /dev/null
+++ b/packages/experimental/cua/tests/agent-scopes.spec.ts
@@ -0,0 +1,95 @@
+/** CUA tool and prompt ownership follows live Agent presets and provider disposal. */
+import { resolve } from 'node:path'
+import { Context } from '@deepseek-ai/cordis'
+import Loader from '@deepseek-ai/cordis-plugin-loader'
+import AgentPresets from '@deepseek-ai/dsh-agent-preset-registry'
+import { mountAgentLoopTestDependencies, mountAgentLoopTestHarness } from '@deepseek-ai/dsh-agent-loop-testkit'
+import ComputerUseRegistry from '@deepseek-ai/dsh-computer-use'
+import Subprocess from '@deepseek-ai/dsh-subprocess'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import { expect, it, onTestFinished, vi } from 'vitest'
+import { CuaConfig, installCua } from '../src/index.ts'
+
+const provider = {
+  name: 'test-cua-scopes',
+  inject: ['computerUse', 'subprocess', 'tools', 'systemPrompt', 'agents'],
+  Config: CuaConfig,
+  apply(ctx: Context, config: CuaConfig) {
+    installCua(ctx, config, {
+      helperPath: resolve('unused-cua-helper'),
+      createChannel() { throw new Error('Scope tests must not start a native helper') },
+      description: 'Fixture computer interaction', guidance: 'Fixture CUA guidance',
+    })
+  },
+}
+
+async function setup() {
+  const ctx = new Context()
+  onTestFinished(() => ctx.fiber.dispose())
+  ctx.baseUrl = import.meta.url
+  await ctx.plugin(Loader)
+  await mountAgentLoopTestDependencies(ctx)
+  await mountAgentLoopTestHarness(ctx)
+  await ctx.plugin(ComputerUseRegistry)
+  await ctx.plugin(Subprocess, [])
+  await ctx.plugin(AgentPresets, { default: 'standard' })
+  for (const id of ['standard', 'ptc']) {
+    await ctx.plugin({ inject: ['agentPresets'], async* apply(owner: Context) {
+      yield await owner.agentPresets.register({ id, plugins: [] })
+    } })
+  }
+  const create = (id: string, preset: string) => ctx.agents.create({
+    sessionId: SessionId(id), setup: async (owner) => { await ctx.agentPresets.mount(owner, preset) },
+  })
+  return { ctx, create }
+}
+
+it('adds and removes CUA for existing and new PTC Agents without changing other presets', async () => {
+  const { ctx, create } = await setup()
+  const existing = await create('existing', 'ptc')
+  const standard = await create('standard', 'standard')
+  expect(ctx.tools.get('cua', existing.agent)).toBeUndefined()
+  const mounted = await ctx.plugin(provider, {})
+  await expect.poll(() => ctx.tools.get('cua', existing.agent)).toBeDefined()
+  expect(ctx.tools.get('cua', standard.agent)).toBeUndefined()
+  expect((await ctx.systemPrompt.assemble({ scope: existing.agent })).sections)
+    .toContainEqual(expect.objectContaining({ name: 'computer-use:dsh-cua', text: 'Fixture CUA guidance' }))
+  await ctx.agentPresets.select(existing.agent, 'ptc')
+  expect(ctx.tools.schemas(existing.agent).filter(tool => tool.name === 'cua')).toHaveLength(1)
+  const fresh = await create('fresh', 'ptc')
+  expect(ctx.tools.get('cua', fresh.agent)).toBeDefined()
+  await ctx.agentPresets.select(existing.agent, 'standard')
+  await expect.poll(() => ctx.tools.get('cua', existing.agent)).toBeUndefined()
+  expect((await ctx.systemPrompt.assemble({ scope: existing.agent })).sections)
+    .not.toContainEqual(expect.objectContaining({ name: 'computer-use:dsh-cua' }))
+  await ctx.agentPresets.select(existing.agent, 'ptc')
+  await expect.poll(() => ctx.tools.get('cua', existing.agent)).toBeDefined()
+  await fresh.dispose()
+  expect(ctx.tools.get('cua', fresh.agent)).toBeUndefined()
+  await mounted.dispose()
+  expect(ctx.tools.get('cua', existing.agent)).toBeUndefined()
+  expect((await ctx.systemPrompt.assemble({ scope: existing.agent })).sections)
+    .not.toContainEqual(expect.objectContaining({ name: 'computer-use:dsh-cua' }))
+  const reloaded = await ctx.plugin(provider, {})
+  await expect.poll(() => ctx.tools.get('cua', existing.agent)).toBeDefined()
+  expect(ctx.tools.get('cua', standard.agent)).toBeUndefined()
+  await reloaded.dispose()
+})
+
+it('ignores unloaded Session selections and reports a failed live scope update', async () => {
+  const { ctx, create } = await setup()
+  const handle = await create('active', 'ptc')
+  const mounted = await ctx.plugin(provider, {})
+  await expect.poll(() => ctx.tools.get('cua', handle.agent)).toBeDefined()
+  const warn = vi.spyOn(mounted.ctx.logger, 'warn').mockImplementation(() => {})
+  const lookup = vi.spyOn(ctx.agentPresets, 'composedPreset')
+  onTestFinished(() => { lookup.mockRestore(); warn.mockRestore() })
+  ctx.emit('agent-preset/selected', SessionId('unloaded'), 'ptc')
+  expect(lookup).not.toHaveBeenCalled()
+  lookup.mockImplementationOnce(() => { throw new Error('Preset lookup failed during reload') })
+  ctx.emit('agent-preset/selected', handle.agent.id, 'ptc')
+  await expect.poll(() => warn.mock.calls).toEqual([['CUA tool scope update failed: Error: Preset lookup failed during reload']])
+  expect(ctx.tools.get('cua', handle.agent)).toBeDefined()
+  await ctx.agentPresets.select(handle.agent, 'standard')
+  await expect.poll(() => ctx.tools.get('cua', handle.agent)).toBeUndefined()
+})
diff --git a/packages/experimental/cua/tests/application-access.spec.ts b/packages/experimental/cua/tests/application-access.spec.ts
index fc77988a11..9e0eac7822 100644
--- a/packages/experimental/cua/tests/application-access.spec.ts
+++ b/packages/experimental/cua/tests/application-access.spec.ts
@@ -36,7 +36,7 @@ const identity = ApplicationAuthorizationResult.parse({ id: 'a'.repeat(64), name
 const handle = 'fixture-app' as CuaAppHandle
 const signal = new AbortController().signal
 
-async function setup(choice = 'Allow for this task', options: { writable?: boolean; questions?: boolean; initial?: readonly CuaApplicationGrant[] } = {}) {
+async function setup(choice = 'Allow for this session', options: { writable?: boolean; questions?: boolean; initial?: readonly CuaApplicationGrant[] } = {}) {
   native.instances.length = 0
   const ctx = new Context()
   onTestFinished(() => ctx.fiber.dispose())
@@ -63,7 +63,7 @@ it('refuses raw handle dispatch until getApp obtains consent', async () => {
   expect(dispatch).not.toHaveBeenCalled()
 })
 
-it('retains task consent for the exact helper handle without saving it', async () => {
+it('reuses session consent across application handles and connections without saving it', async () => {
   const f = await setup()
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await expect(f.access.run(f.client, handle, signal, async () => 'read')).resolves.toBe('read')
@@ -72,6 +72,11 @@ it('retains task consent for the exact helper handle without saving it', async (
   expect(f.save).not.toHaveBeenCalled()
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await expect(f.access.run(replacement, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
+  await f.access.select(f.agent, replacement, 'fresh-app' as CuaAppHandle, identity, signal)
+  await f.access.select(f.agent, replacement, 'restarted-app' as CuaAppHandle, identity, signal)
+  expect(f.answer).toHaveBeenCalledOnce()
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
+  await expect(f.access.run(replacement, 'restarted-app' as CuaAppHandle, signal, async () => 'read')).resolves.toBe('read')
 })
 
 it('does not repeatedly ask after an application is denied', async () => {
@@ -120,10 +125,10 @@ it('reuses only saved signed identities when a task or helper is replaced', asyn
 
 it.each([
   { answers: [] },
-  { answers: [{ id: 'another-question', selected: ['Allow for this task'] }] },
-  { answers: [{ id: 'cua-app-access', selected: ['Allow for this task', 'Deny'] }] },
+  { answers: [{ id: 'another-question', selected: ['Allow for this session'] }] },
+  { answers: [{ id: 'cua-app-access', selected: ['Allow for this session', 'Deny'] }] },
   { answers: [{ id: 'cua-app-access', selected: [], custom: 'Always allow' }] },
-  { answers: [{ id: 'cua-app-access', selected: ['Allow for this task'], custom: 'different scope' }] },
+  { answers: [{ id: 'cua-app-access', selected: ['Allow for this session'], custom: 'different scope' }] },
 ])('does not interpret an incomplete or free-text answer as consent: %j', async (answer) => {
   const f = await setup()
   f.answer.mockResolvedValueOnce(answer)
@@ -199,8 +204,8 @@ it('reuses one accepted question for duplicate selections', async () => {
   f.answer.mockImplementationOnce(() => { entered.resolve(); return answer.promise })
   const first = f.access.select(f.agent, f.client, handle, identity, signal)
   await entered.promise
-  const second = f.access.select(f.agent, f.client, handle, identity, signal)
-  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this task'] }] })
+  const second = f.access.select(f.agent, f.client, 'another-handle' as CuaAppHandle, identity, signal)
+  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
   await Promise.all([first, second])
   expect(f.answer).toHaveBeenCalledOnce()
   await expect(f.access.run(f.client, handle, signal, async () => 'allowed')).resolves.toBe('allowed')
@@ -244,7 +249,7 @@ it('cancels native work when saved consent is removed from configuration', async
     entered.resolve(undefined)
     return done.promise
   })
-  const rejected = expect(pending).rejects.toThrow('native cancelled')
+  const rejected = expect(pending).rejects.toThrow('APP_ACCESS_DENIED')
   await entered.promise
   await f.save([])
   f.ctx.emit('loader/volatile-update', [['allowedApps']])
@@ -279,7 +284,7 @@ it('rejects an answer for a helper that exits while the human question is pendin
   const rejected = expect(selected).rejects.toThrow('NATIVE_CLOSED')
   await entered.promise
   f.client.invalidate()
-  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this task'] }] })
+  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
   await rejected
 })
 
@@ -317,3 +322,57 @@ it('keeps an active task operation running when a different task denies the same
     await expect(pending).resolves.toBeNull()
   } finally { release.resolve(null); await pending }
 })
+
+
+it.each(['Allow for this session', 'Deny'])('retains %s when the same session gets a new agent', async (choice) => {
+  const f = await setup(choice)
+  const select = f.access.select(f.agent, f.client, handle, identity, signal)
+  if (choice === 'Deny') await expect(select).rejects.toThrow('APP_ACCESS_DENIED')
+  else await select
+  await f.owner.dispose()
+  f.access.forget(f.agent)
+  const owner = await f.ctx.agents.create({ sessionId: f.agent.id })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  const resumed = f.access.select(owner.agent, client, handle, identity, signal)
+  if (choice === 'Deny') await expect(resumed).rejects.toThrow('APP_ACCESS_DENIED')
+  else {
+    await resumed
+    await expect(f.access.run(client, handle, signal, async () => 'resumed')).resolves.toBe('resumed')
+  }
+  expect(f.answer).toHaveBeenCalledOnce()
+})
+
+it('asks separately for another session and a changed application identity', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('separate-session') })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(owner.agent, client, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(2)
+  await f.access.select(f.agent, f.client, 'changed-app' as CuaAppHandle,
+    { ...identity, id: 'b'.repeat(64) as typeof identity.id }, signal)
+  expect(f.answer).toHaveBeenCalledTimes(3)
+})
+
+it('revokes session consent even after its agent and connection are released', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  f.access.forget(f.agent)
+  await f.access.revoke(identity.id)
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await expect(f.access.select(f.agent, replacement, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  expect(f.answer).toHaveBeenCalledOnce()
+  f.access.retryApproval(identity.id)
+  await f.access.select(f.agent, replacement, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(2)
+})
+
+it('clears session consent when the provider is disabled and recreated', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.access.dispose()
+  const access = new ApplicationAccess(f.ctx, { grants: f.grants, save: f.save })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await access.select(f.agent, client, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(2)
+})
diff --git a/packages/experimental/cua/tsconfig.json b/packages/experimental/cua/tsconfig.json
index a73c2cfb2e..cb086d3e6f 100644
--- a/packages/experimental/cua/tsconfig.json
+++ b/packages/experimental/cua/tsconfig.json
@@ -41,6 +41,9 @@
     {
       "path": "../../ptc-runtime/ptc-runtime"
     },
+    {
+      "path": "../../typert/protocol"
+    },
     {
       "path": "../../settings/settings"
     },
@@ -55,6 +58,12 @@
     },
     {
       "path": "../../llm/llm"
+    },
+    {
+      "path": "../../core/scope"
+    },
+    {
+      "path": "../../preset/agent-preset-registry"
     }
   ]
 }
diff --git a/packages/experimental/cua/tsdown.config.ts b/packages/experimental/cua/tsdown.config.ts
index ccc53ca43d..f0d407249f 100644
--- a/packages/experimental/cua/tsdown.config.ts
+++ b/packages/experimental/cua/tsdown.config.ts
@@ -1,7 +1,7 @@
 import { defineConfig } from 'tsdown'
 
 export default defineConfig(Object.entries({
-  index: 'lib/types/index.js', api: 'lib/types/api.js', bridge: 'lib/types/bridge.js',
+  index: 'lib/types/index.js', types: 'lib/types/types.js', api: 'lib/types/api.js', bridge: 'lib/types/bridge.js',
   'native-client': 'lib/types/native-client.js', protocol: 'lib/types/protocol.js',
 }).map(([name, path]) => ({
   entry: { [name]: path },

From aa786c98d4aa194fcea7d2f5a11896c14d3f2642 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 06/44] feat(cua-macos): expose system permissions and
 responsible app

---
 .../experimental/cua-macos/README.i18n.yaml   |  12 +-
 packages/experimental/cua-macos/README.md     |  16 ++-
 packages/experimental/cua-macos/README.zh.md  |  16 ++-
 .../cua-macos/examples/macos.cordis.yml       |   1 +
 .../cua-macos/native/README.i18n.yaml         |  16 +--
 .../experimental/cua-macos/native/README.md   |   8 +-
 .../cua-macos/native/README.zh.md             |   8 +-
 .../Sources/CuaNative/NativePlatform.swift    |  27 +++-
 .../CuaNative/NativeProtocol.generated.swift  |   6 +
 .../Sources/CuaNative/Permissions.swift       |  69 ++++++++++
 .../Sources/CuaNative/RequestAdmission.swift  |   7 +
 .../CuaNative/RequestCoordinator.swift        |  27 +++-
 .../CuaNative/SharedHelperServer.swift        |  97 ++++++++++----
 .../cua-macos/native/protocol.schema.json     | 125 ++++++++++++++++++
 .../native/tests/LauncherFixture.swift        |  29 ++++
 .../native/tests/launcher_identity_e2e.py     |  76 +++++++++++
 .../native/tests/shared_helper_e2e.py         |  57 ++++++--
 .../tests/swift/PermissionIdentityTests.swift |  36 +++++
 .../native/tests/swift/ProtocolTests.swift    |   6 +
 .../experimental/cua-macos/src/guidance.ts    |   4 +-
 .../cua-macos/tests/large-image-ptc.spec.ts   |   2 +-
 .../tests/loader-composition.spec.ts          |   2 +-
 .../tests/persistent-bridge.built.e2e.ts      |   2 +-
 .../tests/protocol-generation.spec.ts         |   9 ++
 .../tests/provider-lifecycle.spec.ts          | 100 +++++++++++---
 25 files changed, 658 insertions(+), 100 deletions(-)
 create mode 100644 packages/experimental/cua-macos/native/Sources/CuaNative/Permissions.swift
 create mode 100644 packages/experimental/cua-macos/native/tests/LauncherFixture.swift
 create mode 100644 packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py

diff --git a/packages/experimental/cua-macos/README.i18n.yaml b/packages/experimental/cua-macos/README.i18n.yaml
index 5ed55c261a..477e2b7958 100644
--- a/packages/experimental/cua-macos/README.i18n.yaml
+++ b/packages/experimental/cua-macos/README.i18n.yaml
@@ -12,11 +12,11 @@
   en: 4549f02fc53854a5
   zh: 6f74f1130b6623a8
 /deepseek-ai-dsh-experimental-cua-macos/table-of-contents:
-  en: d152484eb41ac6b4
-  zh: 7b30b973a849247d
+  en: 867d9ec544719acf
+  zh: 92348599582dc33a
 /deepseek-ai-dsh-experimental-cua-macos/use-this-package:
-  en: e2e1797ad6b73f25
-  zh: 35b7a06e471e433c
+  en: f2ceaaa0c834a931
+  zh: 0edd75ea5323d07f
 /deepseek-ai-dsh-experimental-cua-macos/use-this-package/connect-an-external-execution-environment:
   en: e7909c9b43e44fbc
   zh: 98949877d4ea3a86
@@ -45,8 +45,8 @@
   en: a2c9acb5a4320dda
   zh: e8d1586af60215c4
 /deepseek-ai-dsh-experimental-cua-macos/known-limitations-and-deferred-work:
-  en: 9d8af4c39fe407a3
-  zh: afec49eedfd702cb
+  en: 1c42b446c186b01b
+  zh: 0f1ecea4fd0a1a13
 /deepseek-ai-dsh-experimental-cua-macos/known-limitations-and-deferred-work/dev-note:
   en: b836f01bd0bceb4a
   zh: 8122fa08b2aa95fa
diff --git a/packages/experimental/cua-macos/README.md b/packages/experimental/cua-macos/README.md
index 74887ae936..ed56375c26 100644
--- a/packages/experimental/cua-macos/README.md
+++ b/packages/experimental/cua-macos/README.md
@@ -20,12 +20,16 @@ Inspect macOS permissions, select running applications and windows, read accessi
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
+The helper supplies bounded 64-pixel PNG application icons for permission prompts and saved-application lists. Icon reads do not launch an application or inspect its windows; executable and signing checks still determine authorization.
+
+The shared helper queries the process macOS considers responsible for it and captures that application’s name and icon before announcing readiness. A Desktop app launched from Terminal can therefore identify Terminal even when another GUI application sits between it and the helper. Permission queries retain this metadata after the responsible application exits and across connections sharing the helper. If the system query or application metadata is unavailable, the field is omitted and the UI uses the system prompt for guidance.
+
 -----
 
 <a id="use-this-package"></a>
 ## Use this package
 
-Enable this experimental provider through explicit source composition on macOS 14 or later. Windows support is in development. Shipped profiles do not mount it. Prepare a native helper and load the registry/provider overlay:
+For repository Web use, enable [Computer Use](../cua-bundle/README.md) in Plugins. This prepares the local executable on macOS 14 or later; Windows support is in development. Subsequent builds check it while the existing Web profile keeps the bundle selected. Disabled profiles do not prepare native components. Explicit source composition is also available:
 
 ```sh
 swift build --package-path packages/experimental/cua-macos/native --configuration release
@@ -34,7 +38,7 @@ export DSH_CUA_HELPER="$cua_native_root/.build/release/dsh-cua-native"
 pnpm dsh headless --patch packages/experimental/cua-macos/examples/macos.cordis.yml --dump-config
 ```
 
-The dump command checks profile composition without a model request. For a real task, replace `--dump-config` with a prompt and configure the profile’s model credentials. The overlay mounts the computer-use registry and this provider; remove an existing competing provider before using it. The responsible host/helper needs Accessibility permission for AX/input and Screen Recording permission for capture. `getCapabilities` reports permissions and session lock state without opening a system dialog. Locked or unavailable desktop sessions reject UI observations and input before dispatch; the user must unlock macOS before resuming. `listApps` and `cua.getState` list running applications. `findApps(query)` searches standard macOS application directories by name, bundle ID or absolute path. `getApp` selects a unique name, bundle ID, path or running PID, obtains application consent, and launches a stopped app in the background when needed. A stopped executable is identified before approval and checked again before and after launch; unsigned code only receives task access. The returned object reads initial AX without activating the app. Launch cancellation may leave the application running. Model guidance starts with background observation and input, without activation during initialization or before each action. For hidden or minimized windows, try `app.show()` or `window.show()` and read fresh state. This requests unhide and unminimize without activation, raising or switching Spaces; app-level restoration selects the focused, main or sole AX window. The result names the selected `windowId`, or null when no window was selected, and reports `foregroundChanged` by comparing the front app and top window before and after the request. Null means foreground evidence was unavailable; later focus changes remain possible. If restoration fails or the window remains unusable, explain the needed foreground step, call `app.activate()` or an observed window’s `raise` action, then observe again. Necessary foreground access takes priority over preserving focus. Applications may change focus after input; background delivery does not guarantee an undisturbed user session.
+The dump command checks profile composition without a model request. For a real task, replace `--dump-config` with a prompt and configure the profile’s model credentials. The overlay mounts the computer-use registry and this provider; remove an existing competing provider before using it. The responsible host/helper needs Accessibility permission for AX/input and Screen Recording permission for capture. `getCapabilities` reports permissions and session lock state without opening a system dialog. Locked or unavailable desktop sessions reject UI observations and input before dispatch; the user must unlock macOS before resuming. `listApps` and `cua.getState` list running applications. `findApps(query)` searches standard macOS application directories by name, bundle ID or absolute path. `getApp` selects a unique name, bundle ID, path or running PID, obtains application consent, and launches a stopped app in the background when needed. A stopped executable is identified before approval and checked again before and after launch; unsigned code only receives session access for the selected instance. The returned object reads initial AX without activating the app. Launch cancellation may leave the application running. Model guidance starts with background observation and input, without activation during initialization or before each action. For hidden or minimized windows, try `app.show()` or `window.show()` and read fresh state. This requests unhide and unminimize without activation, raising or switching Spaces; app-level restoration selects the focused, main or sole AX window. The result names the selected `windowId`, or null when no window was selected, and reports `foregroundChanged` by comparing the front app and top window before and after the request. Null means foreground evidence was unavailable; later focus changes remain possible. If restoration fails or the window remains unusable, explain the needed foreground step, call `app.activate()` or an observed window’s `raise` action, then observe again. Necessary foreground access takes priority over preserving focus. Applications may change focus after input; background delivery does not guarantee an undisturbed user session.
 
 | Field | Default | Meaning |
 | --- | --- | --- |
@@ -59,7 +63,7 @@ Keypad names (`KP_0` through `KP_9`, `KP_Enter`, and keypad operators) retain th
 
 Agent disposal and plugin unload cancel and await the complete tool call, including image admission and attachment storage. An image write already in progress must settle before disposal returns; a canceled call cannot return a successful screenshot.
 
-Application consent is enforced before AX reads, window-title reads, screenshots, activation, and input through the CUA tool. User Questions offers task access or denial, plus saved access when the application has a verifiable signature and the composition provides settings persistence. Task access is bound to the selected process handle; saved access is bound to its canonical executable path and designated code-signing requirement. Denial prevents repeated prompts in that task. Removing a saved `allowedApps` entry cancels affected operations and invalidates their helper handles; reauthorization requires fresh selection. Other handles on the same Agent connection also expire, while saved grants remain reusable. Agent/provider disposal joins cleanup of the corresponding native connection. See the [application consent decision](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md). These checks govern CUA calls; persistent PTC and separately authorized shell tools retain their own execution authority.
+Application consent is enforced before AX reads, window-title reads, screenshots, activation, and input through the CUA tool. The first selection asks the human for session access, denial, or saved access when the application has a verifiable signature. Session access is kept in memory by session and application identity, survives agent and helper replacement, and expires when DSH restarts or Computer Use is disabled. Signed application identities combine the canonical executable path and designated code-signing requirement; unverifiable applications remain bound to their process instance. Denial prevents repeated prompts in that session. Revocation reads and removes saved access in the same queue as grant creation, invalidates each affected Agent connection, and awaits its native cleanup without replaying input. Every app handle on those Agent connections becomes unusable; other applications need fresh selection, but their session and saved grants remain reusable. See the [application consent decision](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md). These checks govern CUA calls; persistent PTC and separately authorized shell tools are not an operating-system sandbox.
 
 Raw `getState` exposes validated state fields and the complete text for the requested disclosure options. The native helper also returns structured element diagnostics for native checks; the tool projection omits that duplicate array from model text and structured tool values.
 
@@ -147,7 +151,7 @@ The plugin contributes one `cua` operation tool with method-specific parameters.
 ##### Operation guidance (verbatim)
 
 ```markdown
-Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user explicitly grants access again. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
+Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user allows another request on the permission page. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
 
 Initialize the object API once in persistent PTC. Reuse its variables in later calls; put temporary declarations inside { ... } blocks to avoid redeclaration errors. All object methods are async. getAXState returns text, not a structured state object. Its text separates values and placeholders, and reports subroles, help, URLs, disabled/focused/selected/expanded state and UTF-16 selection ranges when available. Writability is true, false or unknown on relevant controls; omitted state fields do not assert false. selection=unavailable means the reported range exceeds the observed text. Compact output omits ordinary Press/Pick (click), ShowMenu (right click) and ScrollToVisible actions; details=true lists every available action. Use the displayed action name with performSecondaryAction; ambiguous aliases require the complete name from details=true. Truncation reports the reached provider limit. Narrow the window or increase that provider limit before reading again.
 
@@ -184,7 +188,7 @@ App and Window methods:
 
 Raw operation tools use { method, params }, including params: {} for parameterless methods. getApp selects without activating the app. Keep applications in the background for observation and routine input. Do not activate or raise an app during initialization, before each action, or merely because another app is foreground. Prefer advertised AX actions. If a window is hidden or minimized, try app.show() or window.show() and read fresh state. show requests unhide and unminimize without activation, raising or switching Spaces; it chooses the explicit, focused, main or sole AX window. A null windowId means no window was selected for restoration. foregroundChanged compares the front app and top window before and after the request; null means unavailable, and delayed focus changes remain possible. If restoration is unsupported or the window remains unusable, including another Space or Stage Manager, explain the needed foreground step, use app.activate() or an advertised raise action, and read fresh state. Completing the task takes priority when foreground access is necessary. Avoid repeated activation when the user switches away; continue background-capable steps and report what requires foreground access. Applications may still change focus in response to input.
 
-Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to grant macOS Accessibility or Screen Recording access in System Settings. After granting access, observe fresh state before continuing; do not automatically replay prior input.
+Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to complete the Computer Use permission setup for macOS Accessibility or Screen Recording. After granting access, observe fresh state before continuing; do not automatically replay prior input.
 
 Hover first uses advertised AX alternate UI without moving the system cursor, preserving revealed descendants until the pointer target leaves their region. When unavailable, it moves the visible system cursor without pressing a button; that route requires the target point to be unobscured in the foreground app. FOREGROUND_REQUIRED requires explicit activation or raising and a fresh observation before retrying. Returning, AX reads and screenshots do not restore the previous point. Wait for the application's hover delay, observe, then hover into the revealed controls before clicking. Use successive hover calls for intermediate points. The result reports hoverRoute and systemPointerMoved. Other input or application changes can interrupt the interaction; app objects do not reserve applications between calls.
 
@@ -210,7 +214,7 @@ The queue orders individual native requests. Holding an app object does not rese
 - macOS Stage Manager can reduce background window bounds and screenshots to thumbnails. Full-window observation and coordinate input in this state are not guaranteed; model guidance requires explaining foreground needs and avoiding repeated focus reclamation.
 - Background input depends on private SkyLight symbols; macOS updates can make them unavailable. Validate each target OS version.
 - Observed failures include dispatched Unicode text not appearing in Blender and background Command+A not selecting all text in AppKit. Inspect application state after input; a successful tool result confirms dispatch only.
-- Native binaries require a local build. Signing, distribution, and system-permission onboarding remain deferred.
+- Native binaries require a local build. Signing and Desktop distribution remain future work. The [permission page](../client-ui-cua/README.md) offers macOS prompts and app revocation; packaged Desktop permission attribution remains deferred.
 - Persistent PTC is an external dependency assumption, not an implementation in this package. Real-model task success requires separate evaluation beyond native and protocol fixtures.
 
 -----
diff --git a/packages/experimental/cua-macos/README.zh.md b/packages/experimental/cua-macos/README.zh.md
index 43c37296bb..ffbd21b79c 100644
--- a/packages/experimental/cua-macos/README.zh.md
+++ b/packages/experimental/cua-macos/README.zh.md
@@ -20,12 +20,16 @@ kind: "package-reference"
 - [已知限制与后续工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
+helper 为授权提示和已授权应用列表提供 64 像素 PNG 图标。读取图标不会启动应用或检查窗口，授权仍由可执行文件和签名校验决定。
+
+共享 helper 查询 macOS 为它记录的责任进程，在发布就绪状态前保存对应应用的名称和图标。因此，从 Terminal 启动 Desktop 时，即使中间还有另一个 GUI 应用，也能识别到 Terminal。责任应用退出后，权限查询仍保留这些信息，后续复用该 helper 的连接读取同一份记录。系统查询或应用信息不可用时省略该字段，由界面引导用户按系统弹窗选择授权对象。
+
 -----
 
 <a id="use-this-package"></a>
 ## 使用本包
 
-该实验性提供方需要在 macOS 14 及以上通过源码配置显式启用。Windows 支持正在开发中。默认配置不加载它。先准备原生组件，再加载注册表和提供方覆盖层：
+从仓库运行 Web 时，在插件页开启 [Computer Use](../cua-bundle/README.zh.md)。首次启用会在 macOS 14 及以上准备本机组件，Windows 支持正在开发中。现有 Web profile 保持选中时，后续构建继续检查更新。未开启的 profile 不准备原生组件。也可以显式加载源码覆盖层：
 
 ```sh
 swift build --package-path packages/experimental/cua-macos/native --configuration release
@@ -34,7 +38,7 @@ export DSH_CUA_HELPER="$cua_native_root/.build/release/dsh-cua-native"
 pnpm dsh headless --patch packages/experimental/cua-macos/examples/macos.cordis.yml --dump-config
 ```
 
-配置输出命令不发起模型请求。执行真实任务时，将 `--dump-config` 替换为任务提示，并配置该 profile 的模型凭据。配置挂载 computer-use 注册表和本 provider；使用前需移除已有的竞争 provider。负责执行的宿主或辅助进程需要辅助功能权限来读取 AX 和输入，需要屏幕录制权限来截图。`getCapabilities` 查询权限和锁屏状态，不弹出系统授权窗口。桌面会话锁定或不可用时，界面观察与输入会在分派前拒绝，需由用户解锁 macOS 后继续。`listApps` 和 `cua.getState` 列出运行中的应用。`findApps(query)` 按名称、bundle ID 或绝对路径搜索 macOS 标准应用目录。`getApp` 按唯一名称、bundle ID、路径或运行中的 PID 选择应用，取得应用许可后，在需要时后台启动尚未运行的应用。启动前先确认可执行文件身份，授权后在启动前后再次核对；未签名代码只取得任务许可。返回的对象读取初始 AX，不自动激活应用。启动被取消时，应用可能已经运行。模型指引要求先在后台观察和输入，不在初始化或每次动作前激活应用。窗口隐藏或最小化时，先尝试 `app.show()` 或 `window.show()`，再重新观察。它请求取消隐藏和恢复最小化，不主动激活、抬起窗口或切换桌面空间；应用级恢复选择焦点窗口、主窗口或唯一 AX 窗口。结果通过 `windowId` 指明选中的窗口，未选中时为 null；`foregroundChanged` 比较操作前后的前台应用和最上层窗口，无法取得完整观察时为 null，返回后仍可能发生焦点变化。恢复失败或窗口仍不可用时，说明需要前台的步骤，再调用 `app.activate()` 或窗口的 `raise` 动作并重新观察。必须使用前台时，以完成任务为先。应用收到输入后仍可能改变焦点，后台投递不保证用户操作始终不受干扰。
+配置输出命令不发起模型请求。执行真实任务时，将 `--dump-config` 替换为任务提示，并配置该 profile 的模型凭据。配置挂载 computer-use 注册表和本 provider；使用前需移除已有的竞争 provider。负责执行的宿主或辅助进程需要辅助功能权限来读取 AX 和输入，需要屏幕录制权限来截图。`getCapabilities` 查询权限和锁屏状态，不弹出系统授权窗口。桌面会话锁定或不可用时，界面观察与输入会在分派前拒绝，需由用户解锁 macOS 后继续。`listApps` 和 `cua.getState` 列出运行中的应用。`findApps(query)` 按名称、bundle ID 或绝对路径搜索 macOS 标准应用目录。`getApp` 按唯一名称、bundle ID、路径或运行中的 PID 选择应用，取得应用许可后，在需要时后台启动尚未运行的应用。启动前先确认可执行文件身份，授权后在启动前后再次核对；未签名代码只能取得所选实例的会话许可。返回的对象读取初始 AX，不自动激活应用。启动被取消时，应用可能已经运行。模型指引要求先在后台观察和输入，不在初始化或每次动作前激活应用。窗口隐藏或最小化时，先尝试 `app.show()` 或 `window.show()`，再重新观察。它请求取消隐藏和恢复最小化，不主动激活、抬起窗口或切换桌面空间；应用级恢复选择焦点窗口、主窗口或唯一 AX 窗口。结果通过 `windowId` 指明选中的窗口，未选中时为 null；`foregroundChanged` 比较操作前后的前台应用和最上层窗口，无法取得完整观察时为 null，返回后仍可能发生焦点变化。恢复失败或窗口仍不可用时，说明需要前台的步骤，再调用 `app.activate()` 或窗口的 `raise` 动作并重新观察。必须使用前台时，以完成任务为先。应用收到输入后仍可能改变焦点，后台投递不保证用户操作始终不受干扰。
 
 | 字段 | 默认值 | 含义 |
 | --- | --- | --- |
@@ -59,7 +63,7 @@ pnpm dsh headless --patch packages/experimental/cua-macos/examples/macos.cordis.
 
 Agent 销毁和插件卸载会取消并等待完整工具调用，包括图像接入检查和附件存储。已经开始的图像写入必须结束后，销毁才会返回；已取消的调用不会返回成功截图。
 
-CUA 工具在读取 AX、窗口标题、截图、激活和输入之前检查应用授权。User Questions 提供任务级允许和拒绝选项；应用签名可验证且组合支持配置持久化时，也可保存授权。任务授权绑定所选进程句柄，长期授权绑定真实可执行路径和指定代码签名要求。拒绝后，同一任务不再反复询问。删除保存的 `allowedApps` 条目会取消相关操作并使原生组件中的句柄失效；重新授权需要重新选择应用。同一 Agent 连接中的其他句柄也会失效，已保存的授权仍可复用。Agent 或提供方销毁时等待对应连接的原生状态清理。设计理由见[应用授权决策](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md)。这些检查约束 CUA 调用；持久 PTC 和另行授权的 shell 工具保留各自的执行权限。
+CUA 工具在读取 AX、窗口标题、截图、激活和输入前检查应用授权。首次选择应用时询问用户，可选择本会话允许、拒绝；签名可验证的应用还可保存长期授权。会话许可按会话和应用身份保存在内存中，Agent 或 helper 重建后仍可复用，重启 DSH 或关闭 Computer Use 后失效。已签名应用的身份由规范化可执行文件路径和代码签名指定要求组成；签名不可验证的应用仍绑定进程实例。拒绝后，同一会话不会反复询问。撤销与长期许可的保存共用队列，在队列内读取并移除许可，然后使相关 Agent 连接失效并等待原生清理完成，不自动重放输入。同一 Agent 连接中的其他应用也需要重新选择，其他应用的会话许可和长期许可仍可复用。设计理由见[应用授权决策](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md)。这些检查的范围是 CUA 调用。persistent PTC 与已授权的 shell 仍按各自执行权限运行。
 
 原始 `getState` 操作返回经过校验的状态字段，以及按本次披露选项生成的完整文本。原生 helper 还返回供原生检查使用的结构化元素诊断数组；工具投影会从模型文本和结构化工具值中移除这份重复数组。
 
@@ -147,7 +151,7 @@ AppKit sheet 可以通过其窗口 ID 单独选择，也会出现在所属文档
 ##### 操作指导文本（原文）
 
 ```markdown
-Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user explicitly grants access again. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
+Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user allows another request on the permission page. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
 
 Initialize the object API once in persistent PTC. Reuse its variables in later calls; put temporary declarations inside { ... } blocks to avoid redeclaration errors. All object methods are async. getAXState returns text, not a structured state object. Its text separates values and placeholders, and reports subroles, help, URLs, disabled/focused/selected/expanded state and UTF-16 selection ranges when available. Writability is true, false or unknown on relevant controls; omitted state fields do not assert false. selection=unavailable means the reported range exceeds the observed text. Compact output omits ordinary Press/Pick (click), ShowMenu (right click) and ScrollToVisible actions; details=true lists every available action. Use the displayed action name with performSecondaryAction; ambiguous aliases require the complete name from details=true. Truncation reports the reached provider limit. Narrow the window or increase that provider limit before reading again.
 
@@ -184,7 +188,7 @@ App and Window methods:
 
 Raw operation tools use { method, params }, including params: {} for parameterless methods. getApp selects without activating the app. Keep applications in the background for observation and routine input. Do not activate or raise an app during initialization, before each action, or merely because another app is foreground. Prefer advertised AX actions. If a window is hidden or minimized, try app.show() or window.show() and read fresh state. show requests unhide and unminimize without activation, raising or switching Spaces; it chooses the explicit, focused, main or sole AX window. A null windowId means no window was selected for restoration. foregroundChanged compares the front app and top window before and after the request; null means unavailable, and delayed focus changes remain possible. If restoration is unsupported or the window remains unusable, including another Space or Stage Manager, explain the needed foreground step, use app.activate() or an advertised raise action, and read fresh state. Completing the task takes priority when foreground access is necessary. Avoid repeated activation when the user switches away; continue background-capable steps and report what requires foreground access. Applications may still change focus in response to input.
 
-Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to grant macOS Accessibility or Screen Recording access in System Settings. After granting access, observe fresh state before continuing; do not automatically replay prior input.
+Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to complete the Computer Use permission setup for macOS Accessibility or Screen Recording. After granting access, observe fresh state before continuing; do not automatically replay prior input.
 
 Hover first uses advertised AX alternate UI without moving the system cursor, preserving revealed descendants until the pointer target leaves their region. When unavailable, it moves the visible system cursor without pressing a button; that route requires the target point to be unobscured in the foreground app. FOREGROUND_REQUIRED requires explicit activation or raising and a fresh observation before retrying. Returning, AX reads and screenshots do not restore the previous point. Wait for the application's hover delay, observe, then hover into the revealed controls before clicking. Use successive hover calls for intermediate points. The result reports hoverRoute and systemPointerMoved. Other input or application changes can interrupt the interaction; app objects do not reserve applications between calls.
 
@@ -210,7 +214,7 @@ Use selectText only on controls advertising selectionWritable. It selects a uniq
 - macOS 台前调度可能将后台窗口的尺寸与截图变为缩略图，当前无法保证这种状态下的完整画面与坐标输入；模型指引要求说明前台需求并避免反复抢回焦点。
 - 后台输入依赖私有 SkyLight 符号，macOS 升级可能使其不可用，需在目标系统版本验证。
 - 实测 Blender Unicode 输入曾出现分派成功但界面未显示文本，后台 AppKit 的 Command+A 曾未选中全文。输入后必须检查应用状态；工具返回成功只表示已分派。
-- 原生二进制需要本地构建。签名、分发和系统权限引导留待后续。
+- 原生二进制需要本地构建，签名和桌面分发留待后续。[权限页面](../client-ui-cua/README.zh.md)提供 macOS 申请入口和应用授权撤销；桌面安装包的权限归属留待后续处理。
 - 持久 PTC 是对外部运行环境的假设，本包不实现它。真实模型任务成功率需要在原生测试和协议测试之外单独评估。
 
 -----
diff --git a/packages/experimental/cua-macos/examples/macos.cordis.yml b/packages/experimental/cua-macos/examples/macos.cordis.yml
index 94942836e0..f1b471523d 100644
--- a/packages/experimental/cua-macos/examples/macos.cordis.yml
+++ b/packages/experimental/cua-macos/examples/macos.cordis.yml
@@ -4,4 +4,5 @@
     - id: cua
       name: '../src/index.ts'
       config:
+        agentPreset: false
         helperPath: !!js process.env.DSH_CUA_HELPER
diff --git a/packages/experimental/cua-macos/native/README.i18n.yaml b/packages/experimental/cua-macos/native/README.i18n.yaml
index 626dc16c0d..cdaaf8ba43 100644
--- a/packages/experimental/cua-macos/native/README.i18n.yaml
+++ b/packages/experimental/cua-macos/native/README.i18n.yaml
@@ -15,17 +15,17 @@
   en: e8cbc43d38786c40
   zh: 52b3ba85d98011b9
 /dsh-cua-native-helper/build-and-service:
-  en: 824e4a2b9036d9bf
-  zh: 37c34a454abc6965
+  en: 02b25ac1126b6094
+  zh: 3995a1f46354531b
 /dsh-cua-native-helper/request-protocol:
-  en: 3202c567a6e1a654
-  zh: 143eebd0096a0487
+  en: c8ad13843989b314
+  zh: 2a42acb2faee8803
 /dsh-cua-native-helper/observation-and-input:
-  en: f2db99ae46a21c61
-  zh: 48c6752bd71dbf27
+  en: ce99636fae06e66c
+  zh: d3c983e8a47916b2
 /dsh-cua-native-helper/verification:
-  en: 2afe5ceb0a3c4965
-  zh: 86bf7187ddae489f
+  en: ba3277817f4da729
+  zh: 4642abf830234a3b
 /dsh-cua-native-helper/further-exploration:
   en: 265e1927952ce6d7
   zh: 7c35d9fd98b6e6c8
diff --git a/packages/experimental/cua-macos/native/README.md b/packages/experimental/cua-macos/native/README.md
index c5ce8798f4..4299301dfc 100644
--- a/packages/experimental/cua-macos/native/README.md
+++ b/packages/experimental/cua-macos/native/README.md
@@ -27,7 +27,7 @@ Build with `swift build --package-path packages/experimental/cua-macos/native --
 
 The shared service uses an owner-only Unix socket under `/tmp/dsh-cua-<uid>`, keyed by the executable SHA-256. A version lock elects one process; an additional real-executable-path lock excludes a different build at the same path. The first frame is protocol-1 `hello` with the runtime key and this connection’s byte, AX, operation, screenshot, event-spacing and cleanup limits. `ready` reports the verified runtime key, PID and instance ID. Every connection owns an independent AXWorker. The stdin/stdout entry is a diagnostic proxy to this service.
 
-AppKit runs on the main event loop. Blocking AX and input use each connection’s serial actor; all connections share a FIFO for complete desktop operations. Socket writes do not hold that operation slot. A request cancellation waits for native work to stop; it does not cancel the connection’s lifetime latch. Screenshot timeout ends only the request. An unfinished system capture retains the single capture slot until its real callback arrives, rejects new captures with CAPTURE_BUSY and leaves AX/input available. Only an operation or cleanup that cannot stop can invalidate the shared process. The proxy accepts `--max-request-bytes`, `--max-response-bytes`, `--ax-timeout-ms`, `--timeout-ms`, `--screenshot-timeout-ms`, `--shutdown-grace-ms` and `--text-event-interval-ms`; the Host sets the same limits in hello. An AX deadline bounds an individual system call. Cancellation can follow partial input, and uncertain input is never replayed automatically.
+AppKit runs on the main event loop. Blocking socket accepts and handshakes use background queues; server callbacks explicitly carry `@MainActor @Sendable` isolation and weak ownership. Shutdown releases accepted connections even when their handshake is incomplete. Blocking AX and input use each connection’s serial actor; all connections share a FIFO for complete desktop operations. Socket writes do not hold that operation slot. A request cancellation waits for native work to stop; it does not cancel the connection’s lifetime latch. Screenshot timeout ends only the request. An unfinished system capture retains the single capture slot until its real callback arrives, rejects new captures with CAPTURE_BUSY and leaves AX/input available. Only an operation or cleanup that cannot stop can invalidate the shared process. The proxy accepts `--max-request-bytes`, `--max-response-bytes`, `--ax-timeout-ms`, `--timeout-ms`, `--screenshot-timeout-ms`, `--shutdown-grace-ms` and `--text-event-interval-ms`; the Host sets the same limits in hello. An AX deadline bounds an individual system call. Cancellation can follow partial input, and uncertain input is never replayed automatically.
 
 
 -----
@@ -57,7 +57,7 @@ Every app-targeted operation requires `appHandle` from `getApp` in the same help
 
 Stable error codes are `INVALID_REQUEST` (malformed envelope), `INVALID_ARGUMENT` (invalid parameters), `UNSUPPORTED` (unknown operation), `APP_UNAVAILABLE`, `AMBIGUOUS_APP`, `STALE_APP`, `STALE_SNAPSHOT`, `WINDOW_UNAVAILABLE`, `WINDOW_CHANGED`, `PERMISSION_DENIED`, `FOREGROUND_REQUIRED` (hover target is not the unobscured foreground window), `PANEL_NOT_READY` (system panel recipient unavailable before input), and `NATIVE_ERROR` (remaining operating-system failures). An error never promises that a partially dispatched input was rolled back. The host must not retry input automatically.
 
-Application selection verifies the executable path and code-signing requirement before returning an authorization identity to the Host. Unsigned running applications receive a process-lifetime identity; stopped unsigned applications use an executable digest and cannot receive persistent consent. The Host obtains human consent before launch, observation or input.
+Application selection returns an authorization record to the Host: a digest of canonical executable path and verified designated signing requirement, display name, executable path, and persistable flag. Unsigned or ad-hoc-signed applications cannot receive saved consent; running instances use process-lifetime identity, while stopped applications use an executable digest. The Host strips this record from model results and obtains human consent before launch, observation or input. This pipe protocol is trusted Host transport, not a sandbox against a separately authorized shell process.
 
 Protocol declarations are generated from [the shared protocol](../../cua/src/protocol.ts). Run `pnpm exec tsx packages/experimental/cua-macos/native/generate-protocol.ts` from the repository root; package tests verify generated JSON and Swift field/enum tables. Model-submittable parameters exclude Host resource bounds and the private launch continuation.
 
@@ -77,6 +77,8 @@ Capture and pointer delivery read CG bounds before and after an exact-window AX
 
 The responsible host/helper needs macOS Accessibility permission for AX state and input, and Screen Recording permission for screenshots. Capability preflight and permission errors do not grant permissions. Capture refuses a window that moves or resizes while the image is being read. Unassociated system panels and accessory-only applications are not selectable.
 
+Host-only permission controls are `permissionStatus {}`, `requestPermission {permission}`, and `openPermissionSettings {permission}`, where permission is `accessibility` or `screenRecording`. They are excluded from model tools and from `getCapabilities.methods`. Permission status includes observed helper/parent process paths; these paths do not identify the TCC responsible application. The operating-system prompt names the application and asks for the user’s decision. The helper identifies the responsible process with the optional libSystem SPI `responsibility_get_pid_responsible_for_pid`, then captures its application name and icon before publishing readiness. The function is resolved dynamically, following the same signature used by [Chromium](https://chromium.googlesource.com/chromium/src/+/refs/tags/134.0.6998.28/base/process/process_info_mac.mm). If the symbol, process, or application metadata is unavailable, attribution stays unknown; it is not inferred from the nearest GUI ancestor. Permission checks remain independent of this metadata.
+
 Observation reads each non-layout node’s descriptive properties and children through `AXUIElementCopyMultipleAttributeValues`. Per-attribute errors retain the individual-read rules; unsupported batch APIs use individual reads. Values are retained only during that observation, and input reads live attributes. Application state can change between nodes; a batch does not make the whole tree atomic.
 
 System file-panel keyboard routing resolves the remote recipient through the selected app’s focused AX sheet. Only Apple’s Open and Save Panel Service is accepted, and its focused ancestry must still contain the identified remote window. Element pointer fallbacks resolve an app-owned window or sheet through AX parents when AXWindow is unavailable. AX actions retain priority over pointer input; visual click markers need no system-cursor movement.
@@ -101,6 +103,8 @@ Use `python3 packages/experimental/cua-macos/native/tests/test_swift.py` for off
 
 Run `python3 packages/experimental/cua-macos/native/tests/shared_helper_e2e.py --helper /absolute/helper` to verify concurrent startup, a shared service PID, independent handles, same-application handoff, request-local screenshot deadlines, connection cleanup and signal shutdown with an owned AppKit fixture. Existing Accessibility and Screen Recording grants are required. `--without-desktop` limits the check to protocol and process lifetime.
 
+Run `python3 packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py --helper /absolute/helper` in a GUI login session to verify a Launch Services application that starts a nested GUI launcher and then the helper. The helper identifies the outer responsible application and retains its name and icon after the launchers exit. This check owns both applications and the helper, cleans up its Launch Services registrations, and does not request Accessibility or Screen Recording access.
+
 Run `python3 packages/experimental/cua-macos/native/tests/axless_e2e.py` after building and unlocking the Mac to verify an owned window whose application removes and later restores its AX roots. The check requires existing Accessibility/Screen Recording grants, rejects stale element indices, captures the AXless window, verifies a coordinate click in the fixture state file, and checks restoration. It never changes system permission settings.
 
 Run `python3 packages/experimental/cua-macos/native/tests/observation_benchmark.py --reference-helper /absolute/reference --candidate-helper /absolute/candidate --artifacts /private/evidence` to compare complete observations of the same owned AppKit window with 35 and 400 synthetic rows. Each helper receives one warmup and three alternating measured requests. All result fields must match except helper-generated app and snapshot IDs. The report keeps raw timings, byte counts, hashes and replies; it sets no CI speed threshold and makes no memory claim. Fixture startup can activate the application. Run without other desktop automation or compilation jobs.
diff --git a/packages/experimental/cua-macos/native/README.zh.md b/packages/experimental/cua-macos/native/README.zh.md
index ed5a5c8687..6c5e4b5f8a 100644
--- a/packages/experimental/cua-macos/native/README.zh.md
+++ b/packages/experimental/cua-macos/native/README.zh.md
@@ -27,7 +27,7 @@ kind: "package-reference"
 
 共享服务在 `/tmp/dsh-cua-<uid>` 下使用仅所有者可访问的 Unix socket，以可执行文件的 SHA-256 区分实例。版本锁选出一个进程，另一个真实可执行路径锁排除同一路径的不同构建。首帧为协议版本 1 的 `hello`，包含运行时标识以及该连接的字节、AX、操作、截图、事件间隔和清理限制。`ready` 返回已核实的运行时标识、PID 和实例 ID。每条连接拥有独立的 AXWorker。stdin/stdout 入口是该服务的诊断代理。
 
-AppKit 在主事件循环上运行。阻塞式 AX 和输入使用每条连接的串行 actor，所有连接共享用于完整桌面操作的 FIFO。socket 写出不占用操作槽位。请求取消会等待原生工作停止，不取消连接的生命期控制器。截图超时只结束该请求。未完成的系统捕获保留唯一捕获槽位，直至真实回调到达；期间新截图返回 CAPTURE_BUSY，AX 和输入仍可用。只有无法停止的操作或清理才可能使共享进程失效。代理接受 `--max-request-bytes`、`--max-response-bytes`、`--ax-timeout-ms`、`--timeout-ms`、`--screenshot-timeout-ms`、`--shutdown-grace-ms` 和 `--text-event-interval-ms`；Host 在 hello 中设置相同限制。AX 超时约束单次系统调用。取消可能发生在部分输入之后，结果不确定的输入不自动重放。
+AppKit 在主事件循环上运行。阻塞式 socket 接收与握手使用后台队列，服务回调明确声明 `@MainActor @Sendable` 隔离，并弱引用服务对象。关闭时会释放已接收的连接，包括尚未完成握手的连接。阻塞式 AX 和输入使用每条连接的串行 actor，所有连接共享用于完整桌面操作的 FIFO。socket 写出不占用操作槽位。请求取消会等待原生工作停止，不取消连接的生命期控制器。截图超时只结束该请求。未完成的系统捕获保留唯一捕获槽位，直至真实回调到达；期间新截图返回 CAPTURE_BUSY，AX 和输入仍可用。只有无法停止的操作或清理才可能使共享进程失效。代理接受 `--max-request-bytes`、`--max-response-bytes`、`--ax-timeout-ms`、`--timeout-ms`、`--screenshot-timeout-ms`、`--shutdown-grace-ms` 和 `--text-event-interval-ms`；Host 在 hello 中设置相同限制。AX 超时约束单次系统调用。取消可能发生在部分输入之后，结果不确定的输入不自动重放。
 
 
 -----
@@ -57,7 +57,7 @@ AppKit 在主事件循环上运行。阻塞式 AX 和输入使用每条连接的
 
 稳定错误码包括 `INVALID_REQUEST`（信封无效）、`INVALID_ARGUMENT`（参数无效）、`UNSUPPORTED`（操作未知）、`APP_UNAVAILABLE`、`AMBIGUOUS_APP`、`STALE_APP`、`STALE_SNAPSHOT`、`WINDOW_UNAVAILABLE`、`WINDOW_CHANGED`、`PERMISSION_DENIED`、`FOREGROUND_REQUIRED`（悬停目标不是未被遮挡的前台窗口）、`PANEL_NOT_READY`（输入前系统面板接收方尚不可用）及 `NATIVE_ERROR`（其余操作系统失败）。错误不保证已分派的部分输入被回滚，Host 不得自动重试输入。
 
-应用选择先核实可执行路径和代码签名要求，再向 Host 返回授权身份。未签名的运行中应用使用进程生命期身份，未启动的未签名应用使用可执行文件摘要，不能获得持久授权。Host 在启动、观察和输入前取得用户许可。
+应用选择向 Host 返回授权记录：规范化可执行路径与经验证的代码签名指定要求的摘要、显示名称、可执行路径和可持久化标记。未签名或临时签名的应用不能获得长期授权；运行中实例使用进程生命期身份，未启动应用使用可执行文件摘要。Host 从模型结果中移除此记录，并在启动、观察和输入前取得用户许可。此管道协议用于可信 Host 传输，无法隔离另一个已获授权的 shell 进程。
 
 协议声明从[共享协议](../../cua/src/protocol.ts)生成。在仓库根目录运行 `pnpm exec tsx packages/experimental/cua-macos/native/generate-protocol.ts`，包测试检查生成的 JSON 和 Swift 字段/枚举表。模型参数不包含 Host 资源上限和私有启动续接操作。
 
@@ -77,6 +77,8 @@ AppKit 在主事件循环上运行。阻塞式 AX 和输入使用每条连接的
 
 负责执行的 host/helper 需要 macOS 辅助功能权限以读取 AX 和输入，需要屏幕录制权限以截图。能力预检和权限错误不授予权限。截图会拒绝在读取图片期间移动或缩放的窗口。无法确认归属的系统面板及仅后台辅助类型的应用不可选择。
 
+仅供 Host 使用的权限操作为 `permissionStatus {}`、`requestPermission {permission}` 和 `openPermissionSettings {permission}`，其中 permission 为 `accessibility` 或 `screenRecording`。这些操作不出现在模型工具及 `getCapabilities.methods` 中。权限状态包含观察到的 helper 和父进程路径，这些路径不能确定 TCC 归属的应用。系统授权提示负责指出应用并询问用户决定。helper 使用可选的 libSystem 内部接口 `responsibility_get_pid_responsible_for_pid` 查询责任进程，在报告就绪前记录对应应用的名称和图标。接口通过动态加载解析，函数签名与 [Chromium](https://chromium.googlesource.com/chromium/src/+/refs/tags/134.0.6998.28/base/process/process_info_mac.mm) 使用的一致。符号、进程或应用信息不可用时，归属保持未知，不根据最近的 GUI 祖先推断。权限检查独立于这些信息。
+
 观察通过 `AXUIElementCopyMultipleAttributeValues` 读取每个非布局节点的描述属性和子节点。逐属性错误保留单独读取的规则；不支持批量 API 时使用单独读取。值只在本次观察期间保留，输入读取即时属性。应用状态可能在节点之间变化，批量读取不使整棵树具备原子性。
 
 系统文件面板的键盘路由通过所选应用的 AX 焦点 sheet 解析远端接收方。只接受 Apple 的 Open and Save Panel Service，且其焦点祖先链仍须包含已识别的远端窗口。AXWindow 不可用时，元素鼠标后备路径沿 AX 父节点解析应用所属窗口或 sheet。AX 动作保持优先，可视点击标记不需要系统鼠标移动。
@@ -101,6 +103,8 @@ AppKit 在主事件循环上运行。阻塞式 AX 和输入使用每条连接的
 
 运行 `python3 packages/experimental/cua-macos/native/tests/shared_helper_e2e.py --helper /absolute/helper`，通过测试自建的 AppKit fixture 核实并发启动、共享服务 PID、独立句柄、同一应用交接、请求级截图期限、连接清理和信号退出。需要已有辅助功能和屏幕录制权限。`--without-desktop` 将检查限定为协议与进程生命期。
 
+在 GUI 登录会话中运行 `python3 packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py --helper /absolute/helper`，验证由 Launch Services 启动的应用先启动另一个 GUI 启动器，再启动 helper。helper 识别外层责任应用，并在启动器退出后保留其名称和图标。检查只使用测试自建的两个应用和 helper，结束后清理对应的 Launch Services 注册，不申请辅助功能或屏幕录制权限。
+
 构建并解锁 Mac 后运行 `python3 packages/experimental/cua-macos/native/tests/axless_e2e.py`，验证应用移除并恢复 AX 根节点的窗口。检查需要已有辅助功能/屏幕录制权限，会拒绝过期元素索引，捕获无 AX 窗口，通过 fixture 状态文件核实坐标点击，并检查恢复。不会修改系统权限设置。
 
 运行 `python3 packages/experimental/cua-macos/native/tests/observation_benchmark.py --reference-helper /absolute/reference --candidate-helper /absolute/candidate --artifacts /private/evidence`，对比同一自建 AppKit 窗口中 35 行和 400 行合成内容的完整观察。每个 helper 先预热一次，再交替测量三次。除 helper 生成的应用和快照 ID 外，结果字段必须一致。报告保留原始耗时、字节数、哈希和回复，不设置 CI 性能阈值，也不声称内存表现。fixture 启动可能激活应用。运行时避免其他桌面自动化或编译任务。
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/NativePlatform.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/NativePlatform.swift
index 8dd6b4f61f..e4dcfe354e 100644
--- a/packages/experimental/cua-macos/native/Sources/CuaNative/NativePlatform.swift
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/NativePlatform.swift
@@ -36,6 +36,22 @@ struct ApplicationCatalogSnapshot: Sendable {
         }
         return ApplicationCatalogSnapshot(applications: apps, frontPID: NSWorkspace.shared.frontmostApplication?.processIdentifier)
     }
+    /// A bounded PNG for human recognition; authorization continues to use executable/signing identity.
+    static func icon(at path: String) -> String? {
+        guard let bitmap = NSBitmapImageRep(bitmapDataPlanes: nil, pixelsWide: 64, pixelsHigh: 64,
+                                            bitsPerSample: 8, samplesPerPixel: 4, hasAlpha: true, isPlanar: false,
+                                            colorSpaceName: .deviceRGB, bytesPerRow: 0, bitsPerPixel: 0),
+              let context = NSGraphicsContext(bitmapImageRep: bitmap) else { return nil }
+        NSGraphicsContext.saveGraphicsState()
+        defer { NSGraphicsContext.restoreGraphicsState() }
+        NSGraphicsContext.current = context
+        var url = URL(fileURLWithPath: path)
+        while url.path != "/" && url.pathExtension != "app" { url.deleteLastPathComponent() }
+        let iconPath = url.pathExtension == "app" ? url.path : path
+        NSWorkspace.shared.icon(forFile: iconPath).draw(in: NSRect(x: 0, y: 0, width: 64, height: 64),
+                                                   from: .zero, operation: .copy, fraction: 1)
+        return bitmap.representation(using: .png, properties: [:]).map { "data:image/png;base64," + $0.base64EncodedString() }
+    }
     static func activate(_ identity: ProcessIdentity) throws {
         try NativePlatform.verify(identity)
         guard let app = NSRunningApplication(processIdentifier: identity.pid), !app.isTerminated else {
@@ -47,9 +63,18 @@ struct ApplicationCatalogSnapshot: Sendable {
 }
 
 enum NativePlatform {
+    /// Optional libSystem SPI: unavailable attribution stays unknown rather than guessing from parentage.
+    static func responsiblePID(_ pid: Int32) -> Int32? {
+        typealias Resolve = @convention(c) (pid_t) -> pid_t
+        guard let symbol = dlsym(UnsafeMutableRawPointer(bitPattern: -2), "responsibility_get_pid_responsible_for_pid") else { return nil }
+        let resolve = unsafeBitCast(symbol, to: Resolve.self)
+        let responsible = resolve(pid)
+        return responsible > 0 ? responsible : nil
+    }
     static func executablePath(_ pid: Int32) -> String? {
         var buffer = [CChar](repeating: 0, count: 4 * Int(MAXPATHLEN))
-        return proc_pidpath(pid, &buffer, UInt32(buffer.count)) > 0 ? String(cString: buffer) : nil
+        guard proc_pidpath(pid, &buffer, UInt32(buffer.count)) > 0 else { return nil }
+        return String(decoding: buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) }, as: UTF8.self)
     }
     static func identity(_ pid: Int32) throws -> ProcessIdentity {
         var info = proc_bsdinfo()
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/NativeProtocol.generated.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/NativeProtocol.generated.swift
index a37cd0d421..62d52a787e 100644
--- a/packages/experimental/cua-macos/native/Sources/CuaNative/NativeProtocol.generated.swift
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/NativeProtocol.generated.swift
@@ -3,6 +3,7 @@ enum NativeProtocol {
     static let modelMethods: [String] = ["activate", "click", "drag", "findApps", "getApp", "getCapabilities", "getState", "hover", "listApps", "listWindows", "paste", "performSecondaryAction", "pressKey", "screenshot", "scroll", "selectText", "setValue", "show", "typeText"]
     static let fields: [String: Set<String>] = [
         "activate": ["appHandle"],
+        "applicationIcons": ["paths"],
         "click": ["appHandle", "clickCount", "elementIndex", "modifiers", "mouseButton", "snapshotId", "windowId", "x", "y"],
         "drag": ["appHandle", "durationMs", "fromX", "fromY", "modifiers", "mouseButton", "snapshotId", "steps", "toX", "toY", "windowId"],
         "findApps": ["maxAppMatches", "query"],
@@ -13,9 +14,12 @@ enum NativeProtocol {
         "launchApp": ["appHandle"],
         "listApps": [],
         "listWindows": ["appHandle"],
+        "openPermissionSettings": ["permission"],
         "paste": ["appHandle", "format", "maxClipboardBytes", "maxDepth", "maxElements", "pasteReadTimeoutMs", "text"],
         "performSecondaryAction": ["action", "appHandle", "elementIndex", "snapshotId"],
+        "permissionStatus": [],
         "pressKey": ["appHandle", "key", "modifiers"],
+        "requestPermission": ["permission"],
         "screenshot": ["appHandle", "windowId"],
         "scroll": ["appHandle", "deltaLinesX", "deltaLinesY", "snapshotId", "windowId", "x", "y"],
         "selectText": ["appHandle", "elementIndex", "prefix", "selectionType", "snapshotId", "suffix", "text"],
@@ -26,8 +30,10 @@ enum NativeProtocol {
     static let stringEnums: [String: [String: Set<String>]] = [
         "click": ["modifiers": ["command", "control", "fn", "option", "shift"], "mouseButton": ["left", "middle", "right"]],
         "drag": ["modifiers": ["command", "control", "fn", "option", "shift"], "mouseButton": ["left", "middle", "right"]],
+        "openPermissionSettings": ["permission": ["accessibility", "screenRecording"]],
         "paste": ["format": ["html", "text"]],
         "pressKey": ["modifiers": ["command", "control", "fn", "option", "shift"]],
+        "requestPermission": ["permission": ["accessibility", "screenRecording"]],
         "selectText": ["selectionType": ["cursor_after", "cursor_before", "text"]],
     ]
 }
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/Permissions.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/Permissions.swift
new file mode 100644
index 0000000000..b4a9dcc587
--- /dev/null
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/Permissions.swift
@@ -0,0 +1,69 @@
+// System consent is requested only by the Host's user-facing permission controls.
+import AppKit
+@preconcurrency import ApplicationServices
+import Darwin
+import Foundation
+
+@MainActor struct SystemPermissions {
+    private let launchApplication: JSONValue?
+
+    // Capture the system-reported responsible app before startup completes and the launcher can exit.
+    init() { launchApplication = Self.responsibleApplication(for: getpid()) }
+
+    func status() -> JSONValue {
+        var result: [String: JSONValue] = [
+            "accessibility": .bool(AXIsProcessTrusted()),
+            "screenRecording": .bool(CGPreflightScreenCaptureAccess()),
+            "helper": Self.process(getpid()),
+            "parent": Self.process(getppid()),
+        ]
+        if let launchApplication { result["launchApplication"] = launchApplication }
+        return .object(result)
+    }
+
+    func request(_ permission: String) throws -> JSONValue {
+        switch permission {
+        case "accessibility":
+            if !AXIsProcessTrusted() {
+                let options = [kAXTrustedCheckOptionPrompt.takeUnretainedValue() as String: true] as CFDictionary
+                _ = AXIsProcessTrustedWithOptions(options)
+            }
+        case "screenRecording":
+            if !CGPreflightScreenCaptureAccess() { _ = CGRequestScreenCaptureAccess() }
+        default: throw RequestParameters.invalid("permission must be accessibility or screenRecording")
+        }
+        return status()
+    }
+
+    func openSettings(_ permission: String) throws -> JSONValue {
+        let pane: String
+        switch permission {
+        case "accessibility": pane = "Privacy_Accessibility"
+        case "screenRecording": pane = "Privacy_ScreenCapture"
+        default: throw RequestParameters.invalid("permission must be accessibility or screenRecording")
+        }
+        guard let url = URL(string: "x-apple.systempreferences:com.apple.preference.security?\(pane)"),
+              NSWorkspace.shared.open(url) else {
+            throw NativeFailure(code: "SETTINGS_UNAVAILABLE", message: "Open System Settings > Privacy & Security manually")
+        }
+        return .object(["opened": .bool(true)])
+    }
+
+    /// Resolve macOS process responsibility, including launchers outside the nearest GUI application.
+    static func responsibleApplication(for pid: Int32) -> JSONValue? {
+        guard let responsible = NativePlatform.responsiblePID(pid),
+              let app = NSRunningApplication(processIdentifier: responsible), !app.isTerminated,
+              let bundle = app.bundleURL else { return nil }
+        var result: [String: JSONValue] = ["name": .string(bundle.lastPathComponent), "path": .string(bundle.path)]
+        if let icon = ApplicationCatalog.icon(at: bundle.path) { result["icon"] = .string(icon) }
+        return .object(result)
+    }
+
+    private static func process(_ pid: Int32) -> JSONValue {
+        let path = NativePlatform.executablePath(pid)
+        var result: [String: JSONValue] = ["pid": .number(Double(pid))]
+        if let path { result["path"] = .string(path) }
+        if let name = NSRunningApplication(processIdentifier: pid)?.localizedName { result["name"] = .string(name) }
+        return .object(result)
+    }
+}
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/RequestAdmission.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/RequestAdmission.swift
index 08bd3b7f6d..9cfb5a1a04 100644
--- a/packages/experimental/cua-macos/native/Sources/CuaNative/RequestAdmission.swift
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/RequestAdmission.swift
@@ -26,6 +26,13 @@ struct RequestParameters: Sendable {
         guard let value = values[key]?.string else { throw Self.invalid("\(key) must be a string") }
         return value
     }
+    func strings(_ key: String) throws -> [String] {
+        guard let raw = values[key], case .array(let items) = raw else { throw Self.invalid("\(key) must be a string array") }
+        return try items.map { value in
+            guard let path = value.string, !path.isEmpty else { throw Self.invalid("\(key) must contain nonempty strings") }
+            return path
+        }
+    }
     func optionalString(_ key: String) throws -> String? { contains(key) ? try string(key) : nil }
     func optionalBoolean(_ key: String) throws -> Bool? {
         guard let raw = values[key] else { return nil }
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/RequestCoordinator.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/RequestCoordinator.swift
index ae9969cb1d..8931d3bfff 100644
--- a/packages/experimental/cua-macos/native/Sources/CuaNative/RequestCoordinator.swift
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/RequestCoordinator.swift
@@ -9,6 +9,7 @@ import Darwin
     private let cancellation: CancellationLatch
     private let worker: AXWorker
     private let capture: WindowCapture
+    private let permissions: SystemPermissions
     private let clipboard = ClipboardPaste()
     private let input: JSONLInput
     private let writer: JSONLWriter
@@ -27,11 +28,12 @@ import Darwin
     private var nextCancelled = false
 
     init(configuration: HelperConfiguration, capture: WindowCapture, channel: SharedSocket,
-         cancellation: CancellationLatch, scheduler: RequestScheduler, writer: JSONLWriter,
+         cancellation: CancellationLatch, scheduler: RequestScheduler, writer: JSONLWriter, permissions: SystemPermissions,
          onClose: @escaping @MainActor @Sendable () -> Void,
          onFatal: @escaping @Sendable (NativeFailure, Double) -> Void) {
         self.configuration = configuration
         self.capture = capture
+        self.permissions = permissions
         self.cancellation = cancellation
         self.channel = channel
         self.scheduler = scheduler
@@ -159,11 +161,25 @@ import Darwin
     }
     private func execute(_ request: NativeRequest, trace: ScreenshotTrace?) async throws -> JSONValue {
         let params = try RequestParameters(request)
+        try cancellation.check()
         if request.method == "screenshot" { try capture.requireAvailable() }
         let requiresCatalog = ["getApp", "listApps", "findApps", "typeText", "pressKey"].contains(request.method)
         let catalog = requiresCatalog ? ApplicationCatalog.snapshot() : ApplicationCatalogSnapshot(applications: [], frontPID: nil)
         let result: JSONValue
-        if request.method == "findApps" {
+        if request.method == "permissionStatus" {
+            result = permissions.status()
+        } else if request.method == "applicationIcons" {
+            var icons: [String: JSONValue] = [:]
+            for path in try params.strings("paths") {
+                try cancellation.check()
+                if let icon = ApplicationCatalog.icon(at: path) { icons[path] = .string(icon) }
+            }
+            result = .object(icons)
+        } else if request.method == "requestPermission" {
+            result = try permissions.request(params.string("permission"))
+        } else if request.method == "openPermissionSettings" {
+            result = try permissions.openSettings(params.string("permission"))
+        } else if request.method == "findApps" {
             result = .array(try ApplicationDiscovery.applications(matching: params.string("query"), exact: false,
                 limit: params.integer("maxAppMatches", in: 1...1000), cancellation: cancellation).map { $0.json(catalog: catalog) })
         } else {
@@ -179,7 +195,12 @@ import Darwin
             let outcome = try await worker.execute(request.method, params: params, catalog: catalog, installed: installed, trace: trace)
             trace?.mark("worker.end")
             switch outcome {
-            case .result(let value): result = value
+            case .result(let value):
+                if request.method == "getApp", var fields = value.object {
+                    let path = installed?.path ?? catalog.applications.first { Double($0.pid) == value["pid"].number }?.path
+                    if let path, let icon = ApplicationCatalog.icon(at: path) { fields["applicationIcon"] = .string(icon) }
+                    result = .object(fields)
+                } else { result = value }
             case .capture(let target):
                 let image = try await capture.capture(target, cancellation: cancellation, trace: trace)
                 result = try await worker.finishCapture(target, image: image, trace: trace)
diff --git a/packages/experimental/cua-macos/native/Sources/CuaNative/SharedHelperServer.swift b/packages/experimental/cua-macos/native/Sources/CuaNative/SharedHelperServer.swift
index 2de82bce2c..253dbfcaa4 100644
--- a/packages/experimental/cua-macos/native/Sources/CuaNative/SharedHelperServer.swift
+++ b/packages/experimental/cua-macos/native/Sources/CuaNative/SharedHelperServer.swift
@@ -67,6 +67,29 @@ final class NativeSignals {
     deinit { sources.forEach { $0.cancel() } }
 }
 
+// Blocking accepts own only Sendable state; server access belongs to the MainActor callback.
+private func acceptConnections(listener: SharedSocket, lifetime: SharedHelperLifetime,
+                               onAccept: @escaping @MainActor @Sendable (UUID, SharedSocket, CancellationLatch) -> Void) {
+    while !lifetime.isStopping {
+        let descriptor = accept(listener.descriptor, nil, nil)
+        if descriptor < 0 && errno == EINTR { continue }
+        guard descriptor >= 0 else {
+            if !lifetime.isStopping { lifetime.abort(grace: lifetime.shutdownGrace) }
+            return
+        }
+        let channel = SharedSocket(descriptor: descriptor)
+        var uid: uid_t = 0
+        var gid: gid_t = 0
+        guard getpeereid(descriptor, &uid, &gid) == 0, uid == getuid() else { channel.shutdown(); continue }
+        let id = UUID()
+        let cancellation = CancellationLatch()
+        guard lifetime.add(id, channel: channel, cancellation: cancellation) else { channel.shutdown(); return }
+        Task { @MainActor [onAccept, id, channel, cancellation] in
+            onAccept(id, channel, cancellation)
+        }
+    }
+}
+
 @MainActor final class SharedHelperServer {
     private let options: SharedHelperOptions
     private let versionLock: SharedHelperLock
@@ -75,6 +98,7 @@ final class NativeSignals {
     private let lifetime: SharedHelperLifetime
     private let scheduler = RequestScheduler()
     private let capture = WindowCapture()
+    private let permissions = SystemPermissions()
     private let instanceID = UUID().uuidString
     private var connections: [UUID: RequestCoordinator] = [:]
     private var startupDeadline: NativeDeadline?
@@ -99,12 +123,18 @@ final class NativeSignals {
 
     func start() throws {
         let lifetime = self.lifetime
-        signals = NativeSignals { [weak self] number in
-            lifetime.abort(grace: lifetime.shutdownGrace, status: 128 + number)
-            Task { @MainActor in self?.closeConnections(); self?.exitIfEmpty() }
+        let onStop: @MainActor @Sendable () -> Void = { [weak self] in
+            guard let self else { return }
+            self.closeConnections()
+            self.exitIfEmpty()
         }
-        startupDeadline = NativeDeadline(seconds: options.startupTimeout) { [weak self] in
-            Task { @MainActor in self?.exitIfEmpty() }
+        signals = NativeSignals { [lifetime, onStop] number in
+            lifetime.abort(grace: lifetime.shutdownGrace, status: 128 + number)
+            Task { @MainActor [onStop] in onStop() }
+        }
+        let onIdle: @MainActor @Sendable () -> Void = { [weak self] in self?.exitIfEmpty() }
+        startupDeadline = NativeDeadline(seconds: options.startupTimeout) { [onIdle] in
+            Task { @MainActor [onIdle] in onIdle() }
         }
         let ready = options.ready(pid: getpid(), instanceID: instanceID)
         let data = try JSONEncoder().encode(ready)
@@ -113,38 +143,45 @@ final class NativeSignals {
         try FileHandle.standardOutput.write(contentsOf: data + Data([10]))
         try FileHandle.standardOutput.close()
         let listener = self.listener
-        DispatchQueue.global(qos: .utility).async { [weak self] in
-            while !lifetime.isStopping {
-                let descriptor = accept(listener.descriptor, nil, nil)
-                if descriptor < 0 && errno == EINTR { continue }
-                guard descriptor >= 0 else {
-                    if !lifetime.isStopping { lifetime.abort(grace: lifetime.shutdownGrace) }
-                    return
-                }
-                let channel = SharedSocket(descriptor: descriptor)
-                var uid: uid_t = 0
-                var gid: gid_t = 0
-                guard getpeereid(descriptor, &uid, &gid) == 0, uid == getuid() else { channel.shutdown(); continue }
-                let id = UUID()
-                let cancellation = CancellationLatch()
-                guard lifetime.add(id, channel: channel, cancellation: cancellation) else { channel.shutdown(); return }
-                Task { @MainActor in self?.admit(id, channel: channel, cancellation: cancellation) }
+        let onAccept: @MainActor @Sendable (UUID, SharedSocket, CancellationLatch) -> Void = { [weak self] id, channel, cancellation in
+            guard let self else {
+                channel.shutdown()
+                lifetime.remove(id)
+                return
             }
+            self.admit(id, channel: channel, cancellation: cancellation)
+        }
+        DispatchQueue.global(qos: .utility).async { [listener, lifetime, onAccept] in
+            acceptConnections(listener: listener, lifetime: lifetime, onAccept: onAccept)
         }
     }
 
     private func admit(_ id: UUID, channel: SharedSocket, cancellation: CancellationLatch) {
+        guard !lifetime.isStopping else { channel.shutdown(); disconnected(id); return }
         let options = self.options
-        DispatchQueue.global(qos: .utility).async { [weak self] in
+        let lifetime = self.lifetime
+        let onHello: @MainActor @Sendable (HelperConfiguration) async -> Void = { [weak self] configuration in
+            guard let self else {
+                channel.shutdown()
+                lifetime.remove(id)
+                return
+            }
+            await self.connected(id, channel: channel, cancellation: cancellation, configuration: configuration)
+        }
+        let onFailure: @MainActor @Sendable () -> Void = { [weak self] in
+            lifetime.remove(id)
+            self?.exitIfEmpty()
+        }
+        DispatchQueue.global(qos: .utility).async { [options, channel, onHello, onFailure] in
             do {
                 let configuration = try HelperConfiguration(hello: channel.readHello(timeout: options.startupTimeout), runtimeKey: options.runtimeKey)
-                Task { @MainActor in await self?.connected(id, channel: channel, cancellation: cancellation, configuration: configuration) }
+                Task { @MainActor [onHello, configuration] in await onHello(configuration) }
             } catch {
                 let failure = error as? NativeFailure ?? NativeFailure(code: "NATIVE_PROTOCOL", message: "Invalid shared helper hello")
                 let response = JSONValue.object(["type": .string("error"), "code": .string(failure.code), "message": .string(failure.message)])
                 if let data = try? JSONEncoder().encode(response) { try? channel.write(data + Data([10]), timeout: options.startupTimeout) }
                 channel.shutdown()
-                Task { @MainActor in self?.disconnected(id) }
+                Task { @MainActor [onFailure] in onFailure() }
             }
         }
     }
@@ -155,14 +192,18 @@ final class NativeSignals {
         let writer = JSONLWriter(limit: configuration.maxResponseBytes, channel: channel, writeTimeout: configuration.shutdownGraceSeconds)
         do { try await writer.write(options.ready(pid: getpid(), instanceID: instanceID)) }
         catch { channel.shutdown(); disconnected(id); return }
+        // Signal shutdown can run while the ready frame is being written.
+        guard !lifetime.isStopping else { channel.shutdown(); disconnected(id); return }
         let lifetime = self.lifetime
+        let onFatal: @MainActor @Sendable () -> Void = { [weak self] in self?.closeConnections() }
         let coordinator = RequestCoordinator(configuration: configuration, capture: capture, channel: channel, cancellation: cancellation,
-            scheduler: scheduler, writer: writer, onClose: { [weak self] in
+            scheduler: scheduler, writer: writer, permissions: permissions, onClose: { [weak self] in
                 channel.shutdown()
-                self?.disconnected(id)
-            }, onFatal: { [weak self] _, grace in
+                guard let self else { lifetime.remove(id); return }
+                self.disconnected(id)
+            }, onFatal: { [lifetime, onFatal] _, grace in
                 lifetime.abort(grace: grace)
-                Task { @MainActor in self?.closeConnections() }
+                Task { @MainActor [onFatal] in onFatal() }
             })
         connections[id] = coordinator
         startupDeadline?.cancel()
diff --git a/packages/experimental/cua-macos/native/protocol.schema.json b/packages/experimental/cua-macos/native/protocol.schema.json
index 8282bd5750..e66efb5989 100644
--- a/packages/experimental/cua-macos/native/protocol.schema.json
+++ b/packages/experimental/cua-macos/native/protocol.schema.json
@@ -1025,6 +1025,131 @@
         "params"
       ],
       "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "method": {
+          "type": "string",
+          "const": "permissionStatus"
+        },
+        "params": {
+          "type": "object",
+          "properties": {},
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "method": {
+          "type": "string",
+          "const": "applicationIcons"
+        },
+        "params": {
+          "type": "object",
+          "properties": {
+            "paths": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          },
+          "required": [
+            "paths"
+          ],
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "method": {
+          "type": "string",
+          "const": "requestPermission"
+        },
+        "params": {
+          "type": "object",
+          "properties": {
+            "permission": {
+              "type": "string",
+              "enum": [
+                "accessibility",
+                "screenRecording"
+              ]
+            }
+          },
+          "required": [
+            "permission"
+          ],
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "method": {
+          "type": "string",
+          "const": "openPermissionSettings"
+        },
+        "params": {
+          "type": "object",
+          "properties": {
+            "permission": {
+              "type": "string",
+              "enum": [
+                "accessibility",
+                "screenRecording"
+              ]
+            }
+          },
+          "required": [
+            "permission"
+          ],
+          "additionalProperties": false
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "additionalProperties": false
     }
   ]
 }
diff --git a/packages/experimental/cua-macos/native/tests/LauncherFixture.swift b/packages/experimental/cua-macos/native/tests/LauncherFixture.swift
new file mode 100644
index 0000000000..ac297f92e5
--- /dev/null
+++ b/packages/experimental/cua-macos/native/tests/LauncherFixture.swift
@@ -0,0 +1,29 @@
+// An owned GUI launcher with no windows; its child outlives the launch application.
+import AppKit
+import Foundation
+import Darwin
+
+@MainActor final class Launcher: NSObject, NSApplicationDelegate {
+    private let child = Process()
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        let arguments = Array(CommandLine.arguments.dropFirst())
+        guard let executable = arguments.first else { exit(64) }
+        child.executableURL = URL(fileURLWithPath: executable)
+        child.arguments = Array(arguments.dropFirst())
+        child.standardOutput = FileHandle.standardOutput
+        child.standardError = FileHandle.standardError
+        child.terminationHandler = { @Sendable process in exit(process.terminationStatus) }
+        do { try child.run() }
+        catch { fputs("Launching fixture child failed: \(error)\n", stderr); exit(1) }
+    }
+}
+
+@main enum LauncherMain {
+    @MainActor static func main() {
+        let app = NSApplication.shared
+        app.setActivationPolicy(.accessory)
+        let launcher = Launcher()
+        app.delegate = launcher
+        withExtendedLifetime(launcher) { app.run() }
+    }
+}
diff --git a/packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py b/packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py
new file mode 100644
index 0000000000..e8204274d1
--- /dev/null
+++ b/packages/experimental/cua-macos/native/tests/launcher_identity_e2e.py
@@ -0,0 +1,76 @@
+"""Verify system responsibility across nested GUI launchers and helper reuse; no TCC grants are required."""
+import argparse
+import base64
+from contextlib import ExitStack
+import hashlib
+import json
+from pathlib import Path
+import plistlib
+import shutil
+import struct
+import subprocess
+import tempfile
+import uuid
+
+from native_test_support import BINARY, ROOT
+from shared_helper_e2e import Connection, wait_released
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--helper", type=Path, default=BINARY)
+    args = parser.parse_args()
+    with tempfile.TemporaryDirectory(prefix="cua-", dir="/tmp") as temporary, ExitStack() as cleanup:
+        root = Path(temporary)
+        helper = root / "helper"
+        shutil.copy2(args.helper.resolve(strict=True), helper)
+        key = hashlib.sha256(helper.read_bytes()).hexdigest()
+        runtime = root / "r"
+        bundle = root / "Visual Studio Code.app"
+        binaries = bundle / "Contents" / "MacOS"
+        binaries.mkdir(parents=True)
+        launcher = binaries / "launcher"
+        subprocess.run(["xcrun", "swiftc", "-parse-as-library", str(ROOT / "tests/LauncherFixture.swift"), "-o", str(launcher)],
+                       check=True, timeout=60)
+        nested = root / "Harness Dev.app"
+        nested_launcher = nested / "Contents" / "MacOS" / "launcher"
+        nested_launcher.parent.mkdir(parents=True)
+        shutil.copy2(launcher, nested_launcher)
+        identity = uuid.uuid4().hex
+        register = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister"
+        for role, application, name in [("owner", bundle, "Code"), ("nested", nested, "Harness Dev")]:
+            with (application / "Contents" / "Info.plist").open("wb") as output:
+                plistlib.dump({"CFBundleExecutable": "launcher",
+                              "CFBundleIdentifier": f"dev.dsh.cua.launcher-fixture.{role}-{identity}",
+                              "CFBundleName": name, "CFBundleDisplayName": name, "CFBundlePackageType": "APPL",
+                              "LSUIElement": True}, output)
+            cleanup.callback(subprocess.run, [register, "-u", str(application)], check=True,
+                             stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=10)
+        ready_file, stderr_file = root / "ready.json", root / "stderr.log"
+        # Launch Services establishes the outer app's responsibility; its GUI child inherits it.
+        subprocess.run(["/usr/bin/open", "-n", "-g", "-W", "--stdout", str(ready_file), "--stderr", str(stderr_file),
+                        str(bundle), "--args", str(nested_launcher), str(helper), "--ensure-shared", "--runtime-key", key,
+                        "--runtime-directory", str(runtime), "--startup-timeout-ms", "10000"],
+                       check=True, capture_output=True, text=True, timeout=25)
+        ready = json.loads(ready_file.read_text())
+        owner = ready["pid"]
+        cleanup.callback(wait_released, runtime / (key + ".lock"), owner)
+        first = Connection(runtime / (key + ".sock"), key)
+        cleanup.callback(first.close)
+        state = first.call("permissionStatus", {})
+        assert state["parent"]["pid"] == 1, state["parent"]
+        source = state["launchApplication"]
+        assert source["name"] == bundle.name, source["name"]
+        assert Path(source["path"]).resolve() == bundle.resolve(), source["path"]
+        assert source["icon"].startswith("data:image/png;base64,")
+        image = base64.b64decode(source["icon"].split(",", 1)[1], validate=True)
+        assert image[:8] == b"\x89PNG\r\n\x1a\n"
+        assert struct.unpack(">II", image[16:24]) == (64, 64)
+        second = Connection(runtime / (key + ".sock"), key)
+        cleanup.callback(second.close)
+        assert second.call("permissionStatus", {})["launchApplication"] == source
+        print("PASS: system-responsible app wins over the nearest GUI ancestor and survives launcher exit and helper reuse")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/packages/experimental/cua-macos/native/tests/shared_helper_e2e.py b/packages/experimental/cua-macos/native/tests/shared_helper_e2e.py
index 85a74e7e64..c624fc5b2f 100644
--- a/packages/experimental/cua-macos/native/tests/shared_helper_e2e.py
+++ b/packages/experimental/cua-macos/native/tests/shared_helper_e2e.py
@@ -5,6 +5,7 @@ Accessibility/Screen Recording grants are required unless --without-desktop is s
 """
 import argparse
 import concurrent.futures
+from contextlib import ExitStack
 import fcntl
 import hashlib
 import json
@@ -128,6 +129,15 @@ def main():
             assert a.ready == b.ready == ready[0]
             for client in clients:
                 client.call("protocol-unsupported", {}, error="UNSUPPORTED")
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as invalid:
+                invalid.settimeout(15)
+                invalid.connect(str(socket_path))
+                invalid.sendall(b'{"type":"hello","protocol":2}\n')
+                with invalid.makefile("rb") as reader:
+                    failure = json.loads(reader.readline())
+                    assert failure["type"] == "error" and failure["code"] == "NATIVE_PROTOCOL", failure
+                    assert reader.readline() == b"", "Rejected handshake retained its connection"
+            b.call("protocol-after-invalid-hello", {}, error="UNSUPPORTED")
             # Coalesced frames retain socket order, including cancellation before execution starts.
             a.socket.sendall(b'{"id":"coalesced","method":"listApps","params":{}}\n'
                              b'{"type":"cancel","id":"coalesced"}\n')
@@ -218,20 +228,39 @@ def main():
             wait_released(lock_path, owner_pid)
             owner_pid = None
 
-            daemon = subprocess.Popen([base[0], "--serve", *base[1:]], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-            try:
-                assert select.select([daemon.stdout], [], [], 15)[0], "Daemon did not report ready"
-                signalled_ready = json.loads(daemon.stdout.readline())
-                assert signalled_ready["type"] == "ready", signalled_ready
-                daemon.send_signal(signal.SIGTERM)
-                status = daemon.wait(timeout=15)
-                assert status == 128 + signal.SIGTERM, (status, daemon.stderr.read())
-                wait_released(lock_path, daemon.pid)
-            finally:
-                stop(daemon)
-                daemon.stdout.close()
-                daemon.stderr.close()
-            print("PASS: concurrent launch, shared PID, client isolation, cleanup/lock release and SIGTERM")
+            for shutdown in ["signal", "incomplete-hello", "idle"]:
+                serve_options = base[1:] if shutdown != "idle" else [*base[1:-1], "100"]
+                daemon = subprocess.Popen([base[0], "--serve", *serve_options], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+                try:
+                    with ExitStack() as connections:
+                        assert select.select([daemon.stdout], [], [], 15)[0], "Daemon did not report ready"
+                        signalled_ready = json.loads(daemon.stdout.readline())
+                        assert signalled_ready["type"] == "ready", signalled_ready
+                        if shutdown == "incomplete-hello":
+                            pending = connections.enter_context(socket.socket(socket.AF_UNIX, socket.SOCK_STREAM))
+                            pending.settimeout(15)
+                            pending.connect(str(socket_path))
+                            pending.sendall(b'{"type":"hello"')
+                            # A later completed handshake observes the accept loop progressing past this socket.
+                            active = Connection(socket_path, key)
+                            connections.callback(active.socket.close)
+                            connections.callback(active.reader.close)
+                        if shutdown != "idle":
+                            daemon.send_signal(signal.SIGTERM)
+                        status = daemon.wait(timeout=15)
+                        expected_status = 0 if shutdown == "idle" else 128 + signal.SIGTERM
+                        assert status == expected_status, (status, daemon.stderr.read())
+                        wait_released(lock_path, daemon.pid)
+                        # The forced-exit deadline does not unlink these files; require normal cleanup.
+                        assert not socket_path.exists(), "Shutdown left its listening socket"
+                        assert not (runtime / (key + ".ready")).exists(), "Shutdown left its ready record"
+                        if shutdown == "incomplete-hello":
+                            assert pending.recv(1) == b"", "Signal shutdown retained an incomplete handshake"
+                finally:
+                    stop(daemon)
+                    daemon.stdout.close()
+                    daemon.stderr.close()
+            print("PASS: concurrent launch, shared PID, client isolation, rejected/incomplete handshakes, cleanup/lock release, SIGTERM and idle exit")
         finally:
             errors = []
             for client in reversed(clients):
diff --git a/packages/experimental/cua-macos/native/tests/swift/PermissionIdentityTests.swift b/packages/experimental/cua-macos/native/tests/swift/PermissionIdentityTests.swift
index 6c29e6afa6..58755b15b1 100644
--- a/packages/experimental/cua-macos/native/tests/swift/PermissionIdentityTests.swift
+++ b/packages/experimental/cua-macos/native/tests/swift/PermissionIdentityTests.swift
@@ -1,5 +1,7 @@
 // The selected catalog entry must still identify the executable inspected for consent.
+import AppKit
 import Darwin
+import Foundation
 import Testing
 @testable import CuaNative
 
@@ -22,3 +24,37 @@ import Testing
         #expect(error.code == "APP_UNAVAILABLE")
     }
 }
+
+@MainActor @Test func applicationIconsUseBoundedNativePNGs() throws {
+    let encoded = try #require(ApplicationCatalog.icon(at: "/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder"))
+    #expect(encoded.hasPrefix("data:image/png;base64,"))
+    let data = try #require(Data(base64Encoded: String(encoded.dropFirst("data:image/png;base64,".count))))
+    let bitmap = try #require(NSBitmapImageRep(data: data))
+    #expect(bitmap.pixelsWide == 64)
+    #expect(bitmap.pixelsHigh == 64)
+    #expect(encoded.utf8.count <= 65536)
+}
+
+@Test func resolvesTheCurrentProcessResponsibility() throws {
+    let responsible = try #require(NativePlatform.responsiblePID(getpid()))
+    #expect(responsible > 0)
+    #expect(NativePlatform.responsiblePID(responsible) == responsible)
+}
+
+@MainActor @Test func unknownResponsibilityDoesNotInventAnApplication() {
+    #expect(SystemPermissions.responsibleApplication(for: 1) == nil)
+    #expect(SystemPermissions.responsibleApplication(for: Int32.max) == nil)
+    #expect(NativePlatform.responsiblePID(Int32.max) == nil)
+}
+
+@MainActor @Test func permissionStatusKeepsProcessDiagnosticsSeparateFromLaunchMetadata() {
+    let permissions = SystemPermissions()
+    let state = permissions.status()
+    #expect(state["helper"]["pid"] == .number(Double(getpid())))
+    #expect(state["parent"]["pid"] == .number(Double(getppid())))
+    if let source = state["launchApplication"].object {
+        #expect(source["name"]?.string?.isEmpty == false)
+        #expect(source["path"]?.string?.hasSuffix(".app") == true)
+    }
+    #expect(permissions.status()["launchApplication"] == state["launchApplication"])
+}
diff --git a/packages/experimental/cua-macos/native/tests/swift/ProtocolTests.swift b/packages/experimental/cua-macos/native/tests/swift/ProtocolTests.swift
index 6ebed6fb7c..611fa6786c 100644
--- a/packages/experimental/cua-macos/native/tests/swift/ProtocolTests.swift
+++ b/packages/experimental/cua-macos/native/tests/swift/ProtocolTests.swift
@@ -116,3 +116,9 @@ func rejectsInvalidWindowIDs(_ value: String) throws {
         #expect(throws: NativeFailure.self) { try params.optionalBoolean("includeMenus") }
     }
 }
+
+@Test(arguments: ["null", "true", "[1]", "[\"\"]"])
+func rejectsMalformedApplicationIconPaths(_ value: String) throws {
+    let request = try NativeRequest(data: Data("{\"id\":\"icons\",\"method\":\"applicationIcons\",\"params\":{\"paths\":\(value)}}".utf8))
+    #expect(throws: NativeFailure.self) { try RequestParameters(request).strings("paths") }
+}
diff --git a/packages/experimental/cua-macos/src/guidance.ts b/packages/experimental/cua-macos/src/guidance.ts
index 829706b8ab..742783330a 100644
--- a/packages/experimental/cua-macos/src/guidance.ts
+++ b/packages/experimental/cua-macos/src/guidance.ts
@@ -1,6 +1,6 @@
 /** macOS operation guidance supplied with the shared CUA object API. */
 /** Instructions for raw operation calls and optional object-API bindings. */
-export const GUIDANCE = `Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user explicitly grants access again. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
+export const GUIDANCE = `Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user allows another request on the permission page. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
 
 Initialize the object API once in persistent PTC. Reuse its variables in later calls; put temporary declarations inside { ... } blocks to avoid redeclaration errors. All object methods are async. getAXState returns text, not a structured state object. Its text separates values and placeholders, and reports subroles, help, URLs, disabled/focused/selected/expanded state and UTF-16 selection ranges when available. Writability is true, false or unknown on relevant controls; omitted state fields do not assert false. selection=unavailable means the reported range exceeds the observed text. Compact output omits ordinary Press/Pick (click), ShowMenu (right click) and ScrollToVisible actions; details=true lists every available action. Use the displayed action name with performSecondaryAction; ambiguous aliases require the complete name from details=true. Truncation reports the reached provider limit. Narrow the window or increase that provider limit before reading again.
 
@@ -37,7 +37,7 @@ App and Window methods:
 
 Raw operation tools use { method, params }, including params: {} for parameterless methods. getApp selects without activating the app. Keep applications in the background for observation and routine input. Do not activate or raise an app during initialization, before each action, or merely because another app is foreground. Prefer advertised AX actions. If a window is hidden or minimized, try app.show() or window.show() and read fresh state. show requests unhide and unminimize without activation, raising or switching Spaces; it chooses the explicit, focused, main or sole AX window. A null windowId means no window was selected for restoration. foregroundChanged compares the front app and top window before and after the request; null means unavailable, and delayed focus changes remain possible. If restoration is unsupported or the window remains unusable, including another Space or Stage Manager, explain the needed foreground step, use app.activate() or an advertised raise action, and read fresh state. Completing the task takes priority when foreground access is necessary. Avoid repeated activation when the user switches away; continue background-capable steps and report what requires foreground access. Applications may still change focus in response to input.
 
-Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to grant macOS Accessibility or Screen Recording access in System Settings. After granting access, observe fresh state before continuing; do not automatically replay prior input.
+Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to complete the Computer Use permission setup for macOS Accessibility or Screen Recording. After granting access, observe fresh state before continuing; do not automatically replay prior input.
 
 Hover first uses advertised AX alternate UI without moving the system cursor, preserving revealed descendants until the pointer target leaves their region. When unavailable, it moves the visible system cursor without pressing a button; that route requires the target point to be unobscured in the foreground app. FOREGROUND_REQUIRED requires explicit activation or raising and a fresh observation before retrying. Returning, AX reads and screenshots do not restore the previous point. Wait for the application's hover delay, observe, then hover into the revealed controls before clicking. Use successive hover calls for intermediate points. The result reports hoverRoute and systemPointerMoved. Other input or application changes can interrupt the interaction; app objects do not reserve applications between calls.
 
diff --git a/packages/experimental/cua-macos/tests/large-image-ptc.spec.ts b/packages/experimental/cua-macos/tests/large-image-ptc.spec.ts
index a8a93b1857..9f8124ff99 100644
--- a/packages/experimental/cua-macos/tests/large-image-ptc.spec.ts
+++ b/packages/experimental/cua-macos/tests/large-image-ptc.spec.ts
@@ -73,7 +73,7 @@ it.skipIf(process.platform === 'win32')('delivers a valid PNG larger than 4 MiB
   const configPath = join(root, 'cordis.yml')
   const configs: Record<string, object> = {
     tools: { mode: 'ptc' }, attachments: { dshHome: join(root, 'home') }, workingDirectory: { defaultDirectory: root },
-    fs: { cwd: root }, sandboxPolicy: { mode: 'danger-full-access', workspaceRoot: root }, cua: { helperPath, allowedApps: [{ 'id': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'name': 'Fixture', 'executablePath': '/fixture/app' }] },
+    fs: { cwd: root }, sandboxPolicy: { mode: 'danger-full-access', workspaceRoot: root }, cua: { agentPreset: false, helperPath, allowedApps: [{ 'id': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'name': 'Fixture', 'executablePath': '/fixture/app' }] },
   }
   await writeFile(configPath, Object.keys(modules).flatMap(name => [
     `- name: 'cordis:${name}'`, ...configs[name] === undefined ? [] : [`  config: ${JSON.stringify(configs[name])}`],
diff --git a/packages/experimental/cua-macos/tests/loader-composition.spec.ts b/packages/experimental/cua-macos/tests/loader-composition.spec.ts
index 9b65b66398..289a47a658 100644
--- a/packages/experimental/cua-macos/tests/loader-composition.spec.ts
+++ b/packages/experimental/cua-macos/tests/loader-composition.spec.ts
@@ -85,7 +85,7 @@ it.skipIf(process.platform === 'win32')('shares one application between retained
   await writeFile(configPath, Object.keys(modules).flatMap(name => [
     `- name: 'cordis:${name}'`,
     ...name === 'attachments' ? ['  config:', `    dshHome: ${JSON.stringify(root)}`] : [],
-    ...name === 'cua' ? ['  config:', `    helperPath: ${JSON.stringify(helperPath)}`, '    allowedApps: [{"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app"}]'] : [],
+    ...name === 'cua' ? ['  config:', '    agentPreset: false', `    helperPath: ${JSON.stringify(helperPath)}`, '    allowedApps: [{"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app"}]'] : [],
   ]).join('\n') + '\n')
   context.baseUrl = pathToFileURL(root).href + '/'
   await context.plugin(Loader)
diff --git a/packages/experimental/cua-macos/tests/persistent-bridge.built.e2e.ts b/packages/experimental/cua-macos/tests/persistent-bridge.built.e2e.ts
index 9dd6452bde..b9573c9eca 100644
--- a/packages/experimental/cua-macos/tests/persistent-bridge.built.e2e.ts
+++ b/packages/experimental/cua-macos/tests/persistent-bridge.built.e2e.ts
@@ -50,7 +50,7 @@ it.skipIf(process.platform === 'win32' || !existsSync(bridge) || !existsSync(boo
       await ctx.plugin(NodeRuntime, { executionMode: 'persistent-in-memory', launch: { kind: 'node-script', executable: process.execPath, bootstrapPath: bootstrap } })
       await ctx.plugin(Loader)
       ctx.loader.builtins.cua = Cua
-      const entry = await ctx.loader.create({ name: 'cordis:cua', config: { helperPath, allowedApps: [{ 'id': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'name': 'Fixture', 'executablePath': '/fixture/app' }] } })
+      const entry = await ctx.loader.create({ name: 'cordis:cua', config: { agentPreset: false, helperPath, allowedApps: [{ 'id': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'name': 'Fixture', 'executablePath': '/fixture/app' }] } })
       await ctx.loader.resolve(entry).fiber!.await()
       await mountAgentLoopTestHarness(ctx)
       ctx.llm.registerAdapter(['bridge-fixture'], new VisualAdapter())
diff --git a/packages/experimental/cua-macos/tests/protocol-generation.spec.ts b/packages/experimental/cua-macos/tests/protocol-generation.spec.ts
index 879657018f..54b4bf3a19 100644
--- a/packages/experimental/cua-macos/tests/protocol-generation.spec.ts
+++ b/packages/experimental/cua-macos/tests/protocol-generation.spec.ts
@@ -18,6 +18,15 @@ describe('native protocol generation', () => {
     { method: 'paste', params: { appHandle: 'app', text: 'text', pasteReadTimeoutMs: 1000 } },
     { method: 'findApps', params: { query: 'Editor', maxAppMatches: 1 } },
     { method: 'launchApp', params: { appHandle: 'pending' } },
+    { method: 'permissionStatus', params: {} },
+    { method: 'requestPermission', params: { permission: 'accessibility' } },
+    { method: 'openPermissionSettings', params: { permission: 'screenRecording' } },
+    { method: 'permissionStatus', params: {} },
+    { method: 'requestPermission', params: { permission: 'accessibility' } },
+    { method: 'openPermissionSettings', params: { permission: 'screenRecording' } },
+    { method: 'permissionStatus', params: {} },
+    { method: 'requestPermission', params: { permission: 'accessibility' } },
+    { method: 'openPermissionSettings', params: { permission: 'screenRecording' } },
   ])('rejects Host-only request data at model admission: $method', (request) => {
     expect(Request.safeParse(request).success).toBe(false)
   })
diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index b91166bad4..0635694c27 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -55,6 +55,7 @@ vi.mock('@deepseek-ai/dsh-cua/native-client', async importOriginal => ({
 }))
 
 const config = {
+  agentPreset: false,
   helperPath: resolve('fixture-helper'), buildTimeoutMs: 300_000, timeoutMs: 10_000, connectTimeoutMs: 5000, screenshotTimeoutMs: 5000, axTimeoutMs: 3000, maxRequestBytes: 1024, maxResponseBytes: 4096, maxClipboardBytes: 8192, pasteReadTimeoutMs: 1000, maxAppMatches: 20,
   graceMs: 10, textEventIntervalMs: 8, maxElements: 64, maxDepth: 8, dragDurationMs: 200, dragSteps: 10,
 } satisfies Omit<NativeProvider.Config, 'allowedApps'>
@@ -93,9 +94,9 @@ async function setup(model?: { provider: string; model: string }) {
 
 async function selectApplication(f: Awaited<ReturnType<typeof setup>>) {
   await f.ctx.plugin(UserQuestions)
-  f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Allow for this task'] }] }))
+  f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] }))
   native.request.mockResolvedValueOnce({ appHandle: 'app-one', pid: 17, name: 'Fixture',
-    authorization: { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: true } })
+    authorization: { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: false } })
   expect((await f.execute('getApp', { selector: 'Fixture' })).isError).toBe(false)
 }
 
@@ -105,7 +106,7 @@ it('rejects a relative helper path before publishing computer-use operations', a
   await expect(NativeProvider.apply(ctx, { ...config, allowedApps: { get: () => [] }, helperPath: 'relative-helper' })).rejects.toThrow('helperPath must be absolute')
 })
 
-it.each(['Allow for this task', 'Deny'])('obtains %s before a stopped application can launch', async (choice) => {
+it.each(['Allow for this session', 'Deny'])('obtains %s before a stopped application can launch', async (choice) => {
   const f = await setup()
   await f.ctx.plugin(UserQuestions)
   const asked: PromiseWithResolvers<void> = Promise.withResolvers()
@@ -130,7 +131,7 @@ it.each(['Allow for this task', 'Deny'])('obtains %s before a stopped applicatio
 it('rejects a launch result that changes the approved handle', async () => {
   const f = await setup()
   await f.ctx.plugin(UserQuestions)
-  f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Allow for this task'] }] }))
+  f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] }))
   native.request.mockResolvedValueOnce({ appHandle: 'pending-app', pid: null, name: 'Fixture', authorization: {
     id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: false,
   } }).mockResolvedValueOnce({ appHandle: 'another-app', pid: 17, name: 'Fixture' })
@@ -257,6 +258,24 @@ it('keeps Agent disposal pending until its helper cleanup completes', async () =
   } finally { release.resolve(); await disposing }
 })
 
+it('retains the computer-use registration until permission helper cleanup settles', async () => {
+  const f = await setup()
+  native.request.mockResolvedValue({ accessibility: false, screenRecording: false, helper: { pid: 9 }, parent: { pid: 8 } })
+  await f.ctx.cuaAccess.systemStatus()
+  const entered = Promise.withResolvers<undefined>(), release = Promise.withResolvers<undefined>()
+  native.dispose.mockImplementation(async () => { entered.resolve(undefined); await release.promise })
+  onTestFinished(() => { release.resolve(undefined) })
+  const registry = f.ctx.computerUse
+  const closing = f.provider.dispose()
+  try {
+    await entered.promise
+    expect(registry.providerName).toBe('dsh-cua')
+    release.resolve(undefined)
+    await closing
+    expect(registry.providerName).toBeUndefined()
+  } finally { release.resolve(undefined); await closing }
+})
+
 it('joins helper cleanup already started by Agent disposal when the provider unloads', async () => {
   const f = await setup()
   await f.execute()
@@ -497,6 +516,8 @@ it.each([
   { owner: 'provider', stage: 'storage' },
   { owner: 'agent', stage: 'admission' },
   { owner: 'agent', stage: 'storage' },
+  { owner: 'revocation', stage: 'admission' },
+  { owner: 'revocation', stage: 'storage' },
 ])('waits for screenshot $stage and cancels its result during $owner disposal', async ({ owner, stage }) => {
   const f = await setup({ provider: 'image-fixture', model: 'vision' })
   await selectApplication(f)
@@ -526,7 +547,9 @@ it.each([
     const reached = await Promise.race([entered.promise.then(() => true), pending.then(() => false)])
     expect(reached).toBe(true)
     let closed = false
-    closing = (owner === 'provider' ? f.provider.dispose() : f.handle.dispose()).then(() => { closed = true })
+    closing = (owner === 'provider' ? f.provider.dispose()
+      : owner === 'agent' ? f.handle.dispose()
+        : f.ctx.cuaAccess.revoke('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)).then(() => { closed = true })
     await setImmediate()
     expect(admissionSignal?.aborted).toBe(true)
     expect(closed).toBe(false)
@@ -624,7 +647,7 @@ it('rejects an unsupported native host before starting preparation', async () =>
 })
 
 
-it('stores signed application consent in the current profile and refuses unavailable settings', async () => {
+async function permissionProfile() {
   const f = await setup()
   await f.provider.dispose()
   const home = await mkdtemp(join(tmpdir(), 'cua-grant-profile-')), dir = join(home, 'profile')
@@ -648,33 +671,72 @@ it('stores signed application consent in the current profile and refuses unavail
   await f.ctx.plugin(ConfigEditor)
   await mountRootInclude(f.ctx, join(dir, 'cordis.yml'), readProfilePatches('test', profile))
   await f.ctx.loader.await()
-  await f.ctx.plugin(UserQuestions)
-  const answer = vi.fn(async () => ({ answers: [{ id: 'cua-app-access', selected: ['Allow for this task'] }] }))
-  f.ctx.on('user-questions/request', answer)
-  native.request.mockResolvedValue({ appHandle: 'task-app', pid: 17, name: 'Fixture',
-    authorization: { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: true } })
-  expect((await f.execute('getApp', { selector: 'Fixture' })).isError).toBe(false)
+  native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
+    : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
+  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
   await f.ctx.plugin(Settings)
   await f.ctx.plugin(Timer)
   await f.ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 })
   await f.ctx.hmr.runExclusive(async () => {})
+  return { ...f, profile }
+}
+
+it('cancels a queued grant write when the current HMR transaction unloads CUA', async () => {
+  const f = await permissionProfile()
+  const grant = { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app' }
+  await f.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'], value: [grant] }])
+  const before = await readFile(f.profile.patchPath, 'utf8')
+  const acquired = Promise.withResolvers<undefined>(), unload = Promise.withResolvers<undefined>()
+  const queued = Promise.withResolvers<undefined>()
+  onTestFinished(() => { unload.resolve(undefined) })
+  const mutate = f.ctx.settings.mutate.bind(f.ctx.settings)
+  const observe = vi.spyOn(f.ctx.settings, 'mutate').mockImplementation((...args) => {
+    const pending = mutate(...args)
+    queued.resolve(undefined)
+    return pending
+  })
+  onTestFinished(() => { observe.mockRestore() })
+  const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
+  const disabling = f.ctx.hmr.runExclusive(async () => {
+    acquired.resolve(undefined)
+    await unload.promise
+    await entry.update({ disabled: true })
+  })
+  await acquired.promise
+  const revoked = f.ctx.cuaAccess.revoke(grant.id as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
+  const rejected = expect(revoked).rejects.toThrow()
+  await queued.promise
+  unload.resolve(undefined)
+  await Promise.all([disabling, rejected])
+  await f.ctx.hmr.runExclusive(async () => {})
+  expect(entry.disabled).toBe(true)
+  expect(await readFile(f.profile.patchPath, 'utf8')).toBe(before)
+})
+
+it('stores signed application consent in the current profile and refuses unavailable settings', async () => {
+  const f = await permissionProfile(), { profile } = f
   expect(f.ctx.settings.describe().find(row => row.ns === 'cua')?.autoGenerate).toBe(false)
-  answer.mockResolvedValue({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] })
+  await f.ctx.plugin(UserQuestions)
+  f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] }))
   const authorization = { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: true }
   native.request.mockResolvedValue({ appHandle: 'signed-app', pid: 17, name: 'Fixture', authorization })
   expect((await f.execute('getApp', { selector: 'Fixture' })).isError).toBe(false)
   expect(await readFile(profile.patchPath, 'utf8')).toContain(authorization.id)
-  const settings = f.ctx.settings.describe().find(row => row.ns === 'cua')!
-  await f.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'], value: [] }], settings.revision)
+  native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
+    : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
+  const permission = f.ctx.cuaAccess.applications()
+  expect(permission.allowedApps).toHaveLength(1)
+  await f.ctx.cuaAccess.revoke(permission.allowedApps[0]!.id)
   expect(await readFile(profile.patchPath, 'utf8')).toContain('allowedApps: []')
-  const revoked = await f.execute('getState', { appHandle: 'signed-app' })
-  expect(revoked.isError).toBe(true)
-  expect(JSON.stringify(revoked.content)).toContain('APP_ACCESS_REVOKED')
+  await f.ctx.cuaAccess.retryApproval(permission.allowedApps[0]!.id)
   vi.spyOn(f.ctx.settings, 'describe').mockReturnValue([])
-  native.request.mockResolvedValue({ appHandle: 'different-app', pid: 18, name: 'Other fixture', authorization: { ...authorization, id: 'b'.repeat(64) } })
+  native.request.mockResolvedValue({ appHandle: 'signed-app', pid: 17, name: 'Fixture', authorization })
   const unavailable = await f.execute('getApp', { selector: 'Fixture' })
   expect(unavailable.isError).toBe(true)
   expect(JSON.stringify(unavailable.content)).toContain('APP_ACCESS_DENIED')
+  native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
+    : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
+  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
 })
 
 it('rejects an application handle before any helper or consent has been acquired', async () => {

From 6ae9ce5e2f294a1e58987ad118ae68298fda2757 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 07/44] feat(cua): add the experimental Computer Use bundle

---
 .../experimental/cua-bundle/README.i18n.yaml  | 46 +++++++++
 packages/experimental/cua-bundle/README.md    | 94 +++++++++++++++++++
 packages/experimental/cua-bundle/README.zh.md | 94 +++++++++++++++++++
 .../experimental/cua-bundle/cordis.patch.yml  |  9 ++
 packages/experimental/cua-bundle/icon.svg     | 12 +++
 .../experimental/cua-bundle/locale/en.json    |  6 ++
 .../experimental/cua-bundle/locale/zh.json    |  6 ++
 packages/experimental/cua-bundle/package.json | 66 +++++++++++++
 packages/experimental/cua-bundle/src/index.ts |  2 +
 .../experimental/cua-bundle/tsconfig.json     | 15 +++
 10 files changed, 350 insertions(+)
 create mode 100644 packages/experimental/cua-bundle/README.i18n.yaml
 create mode 100644 packages/experimental/cua-bundle/README.md
 create mode 100644 packages/experimental/cua-bundle/README.zh.md
 create mode 100644 packages/experimental/cua-bundle/cordis.patch.yml
 create mode 100644 packages/experimental/cua-bundle/icon.svg
 create mode 100644 packages/experimental/cua-bundle/locale/en.json
 create mode 100644 packages/experimental/cua-bundle/locale/zh.json
 create mode 100644 packages/experimental/cua-bundle/package.json
 create mode 100644 packages/experimental/cua-bundle/src/index.ts
 create mode 100644 packages/experimental/cua-bundle/tsconfig.json

diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
new file mode 100644
index 0000000000..519c87ef6b
--- /dev/null
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -0,0 +1,46 @@
+# Bilingual-pair consistency record for README.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/experimental/cua-bundle/README.md
+/:
+  en: 6a4efed7f053f52c
+  zh: 9135d38515947b44
+/deepseek-ai-dsh-cua-bundle:
+  en: 9084fb48d0f6489c
+  zh: ce692972d91cf663
+/deepseek-ai-dsh-cua-bundle/summary:
+  en: 06d8bf4ee1ef6f3b
+  zh: 8568f649fb846615
+/deepseek-ai-dsh-cua-bundle/table-of-contents:
+  en: b563e4ec4727d0de
+  zh: d0228da978238e05
+/deepseek-ai-dsh-cua-bundle/use-this-package:
+  en: 5b315d6902074bdd
+  zh: b904b76441f44088
+/deepseek-ai-dsh-cua-bundle/understand-the-implementation:
+  en: 1d592dc9112502fe
+  zh: a922cd0878b6c27d
+/deepseek-ai-dsh-cua-bundle/further-exploration:
+  en: 9f15d56b5b16e1ca
+  zh: 75eb08e8828c8877
+/deepseek-ai-dsh-cua-bundle/model-experience:
+  en: 215e7ba838619b7b
+  zh: a311da3843709f90
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc:
+  en: b932589e03b6ff18
+  zh: b932589e03b6ff18
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/what-the-model-sees:
+  en: 591af735d1eb92f6
+  zh: 3632bffa33c77b28
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/token-effect:
+  en: 09a8fd5d9ab27cea
+  zh: 05de759d1f4f33c5
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/kv-cache-effect:
+  en: 417c40acd93df532
+  zh: 69cc5cf7140c75a9
+/deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work:
+  en: 8ddfd9245748b7c3
+  zh: 52015ab010abd0f8
+/deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work/dev-note:
+  en: 0a1253c6f7b5e8b9
+  zh: ce96645b3e75874e
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
new file mode 100644
index 0000000000..2428194877
--- /dev/null
+++ b/packages/experimental/cua-bundle/README.md
@@ -0,0 +1,94 @@
+---
+description: "Enable experimental Computer Use and persistent PTC from the plugin page."
+kind: "package-bundle"
+---
+
+# @deepseek-ai/dsh-cua-bundle
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Enable macOS Computer Use from Plugins for existing and new PTC sessions. Windows support is in development. This bundle remains in `experimental` until that support is complete, then moves to the `computer-use` group. It is off by default; disabled profiles prepare no native components and register neither CUA tools nor their model guidance.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+This workflow targets developers running macOS Web or unpackaged Desktop from source. Open Plugins → Experimental plugins → Computer Use and enable the switch. The permission page identifies the responsible application reported by macOS when the optional system query is available, and guides the user through requesting access, enabling the matching system switch, and automatically refreshing on return. Follow the application named by macOS if it differs from the detected source. Persistent PTC retains variables across calls under the selected file sandbox policy. For Web, run these commands from the repository root:
+
+```sh
+pnpm run build
+pnpm dsh web
+```
+
+For the source Desktop launcher and its separate development profile, follow [Desktop development](../../../apps/desktop/README.md). Enable Computer Use in each profile that needs it.
+
+The switch saves bundle selection in the profile’s `package.json`. Enabling configures persistent PTC in the user’s `cordis.patch.yml`; matching values are left unchanged. Computer Use is designed for PTC and installed only in PTC sessions. When system permissions need attention, activation guidance opens the plugin details. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. HMR maintains these settings and the provider’s session tool registrations. Native components prepare on activation and source startup; subsequent `pnpm run build` checks the selected Web profile’s incremental native build. First preparation requires local compiler tools, and failure preserves diagnostics without publishing a new executable.
+
+Disabling unloads the provider and withdraws CUA tools from its Agent scopes. It retains the selected default, runtime configuration and retained PTC variables. Enabling again does not recreate a runtime already configured as persistent. A first change from per-call execution replaces the shared runtime through HMR and can interrupt an active PTC call.
+
+Computer Use is available only on a macOS DSH Host. Other Hosts refuse enablement before saving settings. An already selected bundle is skipped at startup with a diagnostic and remains available for deselection; saved user settings remain. A browser on another operating system can connect to a supported Mac Host.
+
+If preparation fails, the saved selection and PTC settings remain, while CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
+
+Explicit activation runs a read-only permission check, which may start a helper without opening a system dialog. Open the [permission page](../client-ui-cua/README.md) for system requests, settings navigation and automatic refresh. Tasks ask separately before accessing an application. Saved application decisions use the existing profile configuration; session decisions remain in memory across turns and connections until DSH restarts or Computer Use is disabled. Revoke access on the same page.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Maintainer details</summary>
+
+The bundle patch mounts the shared native provider and permission UI with `agentPreset: ptc`. The provider registers tools through existing Agent scopes, so other presets receive no CUA tool or guidance. Preset documents remain unchanged. `configureOnEnable` persists `ui-settings.enabled: true` and `ptc-runtime.executionMode: persistent-in-memory` through [Plugin Manager](../../boot/plugin-manager/README.md). The detail-page action uses the existing settings form to save `agent-preset-registry.selectedDefault: ptc` only when clicked, preserving the deployment `default`. The provider defaults to PTC scope even when a saved grants override omits that field. [CUA](../cua/README.md) owns registration and disposal.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+[Computer use](../../../docs/subsystems/computer-use.md)
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Computer Use and persistent PTC
+
+#### What the model sees
+
+Existing and new PTC sessions receive `cua` through the generated SDK and `run_code`, plus CUA guidance. Disabling withdraws these contributions and keeps PTC presentation. Other presets receive no CUA contributions. [CUA](../cua/README.md) and [PTC](../../ptc-runtime/ptc-runtime-node/README.md#persistent-repl) own the interfaces and output semantics.
+
+#### Token effect
+
+CUA activation adds its guidance. Disabling removes that guidance and retains persistent PTC instructions.
+
+#### KV Cache effect
+
+CUA activation and removal change the PTC SDK and system guidance; subsequent requests use the updated prefix. The top-level `run_code` transport remains present.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- Source Web and Desktop share permission controls on macOS. Packaged Desktop helper distribution, signing, and permission attribution are deferred.
+- PTC execution is shared by the profile. A Host without HMR applies saved changes at restart.
+
+<a id="dev-note"></a>
+### Dev Note
+
+None.
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
new file mode 100644
index 0000000000..02da5693b5
--- /dev/null
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -0,0 +1,94 @@
+---
+description: "从插件页开启实验性 Computer Use 和 persistent PTC。"
+kind: "package-bundle"
+---
+
+# @deepseek-ai/dsh-cua-bundle
+
+[English](README.md) | 中文
+
+## 概述
+
+从插件页为已有和新建 PTC 会话开启 macOS Computer Use。Windows 支持正在开发中。本组合包暂放在 `experimental`，待 Windows 支持完成后迁回 `computer-use` 组。默认关闭，关闭时不准备本机组件、不注册 CUA 工具或添加其模型指引。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [进一步探索](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与延后工作](#known-limitations-and-deferred-work)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+本流程面向从源码运行 macOS Web 或未打包 Desktop 的开发者。打开侧栏“插件 → 实验性插件 → Computer Use”并启用。权限页通过可选系统查询显示 macOS 报告的责任应用，无法识别时使用通用指引，指引用户申请权限、开启对应系统开关，返回后自动检测。若 macOS 显示其他应用名称，以系统提示为准。persistent PTC 跨调用保留变量，并遵守当前文件沙箱策略。Web 版在仓库根目录运行以下命令：
+
+```sh
+pnpm run build
+pnpm dsh web
+```
+
+源码 Desktop 的启动方式和独立开发配置档见[桌面开发说明](../../../apps/desktop/README.zh.md)。需要使用 Computer Use 的配置档分别开启该功能。
+
+开关将组合包选择保存到 profile 的 `package.json`。开启时在用户 `cordis.patch.yml` 中配置 persistent PTC，已匹配的值不改写。Computer Use 针对 PTC 模式设计，仅安装在 PTC 会话中。系统权限尚未就绪时，启用引导会进入插件详情页。详情页提供“设为 PTC”按钮来修改新会话默认模式；已有会话保留原 preset。HMR 维护这些设置和提供方的会话工具注册。本机组件在启用及源码启动时准备，后续 `pnpm run build` 检查已选中 Web profile 的本机增量构建。首次准备需要本机编译工具，失败保留诊断且不发布新的可执行文件。
+
+关闭会卸载提供方，并从其 Agent 作用域中撤回 CUA 工具。用户选择的默认值、执行器配置和变量均保留。再次开启不会重建已经配置为 persistent 的执行器。首次从 per-call 切换时，HMR 会重载共享执行器，可能中断正在执行的 PTC 调用。
+
+Computer Use 仅支持 macOS DSH Host。其他 Host 会在保存设置前拒绝启用。已选中的组合包会在启动时跳过并报告原因，仍可取消选择；已保存的用户设置保留。其他操作系统上的浏览器可以连接受支持的 Mac Host。
+
+准备失败时，已保存的选择和 PTC 设置保留，CUA 操作暂不可用。刷新或重新打开插件页查看组件诊断，修复后重启 DSH。
+
+显式启用会进行只读权限检查，可能启动 helper，但不会打开系统授权弹窗。[权限页面](../client-ui-cua/README.zh.md) 提供系统申请入口、设置跳转和自动检测。任务访问应用前会单独询问用户。长期应用授权保存在现有 profile 配置中，会话授权保存在内存中，跨 turn 和连接复用，重启 DSH 或关闭 Computer Use 后失效。可以在同一页面撤销授权。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>维护者说明</summary>
+
+组合包 patch 通过 `agentPreset: ptc` 挂载共享原生提供方和权限界面。提供方在现有 Agent 作用域中注册工具，其他 preset 不获得 CUA 工具或指引，preset 文档保持不变。`configureOnEnable` 通过[插件管理器](../../boot/plugin-manager/README.zh.md)保存 `ui-settings.enabled: true` 和 `ptc-runtime.executionMode: persistent-in-memory`。详情页按钮复用现有设置表单，仅在用户点击后保存 `agent-preset-registry.selectedDefault: ptc`，保留部署级 `default`。即使旧授权配置没有声明作用域字段，提供方也默认只为 PTC 会话注册工具。[CUA](../cua/README.zh.md)负责注册和销毁。
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 进一步探索
+
+[Computer use](../../../docs/subsystems/computer-use.zh.md)
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+### Computer Use and persistent PTC
+
+#### What the model sees
+
+已有和新建 PTC 会话通过生成的 SDK 与 `run_code` 使用 `cua`，并获得 CUA 指引。关闭撤回这些贡献，保留 PTC 展示方式。其他 preset 不获得 CUA 贡献。完整接口与输出约定由 [CUA](../cua/README.zh.md) 和 [PTC](../../ptc-runtime/ptc-runtime-node/README.zh.md#persistent-repl) 说明。
+
+#### Token effect
+
+CUA 生效时添加其指引。关闭撤回这些指引，保留 persistent PTC 说明。
+
+#### KV Cache effect
+
+CUA 生效和卸载会改变 PTC SDK 与系统指引，后续请求使用更新后的前缀。顶层 `run_code` 工具保持存在。
+
+## 已知限制与延后工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- 源码 Web 与 Desktop 共用 macOS 权限控件。桌面安装包的 helper 分发、签名和权限归属留待后续处理。
+- PTC 执行方式由 profile 共享。未启用 HMR 的 Host 在重启时应用已保存的变更。
+
+<a id="dev-note"></a>
+### 开发备注
+
+None.
diff --git a/packages/experimental/cua-bundle/cordis.patch.yml b/packages/experimental/cua-bundle/cordis.patch.yml
new file mode 100644
index 0000000000..e468011f06
--- /dev/null
+++ b/packages/experimental/cua-bundle/cordis.patch.yml
@@ -0,0 +1,9 @@
+- insert:
+    - id: cua-provider-registry
+      name: '@deepseek-ai/dsh-computer-use'
+    - id: cua
+      name: '@deepseek-ai/dsh-experimental-cua-macos'
+      config:
+        agentPreset: ptc
+    - id: ui-cua
+      name: '@deepseek-ai/dsh-client-ui-cua'
diff --git a/packages/experimental/cua-bundle/icon.svg b/packages/experimental/cua-bundle/icon.svg
new file mode 100644
index 0000000000..5d50e0fa5a
--- /dev/null
+++ b/packages/experimental/cua-bundle/icon.svg
@@ -0,0 +1,12 @@
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <circle cx="15.5" cy="15.5" r="8.5" fill="url(#a)" />
+  <circle cx="15.5" cy="15.5" r="5" fill="#FFFFFF" />
+  <path d="M13.2 15.5L14.9 17.2L18.2 13.9" stroke="#145AF3" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" />
+  <path d="M22 22L29 29" stroke="#145AF3" stroke-width="3.2" stroke-linecap="round" />
+  <defs>
+    <linearGradient id="a" x1="7" y1="7" x2="24" y2="24" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#7CB7FF" />
+      <stop offset="1" stop-color="#45D9E7" />
+    </linearGradient>
+  </defs>
+</svg>
diff --git a/packages/experimental/cua-bundle/locale/en.json b/packages/experimental/cua-bundle/locale/en.json
new file mode 100644
index 0000000000..58df5ffbb9
--- /dev/null
+++ b/packages/experimental/cua-bundle/locale/en.json
@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Computer Use",
+    "description": "macOS only. Windows support is in development. Enabling makes PTC persistent and loads Computer Use for existing and new PTC sessions. Switch to PTC mode and grant Accessibility and Screen Recording permissions to use Computer Use."
+  }
+}
diff --git a/packages/experimental/cua-bundle/locale/zh.json b/packages/experimental/cua-bundle/locale/zh.json
new file mode 100644
index 0000000000..6e632dcd4f
--- /dev/null
+++ b/packages/experimental/cua-bundle/locale/zh.json
@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Computer Use",
+    "description": "目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。"
+  }
+}
diff --git a/packages/experimental/cua-bundle/package.json b/packages/experimental/cua-bundle/package.json
new file mode 100644
index 0000000000..ccd21f4164
--- /dev/null
+++ b/packages/experimental/cua-bundle/package.json
@@ -0,0 +1,66 @@
+{
+  "name": "@deepseek-ai/dsh-cua-bundle",
+  "description": "Optional macOS Computer Use with persistent PTC",
+  "version": "0.2.1-rc.2",
+  "icon": "./icon.svg",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/experimental/cua-bundle"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "icon.svg",
+    "locale/*.json",
+    "lib/index.js",
+    "cordis.patch.yml",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml",
+      "experimental": true,
+      "configureOnEnable": {
+        "ui-settings": {
+          "enabled": true
+        },
+        "ptc-runtime": {
+          "executionMode": "persistent-in-memory"
+        }
+      },
+      "platforms": [
+        "darwin"
+      ]
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-experimental-cua-macos": "workspace:*",
+    "@deepseek-ai/dsh-computer-use": "workspace:*",
+    "@deepseek-ai/dsh-ptc-runtime-node": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-cua": "workspace:*"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "workspace:~"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:~",
+    "@deepseek-ai/cordis-plugin-include": "workspace:~",
+    "js-yaml": "^4.2.0"
+  }
+}
diff --git a/packages/experimental/cua-bundle/src/index.ts b/packages/experimental/cua-bundle/src/index.ts
new file mode 100644
index 0000000000..f04783f7c0
--- /dev/null
+++ b/packages/experimental/cua-bundle/src/index.ts
@@ -0,0 +1,2 @@
+/** Optional Computer Use composition; configuration rows live in cordis.patch.yml. */
+export {}
diff --git a/packages/experimental/cua-bundle/tsconfig.json b/packages/experimental/cua-bundle/tsconfig.json
new file mode 100644
index 0000000000..f1a449634c
--- /dev/null
+++ b/packages/experimental/cua-bundle/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types"
+  },
+  "include": [
+    "src"
+  ],
+  "references": [
+    {
+      "path": "../../../vendor/cordis"
+    }
+  ]
+}

From 36ec182e33f18bca76c2f6102712d012023127d6 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 08/44] feat(cua-ui): guide setup and manage application access

---
 .../client-ui-cua/README.i18n.yaml            |  37 ++
 packages/experimental/client-ui-cua/README.md |  92 +++++
 .../experimental/client-ui-cua/README.zh.md   |  92 +++++
 .../experimental/client-ui-cua/package.json   |  72 ++++
 .../src/client/PermissionPanel.module.css     |  48 +++
 .../src/client/PermissionPanel.tsx            | 185 +++++++++
 .../client-ui-cua/src/client/controller.ts    | 136 +++++++
 .../client-ui-cua/src/client/index.ts         |  15 +
 .../client-ui-cua/src/client/locales.ts       |  64 ++++
 .../client-ui-cua/src/client/mount.ts         |  82 ++++
 .../client-ui-cua/src/css-modules.d.ts        |   4 +
 .../experimental/client-ui-cua/src/index.ts   |   2 +
 .../tests/controller.client.spec.ts           | 253 +++++++++++++
 .../client-ui-cua/tests/mount.client.spec.ts  | 180 +++++++++
 .../client-ui-cua/tests/panel.client.spec.tsx | 352 ++++++++++++++++++
 .../experimental/client-ui-cua/tsconfig.json  |  51 +++
 .../client-ui-cua/tsdown.config.ts            |   3 +
 17 files changed, 1668 insertions(+)
 create mode 100644 packages/experimental/client-ui-cua/README.i18n.yaml
 create mode 100644 packages/experimental/client-ui-cua/README.md
 create mode 100644 packages/experimental/client-ui-cua/README.zh.md
 create mode 100644 packages/experimental/client-ui-cua/package.json
 create mode 100644 packages/experimental/client-ui-cua/src/client/PermissionPanel.module.css
 create mode 100644 packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
 create mode 100644 packages/experimental/client-ui-cua/src/client/controller.ts
 create mode 100644 packages/experimental/client-ui-cua/src/client/index.ts
 create mode 100644 packages/experimental/client-ui-cua/src/client/locales.ts
 create mode 100644 packages/experimental/client-ui-cua/src/client/mount.ts
 create mode 100644 packages/experimental/client-ui-cua/src/css-modules.d.ts
 create mode 100644 packages/experimental/client-ui-cua/src/index.ts
 create mode 100644 packages/experimental/client-ui-cua/tests/controller.client.spec.ts
 create mode 100644 packages/experimental/client-ui-cua/tests/mount.client.spec.ts
 create mode 100644 packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
 create mode 100644 packages/experimental/client-ui-cua/tsconfig.json
 create mode 100644 packages/experimental/client-ui-cua/tsdown.config.ts

diff --git a/packages/experimental/client-ui-cua/README.i18n.yaml b/packages/experimental/client-ui-cua/README.i18n.yaml
new file mode 100644
index 0000000000..7a10437d5e
--- /dev/null
+++ b/packages/experimental/client-ui-cua/README.i18n.yaml
@@ -0,0 +1,37 @@
+# Bilingual-pair consistency record for README.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/experimental/client-ui-cua/README.md
+/:
+  en: e5ff656e81db5fc8
+  zh: 43a8e818159176b3
+/deepseek-ai-dsh-client-ui-cua:
+  en: 43859860b79a3757
+  zh: e8e0829c36613320
+/deepseek-ai-dsh-client-ui-cua/summary:
+  en: 4e62e511b5d14986
+  zh: 1fce04dbad7515f7
+/deepseek-ai-dsh-client-ui-cua/table-of-contents:
+  en: c606f8af967e93e9
+  zh: c569e0decbd74353
+/deepseek-ai-dsh-client-ui-cua/use-this-package:
+  en: ecf4a8b23d6f976d
+  zh: 46793f29118b4eff
+/deepseek-ai-dsh-client-ui-cua/understand-the-implementation:
+  en: 3282a9539cce0073
+  zh: 9d99864ffbfa6f64
+/deepseek-ai-dsh-client-ui-cua/further-exploration:
+  en: f0fde9f736ade61a
+  zh: 43a534a21bcc1c13
+/deepseek-ai-dsh-client-ui-cua/model-experience:
+  en: 7cfbaa62f70c1916
+  zh: 384ec816a50fc7c5
+/deepseek-ai-dsh-client-ui-cua/model-experience/kv-cache-effect:
+  en: f04fc6e6f503960f
+  zh: f080408ae6729fee
+/deepseek-ai-dsh-client-ui-cua/known-limitations-and-deferred-work:
+  en: c032612d923e1367
+  zh: eb77d474e21ca5d9
+/deepseek-ai-dsh-client-ui-cua/known-limitations-and-deferred-work/dev-note:
+  en: b836f01bd0bceb4a
+  zh: a6ea1361c4a48df0
diff --git a/packages/experimental/client-ui-cua/README.md b/packages/experimental/client-ui-cua/README.md
new file mode 100644
index 0000000000..7cf82917e0
--- /dev/null
+++ b/packages/experimental/client-ui-cua/README.md
@@ -0,0 +1,92 @@
+---
+description: "Check macOS Computer Use permissions and revoke application access."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-client-ui-cua
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Open Computer Use in Plugins to check Accessibility and Screen Recording, request missing system permissions, and revoke application access. Explicit activation probes permissions and may start a dedicated native helper. Missing privileges show setup guidance; a failed probe directs the user to diagnostics and retry in the details page. System prompts still require the user's decision.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+Application permission prompts and permission-page lists show native icons and application names. Paths remain available on hover. Icons are presentation metadata and are never saved with grants. The prompt offers session access, refusal and, for verifiable applications with writable settings, persistent access through the shared approval card.
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+The [Computer Use bundle](../cua-bundle/README.md) mounts this page with its native provider. **Authorize Computer Use** groups the new-session default, Accessibility, and Screen Recording inside one border, with dividers between the rows. Each system-permission row shows the system-reported responsible application’s `.app` bundle filename and icon together in a bordered label. **Manage applications Computer Use can access** places the application lists inside a separate bordered group. Choose **Request permission**, find that application in the macOS permission list, and enable its switch; if macOS names another application, follow that prompt. With no detected source, the page directs the user to the application named by macOS. **Open System Settings** opens the corresponding privacy pane. The page refreshes on entry, when the window regains focus, and after permission actions. A failed query offers **Retry**. Follow any macOS quit-and-reopen prompt and restart DSH as needed.
+
+System-permission operations affect the computer running DSH. When accessing DSH remotely, complete authorization on that computer.
+
+Enabling shows setup guidance when system permissions need attention, with **Later** and **Open settings** actions. The dialog navigates to the plugin details without changing the default mode. The detail page provides **Set to PTC** under **Default mode for new sessions**; only this action saves the default. Existing sessions keep their preset.
+
+The page lists always-allowed applications and refusals from any session. A refusal in one session does not cancel another session’s grant or prevent a new session from asking. Session-only grants remain effective within their sessions and are omitted from this page. **Revoke** removes the selected application's access and cancels affected work. Input already delivered to an application cannot be undone; observe the application before any further action. **Allow asking again** clears that application’s refusal records across all sessions; the next application selection still requires a new decision.
+
+This plugin has no configurable fields.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals</summary>
+
+The optional browser contribution mounts the native provider's permission Remote and reuses the Plugins activation and configuration slots. The three setup rows remain visible while unknown fields use placeholders. The default-mode form, system checks, application decisions, and application icons fill in as each query completes. Application names and actions do not wait for icons; icon positions retain their space. User actions run in order without waiting for pending observation queries. Disposal waits for both actions and queries to settle before releasing the separately owned Remote mount. Query errors stay with the affected section, and activation guidance depends only on system checks. Plugin Manager’s pending state pauses observation during bundle changes and resumes it afterward; late results from the previous activation are discarded. One controller projects queries into the page and setup dialog; reconnects and updates to the Host-reported settings namespace refresh it. Operation notices live in the shell overlay, so closing the page does not remove them. The provider owns permission checks, persisted decisions, and cancellation; the browser owns no authorization state.
+
+The detail page reads the effective default (`selectedDefault ?? default`) from the existing `configForms` service. Its button writes only `selectedDefault` through the form's revision-checked settings path. Loading, read-only and unavailable settings cannot submit a change; a failed write remains beside the setting for retry.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+- [Native provider](../cua/README.md): executable identity and operation checks.
+- [Plugin manager](../../client/ui-plugin-manager/README.md): activation and page slots.
+- [UI primitives](../../client/ui-primitives/README.md): shared modal, buttons, and toast.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as this package registers browser controls and no model-facing tools or prompt sections.
+
+#### KV Cache effect
+
+None; the native provider owns model-visible guidance and operation results.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+This CUA-specific UI remains experimental while Windows support is in development; promotion returns it to the `client` group as `ui-cua`.
+
+- macOS may require restarting the launching application after a system permission change. A pending request is not an authorization grant.
+- Application attribution depends on an optional native system query and available application metadata. If either is unavailable, the page uses generic system-prompt guidance. Packaged Desktop distribution and permission attribution remain deferred.
+- No invariant companion is published: this UI projects the provider's query and stores no independent authorization decisions.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers</summary>
+
+None.
+
+</details>
diff --git a/packages/experimental/client-ui-cua/README.zh.md b/packages/experimental/client-ui-cua/README.zh.md
new file mode 100644
index 0000000000..08b112c67f
--- /dev/null
+++ b/packages/experimental/client-ui-cua/README.zh.md
@@ -0,0 +1,92 @@
+---
+description: "检查 macOS Computer Use 权限并撤销应用访问权限。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-client-ui-cua
+
+[English](README.md) | 中文
+
+## 概述
+
+在插件页打开 Computer Use，可以检查辅助功能和屏幕录制权限、申请缺失的系统权限，并撤销应用授权。用户显式启用时会检查权限，可能启动专用原生 helper。缺少权限时显示设置引导，查询失败时引导用户到详情页查看原因并重试。系统授权仍由用户决定。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [延伸阅读](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与后续工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+应用授权提示和权限页列表显示本机图标与应用名称，悬停可查看列表中的路径。图标仅用于展示，不随授权保存。提示复用共用审批卡片，提供本会话允许和拒绝；应用签名可验证且配置可写时，还提供始终允许。
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+[Computer Use 组合](../cua-bundle/README.zh.md)将本页与原生 provider 一起挂载。“给 Computer Use 授权”把新会话默认模式、辅助功能和屏幕录制放在同一个边框内，三排之间使用分隔线。两条系统权限要求在能识别责任应用时，把该应用的 `.app` 包名称和图标放在同一个标签中。“管理 Computer Use 可访问的应用”使用独立边框包住应用列表。点击“申请权限”，在 macOS 权限列表中找到该应用并开启对应开关；若 macOS 显示其他名称，以系统提示为准。来源无法识别时，页面引导用户查找系统提示的应用。“打开系统设置”会打开对应的隐私设置页。进入详情页、返回窗口或完成授权操作后会自动刷新；查询失败时可点击“重试”。若系统要求退出并重新打开应用，请按提示操作并重新启动 DSH。
+
+系统权限操作作用于运行 DSH 的电脑。远程访问时，请在该电脑上完成授权。
+
+启用后，系统权限尚未就绪时会显示设置引导，提供“稍后”和“前往设置”。弹窗进入插件详情页，不修改默认模式。详情页的“新会话默认模式”提供“设为 PTC”按钮，仅点击此按钮才保存默认值。已有会话保留原 preset。
+
+页面展示“始终允许的应用”和“不允许访问的应用”。后者汇总任一会话的拒绝记录，不取消其他会话已有的授权，也不阻止新会话询问授权。会话授权仍在对应会话中生效，详情页不展示这类应用。“撤销”会移除对应应用的访问许可并取消相关操作。已发送到应用的输入无法撤回，继续操作前需重新观察应用。“允许再次询问”清除该应用在所有会话中的拒绝记录；下次选择应用时仍需用户重新决定。
+
+本插件没有配置字段。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>实现细节</summary>
+
+可选浏览器插件挂载原生 provider 的权限 Remote，复用插件页的启用引导和配置插槽。三排使用条件始终可见，未加载的字段保留占位。默认模式、系统权限、应用列表和应用图标分别查询，结果返回后各自显示。应用名称和操作按钮不等待图标，图标位置保留空位。用户操作按顺序执行，不等待尚未完成的查询；卸载时等待操作和查询全部结束，再释放独立持有的 Remote 挂载。查询错误只显示在对应部分，启用引导只等待系统权限结果。面板复用插件管理器的忙碌状态，在启停期间暂停查询，完成后再刷新；上一次启用期间的迟到结果会被丢弃。一个控制器把查询结果投影到页面和设置弹窗；重新连接或 Host 返回的配置 namespace 更新时刷新状态。操作提示挂载到 shell overlay，关闭页面后仍可显示。provider 负责权限检查、持久授权和取消；浏览器不保存授权决定。
+
+详情页通过现有 `configForms` 服务读取实际默认值（`selectedDefault ?? default`）。按钮仅写入 `selectedDefault`，沿用表单带版本检查的设置写入流程。设置仍在加载、只读或不可用时不能提交；写入失败时在设置旁显示错误，供用户重试。
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 延伸阅读
+
+- [原生 provider](../cua/README.zh.md)：可执行文件身份和操作检查。
+- [插件管理](../../client/ui-plugin-manager/README.zh.md)：启用引导和页面插槽。
+- [界面基础组件](../../client/ui-primitives/README.zh.md)：共用弹窗、按钮和提示。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+无。本包注册浏览器控件，不注册模型工具或提示词段落。
+
+#### KV 缓存影响
+
+无。模型可见的指引和操作结果由原生 provider 负责。
+
+## 已知限制与后续工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+这套 CUA 专用界面随 Windows 支持一起开发，暂放在 `experimental`；转为正式功能后迁回 `client` 组的 `ui-cua`。
+
+- 系统权限变更后，macOS 可能要求重启启动程序。申请尚未完成时，不能视为已授权。
+- 应用归属依赖可选的本机系统查询和可读取的应用信息；不可用时，页面使用通用指引，让用户按系统弹窗完成授权。桌面安装包的分发和权限归属留待后续处理。
+- 不提供 invariant companion：本界面投影 provider 查询，不独立保存授权决定。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作记录</summary>
+
+无。
+
+</details>
diff --git a/packages/experimental/client-ui-cua/package.json b/packages/experimental/client-ui-cua/package.json
new file mode 100644
index 0000000000..6554c14387
--- /dev/null
+++ b/packages/experimental/client-ui-cua/package.json
@@ -0,0 +1,72 @@
+{
+  "name": "@deepseek-ai/dsh-client-ui-cua",
+  "description": "Computer Use permission setup and application access controls",
+  "version": "0.2.1-rc.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/experimental/client-ui-cua"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-layout"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "bundle": "tsdown",
+    "watch": "tsdown --watch"
+  },
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "workspace:~"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:~",
+    "@deepseek-ai/dsh-api-remotes": "workspace:*",
+    "@deepseek-ai/dsh-api-gateway": "workspace:*",
+    "@deepseek-ai/dsh-client-locale": "workspace:*",
+    "@deepseek-ai/dsh-client-store": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-primitives": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-renderer": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-slots": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-settings": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-layout": "workspace:*",
+    "@deepseek-ai/dsh-cua": "workspace:*",
+    "@deepseek-ai/dsh-client-test-runtime": "workspace:*",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "@testing-library/react": "^16.1.0",
+    "@deepseek-ai/dsh-typert-protocol": "workspace:*"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/client.js",
+    "lib/types/**/*.d.ts"
+  ]
+}
diff --git a/packages/experimental/client-ui-cua/src/client/PermissionPanel.module.css b/packages/experimental/client-ui-cua/src/client/PermissionPanel.module.css
new file mode 100644
index 0000000000..f4fb0334d0
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/PermissionPanel.module.css
@@ -0,0 +1,48 @@
+.panels { display: grid; gap: 24px; margin: 18px 0; font-size: 13px; }
+.panel { display: grid; gap: 12px; min-width: 0; }
+.card { min-width: 0; border: 0.5px solid var(--dsw-alias-border-l1); border-radius: var(--dsw-radius-md); }
+.card > * + * { border-top: 0.5px solid var(--dsw-alias-border-l1); }
+.panel p { margin: 0; color: var(--dsw-alias-label-secondary); line-height: 1.6; }
+.panel h3 { margin: 0; font-size: 14px; font-weight: 500; }
+.panel h4 { margin: 0; font-size: 13px; font-weight: 500; color: var(--dsw-alias-label-secondary); }
+.permission, .apps li { display: flex; flex-wrap: wrap; align-items: center; gap: 12px; }
+.permission, .group, .emptyState, .notice { padding: 16px; }
+.permission { min-height: 80px; box-sizing: border-box; }
+.defaultSetting > p { margin: 0 16px 16px; }
+.permission > div:first-child, .apps li > div { flex: 1; min-width: 140px; }
+.actions, .notice { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
+.group { display: grid; gap: 4px; }
+.apps { display: grid; padding: 0; margin: 0; list-style: none; }
+.apps li { padding: 12px 0; }
+.apps li:last-child { padding-bottom: 0; }
+.panel strong { font-weight: 500; }
+.panel .error { color: var(--dsw-alias-state-error-primary); overflow-wrap: anywhere; }
+.application { display: flex; align-items: center; gap: 10px; }
+.application strong { min-width: 0; overflow-wrap: anywhere; }
+.application img { flex-shrink: 0; object-fit: contain; }
+.applicationBadge {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  max-width: 100%;
+  padding: 2px 6px;
+  border: 0.5px solid var(--dsw-alias-border-l1);
+  border-radius: var(--dsw-radius-sm);
+  color: var(--dsw-alias-label-primary);
+  vertical-align: middle;
+}
+.applicationBadge img { flex-shrink: 0; object-fit: contain; }
+.applicationBadge > span { min-width: 0; overflow-wrap: anywhere; }
+.permissionStatus { min-width: 72px; }
+.buttonPlaceholder, .statusPlaceholder, .appPlaceholder, .appsPlaceholder {
+  display: inline-block;
+  max-width: 100%;
+  border-radius: var(--dsw-radius-xs);
+  background: var(--dsw-alias-bg-skeleton);
+}
+.buttonPlaceholder { width: 120px; height: 28px; }
+.statusPlaceholder { width: 64px; height: 12px; }
+.appPlaceholder { width: 160px; height: 20px; }
+.appsPlaceholder { width: 240px; height: 40px; }
+
+.iconPlaceholder { display: inline-block; width: 32px; height: 32px; flex-shrink: 0; }
diff --git a/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx b/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
new file mode 100644
index 0000000000..5904807d92
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
@@ -0,0 +1,185 @@
+/** Native permission status and revocable application consent on the existing plugin page. */
+import { useEffect, useState } from 'react'
+import { Button, Modal, Toast } from '@deepseek-ai/dsh-client-ui-primitives'
+import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
+import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { CuaApplicationGrant, CuaSystemPermissionState } from '@deepseek-ai/dsh-cua/types'
+import type { PermissionFace } from './controller.ts'
+import type { NS } from './locales.ts'
+import css from './PermissionPanel.module.css'
+
+/** Renderer-bound permission observation and localized controls. */
+export type PermissionProps = InjectFace<PermissionFace> & PropsLocale<typeof NS>
+
+/** Permission guidance only navigates to the existing bundle details. */
+export type PermissionSetupProps = PermissionProps
+  & Pick<PropsRuntime<'plugins.bundle.activation'>, 'onDismiss' | 'onOpenDetails'>
+
+type DefaultPresetProps = PropsLocale<typeof NS> & Pick<PropsRuntime<'plugins.bundle.config'>, 'busy'> & InjectFace<{
+  hooks: { cuaDefaultPreset: ConfigForm<{ default: string; selectedDefault?: string }> }
+  setPtcDefault: () => Promise<boolean>
+}>
+
+/** The detail page owns the optional new-session default action. */
+export type PermissionPanelProps = PermissionProps & DefaultPresetProps
+
+function DefaultPresetSetting(props: DefaultPresetProps) {
+  const { t } = props
+  const preset = props.useCuaDefaultPreset(value => value)
+  const isPtc = (preset.value?.selectedDefault ?? preset.value?.default) === 'ptc'
+  const loading = preset.value === undefined && (props.busy === true || preset.status === 'loading')
+  const [saving, setSaving] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const setDefault = async (): Promise<void> => {
+    setSaving(true)
+    setError(null)
+    try {
+      if (!await props.setPtcDefault()) setError(t('defaultNotSaved'))
+    } catch (error) {
+      setError(t('defaultFailed', { message: error instanceof Error ? error.message : String(error) }))
+    } finally { setSaving(false) }
+  }
+  return <div className={css.defaultSetting} role="group" aria-label={t('defaultTitle')}>
+    <div className={css.permission}>
+      <div><strong>{t('defaultTitle')}</strong><p>{t('defaultBody')}</p></div>
+      {loading ? <span className={css.buttonPlaceholder} aria-hidden />
+        : <Button size="sm" variant={isPtc ? 'outline' : 'primary'} disabled={props.busy === true || saving || isPtc || !preset.writable || preset.status !== 'ready'}
+          onClick={() => { void setDefault() }}>{t(isPtc ? 'defaultSet' : 'defaultConfirm')}</Button>}
+    </div>
+    {!props.busy && !isPtc && (preset.status === 'unavailable' ? <p className={css.error} role="alert">{t('defaultUnavailable')}</p>
+      : preset.status === 'ready' && !preset.writable && <p className={css.error} role="alert">{t('defaultReadOnly')}</p>)}
+    {!props.busy && error !== null && <p className={css.error} role="alert">{error}</p>}
+  </div>
+}
+
+function Applications({ title, apps, icons, onAction, label, disabled }: {
+  title: string
+  apps: readonly CuaApplicationGrant[]
+  icons: Record<string, string> | null
+  disabled: boolean
+  label: string
+  onAction: PermissionProps['revoke']
+}) {
+  return <section className={css.group}>
+    <h4>{title}</h4>
+    <ul className={css.apps}>{apps.map(app => <li key={app.id}>
+      <div className={css.application} title={app.executablePath}>
+        {icons?.[app.executablePath] !== undefined ? <img src={icons[app.executablePath]} alt="" width={32} height={32} draggable={false} />
+          : <span className={css.iconPlaceholder} aria-hidden />}
+        <strong>{app.name}</strong>
+      </div>
+      <Button size="sm" variant="outline" disabled={disabled} onClick={() => { onAction(app.id) }}>{label}</Button>
+    </li>)}</ul>
+  </section>
+}
+
+function PermissionDescription({ application, permission, loading, t }: Pick<PermissionProps, 't'> & {
+  application: CuaSystemPermissionState['launchApplication']
+  permission: 'accessibility' | 'screenRecording'
+  loading: boolean
+}) {
+  if (!loading && application === undefined) return <p>{t(permission === 'accessibility' ? 'accessibilityUse' : 'screenRecordingUse')}</p>
+  return <p>
+    {t('permissionPrefix')}{' '}
+    <span className={css.applicationBadge}>
+      {application === undefined ? <span className={css.appPlaceholder} aria-hidden /> : <>
+        {application.icon !== undefined && <img src={application.icon} alt="" width={20} height={20} draggable={false} />}
+        <span>{application.name}</span>
+      </>}
+    </span>{' '}
+    {t(permission === 'accessibility' ? 'accessibilityAction' : 'screenRecordingAction')}
+  </p>
+}
+
+/** @param props Host observation and explicit user actions. @returns Permission controls without automatic system prompts. */
+export function PermissionPanel(props: PermissionPanelProps) {
+  const { t, refresh, setActive } = props
+  const state = props.useCuaPermissions(value => value)
+  const observed = state.system.value
+  const apps = state.applications.value
+  const transitioning = props.busy === true
+  const busy = transitioning || state.system.busy
+  const appsBusy = transitioning || state.applications.busy
+  const loading = observed === null && (busy || state.system.error === null)
+  const application = !busy && state.system.error !== null ? undefined : observed?.launchApplication
+  useEffect(() => {
+    setActive(!transitioning)
+    if (transitioning) return
+    window.addEventListener('focus', refresh)
+    return () => { window.removeEventListener('focus', refresh) }
+  }, [transitioning, refresh, setActive])
+  return <div className={css.panels} data-cua-settings aria-busy={transitioning || state.busy || loading}>
+    <section className={css.panel} aria-label={t('title')}>
+      <h3>{t('title')}</h3>
+      <div className={css.card}>
+        <DefaultPresetSetting {...props} />
+        {!busy && state.system.error !== null && <div className={css.notice} role="alert">
+          <span className={css.error}>{t('queryFailed', { message: state.system.error })}</span>
+          <Button size="sm" variant="outline" disabled={state.system.busy} onClick={refresh}>{t('retry')}</Button>
+        </div>}
+        {(['accessibility', 'screenRecording'] as const).map(permission => <div className={css.permission} key={permission}
+          role="group" aria-label={t(permission)}>
+          <div>
+            <strong>{t(permission)}</strong>
+            <PermissionDescription application={application} permission={permission} loading={loading} t={t} />
+          </div>
+          <span className={css.permissionStatus}>{loading ? <span className={css.statusPlaceholder} aria-hidden />
+            : t(observed === null || state.system.error !== null ? 'unknown' : observed[permission] ? 'granted' : 'missing')}</span>
+          <div className={css.actions}>
+            {loading ? <span className={css.buttonPlaceholder} aria-hidden />
+              : observed?.[permission] === false && <Button size="sm" variant="primary" disabled={busy} onClick={() => { props.request(permission) }}>{t('request')}</Button>}
+            <Button size="sm" variant="outline" disabled={busy || loading} onClick={() => { props.openSettings(permission) }}>{t('settings')}</Button>
+          </div>
+        </div>)}
+      </div>
+      {observed !== null && (!observed.accessibility || !observed.screenRecording) && <p>
+        {t(application === undefined ? 'permissionHintUnknown' : 'permissionHint')}
+      </p>}
+    </section>
+    <section className={css.panel} aria-label={t('applicationsTitle')}>
+      <h3>{t('applicationsTitle')}</h3>
+      <div className={css.card}>
+        {(['applications', 'icons'] as const).map(key => !transitioning && !state[key].busy && state[key].error !== null && <div className={css.notice} role="alert" key={key}>
+          <span className={css.error}>{t(key === 'applications' ? 'applicationsFailed' : 'iconsFailed', { message: state[key].error })}</span>
+          <Button size="sm" variant="outline" onClick={refresh}>{t('retry')}</Button>
+        </div>)}
+        {apps === null ? <div className={css.emptyState}><span className={css.appsPlaceholder} aria-hidden /></div> : <>
+          {apps.allowedApps.length === 0 && apps.blockedApps.length === 0 && <p className={css.emptyState}>{t('noApps')}</p>}
+          {apps.allowedApps.length > 0 && <Applications title={t('allowedApps')} apps={apps.allowedApps} icons={state.icons.value}
+            onAction={props.revoke} label={t('revoke')} disabled={appsBusy || !apps.persistentAvailable} />}
+          {apps.blockedApps.length > 0 && <Applications title={t('blockedApps')} apps={apps.blockedApps} icons={state.icons.value}
+            onAction={props.retryApproval} label={t('retryApproval')} disabled={appsBusy} />}
+        </>}
+      </div>
+    </section>
+  </div>
+}
+
+/**
+ * @param props Permission observation and activation navigation callbacks.
+ * @returns Setup guidance when system permissions need attention.
+ */
+export function PermissionSetup({ t, setActive, useCuaPermissions, onDismiss, onOpenDetails }: PermissionSetupProps) {
+  const state = useCuaPermissions(value => value.system)
+  useEffect(() => { setActive(true) }, [setActive])
+  const ready = state.value !== null && state.error === null
+    && state.value.accessibility && state.value.screenRecording
+  useEffect(() => { if (ready && !state.busy) onDismiss() }, [ready, state.busy, onDismiss])
+  return <Modal open={!ready && (state.value !== null || (!state.busy && state.error !== null))}
+    title={t('setupTitle')} closeLabel={t('close')} onClose={onDismiss}
+    footer={<>
+      <Button variant="ghost" onClick={onDismiss}>{t('later')}</Button>
+      <Button variant="primary" data-modal-autofocus onClick={onOpenDetails}>{t('openSetup')}</Button>
+    </>}>
+    <p>{t(state.error === null ? 'setupBody' : 'setupQueryFailed')}</p>
+  </Modal>
+}
+
+/** @param props Shared operation outcome, independent of page lifetime. @returns The existing global toast presentation. */
+export function PermissionToast(props: PermissionProps) {
+  const toast = props.useCuaPermissions(value => value.toast)
+  if (!toast) return null
+  return <Toast key={toast.id} text={toast.kind === 'failed' ? props.t('failed', { message: toast.message }) : props.t(toast.kind)}
+    {...toast.kind === 'revoked' ? { tone: 'success' as const } : {}} onDone={props.dismissToast} />
+}
diff --git a/packages/experimental/client-ui-cua/src/client/controller.ts b/packages/experimental/client-ui-cua/src/client/controller.ts
new file mode 100644
index 0000000000..552dcefbba
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/controller.ts
@@ -0,0 +1,136 @@
+/** One query projection for the permission page and activation guidance. */
+import { createSnapshotStore, type SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { CuaApplicationId, CuaApplicationState, CuaSystemPermission, CuaSystemPermissionState } from '@deepseek-ai/dsh-cua/types'
+
+/** Host operations available to the permission UI. */
+export interface PermissionActions {
+  readSystem: () => Promise<CuaSystemPermissionState>
+  readApplications: () => Promise<CuaApplicationState>
+  readIcons: () => Promise<Record<string, string>>
+  request: (permission: CuaSystemPermission) => Promise<void>
+  openSettings: (permission: CuaSystemPermission) => Promise<void>
+  revoke: (id: CuaApplicationId) => Promise<void>
+  retryApproval: (id: CuaApplicationId) => Promise<void>
+}
+interface PermissionData {
+  system: CuaSystemPermissionState
+  applications: CuaApplicationState
+  icons: Record<string, string>
+}
+/** Query failures retain the last observation without presenting it as current. */
+interface Query<T> {
+  value: T | null
+  busy: boolean
+  error: string | null
+}
+/** Independently settled observations; the overall busy flag follows the latest refresh. */
+export type PermissionView = { [K in keyof PermissionData]: Query<PermissionData[K]> } & {
+  busy: boolean
+  toast: { id: number; kind: 'requested' | 'opened' | 'revoked' | 'retryAllowed' } | { id: number; kind: 'failed'; message: string } | null
+}
+/** Slot actions and the renderer-bound permission projection. */
+export interface PermissionFace {
+  hooks: { cuaPermissions: SnapshotStore<PermissionView> }
+  /** Pause observation during bundle changes, or resume with a fresh read. */
+  setActive: (active: boolean) => void
+  refresh: () => void
+  request: (permission: CuaSystemPermission) => void
+  openSettings: (permission: CuaSystemPermission) => void
+  revoke: (id: CuaApplicationId) => void
+  retryApproval: (id: CuaApplicationId) => void
+  dismissToast: () => void
+}
+
+/** Serializes user actions and drops superseded refresh results or results arriving after disposal. */
+export class PermissionController {
+  /** Last observed permissions and the lifetime of the current refresh/action. */
+  readonly state = createSnapshotStore<PermissionView>({
+    system: { value: null, busy: false, error: null },
+    applications: { value: null, busy: false, error: null },
+    icons: { value: null, busy: false, error: null },
+    busy: false, toast: null,
+  })
+  private tail: Promise<void> = Promise.resolve()
+  private reads: Promise<void> = Promise.resolve()
+  private closed = false
+  private active = true
+  private epoch = 0
+  private sequence = 0
+  /** @param actions Browser-owned Remote calls that reject on failed responses. */
+  constructor(private readonly actions: PermissionActions) {}
+  /**
+   * Bind the permission projection to its user actions.
+   * @returns Reactive state and controls shared by the page, prompt, and toast host.
+   */
+  face(): PermissionFace {
+    return {
+      hooks: { cuaPermissions: this.state },
+      setActive: (active) => {
+        if (this.closed) return
+        if (active !== this.active) { this.active = active; this.epoch++ }
+        if (active) this.enqueue()
+        else this.state.update((state) => {
+          state.busy = true
+          for (const key of ['system', 'applications', 'icons'] as const) {
+            state[key].busy = true; state[key].error = null
+          }
+        })
+      },
+      refresh: () => { this.enqueue() },
+      request: (permission) => { this.enqueue(() => this.actions.request(permission), 'requested') },
+      openSettings: (permission) => { this.enqueue(() => this.actions.openSettings(permission), 'opened') },
+      revoke: (id) => { this.enqueue(() => this.actions.revoke(id), 'revoked') },
+      retryApproval: (id) => { this.enqueue(() => this.actions.retryApproval(id), 'retryAllowed') },
+      dismissToast: () => { if (!this.closed) this.state.update((state) => { state.toast = null }) },
+    }
+  }
+  /** Prevent publication after UI withdrawal and join the accepted Remote work. */
+  async dispose(): Promise<void> { this.closed = true; await this.tail; await this.reads }
+  private enqueue(action?: () => Promise<void>, kind?: 'requested' | 'opened' | 'revoked' | 'retryAllowed'): void {
+    if (this.closed || !this.active) return
+    const epoch = this.epoch
+    const current = () => !this.closed && this.active && epoch === this.epoch
+    const sequence = ++this.sequence
+    this.state.update((state) => {
+      state.busy = true
+      for (const key of ['system', 'applications', 'icons'] as const) state[key].busy = true
+    })
+    this.tail = this.tail.then(async () => {
+      if (!current()) return
+      try {
+        await action?.()
+        if (!current()) return
+        if (kind) this.state.update((state) => { state.toast = { id: sequence, kind } })
+      } catch (error) {
+        if (!current()) return
+        const message = error instanceof Error ? error.message : String(error)
+        this.state.update((state) => { state.toast = { id: sequence, kind: 'failed', message } })
+      }
+      const latest = () => current() && this.sequence === sequence
+      const refresh = Promise.all([
+        this.read('system', this.actions.readSystem, latest),
+        this.read('applications', this.actions.readApplications, latest),
+        this.read('icons', this.actions.readIcons, latest),
+      ]).then(() => {
+        if (latest()) this.state.update((state) => { state.busy = false })
+      })
+      this.reads = Promise.all([this.reads, refresh]).then(() => {})
+    })
+  }
+
+  private async read<K extends keyof PermissionData>(
+    key: K, read: () => Promise<PermissionData[K]>, current: () => boolean,
+  ): Promise<void> {
+    if (!current()) return
+    try {
+      const value = await read()
+      if (!current()) return
+      this.state.update((state) => { state[key].value = value; state[key].error = null; state[key].busy = false })
+    } catch (error) {
+      if (!current()) return
+      this.state.update((state) => {
+        state[key].error = error instanceof Error ? error.message : String(error); state[key].busy = false
+      })
+    }
+  }
+}
diff --git a/packages/experimental/client-ui-cua/src/client/index.ts b/packages/experimental/client-ui-cua/src/client/index.ts
new file mode 100644
index 0000000000..a4b192ce58
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/index.ts
@@ -0,0 +1,15 @@
+/** Bind the source-owned permission UI to its generated Remote contribution. */
+import type { Context } from '@deepseek-ai/cordis'
+import cuaRemote from '@deepseek-ai/dsh-cua/remote'
+import { mountCuaPermissions } from './mount.ts'
+
+export { inject } from './mount.ts'
+
+/**
+ * Activate the optional Computer Use permission controls.
+ * @param ctx Browser plugin context.
+ * @returns Cleanup of the UI and Remote contribution.
+ */
+export async function apply(ctx: Context): Promise<() => Promise<void>> {
+  return mountCuaPermissions(ctx, cuaRemote)
+}
diff --git a/packages/experimental/client-ui-cua/src/client/locales.ts b/packages/experimental/client-ui-cua/src/client/locales.ts
new file mode 100644
index 0000000000..03e86f33d0
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/locales.ts
@@ -0,0 +1,64 @@
+/** Product copy for native permission onboarding and application revocation. */
+export const NS = 'cuaPermissions'
+/** English permission-page dictionary. */
+export const en = {
+  title: 'Authorize Computer Use',
+  applicationsTitle: 'Manage applications Computer Use can access',
+  setupTitle: 'Set up Computer Use before use',
+  setupBody: 'Computer Use is enabled. Before using it, switch to PTC mode and grant Accessibility and Screen Recording permissions. Open the plugin details to complete setup.',
+  setupQueryFailed: 'Computer Use is enabled, but system permissions could not be checked. Open the plugin details to see the error and retry.',
+  defaultTitle: 'Default mode for new sessions',
+  defaultBody: 'Computer Use is available only in PTC mode.',
+  defaultConfirm: 'Set to PTC', defaultSet: 'PTC is the default',
+  defaultUnavailable: 'Could not read the default mode. Check it in Settings.',
+  defaultReadOnly: 'Default-mode settings are read-only.',
+  defaultNotSaved: 'The default mode was not saved. Try again.',
+  defaultFailed: 'Could not change the default mode: {message}',
+  openSetup: 'Open settings', later: 'Later', close: 'Close',
+  accessibility: 'Accessibility', screenRecording: 'Screen Recording',
+  accessibilityUse: 'Read interface controls, click, and type.', screenRecordingUse: 'Capture the selected application window.',
+  permissionPrefix: 'In System Settings, allow',
+  accessibilityAction: 'to read interface controls, click, and type.',
+  screenRecordingAction: 'to capture application windows.',
+  permissionHint: 'Enable the application in System Settings. Follow the macOS prompt if it names another application.',
+  permissionHintUnknown: 'Enable these permissions for the application named in the macOS prompt.',
+  granted: 'Allowed', missing: 'Not allowed', unknown: 'Unknown', request: 'Request permission', settings: 'Open System Settings', retry: 'Retry',
+  allowedApps: 'Always-allowed applications',
+  blockedApps: 'Applications not allowed', retryApproval: 'Allow asking again',
+  retryAllowed: 'The next application selection will ask again; access has not been granted',
+  noApps: 'No always-allowed or blocked applications.',
+  revoke: 'Revoke', revoked: 'Application access revoked', requested: 'Review the macOS prompt, or open System Settings if no prompt appears', opened: 'System Settings opened',
+  applicationsFailed: 'Could not load application access: {message}', iconsFailed: 'Could not load application icons: {message}',
+  failed: 'Could not update permissions: {message}', queryFailed: 'Could not check permissions: {message}',
+}
+/** Keys shared by all supported locale dictionaries. */
+export type CuaPermissionLocaleKey = keyof typeof en
+/** Chinese permission-page dictionary. */
+export const zh: Record<CuaPermissionLocaleKey, string> = {
+  title: '给 Computer Use 授权', applicationsTitle: '管理 Computer Use 可访问的应用', setupTitle: '使用 Computer Use 前需要设置',
+  setupBody: 'Computer Use 插件已开启。使用前请切换到 PTC 模式，并授予辅助功能和屏幕录制权限。请前往插件详情页完成设置。',
+  setupQueryFailed: 'Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。',
+  defaultTitle: '新会话默认模式',
+  defaultBody: 'Computer Use 仅在 PTC 模式中可用。',
+  defaultConfirm: '设为 PTC', defaultSet: '已设为 PTC',
+  defaultUnavailable: '无法读取默认模式，请在设置中检查',
+  defaultReadOnly: '默认模式设置为只读',
+  defaultNotSaved: '默认模式未保存，请重试',
+  defaultFailed: '无法切换默认模式：{message}',
+  openSetup: '前往设置', later: '稍后', close: '关闭',
+  accessibility: '辅助功能', screenRecording: '屏幕录制',
+  accessibilityUse: '读取界面控件、点击和输入文字', screenRecordingUse: '截取所选应用的窗口',
+  permissionPrefix: '在系统设置中允许',
+  accessibilityAction: '读取界面、点击和输入',
+  screenRecordingAction: '截取应用窗口',
+  permissionHint: '在系统设置中开启对应应用；若 macOS 提示其他应用，以系统提示为准',
+  permissionHintUnknown: '在系统设置中，为 macOS 提示的应用开启对应权限',
+  granted: '已允许', missing: '未允许', unknown: '未确认', request: '申请权限', settings: '打开系统设置', retry: '重试',
+  allowedApps: '始终允许的应用',
+  blockedApps: '不允许访问的应用', retryApproval: '允许再次询问',
+  retryAllowed: '下次选择此应用时将重新询问，当前尚未授权',
+  noApps: '暂无始终允许或不允许访问的应用。',
+  revoke: '撤销', revoked: '已撤销应用访问权限', requested: '请查看 macOS 提示；若未出现，请打开系统设置', opened: '已打开系统设置',
+  applicationsFailed: '无法读取应用授权：{message}', iconsFailed: '无法读取应用图标：{message}',
+  failed: '无法更新权限：{message}', queryFailed: '无法检测权限：{message}',
+}
diff --git a/packages/experimental/client-ui-cua/src/client/mount.ts b/packages/experimental/client-ui-cua/src/client/mount.ts
new file mode 100644
index 0000000000..a475c43d8e
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/mount.ts
@@ -0,0 +1,82 @@
+/** Optional Computer Use controls mounted through existing plugin-page and overlay slots. */
+import type { Context } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-cua/remote'
+import type { TypertRemoteContribution } from '@deepseek-ai/dsh-typert-protocol'
+import type {} from '@deepseek-ai/dsh-api-remotes/client'
+import type {} from '@deepseek-ai/dsh-client-locale/client'
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
+import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
+import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
+import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
+import { PermissionController } from './controller.ts'
+import { PermissionPanel, PermissionSetup, PermissionToast } from './PermissionPanel.tsx'
+import { en, NS, zh, type CuaPermissionLocaleKey } from './locales.ts'
+
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+  interface LocaleNamespaceMap {
+    /** Native permission controls and application consent. */
+    cuaPermissions: CuaPermissionLocaleKey
+  }
+}
+
+/** Existing browser registries needed by the optional permission UI. */
+export const inject = ['remote', 'slots', 'locale', 'configForms']
+
+/**
+ * Mount the optional permission Remote and its browser controls.
+ * @param ctx Browser plugin context.
+ * @param contribution Generated permission Remote definitions.
+ * @returns Cleanup for the optional Remote and UI registrations.
+ */
+export async function mountCuaPermissions(ctx: Context, contribution: TypertRemoteContribution): Promise<() => Promise<void>> {
+  const transport = ctx.plugin(async (owner) => { await owner.remote.$mount(contribution) })
+  const ui = ctx.inject(['remote.cuaAccess', 'slots', 'locale'], (ctx) => {
+    ctx.effect(() => ctx.locale.register(NS, { en, zh }))
+    const controller = new PermissionController({
+      readSystem: async () => {
+        const result = await ctx.remote.cuaAccess.systemStatus(); if (!result.ok) throw result.error; return result.value
+      },
+      readApplications: async () => {
+        const result = await ctx.remote.cuaAccess.applications(); if (!result.ok) throw result.error; return result.value
+      },
+      readIcons: async () => {
+        const result = await ctx.remote.cuaAccess.applicationIcons(); if (!result.ok) throw result.error; return result.value
+      },
+      request: async (permission) => {
+        const result = await ctx.remote.cuaAccess.requestPermission(permission); if (!result.ok) throw result.error
+      },
+      openSettings: async (permission) => {
+        const result = await ctx.remote.cuaAccess.openSettings(permission); if (!result.ok) throw result.error
+      },
+      revoke: async (id) => { const result = await ctx.remote.cuaAccess.revoke(id); if (!result.ok) throw result.error },
+      retryApproval: async (id) => { const result = await ctx.remote.cuaAccess.retryApproval(id); if (!result.ok) throw result.error },
+    })
+    const face = controller.face()
+    const preset = ctx.configForms.get<{ default: string; selectedDefault?: string }>('agent-preset-registry')
+    const settings = {
+      ...face,
+      hooks: { ...face.hooks, cuaDefaultPreset: preset },
+      setPtcDefault: () => preset.set('selectedDefault', 'ptc'),
+    }
+    ctx.effect(() => () => controller.dispose())
+    ctx.on('connection/reset', face.refresh)
+    ctx.effect(() => ctx.remote.$on('settings/document-updated', (namespace) => {
+      if (namespace === controller.state.getSnapshot().applications.value?.settingsNamespace) face.refresh()
+    }))
+    ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
+      name: 'plugins.bundle.config', key: '@deepseek-ai/dsh-cua-bundle', locale: NS, inject: () => settings,
+    }, PermissionPanel))
+    ctx.slots.inject('plugins.bundle.activation', () => ctx.slots.register({
+      name: 'plugins.bundle.activation', key: '@deepseek-ai/dsh-cua-bundle', locale: NS, inject: () => face,
+    }, PermissionSetup))
+    ctx.slots.inject('shell.overlay', () => ctx.slots.register({
+      name: 'shell.overlay', id: 'cua-permission-outcome', locale: NS, inject: () => face,
+    }, PermissionToast))
+  })
+  const dispose = ctx.effect(function* () {
+    yield transport.dispose
+    yield ui.dispose
+  }, 'cua-permissions.mount')
+  try { await Promise.all([transport, ui]) } catch (error) { await dispose(); throw error }
+  return dispose
+}
diff --git a/packages/experimental/client-ui-cua/src/css-modules.d.ts b/packages/experimental/client-ui-cua/src/css-modules.d.ts
new file mode 100644
index 0000000000..8811db1264
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/css-modules.d.ts
@@ -0,0 +1,4 @@
+declare module '*.module.css' {
+  const classes: Record<string, string>
+  export default classes
+}
diff --git a/packages/experimental/client-ui-cua/src/index.ts b/packages/experimental/client-ui-cua/src/index.ts
new file mode 100644
index 0000000000..ceee879f3f
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/index.ts
@@ -0,0 +1,2 @@
+/** Host marker; the client export owns the optional permission UI, while dsh-cua owns native policy. */
+export function apply(): void {}
diff --git a/packages/experimental/client-ui-cua/tests/controller.client.spec.ts b/packages/experimental/client-ui-cua/tests/controller.client.spec.ts
new file mode 100644
index 0000000000..6c12499c16
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tests/controller.client.spec.ts
@@ -0,0 +1,253 @@
+/** Permission refreshes preserve observations and join user actions before withdrawal. */
+import { setImmediate } from 'node:timers/promises'
+import { expect, it, onTestFinished, vi } from 'vitest'
+import type { CuaApplicationId, CuaApplicationState, CuaSystemPermissionState } from '@deepseek-ai/dsh-cua/types'
+import { PermissionController } from '../src/client/controller.ts'
+
+const value: CuaSystemPermissionState = { accessibility: true, screenRecording: false, helper: { pid: 9 }, parent: { pid: 8 } }
+const applications: CuaApplicationState = {
+  allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+function fixture() {
+  const actions = { readSystem: vi.fn(async () => value), readApplications: vi.fn(async () => applications),
+    readIcons: vi.fn(async (): Promise<Record<string, string>> => ({})), request: vi.fn(async () => {}),
+    openSettings: vi.fn(async () => {}), revoke: vi.fn(async () => {}), retryApproval: vi.fn(async () => {}) }
+  const controller = new PermissionController(actions)
+  return { actions, controller, face: controller.face() }
+}
+
+it('refreshes after a user request without treating the request itself as a grant', async () => {
+  const f = fixture()
+  f.face.request('screenRecording')
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.actions.request).toHaveBeenCalledWith('screenRecording')
+  expect(f.controller.state.getSnapshot().system.value?.screenRecording).toBe(false)
+  expect(f.controller.state.getSnapshot().toast?.kind).toBe('requested')
+  f.face.dismissToast()
+  expect(f.controller.state.getSnapshot().toast).toBeNull()
+  await f.controller.dispose()
+})
+
+it('retains the last observation while marking a failed refresh', async () => {
+  const f = fixture()
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().system.value).toEqual(value) })
+  f.actions.readSystem.mockRejectedValueOnce(new Error('connection closed'))
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().system.error).toBe('connection closed') })
+  expect(f.controller.state.getSnapshot().system.value).toEqual(value)
+  await f.controller.dispose()
+})
+
+it.each([new Error('write refused'), 'write refused'])('reports settings and revocation outcomes through the shared toast state', async (error) => {
+  const f = fixture()
+  f.face.openSettings('accessibility')
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().toast?.kind).toBe('opened') })
+  f.face.revoke('a'.repeat(64) as CuaApplicationId)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().toast?.kind).toBe('revoked') })
+  f.face.retryApproval('a'.repeat(64) as CuaApplicationId)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().toast?.kind).toBe('retryAllowed') })
+  f.actions.revoke.mockRejectedValueOnce(error)
+  f.face.revoke('a'.repeat(64) as CuaApplicationId)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().toast).toMatchObject({ kind: 'failed', message: 'write refused' }) })
+  await f.controller.dispose()
+})
+
+it('joins a pending read without publishing after disposal or starting queued actions', async () => {
+  const f = fixture()
+  const pending = Promise.withResolvers<CuaSystemPermissionState>()
+  const entered = Promise.withResolvers<undefined>()
+  f.actions.readSystem.mockImplementationOnce(() => { entered.resolve(undefined); return pending.promise })
+  f.face.refresh()
+  await entered.promise
+  f.face.request('accessibility')
+  const before = f.controller.state.getSnapshot()
+  const closed = f.controller.dispose()
+  pending.resolve(value)
+  await closed
+  expect(f.controller.state.getSnapshot()).toBe(before)
+  expect(f.actions.request).not.toHaveBeenCalled()
+  f.face.refresh()
+  expect(f.actions.readSystem).toHaveBeenCalledOnce()
+})
+
+it('revokes access while icons are pending, serializes writes, and joins reads on disposal', async () => {
+  const f = fixture(), icons = Promise.withResolvers<Record<string, string>>()
+  const action = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { icons.resolve({}); action.resolve(undefined); await f.controller.dispose() })
+  f.actions.readIcons.mockReturnValueOnce(icons.promise)
+  f.actions.revoke.mockImplementationOnce(() => { entered.resolve(undefined); return action.promise })
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().applications.busy).toBe(false) })
+  expect(f.controller.state.getSnapshot().icons.busy).toBe(true)
+  f.face.revoke('a'.repeat(64) as CuaApplicationId)
+  await entered.promise
+  f.face.retryApproval('a'.repeat(64) as CuaApplicationId)
+  await setImmediate()
+  expect(f.actions.retryApproval).not.toHaveBeenCalled()
+  action.resolve(undefined)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.actions.retryApproval).toHaveBeenCalledOnce()
+  expect(f.controller.state.getSnapshot().toast?.kind).toBe('retryAllowed')
+  const before = f.controller.state.getSnapshot()
+  let disposed = false
+  const closed = f.controller.dispose().then(() => { disposed = true })
+  await setImmediate()
+  expect(disposed).toBe(false)
+  icons.resolve({ '/old/app': 'old-icon' })
+  await closed
+  expect(f.controller.state.getSnapshot()).toBe(before)
+})
+
+it('ignores stale toast completion after the permission UI is disposed', async () => {
+  const f = fixture()
+  f.face.request('accessibility')
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().toast?.kind).toBe('requested') })
+  await f.controller.dispose()
+  const before = f.controller.state.getSnapshot()
+  f.face.dismissToast()
+  f.face.setActive(true)
+  expect(f.controller.state.getSnapshot()).toBe(before)
+})
+
+it('contains a late read rejection and supports errors without an Error instance', async () => {
+  const f = fixture()
+  f.actions.readSystem.mockRejectedValueOnce('offline')
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().system.error).toBe('offline') })
+  const pending = Promise.withResolvers<CuaSystemPermissionState>(), entered = Promise.withResolvers<undefined>()
+  f.actions.readSystem.mockImplementationOnce(() => { entered.resolve(undefined); return pending.promise })
+  f.face.refresh()
+  await entered.promise
+  const before = f.controller.state.getSnapshot(), closed = f.controller.dispose()
+  pending.reject(new Error('late disconnect'))
+  await closed
+  expect(f.controller.state.getSnapshot()).toBe(before)
+})
+
+
+it.each(['success', 'failure'])('does not publish an older refresh %s while the activation refresh is queued', async (outcome) => {
+  const f = fixture()
+  const first = Promise.withResolvers<CuaSystemPermissionState>(), firstEntered = Promise.withResolvers<undefined>()
+  const latest = Promise.withResolvers<CuaSystemPermissionState>(), latestEntered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { first.resolve(value); latest.resolve(value); await f.controller.dispose() })
+  f.actions.readSystem.mockImplementationOnce(() => { firstEntered.resolve(undefined); return first.promise })
+  f.actions.readSystem.mockImplementationOnce(() => { latestEntered.resolve(undefined); return latest.promise })
+  const observations: Array<ReturnType<typeof f.controller.state.getSnapshot>> = []
+  const unsubscribe = f.controller.state.subscribe(() => { observations.push(f.controller.state.getSnapshot()) })
+  onTestFinished(unsubscribe)
+  f.face.refresh()
+  await firstEntered.promise
+  f.face.refresh()
+  if (outcome === 'failure') first.reject(new Error('provider is reloading'))
+  else first.resolve({ ...value, screenRecording: true })
+  await latestEntered.promise
+  expect(observations.every(state => state.system.error === null && state.system.value === null && state.busy)).toBe(true)
+  latest.resolve(value)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot()).toMatchObject({ busy: false, system: { error: null, value } }) })
+  expect(observations.every(state => state.system.error === null)).toBe(true)
+})
+
+it('keeps a user-action failure visible when a refresh is queued behind it', async () => {
+  const f = fixture(), action = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { action.resolve(undefined); await f.controller.dispose() })
+  f.actions.request.mockImplementationOnce(() => { entered.resolve(undefined); return action.promise })
+  f.face.request('accessibility')
+  await entered.promise
+  f.face.refresh()
+  action.reject(new Error('permission request failed'))
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot()).toMatchObject({ system: { value, error: null },
+    toast: { kind: 'failed', message: 'permission request failed' } })
+})
+
+
+it.each(['success', 'failure'])('drops a permission read %s from the previous bundle activation', async (outcome) => {
+  const f = fixture()
+  f.face.setActive(true)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  const pending = Promise.withResolvers<CuaSystemPermissionState>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { pending.resolve(value); await f.controller.dispose() })
+  f.actions.readSystem.mockImplementationOnce(() => { entered.resolve(undefined); return pending.promise })
+  f.face.refresh()
+  await entered.promise
+  f.face.setActive(false)
+  f.face.setActive(false)
+  expect(f.controller.state.getSnapshot()).toMatchObject({ busy: true, system: { error: null, value } })
+  f.face.request('accessibility')
+  expect(f.actions.request).not.toHaveBeenCalled()
+  if (outcome === 'failure') pending.reject(new Error('old helper stopped'))
+  else pending.resolve({ ...value, screenRecording: true })
+  await Promise.allSettled([pending.promise])
+  expect(f.controller.state.getSnapshot()).toMatchObject({ busy: true, system: { error: null, value } })
+  f.face.setActive(true)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot()).toMatchObject({ system: { error: null, value } })
+  expect(f.actions.readSystem).toHaveBeenCalledTimes(3)
+})
+
+it.each(['success', 'failure'])('does not publish a user-action %s after its bundle is replaced', async (outcome) => {
+  const f = fixture(), pending = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { pending.resolve(undefined); await f.controller.dispose() })
+  f.actions.request.mockImplementationOnce(() => { entered.resolve(undefined); return pending.promise })
+  f.face.request('accessibility')
+  await entered.promise
+  f.face.setActive(false)
+  if (outcome === 'failure') pending.reject(new Error('old request cancelled'))
+  else pending.resolve(undefined)
+  f.face.setActive(true)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot()).toMatchObject({ toast: null, system: { error: null, value } })
+  expect(f.actions.readSystem).toHaveBeenCalledOnce()
+})
+
+it('publishes each observation before the other queries finish', async () => {
+  const f = fixture()
+  const system = Promise.withResolvers<CuaSystemPermissionState>()
+  const apps = Promise.withResolvers<CuaApplicationState>()
+  const icons = Promise.withResolvers<Record<string, string>>()
+  onTestFinished(async () => { system.resolve(value); apps.resolve(applications); icons.resolve({}); await f.controller.dispose() })
+  f.actions.readSystem.mockReturnValueOnce(system.promise)
+  f.actions.readApplications.mockReturnValueOnce(apps.promise)
+  f.actions.readIcons.mockReturnValueOnce(icons.promise)
+  f.face.refresh()
+  apps.resolve(applications)
+  await vi.waitFor(() => {
+    expect(f.controller.state.getSnapshot().applications).toEqual({ value: applications, error: null, busy: false })
+  })
+  expect(f.controller.state.getSnapshot().system).toMatchObject({ value: null, busy: true })
+  system.resolve(value)
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().system).toEqual({ value, error: null, busy: false }) })
+  expect(f.controller.state.getSnapshot().icons).toMatchObject({ value: null, busy: true })
+  icons.reject(new Error('icon unavailable'))
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot()).toMatchObject({
+    system: { value, error: null }, applications: { value: applications, error: null },
+    icons: { value: null, error: 'icon unavailable', busy: false },
+  })
+})
+
+it('keeps application decisions available when system inspection fails', async () => {
+  const f = fixture()
+  f.actions.readSystem.mockRejectedValueOnce(new Error('helper offline'))
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot()).toMatchObject({
+    system: { value: null, error: 'helper offline' },
+    applications: { value: applications, error: null, busy: false },
+  })
+  await f.controller.dispose()
+})
+
+it.each(['success', 'failure'])('drops old icon %s after disabling and reenabling the bundle', async (outcome) => {
+  const f = fixture(), pending = Promise.withResolvers<Record<string, string>>()
+  onTestFinished(async () => { pending.resolve({}); await f.controller.dispose() })
+  f.actions.readIcons.mockReturnValueOnce(pending.promise)
+  f.face.refresh()
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().system.busy).toBe(false) })
+  f.face.setActive(false)
+  f.face.setActive(true)
+  if (outcome === 'success') pending.resolve({ '/old/app': 'old-icon' })
+  else pending.reject(new Error('old helper stopped'))
+  await vi.waitFor(() => { expect(f.controller.state.getSnapshot().busy).toBe(false) })
+  expect(f.controller.state.getSnapshot().icons).toEqual({ value: {}, error: null, busy: false })
+})
diff --git a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
new file mode 100644
index 0000000000..bf3962fe46
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
@@ -0,0 +1,180 @@
+/** The optional permission namespace and existing page slots share one disposal lifetime. */
+import assert from 'node:assert/strict'
+import { setImmediate } from 'node:timers/promises'
+import { Context, Service } from '@deepseek-ai/cordis'
+import { LocaleRuntime } from '@deepseek-ai/dsh-client-locale/client'
+import { SlotRegistry } from '@deepseek-ai/dsh-client-ui-renderer/client'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import { RemoteError, type RemoteResult, type TypertRemoteContribution } from '@deepseek-ai/dsh-typert-protocol'
+import type { CuaApplicationState, CuaSystemPermissionState } from '@deepseek-ai/dsh-cua/types'
+import { expect, it, vi } from 'vitest'
+import type { PermissionFace } from '../src/client/controller.ts'
+import { mountCuaPermissions, inject } from '../src/client/mount.ts'
+import { apply as hostApply } from '../src/index.ts'
+
+const contribution: TypertRemoteContribution = { package: '@deepseek-ai/dsh-cua', descriptors: [] }
+const value: CuaApplicationState & { system: CuaSystemPermissionState } = {
+  system: { accessibility: false, screenRecording: false, helper: { pid: 2 }, parent: { pid: 1 } },
+  allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+
+function actionsOf(value: Record<string, unknown>): asserts value is Record<string, unknown> & PermissionFace {
+  assert(typeof value.setActive === 'function')
+  assert(typeof value.refresh === 'function' && typeof value.request === 'function' && typeof value.openSettings === 'function')
+  assert(typeof value.revoke === 'function' && typeof value.dismissToast === 'function')
+  assert(typeof value.retryApproval === 'function')
+  assert(typeof value.hooks === 'object' && value.hooks !== null)
+}
+
+async function fixture(fail = false) {
+  const ctx = new Context(), unmount = vi.fn(async () => {}), unsubscribe = vi.fn()
+  let settingsListener: ((namespace: string, revision: number) => void) | undefined
+  class Remote extends Service {
+    constructor() { super(ctx, 'remote') }
+    async $mount(received: TypertRemoteContribution) {
+      expect(received).toBe(contribution)
+      const owned = this.ctx.effect(() => unmount)
+      return () => owned()
+    }
+    $on(_event: string, listener: (namespace: string, revision: number) => void) { settingsListener = listener; return unsubscribe }
+  }
+  new Remote()
+  const setDefault = vi.fn(async () => true)
+  const preset = createSnapshotStore({ status: 'ready' as const, value: { default: 'standard' },
+    base: {}, user: {}, revision: 1, writable: true })
+  ctx.provide('configForms', { get: (namespace: string) => {
+    expect(namespace).toBe('agent-preset-registry')
+    return { ...preset, set: setDefault }
+  } })
+  const status = vi.fn<() => Promise<RemoteResult<CuaApplicationState>>>().mockResolvedValue({ ok: true, value })
+  const systemStatus = vi.fn<() => Promise<RemoteResult<CuaSystemPermissionState>>>().mockResolvedValue({ ok: true, value: value.system })
+  const applicationIcons = vi.fn<() => Promise<RemoteResult<Record<string, string>>>>().mockResolvedValue({ ok: true, value: {} })
+  const requestPermission = vi.fn<() => Promise<RemoteResult<CuaSystemPermissionState>>>()
+    .mockResolvedValue({ ok: true, value: value.system })
+  const openSettings = vi.fn<() => Promise<RemoteResult<void>>>().mockResolvedValue({ ok: true, value: undefined })
+  const revoke = vi.fn<() => Promise<RemoteResult<void>>>().mockResolvedValue({ ok: true, value: undefined })
+  const retryApproval = vi.fn<() => Promise<RemoteResult<void>>>().mockResolvedValue({ ok: true, value: undefined })
+  ctx.provide('remote.cuaAccess', { applications: status, systemStatus, applicationIcons, requestPermission, openSettings, revoke, retryApproval })
+  ctx.provide('locale', new LocaleRuntime(ctx))
+  await ctx.plugin(SlotRegistry)
+  ctx.slots.register({ name: 'root', children: {
+    'plugins.bundle.activation': { kind: 'keyed', scope: 'root' },
+    'plugins.bundle.config': { kind: 'keyed', scope: 'root' }, 'shell.overlay': { kind: 'list', scope: 'root' },
+  } } as never, () => null)
+  if (fail) vi.spyOn(ctx.slots, 'inject').mockImplementationOnce(() => { throw new Error('slot unavailable') })
+  return { ctx, unmount, unsubscribe, status, systemStatus, applicationIcons,
+    requestPermission, openSettings, revoke, retryApproval, setDefault,
+    updateSettings(namespace: string) { settingsListener!(namespace, 1) },
+  }
+}
+
+it('withdraws the permission Remote and all controls with the optional plugin', async () => {
+  hostApply()
+  const f = await fixture()
+  try {
+    const fiber = f.ctx.plugin({ inject: [...inject], apply: ctx => mountCuaPermissions(ctx, contribution) })
+    await fiber
+    const entry = f.ctx.slots.entries('plugins.bundle.config')[0]!
+    const actions = entry.inject!()
+    actionsOf(actions)
+    actions.refresh()
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().applications.value).toEqual(value) })
+    actions.request('accessibility')
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().toast?.kind).toBe('requested') })
+    actions.openSettings('screenRecording')
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().toast?.kind).toBe('opened') })
+    actions.revoke('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().toast?.kind).toBe('revoked') })
+    actions.retryApproval('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().toast?.kind).toBe('retryAllowed') })
+    const failed = { ok: false as const, error: new RemoteError('gateway/internal', 'offline', {}) }
+    for (const [target, invoke] of [
+      [f.status, actions.refresh], [f.systemStatus, actions.refresh], [f.applicationIcons, actions.refresh], [f.requestPermission, () => { actions.request('accessibility') }],
+      [f.openSettings, () => { actions.openSettings('accessibility') }],
+      [f.revoke, () => { actions.revoke('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId) }],
+      [f.retryApproval, () => { actions.retryApproval('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId) }],
+    ] as const) {
+      actions.refresh()
+      await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().busy).toBe(false) })
+      target.mockResolvedValueOnce(failed)
+      invoke()
+      await vi.waitFor(() => {
+        const state = actions.hooks.cuaPermissions.getSnapshot()
+        const error = target === f.status ? state.applications.error : target === f.systemStatus ? state.system.error
+          : target === f.applicationIcons ? state.icons.error : state.toast?.kind === 'failed' ? state.toast.message : null
+        expect(error).toContain('offline')
+      })
+    }
+    for (const name of ['plugins.bundle.activation', 'shell.overlay'] as const) {
+      const other = f.ctx.slots.entries(name)[0]!
+      const otherActions = other.inject!()
+      actionsOf(otherActions)
+      expect(otherActions.hooks.cuaPermissions).toBe(actions.hooks.cuaPermissions)
+    }
+    const settings = f.ctx.slots.entries('plugins.bundle.config')[0]!.inject!()
+    assert(typeof settings.setPtcDefault === 'function')
+    expect(f.ctx.slots.entries('plugins.bundle.activation')[0]!.inject!()).not.toHaveProperty('setPtcDefault')
+    expect(f.setDefault).not.toHaveBeenCalled()
+    await (settings.setPtcDefault as () => Promise<boolean>)()
+    expect(f.setDefault).toHaveBeenCalledExactlyOnceWith('selectedDefault', 'ptc')
+    await fiber.dispose()
+    expect(f.ctx.slots.entries('plugins.bundle.config')).toHaveLength(0)
+    expect(f.ctx.slots.entries('shell.overlay')).toHaveLength(0)
+    expect(f.unsubscribe).toHaveBeenCalledOnce()
+    expect(f.unmount).toHaveBeenCalledOnce()
+  } finally { await f.ctx.fiber.dispose() }
+})
+
+it('withdraws the Remote contribution when UI registration fails', async () => {
+  const f = await fixture(true)
+  try {
+    await expect(mountCuaPermissions(f.ctx, contribution)).rejects.toThrow('slot unavailable')
+    expect(f.unmount).toHaveBeenCalledOnce()
+  } finally { await f.ctx.fiber.dispose() }
+})
+
+it.each(['plugin', 'root'])('keeps the Remote mounted until an accepted revoke completes during %s disposal', async (owner) => {
+  const f = await fixture()
+  const response = Promise.withResolvers<RemoteResult<void>>(), entered = Promise.withResolvers<undefined>()
+  f.revoke.mockImplementationOnce(() => { entered.resolve(undefined); return response.promise })
+  f.unmount.mockImplementation(async () => { response.resolve({ ok: false, error: new RemoteError('gateway/internal', 'unmounted', {}) }) })
+  let closing: Promise<void> | undefined
+  try {
+    const fiber = await f.ctx.plugin({ inject: [...inject], apply: ctx => mountCuaPermissions(ctx, contribution) })
+    const actions = f.ctx.slots.entries('plugins.bundle.config')[0]!.inject!()
+    actionsOf(actions)
+    actions.revoke('a'.repeat(64) as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
+    await entered.promise
+    let closed = false
+    closing = Promise.resolve(owner === 'plugin' ? fiber.dispose() : f.ctx.fiber.dispose()).then(() => { closed = true })
+    await setImmediate()
+    expect(f.unmount).not.toHaveBeenCalled()
+    expect(closed).toBe(false)
+    response.resolve({ ok: true, value: undefined })
+    await closing
+    expect(f.unmount).toHaveBeenCalledOnce()
+  } finally {
+    response.resolve({ ok: true, value: undefined })
+    await closing
+    await f.ctx.fiber.dispose()
+  }
+})
+
+it('refreshes only the settings namespace reported by the permission owner', async () => {
+  const f = await fixture()
+  f.status.mockResolvedValue({ ok: true, value: { ...value, settingsNamespace: 'custom-cua-entry' } })
+  try {
+    await f.ctx.plugin({ inject: [...inject], apply: ctx => mountCuaPermissions(ctx, contribution) })
+    const actions = f.ctx.slots.entries('plugins.bundle.config')[0]!.inject!()
+    actionsOf(actions)
+    f.updateSettings('locale')
+    expect(f.status).not.toHaveBeenCalled()
+    actions.refresh()
+    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().busy).toBe(false) })
+    expect(f.status).toHaveBeenCalledOnce()
+    f.updateSettings('cua')
+    f.updateSettings('locale')
+    expect(f.status).toHaveBeenCalledOnce()
+    f.updateSettings('custom-cua-entry')
+    await vi.waitFor(() => { expect(f.status).toHaveBeenCalledTimes(2) })
+  } finally { await f.ctx.fiber.dispose() }
+})
diff --git a/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
new file mode 100644
index 0000000000..d3c999f9a0
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
@@ -0,0 +1,352 @@
+// @vitest-environment jsdom
+/** Permission UI distinguishes missing privileges, uncertainty, and application consent. */
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { bindSnapshotSelector, makeTranslate } from '@deepseek-ai/dsh-client-test-runtime'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
+import type { CuaApplicationId, CuaApplicationState, CuaSystemPermissionState } from '@deepseek-ai/dsh-cua/types'
+import type { ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
+import { afterEach, expect, it, vi } from 'vitest'
+import { PermissionPanel, PermissionSetup, PermissionToast, type PermissionPanelProps } from '../src/client/PermissionPanel.tsx'
+import type { PermissionView } from '../src/client/controller.ts'
+import { en, zh } from '../src/client/locales.ts'
+
+afterEach(() => { cleanup(); vi.useRealTimers() })
+const value: CuaApplicationState & { system: CuaSystemPermissionState } = { system: { accessibility: false, screenRecording: true,
+  helper: { pid: 9, path: '/native/helper' }, parent: { pid: 8, path: '/host/node' } },
+allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+
+function observe(value: CuaApplicationState & { system: CuaSystemPermissionState }) {
+  return { system: { value: value.system, busy: false, error: null },
+    applications: { value, busy: false, error: null }, icons: { value: {}, busy: false, error: null }, busy: false }
+}
+
+function fixture() {
+  const state = createSnapshotStore<PermissionView>({
+    system: { value: null, busy: true, error: null }, applications: { value: null, busy: true, error: null },
+    icons: { value: null, busy: true, error: null }, busy: true, toast: null,
+  })
+  const preset = createSnapshotStore<ConfigFormSnapshot<{ default: string; selectedDefault?: string }>>({
+    status: 'ready', value: { default: 'standard', selectedDefault: 'ptc' },
+    base: {}, user: {}, revision: 1, writable: true,
+  })
+  const refresh = vi.fn()
+  const props = { useCuaPermissions: bindSnapshotSelector(state), t: makeTranslate(en),
+    useCuaDefaultPreset: bindSnapshotSelector(preset), setPtcDefault: vi.fn(async () => true),
+    refresh, setActive: vi.fn((active: boolean) => { if (active) refresh() }), request: vi.fn(), openSettings: vi.fn(), revoke: vi.fn(),
+    retryApproval: vi.fn(), dismissToast: vi.fn(),
+  } satisfies PermissionPanelProps
+  return { state, preset, props,
+    publish(patch: Partial<PermissionView>) { act(() => { state.set({ ...state.getSnapshot(), ...patch }) }) },
+  }
+}
+
+it('requests only a missing privilege and leaves OS attribution to the system prompt', () => {
+  const f = fixture()
+  const shown = render(<PermissionPanel {...f.props} />)
+  expect(f.props.refresh).toHaveBeenCalledOnce()
+  f.publish({ ...observe(value) })
+  fireEvent.click(screen.getByRole('button', { name: en.request }))
+  expect(f.props.request).toHaveBeenCalledWith('accessibility')
+  const controls = screen.getAllByRole('button', { name: en.settings })
+  fireEvent.click(controls[0]!)
+  fireEvent.click(controls[1]!)
+  expect(f.props.openSettings.mock.calls).toEqual([['accessibility'], ['screenRecording']])
+  fireEvent.focus(window)
+  expect(f.props.refresh).toHaveBeenCalledTimes(2)
+  shown.unmount()
+  fireEvent.focus(window)
+  expect(f.props.refresh).toHaveBeenCalledTimes(2)
+})
+
+it.each([en, zh])('changes the default from the detail page and retains a refused write for retry', async (dictionary) => {
+  const f = fixture()
+  f.preset.set({ ...f.preset.getSnapshot(), value: { default: 'standard' } })
+  f.publish({ ...observe(value) })
+  render(<PermissionPanel {...f.props} t={makeTranslate(dictionary)} />)
+  const group = screen.getByRole('group', { name: dictionary.defaultTitle })
+  expect(within(group).getByText(dictionary.defaultBody)).toBeTruthy()
+  expect(f.props.setPtcDefault).not.toHaveBeenCalled()
+  const write = Promise.withResolvers<boolean>()
+  f.props.setPtcDefault.mockReturnValueOnce(write.promise)
+  fireEvent.click(within(group).getByRole('button', { name: dictionary.defaultConfirm }))
+  expect(within(group).getByRole('button', { name: dictionary.defaultConfirm }).hasAttribute('disabled')).toBe(true)
+  await act(async () => { write.resolve(false); await write.promise })
+  expect(screen.getByRole('alert').textContent).toBe(dictionary.defaultNotSaved)
+  fireEvent.click(within(group).getByRole('button', { name: dictionary.defaultConfirm }))
+  await waitFor(() => { expect(screen.queryByRole('alert')).toBeNull() })
+  expect(f.props.setPtcDefault).toHaveBeenCalledTimes(2)
+  act(() => { f.preset.set({ ...f.preset.getSnapshot(), value: { default: 'standard', selectedDefault: 'ptc' } }) })
+  expect(within(group).getByRole('button', { name: dictionary.defaultSet }).hasAttribute('disabled')).toBe(true)
+})
+
+it('dismisses activation when permissions are ready without changing the default', () => {
+  const f = fixture(), onDismiss = vi.fn()
+  f.preset.set({ ...f.preset.getSnapshot(), value: { default: 'standard', selectedDefault: 'minimal' } })
+  f.publish({ ...observe({ ...value, system: { ...value.system, accessibility: true } }) })
+  render(<PermissionSetup {...f.props} onDismiss={onDismiss} onOpenDetails={vi.fn()} />)
+  expect(onDismiss).toHaveBeenCalledOnce()
+  expect(screen.queryByRole('dialog')).toBeNull()
+  expect(f.props.setPtcDefault).not.toHaveBeenCalled()
+})
+
+it.each([new Error('offline'), 'offline'])('reports a failed default-mode request on the detail page', async (error) => {
+  const f = fixture()
+  f.preset.set({ ...f.preset.getSnapshot(), value: { default: 'standard' } })
+  f.props.setPtcDefault.mockRejectedValueOnce(error)
+  render(<PermissionPanel {...f.props} />)
+  fireEvent.click(screen.getByRole('button', { name: en.defaultConfirm }))
+  await waitFor(() => { expect(screen.getByRole('alert').textContent).toContain('offline') })
+})
+
+it('waits for the settings document and recognizes PTC as the deployment default', () => {
+  const f = fixture()
+  f.preset.set({ ...f.preset.getSnapshot(), status: 'loading', value: undefined })
+  render(<PermissionPanel {...f.props} />)
+  expect(screen.queryByRole('button', { name: en.defaultConfirm })).toBeNull()
+  act(() => { f.preset.set({ ...f.preset.getSnapshot(), status: 'ready', value: { default: 'ptc' } }) })
+  expect(screen.getByRole('button', { name: en.defaultSet }).hasAttribute('disabled')).toBe(true)
+  expect(f.props.setPtcDefault).not.toHaveBeenCalled()
+})
+
+it.each(['unavailable', 'ready'] as const)('explains why the %s settings document cannot change the default', (status) => {
+  const f = fixture()
+  f.preset.set({ ...f.preset.getSnapshot(), status, writable: false,
+    value: status === 'ready' ? { default: 'standard' } : undefined })
+  render(<PermissionPanel {...f.props} />)
+  expect(screen.getByRole('alert').textContent).toBe(status === 'ready' ? en.defaultReadOnly : en.defaultUnavailable)
+  expect(screen.getByRole('button', { name: en.defaultConfirm }).hasAttribute('disabled')).toBe(true)
+  expect(f.props.setPtcDefault).not.toHaveBeenCalled()
+})
+
+it('shows query failures as unknown while retaining previously displayed apps', () => {
+  const f = fixture(), app = { id: 'a'.repeat(64) as CuaApplicationId, name: 'Fixture', executablePath: '/fixture/app' }
+  render(<PermissionPanel {...f.props} />)
+  f.publish({ ...observe({ ...value, allowedApps: [app] }), system: { value: value.system, busy: false, error: 'offline' }, busy: false })
+  expect(screen.getAllByRole('button', { name: en.revoke })).toHaveLength(1)
+  expect(screen.getAllByText(en.unknown)).toHaveLength(2)
+  expect(screen.queryByText(en.granted)).toBeNull()
+  expect(screen.getByRole('alert').textContent).toContain('offline')
+  fireEvent.click(screen.getAllByRole('button', { name: en.revoke })[0]!)
+  expect(f.props.revoke).toHaveBeenCalledWith(app.id)
+  fireEvent.click(screen.getByRole('button', { name: en.retry }))
+  expect(f.props.refresh).toHaveBeenCalledTimes(2)
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: true }, busy: true })
+  expect(screen.queryByRole('button', { name: en.retry })).toBeNull()
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: false, error: null }, busy: false })
+  expect(screen.queryByRole('button', { name: en.retry })).toBeNull()
+  f.publish(observe(value))
+  expect(screen.getByText(en.noApps)).toBeTruthy()
+  expect(screen.queryByRole('button', { name: en.revoke })).toBeNull()
+})
+
+it('keeps unknown initial status distinct from a confirmed missing privilege in Chinese', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} t={makeTranslate(zh)} />)
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: false, error: 'connection lost' }, busy: false })
+  expect(screen.queryByText(zh.granted)).toBeNull()
+  expect(screen.queryByRole('button', { name: zh.request })).toBeNull()
+  f.publish({ ...observe({ ...value, system: { ...value.system, accessibility: true, screenRecording: false } }) })
+  fireEvent.click(screen.getByRole('button', { name: zh.request }))
+  expect(f.props.request).toHaveBeenCalledWith('screenRecording')
+})
+
+it('offers setup after inspection, permits dismissal, and dismisses once both privileges are observed', () => {
+  const f = fixture(), onDismiss = vi.fn(), onOpenDetails = vi.fn()
+  render(<PermissionSetup {...f.props} onDismiss={onDismiss} onOpenDetails={onOpenDetails} />)
+  expect(screen.queryByRole('dialog')).toBeNull()
+  f.publish({ ...observe(value) })
+  const dialog = screen.getByRole('dialog', { name: en.setupTitle })
+  fireEvent.click(within(dialog).getByRole('button', { name: en.openSetup }))
+  expect(onOpenDetails).toHaveBeenCalledOnce()
+  fireEvent.click(within(dialog).getByRole('button', { name: en.later }))
+  expect(onDismiss).toHaveBeenCalledOnce()
+  f.publish({ ...observe({ ...value, system: { ...value.system, accessibility: true } }) })
+  expect(screen.queryByRole('dialog')).toBeNull()
+  expect(onDismiss).toHaveBeenCalledTimes(2)
+})
+
+it('offers the details page when permission inspection fails', () => {
+  const f = fixture()
+  render(<PermissionSetup {...f.props} onDismiss={vi.fn()} onOpenDetails={vi.fn()} />)
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: false, error: 'offline' }, busy: false })
+  expect(screen.getByRole('dialog')).toBeTruthy()
+  expect(screen.queryByRole('alert')).toBeNull()
+  expect(screen.getByText(en.setupQueryFailed)).toBeTruthy()
+  expect(screen.queryByText(en.setupBody)).toBeNull()
+})
+
+it('exposes a new-request action for a blocked application without calling grant or revoke', () => {
+  const f = fixture(), app = { id: 'a'.repeat(64) as CuaApplicationId, name: 'Fixture', executablePath: '/fixture/app' }
+  render(<PermissionPanel {...f.props} />)
+  f.publish({ ...observe({ ...value, blockedApps: [app] }) })
+  expect(screen.queryByText(en.noApps)).toBeNull()
+  fireEvent.click(screen.getByRole('button', { name: en.retryApproval }))
+  expect(f.props.retryApproval).toHaveBeenCalledWith(app.id)
+  expect(f.props.revoke).not.toHaveBeenCalled()
+  expect(f.props.request).not.toHaveBeenCalled()
+})
+
+it('renders action outcomes outside the permission page and clears finished toasts', async () => {
+  vi.useFakeTimers()
+  const f = fixture()
+  render(<PermissionToast {...f.props} />)
+  expect(screen.queryByRole('alert')).toBeNull()
+  f.publish({ toast: { id: 1, kind: 'revoked' } })
+  expect(screen.getByRole('alert').textContent).toBe(en.revoked)
+  await act(async () => { await vi.advanceTimersByTimeAsync(4000) })
+  expect(f.props.dismissToast).toHaveBeenCalledOnce()
+  f.publish({ toast: { id: 2, kind: 'failed', message: 'write refused' } })
+  expect(screen.getByRole('alert').textContent).toContain('write refused')
+})
+
+it('keeps permission guidance open while a fresh observation is pending', () => {
+  const f = fixture()
+  render(<PermissionSetup {...f.props} onDismiss={vi.fn()} onOpenDetails={vi.fn()} />)
+  f.publish({ ...observe(value) })
+  const dialog = screen.getByRole('dialog')
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: true }, busy: true })
+  expect(screen.getByRole('dialog')).toBe(dialog)
+})
+
+it('shows application icons and names while keeping the executable path in the tooltip', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} />)
+  f.publish({ ...observe({ ...value, allowedApps: [{ id: 'a'.repeat(64) as CuaApplicationId,
+    name: 'Calculator', executablePath: '/Applications/Calculator.app/Contents/MacOS/Calculator' }] }),
+  icons: { value: { '/Applications/Calculator.app/Contents/MacOS/Calculator': 'data:image/png;base64,aWNvbg==' }, busy: false, error: null }, busy: false })
+  expect(screen.getByText('Calculator')).toBeTruthy()
+  expect(screen.queryByText('/Applications/Calculator.app/Contents/MacOS/Calculator')).toBeNull()
+  const identity = screen.getByTitle('/Applications/Calculator.app/Contents/MacOS/Calculator')
+  expect(identity.querySelector('img')?.getAttribute('src')).toBe('data:image/png;base64,aWNvbg==')
+})
+
+it.each([en, zh])('shows three requirements with the target application beside each system permission', (dictionary) => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} t={makeTranslate(dictionary)} />)
+  const application = { name: 'Visual Studio Code.app', path: '/Applications/Visual Studio Code.app', icon: 'data:image/png;base64,aWNvbg==' }
+  f.publish({ ...observe({ ...value, system: { ...value.system, parent: { pid: 1, path: '/sbin/launchd' }, launchApplication: application } }) })
+  const requirements = screen.getByRole('region', { name: dictionary.title })
+  expect(within(requirements).getAllByRole('group')).toHaveLength(3)
+  expect(screen.getByRole('region', { name: dictionary.applicationsTitle })).toBeTruthy()
+  const accessibility = within(requirements).getByRole('group', { name: dictionary.accessibility })
+  expect(accessibility.textContent).toContain(dictionary.permissionPrefix)
+  expect(within(accessibility).getByText(application.name)).toBeTruthy()
+  expect(accessibility.textContent).toContain(dictionary.accessibilityAction)
+  expect(accessibility.querySelector('img')?.getAttribute('src')).toBe(application.icon)
+  const recording = within(requirements).getByRole('group', { name: dictionary.screenRecording })
+  expect(within(recording).getByText(application.name)).toBeTruthy()
+  expect(recording.textContent).toContain(dictionary.screenRecordingAction)
+  expect(within(requirements).getByText(dictionary.permissionHint)).toBeTruthy()
+  f.publish({ system: { ...f.state.getSnapshot().system, error: 'offline' } })
+  expect(screen.queryByText(application.name)).toBeNull()
+  expect(within(requirements).getByText(dictionary.permissionHintUnknown)).toBeTruthy()
+})
+
+it('names the authorization target even when its icon is unavailable', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} />)
+  f.publish({ ...observe({ ...value, system: { ...value.system,
+    launchApplication: { name: 'iTerm.app', path: '/Applications/iTerm.app' } } }) })
+  const accessibility = screen.getByRole('group', { name: en.accessibility })
+  expect(within(accessibility).getByText('iTerm.app')).toBeTruthy()
+  expect(accessibility.querySelector('img')).toBeNull()
+})
+
+it('waits for the first current observation instead of opening setup with a stale error', () => {
+  const f = fixture()
+  render(<PermissionSetup {...f.props} onDismiss={vi.fn()} onOpenDetails={vi.fn()} />)
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: true, error: 'provider is reloading' }, busy: true })
+  expect(screen.queryByRole('dialog')).toBeNull()
+  f.publish({ ...observe(value) })
+  expect(screen.getByRole('dialog', { name: en.setupTitle })).toBeTruthy()
+  expect(screen.queryByRole('alert')).toBeNull()
+})
+
+
+it('omits setup instructions once both system permissions are granted', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} />)
+  f.publish({ ...observe({ ...value, system: { ...value.system, accessibility: true, screenRecording: true } }) })
+  expect(screen.getAllByText(en.granted)).toHaveLength(2)
+  expect(screen.queryByText(en.permissionHintUnknown)).toBeNull()
+})
+
+
+it('keeps all three requirements visible before the first permission response', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} />)
+  const requirements = screen.getByRole('region', { name: en.title })
+  expect(within(requirements).getAllByRole('group')).toHaveLength(3)
+  expect(screen.queryByRole('alert')).toBeNull()
+  expect(screen.queryByRole('button', { name: en.request })).toBeNull()
+  for (const button of screen.getAllByRole('button', { name: en.settings })) expect(button.hasAttribute('disabled')).toBe(true)
+})
+
+it('keeps content mounted and pauses observation while the bundle changes', () => {
+  const f = fixture()
+  f.publish({ ...observe(value), system: { value: value.system, busy: false, error: 'provider is reloading' }, busy: false })
+  const view = render(<PermissionPanel {...f.props} busy />)
+  const requirements = screen.getByRole('region', { name: en.title })
+  expect(within(requirements).getAllByRole('group')).toHaveLength(3)
+  expect(screen.queryByRole('alert')).toBeNull()
+  expect(f.props.setActive).toHaveBeenLastCalledWith(false)
+  expect(screen.getByRole('button', { name: en.request }).hasAttribute('disabled')).toBe(true)
+  fireEvent.focus(window)
+  expect(f.props.refresh).not.toHaveBeenCalled()
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: true, error: null }, busy: true })
+  view.rerender(<PermissionPanel {...f.props} busy={false} />)
+  expect(f.props.setActive).toHaveBeenLastCalledWith(true)
+  expect(screen.getByRole('region', { name: en.title })).toBe(requirements)
+  expect(f.props.refresh).toHaveBeenCalledOnce()
+  f.publish({ system: { ...f.state.getSnapshot().system, busy: false }, busy: false })
+  expect(screen.getByRole('button', { name: en.request }).hasAttribute('disabled')).toBe(false)
+})
+
+it('fills application names, system permissions, and icons as their observations arrive', () => {
+  const f = fixture()
+  render(<PermissionPanel {...f.props} />)
+  const requirements = screen.getByRole('region', { name: en.title })
+  const access = screen.getByRole('region', { name: en.applicationsTitle })
+  const app = { id: 'a'.repeat(64) as CuaApplicationId, name: 'Calculator', executablePath: '/Applications/Calculator.app' }
+  f.publish({ applications: { value: { ...value, allowedApps: [app] }, busy: false, error: null } })
+  expect(within(access).getByText(app.name)).toBeTruthy()
+  expect(within(access).getByRole('button', { name: en.revoke }).hasAttribute('disabled')).toBe(false)
+  expect(screen.queryByText(en.granted)).toBeNull()
+  const identity = within(access).getByTitle(app.executablePath)
+  expect(identity.querySelector('img')).toBeNull()
+  const placeholder = identity.querySelector('[aria-hidden]')!
+  expect(placeholder).toBeTruthy()
+  f.publish({ system: { value: value.system, busy: false, error: null } })
+  expect(within(requirements).getByText(en.granted)).toBeTruthy()
+  expect(within(requirements).getByRole('button', { name: en.request }).hasAttribute('disabled')).toBe(false)
+  expect(within(access).getByTitle(app.executablePath)).toBe(identity)
+  expect(identity.querySelector('[aria-hidden]')).toBe(placeholder)
+  f.publish({ icons: { value: { [app.executablePath]: 'data:image/png;base64,aWNvbg==' }, busy: false, error: null } })
+  expect(identity.querySelector('img')?.getAttribute('src')).toBe('data:image/png;base64,aWNvbg==')
+  expect(identity.querySelector('[aria-hidden]')).toBeNull()
+  expect(screen.getByRole('region', { name: en.title })).toBe(requirements)
+})
+
+it.each(['applications', 'icons'] as const)('contains a failed %s query in the application section', (key) => {
+  const f = fixture()
+  f.publish({ ...observe(value), [key]: { value: null, busy: false, error: 'offline' } })
+  const view = render(<PermissionPanel {...f.props} />)
+  const requirements = screen.getByRole('region', { name: en.title })
+  const access = screen.getByRole('region', { name: en.applicationsTitle })
+  expect(within(requirements).getByText(en.granted)).toBeTruthy()
+  expect(within(requirements).queryByRole('alert')).toBeNull()
+  expect(within(access).getByRole('alert').textContent).toContain('offline')
+  fireEvent.click(within(access).getByRole('button', { name: en.retry }))
+  expect(f.props.refresh).toHaveBeenCalledTimes(2)
+  view.rerender(<PermissionPanel {...f.props} busy />)
+  expect(screen.queryByRole('alert')).toBeNull()
+})
+
+it('finishes activation guidance without waiting for application icons', () => {
+  const f = fixture(), onDismiss = vi.fn()
+  render(<PermissionSetup {...f.props} onDismiss={onDismiss} onOpenDetails={vi.fn()} />)
+  f.publish({ system: { value: { ...value.system, accessibility: true }, busy: false, error: null } })
+  expect(onDismiss).toHaveBeenCalledOnce()
+  expect(screen.queryByRole('dialog')).toBeNull()
+  expect(f.state.getSnapshot().icons.busy).toBe(true)
+})
diff --git a/packages/experimental/client-ui-cua/tsconfig.json b/packages/experimental/client-ui-cua/tsconfig.json
new file mode 100644
index 0000000000..66cf034b76
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tsconfig.json
@@ -0,0 +1,51 @@
+{
+  "extends": "../../../tsconfig.base.client.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types"
+  },
+  "include": [
+    "src"
+  ],
+  "references": [
+    {
+      "path": "../../../vendor/cordis"
+    },
+    {
+      "path": "../../client/locale/tsconfig.client.json"
+    },
+    {
+      "path": "../../client/store"
+    },
+    {
+      "path": "../../client/ui-primitives"
+    },
+    {
+      "path": "../../client/ui-renderer"
+    },
+    {
+      "path": "../../client/ui-slots"
+    },
+    {
+      "path": "../../client/ui-plugin-manager/tsconfig.client.json"
+    },
+    {
+      "path": "../../client/ui-settings/tsconfig.client.json"
+    },
+    {
+      "path": "../../client/ui-layout"
+    },
+    {
+      "path": "../../api/remotes/tsconfig.client.json"
+    },
+    {
+      "path": "../../api/gateway/tsconfig.client.json"
+    },
+    {
+      "path": "../cua"
+    },
+    {
+      "path": "../../typert/protocol"
+    }
+  ]
+}
diff --git a/packages/experimental/client-ui-cua/tsdown.config.ts b/packages/experimental/client-ui-cua/tsdown.config.ts
new file mode 100644
index 0000000000..71d5bd77f8
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tsdown.config.ts
@@ -0,0 +1,3 @@
+import { clientBundle } from '../../client/tsdown.client.ts'
+
+export default clientBundle(import.meta.dirname, ['lib/types/index.js'])

From c32a59cf891e00649579090ba7031b8a509d290f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 09/44] build(cua): integrate source builds and product
 regressions

---
 apps/cli/package.json                         |   1 +
 apps/web/tests/bundle-platform.e2e.ts         |  60 ++++
 apps/web/tests/cua-optin.e2e.ts               | 200 +++++++++++
 apps/web/tests/cua-permissions.e2e.ts         | 173 ++++++++++
 .../application-approval.expected.md          |   8 +
 .../cua-permissions/default-mode.expected.md  |   4 +
 .../cua-permissions/enabling.expected.md      |   5 +
 .../cua-permissions/missing.expected.md       |  26 ++
 .../cua-permissions/setup.expected.md         |   6 +
 .../unsupported-platform.expected.md          |   1 +
 .../official-unsupported-platform.expected.md |  53 +++
 .../plugin-config/official.expected.md        |   4 +
 ...e-enabled-unsupported-platform.expected.md |  54 +++
 .../plugin-manager/live-enabled.expected.md   |   4 +
 .../manager-unsupported-platform.expected.md  |  54 +++
 .../plugin-manager/manager.expected.md        |   4 +
 .../plugin-manager/refresh.expected.md        |   4 +-
 apps/web/tests/plugin-config.e2e.ts           |   5 +-
 apps/web/tests/plugin-manager.e2e.ts          |  10 +-
 apps/web/tests/preview-boot.e2e.ts            |  14 +-
 apps/web/tsconfig.json                        |   3 +
 package.json                                  |   4 +-
 .../tests/retired-content-admission.spec.ts   |  13 +-
 pnpm-lock.yaml                                |  97 ++++++
 scripts/build-cua.spec.ts                     |  31 ++
 scripts/build-cua.ts                          |  57 +++
 scripts/build.spec.ts                         |   3 +-
 scripts/build.ts                              |   5 +-
 scripts/check-workspace-constraints.ts        |   2 +-
 scripts/experimental-package-policy.ts        |   2 +
 scripts/gen-cordis-catalog.ts                 |   7 +
 scripts/gen-doc-graphs.ts                     |   5 +
 scripts/optional-bundles.spec.ts              |   3 +
 scripts/release/families.spec.ts              |   2 +
 .../verify-default-product-isolation.spec.ts  |  11 +-
 scripts/verify-default-product-isolation.ts   |   3 +-
 .../verify-package-readme-model-experience.ts |   1 +
 .../session/cua-native/consent-fixture.mjs    |  14 -
 .../session/cua-native/cordis.snapshot.yml    |   6 +-
 snapshots/session/cua-native/cordis.yml       |   6 +-
 .../session/cua-native/permission-fixture.mjs |  23 ++
 .../session/cua-native/replay.override.json   | 198 +++++++++++
 snapshots/session/cua-native/session.v4.jsonl | 326 ++++++++++--------
 .../cua-native/system-prompt.expected.md      |   4 +-
 .../cua-native/workspace/native-helper.mjs    |   8 +-
 snapshots/session/cua-ptc/consent-fixture.mjs |   2 +-
 snapshots/session/cua-ptc/cordis.snapshot.yml |   1 +
 snapshots/session/cua-ptc/cordis.yml          |   1 +
 .../session/cua-ptc/system-prompt.expected.md |   4 +-
 tsconfig.base.json                            |   4 +
 tsconfig.client.json                          |   1 +
 tsconfig.host.json                            |   4 +
 vitest.config.ts                              |   3 +
 53 files changed, 1348 insertions(+), 196 deletions(-)
 create mode 100644 apps/web/tests/bundle-platform.e2e.ts
 create mode 100644 apps/web/tests/cua-optin.e2e.ts
 create mode 100644 apps/web/tests/cua-permissions.e2e.ts
 create mode 100644 apps/web/tests/expected/cua-permissions/application-approval.expected.md
 create mode 100644 apps/web/tests/expected/cua-permissions/default-mode.expected.md
 create mode 100644 apps/web/tests/expected/cua-permissions/enabling.expected.md
 create mode 100644 apps/web/tests/expected/cua-permissions/missing.expected.md
 create mode 100644 apps/web/tests/expected/cua-permissions/setup.expected.md
 create mode 100644 apps/web/tests/expected/cua-permissions/unsupported-platform.expected.md
 create mode 100644 apps/web/tests/expected/plugin-config/official-unsupported-platform.expected.md
 create mode 100644 apps/web/tests/expected/plugin-manager/live-enabled-unsupported-platform.expected.md
 create mode 100644 apps/web/tests/expected/plugin-manager/manager-unsupported-platform.expected.md
 create mode 100644 scripts/build-cua.spec.ts
 create mode 100644 scripts/build-cua.ts
 delete mode 100644 snapshots/session/cua-native/consent-fixture.mjs
 create mode 100644 snapshots/session/cua-native/permission-fixture.mjs

diff --git a/apps/cli/package.json b/apps/cli/package.json
index cd8c213149..64a7bf6200 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -105,6 +105,7 @@
     "@deepseek-ai/dsh-experimental-terminal-bundle": "workspace:*",
     "@deepseek-ai/dsh-experimental-session-search": "workspace:*",
     "@deepseek-ai/dsh-experimental-tool-worktree": "workspace:*",
+    "@deepseek-ai/dsh-cua-bundle": "workspace:*",
     "@deepseek-ai/dsh-experimental-plugin-market-bundle": "workspace:*"
   },
   "devDependencies": {
diff --git a/apps/web/tests/bundle-platform.e2e.ts b/apps/web/tests/bundle-platform.e2e.ts
new file mode 100644
index 0000000000..c592af5497
--- /dev/null
+++ b/apps/web/tests/bundle-platform.e2e.ts
@@ -0,0 +1,60 @@
+/** Unsupported Host platforms leave the profile and running PTC configuration untouched. */
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { chromium, type Browser } from 'playwright'
+import type {} from '@deepseek-ai/dsh-ptc-runtime'
+import { expect, it, onTestFinished } from 'vitest'
+import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapshotMode, type WebScaffold } from './scaffold.ts'
+import { connectFreshWorkspaceZh, ZH_BROWSER_LOCALE } from './support.ts'
+
+it('disables unsupported bundles, shows the Host restriction, and refuses direct activation without changing PTC', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'bundle-platform-web-'))
+  const owned: { scaffold?: WebScaffold; browser?: Browser } = {}
+  onTestFinished(async () => {
+    try { await owned.browser?.close() } finally {
+      try { await owned.scaffold?.close() } finally { await rm(root, { recursive: true, force: true }) }
+    }
+  })
+  const name = 'host-platform-only'
+  await writeFile(join(root, 'package.json'), JSON.stringify({ name, version: '1.0.0', dsh: { bundle: {
+    patch: './cordis.patch.yml', experimental: true, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'],
+  } } }))
+  await writeFile(join(root, 'cordis.patch.yml'), '- id: ptc-runtime\n  config:\n    executionMode: persistent-in-memory\n')
+  const scaffold = owned.scaffold = await launchWebScaffold({ profile: { packages: [{ dir: root }] } })
+  const browser = owned.browser = await chromium.launch()
+  const page = await browser.newPage({ viewport: { width: 1680, height: 1000 }, locale: ZH_BROWSER_LOCALE })
+  await page.goto(scaffold.authenticatedUrl)
+  await connectFreshWorkspaceZh(page, scaffold.workspaceCwd)
+  await page.getByRole('navigation', { name: '全局面板' }).getByRole('button', { name: '插件', exact: true }).click()
+  const reason = '此插件不支持运行 DSH 的主机操作系统'
+  const card = page.locator(`[data-plugin-package="${name}"]`)
+  await card.getByText(reason, { exact: true }).waitFor()
+  expect(await card.getByRole('switch').isEnabled()).toBe(false)
+  expect(await card.getByRole('switch').getAttribute('aria-checked')).toBe('false')
+  await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/unsupported-platform.expected.md', import.meta.url)),
+    await captureStableAria(page, `[data-plugin-package="${name}"] p[role="status"]`, scaffold.workspaceCwd), webSnapshotMode())
+  const manifest = join(scaffold.harnessHome, 'profiles/scaffold/package.json')
+  const before = await readFile(manifest, 'utf8')
+  const runtimeId = () => [...scaffold.ctx.loader.entries()].find(entry => entry.options.id === 'ptc-runtime')?.fiber?.uid
+  const beforeRuntime = runtimeId()
+  expect(beforeRuntime).toBeTypeOf('number')
+  expect(scaffold.ctx.ptcRuntime.programFormat).toBe('function-body')
+  const names = [name]
+  if (process.platform !== 'darwin') {
+    const cua = page.locator('[data-plugin-package="@deepseek-ai/dsh-cua-bundle"]')
+    await cua.getByText(reason, { exact: true }).waitFor()
+    expect(await cua.getByRole('switch').isEnabled()).toBe(false)
+    names.push('@deepseek-ai/dsh-cua-bundle')
+  }
+  for (const bundle of names) {
+    expect(await scaffold.ctx.pluginManager.setBundleEnabled(bundle, true)).toMatchObject({
+      changed: false, application: 'failed', error: { code: 'unsupported-platform' },
+    })
+  }
+  expect(await readFile(manifest, 'utf8')).toBe(before)
+  expect(runtimeId()).toBe(beforeRuntime)
+  expect(scaffold.ctx.ptcRuntime.programFormat).toBe('function-body')
+  expect(scaffold.ctx.get('computerUse')).toBeUndefined()
+})
diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
new file mode 100644
index 0000000000..c3f0e15eba
--- /dev/null
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -0,0 +1,200 @@
+/** CUA follows PTC Agent scopes and changes the default only from its detail page. */
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { chromium, type Browser } from 'playwright'
+import { readProfileManifest } from '@deepseek-ai/dsh-app-boot'
+import { SessionId } from '@deepseek-ai/dsh-session'
+import type {} from '@deepseek-ai/dsh-ptc-runtime'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
+import { load } from 'js-yaml'
+import { expect, it, vi } from 'vitest'
+import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapshotMode, type WebScaffold } from './scaffold.ts'
+import { connectFreshWorkspaceZh, writeComposerDraft, ZH_BROWSER_LOCALE } from './support.ts'
+
+// The shipped bundle admits only macOS Hosts; unsupported Hosts are exercised in bundle-platform.e2e.ts.
+it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('hot-reloads CUA and changes the default %s only from its detail page', async (selectedDefault) => {
+  const directory = await mkdtemp(join(tmpdir(), 'cua-optin-web-'))
+  let ownedScaffold: WebScaffold | undefined
+  let browser: Browser | undefined
+  try {
+    const patch = join(directory, 'native-fixture.yml')
+    // Permission inspection fails against this non-helper executable; activation still permits dismissing setup.
+    await writeFile(patch, JSON.stringify([{ id: 'cua', config: { helperPath: process.execPath } }]))
+    const harnessHome = join(directory, 'home')
+    const scaffold = ownedScaffold = await launchWebScaffold({ harnessHome, extraOverlayPath: [
+      fileURLToPath(new URL('./pin-browse-picker.overlay.yml', import.meta.url)), patch,
+    ] })
+    const initialDefault = selectedDefault ?? 'standard'
+    if (selectedDefault !== undefined) await scaffold.ctx.settings.update('agent-preset-registry', { selectedDefault })
+    browser = await chromium.launch()
+    const page = await browser.newPage({ viewport: { width: 1680, height: 1000 }, locale: ZH_BROWSER_LOCALE })
+    await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
+    await connectFreshWorkspaceZh(page, scaffold.workspaceCwd)
+    const input = page.locator('[data-composer-input]')
+    await writeComposerDraft(page, input, 'Retained draft')
+    await page.getByRole('navigation', { name: '全局面板' }).getByRole('button', { name: '插件', exact: true }).click()
+    const card = page.locator('[data-plugin-package="@deepseek-ai/dsh-cua-bundle"]')
+    let toggle = card.getByRole('switch', { name: '启用 Computer Use', exact: true })
+    await toggle.waitFor()
+    expect(await toggle.getAttribute('aria-checked')).toBe('false')
+    expect(await card.getByText('实验性', { exact: true }).count()).toBe(1)
+    expect(await card.textContent()).toContain('将 PTC 模式改为可持久化')
+    expect(await card.textContent()).toContain('请切换到 PTC 模式')
+    expect(await card.textContent()).toContain('Windows 支持正在开发中')
+    expect(await card.textContent()).not.toContain('Swift')
+    const originalAgent = scaffold.ctx.agents.list()[0]!
+    const ptcAgent = (await scaffold.ctx.agents.create({
+      sessionId: SessionId('cua-existing-ptc'),
+      setup: async (ctx) => { await scaffold.ctx.agentPresets.mount(ctx, 'ptc') },
+    })).agent
+    expect(scaffold.ctx.tools.schemas(ptcAgent).some(tool => tool.name === 'cua')).toBe(false)
+    const originalRuntime = scaffold.ctx.ptcRuntime
+    expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+    expect(originalRuntime.programFormat).toBe('function-body')
+    expect(scaffold.ctx.get('computerUse')).toBeUndefined()
+    const selected = () => readProfileManifest('scaffold', join(scaffold.harnessHome, 'profiles/scaffold')).dsh?.profile?.bundles
+    expect(selected()).not.toContain('@deepseek-ai/dsh-cua-bundle')
+
+    const enabling = Promise.withResolvers<undefined>()
+    const setEnabled = scaffold.ctx.pluginManager.setBundleEnabled.bind(scaffold.ctx.pluginManager)
+    let applying: ReturnType<typeof setEnabled> | undefined
+    // Hold the Host request so the pending UI does not depend on machine speed; release into the real operation.
+    const enableCall = vi.spyOn(scaffold.ctx.pluginManager, 'setBundleEnabled').mockImplementationOnce((name, enabled) => {
+      applying = enabling.promise.then(() => setEnabled(name, enabled))
+      return applying
+    })
+    try {
+      await toggle.click()
+      await card.getByRole('status', { name: '正在应用 Computer Use 的更改', exact: true }).waitFor()
+      expect(await toggle.isEnabled()).toBe(false)
+      await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/enabling.expected.md', import.meta.url)),
+        await captureStableAria(page, '[data-plugin-package="@deepseek-ai/dsh-cua-bundle"]', scaffold.workspaceCwd), webSnapshotMode())
+    } finally {
+      enabling.resolve(undefined)
+      enableCall.mockRestore()
+      await applying
+    }
+    await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+    await card.getByRole('status', { name: '正在应用 Computer Use 的更改', exact: true }).waitFor({ state: 'hidden' })
+    const setup = page.getByRole('dialog', { name: '使用 Computer Use 前需要设置', exact: true })
+    await setup.waitFor()
+    expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
+    await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/setup.expected.md', import.meta.url)),
+      await captureStableAria(page, '[role="dialog"]', scaffold.workspaceCwd), webSnapshotMode())
+    expect(await setup.getByRole('button', { name: '设为 PTC', exact: true }).count()).toBe(0)
+    expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+    expect(selected()).toContain('@deepseek-ai/dsh-cua-bundle')
+    expect(scaffold.ctx.get('computerUse')).toBeDefined()
+    expect(scaffold.ctx.agents.get(originalAgent.id) === originalAgent).toBe(true)
+    expect(scaffold.ctx.agents.get(ptcAgent.id) === ptcAgent).toBe(true)
+    expect(scaffold.ctx.agentPresets.composedPreset(originalAgent.ctx)).toBe(initialDefault)
+    expect(scaffold.ctx.tools.schemas(originalAgent).some(tool => tool.name === 'cua')).toBe(false)
+    expect(scaffold.ctx.tools.schemas(ptcAgent).some(tool => tool.name === 'cua')).toBe(true)
+    expect((await scaffold.ctx.systemPrompt.assemble({ scope: ptcAgent })).tools.map(tool => tool.name)).toEqual(['run_code'])
+    for (const preset of ['ptc', 'standard', 'ptc', initialDefault]) {
+      await scaffold.ctx.agentPresets.select(originalAgent, preset)
+      expect(scaffold.ctx.tools.schemas(originalAgent).some(tool => tool.name === 'cua')).toBe(preset === 'ptc')
+    }
+    const child = await scaffold.ctx.agents.create({
+      sessionId: SessionId('cua-child'), parentAgent: ptcAgent,
+      setup: (ctx) => { scaffold.ctx.agentPresets.composeFrom(ctx, ptcAgent.ctx) },
+    })
+    expect(scaffold.ctx.tools.schemas(child.agent).some(tool => tool.name === 'cua')).toBe(true)
+    await child.dispose()
+    expect(scaffold.ctx.tools.schemas(child.agent).some(tool => tool.name === 'cua')).toBe(false)
+    expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+    expect(scaffold.ctx.ptcRuntime.programFormat).toBe('repl')
+    await setup.waitFor()
+    expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
+    await setup.getByRole('button', { name: '稍后', exact: true }).click()
+    await setup.waitFor({ state: 'hidden' })
+    const settingsPath = join(harnessHome, 'profiles/scaffold/cordis.patch.yml')
+    const saved = await readFile(settingsPath, 'utf8')
+    expect(load(saved)).toEqual(expect.arrayContaining([
+      expect.objectContaining({ id: 'ptc-runtime', config: { executionMode: 'persistent-in-memory' } }),
+      expect.objectContaining({ id: 'ui-settings', config: { enabled: true } }),
+    ]))
+    if (selectedDefault === undefined) {
+      expect(load(saved)).not.toEqual(expect.arrayContaining([expect.objectContaining({ id: 'agent-preset-registry' })]))
+    } else {
+      expect(load(saved)).toEqual(expect.arrayContaining([
+        expect.objectContaining({ id: 'agent-preset-registry', config: { default: 'standard', selectedDefault } }),
+      ]))
+    }
+    const freshDefault = (await scaffold.ctx.agents.create({
+      sessionId: SessionId('cua-new-default'),
+      setup: async (ctx) => { await scaffold.ctx.agentPresets.mount(ctx) },
+    })).agent
+    expect(scaffold.ctx.agentPresets.composedPreset(freshDefault.ctx)).toBe(initialDefault)
+    expect(scaffold.ctx.tools.schemas(freshDefault).some(tool => tool.name === 'cua')).toBe(false)
+    const fresh = (await scaffold.ctx.agents.create({
+      sessionId: SessionId('cua-new-ptc'),
+      setup: async (ctx) => { await scaffold.ctx.agentPresets.mount(ctx, 'ptc') },
+    })).agent
+    expect(scaffold.ctx.agentPresets.composedPreset(fresh.ctx)).toBe('ptc')
+    expect(scaffold.ctx.tools.schemas(fresh).some(tool => tool.name === 'cua')).toBe(true)
+    const runtime = scaffold.ctx.ptcRuntime
+    const runtimeFiber = [...scaffold.ctx.loader.entries()].find(entry => entry.options.id === 'ptc-runtime')!.fiber
+    const owner = {}
+    const program = 'globalThis.counter = (globalThis.counter ?? 0) + 1'
+    expect((await runtime.run(runtime.resolve({ program, bindings: [], stateOwner: owner }))).value).toBe(1)
+    await toggle.click()
+    await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('false')
+    expect(scaffold.ctx.get('computerUse')).toBeUndefined()
+    expect([...scaffold.ctx.loader.entries()].find(entry => entry.options.id === 'ptc-runtime')!.fiber === runtimeFiber).toBe(true)
+    expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+    expect(scaffold.ctx.agents.get(ptcAgent.id) === ptcAgent).toBe(true)
+    for (const agent of [ptcAgent, fresh]) {
+      expect(scaffold.ctx.tools.schemas(agent).some(tool => tool.name === 'cua')).toBe(false)
+      expect((await scaffold.ctx.systemPrompt.assemble({ scope: agent })).tools.map(tool => tool.name)).toEqual(['run_code'])
+    }
+    expect((await runtime.run(runtime.resolve({ program, bindings: [], stateOwner: owner }))).value).toBe(2)
+    expect(await readFile(settingsPath, 'utf8')).toBe(saved)
+    await card.getByRole('button', { name: '查看 Computer Use', exact: true }).click()
+    toggle = page.locator('[data-plugin-panel]').getByRole('switch', { name: '启用 Computer Use', exact: true })
+    await toggle.click()
+    await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+    await setup.waitFor()
+    expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
+    expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+    await setup.getByRole('button', { name: '前往设置', exact: true }).click()
+    await setup.waitFor({ state: 'hidden' })
+    await page.getByRole('region', { name: '给 Computer Use 授权', exact: true }).getByRole('alert').waitFor()
+    const defaultSetting = page.getByRole('group', { name: '新会话默认模式', exact: true })
+    await expect.poll(() => defaultSetting.getByRole('button', { name: '设为 PTC', exact: true }).isEnabled()).toBe(true)
+    await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/default-mode.expected.md', import.meta.url)),
+      await captureStableAria(page, '[role="group"][aria-label="新会话默认模式"]', scaffold.workspaceCwd), webSnapshotMode())
+    await defaultSetting.getByRole('button', { name: '设为 PTC', exact: true }).click()
+    await expect.poll(() => scaffold.ctx.agentPresets.defaultId).toBe('ptc')
+    expect(scaffold.ctx.agentPresets.composedPreset(originalAgent.ctx)).toBe(initialDefault)
+    expect(scaffold.ctx.agentPresets.composedPreset(freshDefault.ctx)).toBe(initialDefault)
+    const confirmed = (await scaffold.ctx.agents.create({
+      sessionId: SessionId('cua-confirmed-default'),
+      setup: async (ctx) => { await scaffold.ctx.agentPresets.mount(ctx) },
+    })).agent
+    expect(scaffold.ctx.agentPresets.composedPreset(confirmed.ctx)).toBe('ptc')
+    expect(scaffold.ctx.tools.schemas(confirmed).some(tool => tool.name === 'cua')).toBe(true)
+    expect([...scaffold.ctx.loader.entries()].find(entry => entry.options.id === 'ptc-runtime')!.fiber === runtimeFiber).toBe(true)
+    expect(scaffold.ctx.tools.schemas(ptcAgent).some(tool => tool.name === 'cua')).toBe(true)
+    expect((await runtime.run(runtime.resolve({ program, bindings: [], stateOwner: owner }))).value).toBe(3)
+    const confirmedSettings = await readFile(settingsPath, 'utf8')
+    expect(load(confirmedSettings)).toEqual(expect.arrayContaining([
+      expect.objectContaining({ id: 'agent-preset-registry', config: { default: 'standard', selectedDefault: 'ptc' } }),
+    ]))
+    await toggle.click()
+    await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('false')
+    await toggle.click()
+    await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+    await setup.waitFor()
+    expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
+    expect(await setup.getByRole('button', { name: '设为 PTC', exact: true }).count()).toBe(0)
+    expect(await readFile(settingsPath, 'utf8')).toBe(confirmedSettings)
+    await runtime.release(owner)
+  } finally {
+    try { await browser?.close() } finally {
+      try { await ownedScaffold?.close() } finally { await rm(directory, { recursive: true, force: true }) }
+    }
+  }
+})
diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
new file mode 100644
index 0000000000..ff3f6c92a6
--- /dev/null
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -0,0 +1,173 @@
+/** Built permission UI talks to the real provider; the isolated helper substitutes only macOS privilege observations. */
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { ToolCallId } from '@deepseek-ai/dsh-llm'
+import type {} from '@deepseek-ai/dsh-user-approval'
+import type {} from '@deepseek-ai/dsh-agent-preset-registry'
+import { chromium, type Browser } from 'playwright'
+import { expect, it, onTestFailed, onTestFinished } from 'vitest'
+import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapshotMode, watchConsole, type WebScaffold } from './scaffold.ts'
+import { connectFreshWorkspace, newEnglishPage, saveFailureShot } from './support.ts'
+import { installNativeFixture, startFixtureHost } from '../../../packages/experimental/cua-macos/tests/native-fixture.ts'
+
+const bundle = fileURLToPath(new URL('../../../packages/experimental/cua-bundle', import.meta.url))
+const expected = fileURLToPath(new URL('./expected/cua-permissions/missing.expected.md', import.meta.url))
+
+// System-permission onboarding belongs to the macOS-only bundle; rendering and policy units remain portable.
+it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fresh observation and persists application revocation', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'dsh-cua-permissions-web-'))
+  const resources: { scaffold?: WebScaffold; browser?: Browser; closeFixture?: () => Promise<void> } = {}
+  onTestFinished(async () => {
+    try { await resources.browser?.close() } finally {
+      try { await resources.scaffold?.close() } finally {
+        try { await resources.closeFixture?.() } finally { await rm(root, { recursive: true, force: true }) }
+      }
+    }
+  })
+  const helper = await installNativeFixture(root)
+  resources.closeFixture = await startFixtureHost(helper)
+  const state = join(root, 'permissions.json'), audit = join(root, 'helper-events.jsonl')
+  const launchApplication = { name: 'Visual Studio Code.app', path: '/Applications/Visual Studio Code.app',
+    icon: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAADElEQVQImWNgZGIGAAAOAAeCcsnOAAAAAElFTkSuQmCC' }
+  await writeFile(state, JSON.stringify({ accessibility: false, screenRecording: false, launchApplication }))
+  await writeFile(join(root, 'observe-helper'), '')
+  const fixtureBundle = join(root, 'fixture-bundle')
+  await mkdir(fixtureBundle)
+  await writeFile(join(fixtureBundle, 'package.json'), JSON.stringify({ name: 'cua-permission-fixture', version: '1.0.0',
+    dsh: { bundle: { patch: 'cordis.patch.yml' } } }))
+  await writeFile(join(fixtureBundle, 'cordis.patch.yml'), `- id: cua\n  config: ${JSON.stringify({ helperPath: helper })}\n`)
+  const scaffold = await launchWebScaffold({
+    profile: { packages: [{ dir: bundle, enabled: true }, { dir: fixtureBundle, enabled: true }] },
+  })
+  resources.scaffold = scaffold
+  await scaffold.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'],
+    value: [{ id: 'a'.repeat(64), name: 'Fixture', executablePath: '/Applications/Fixture.app' }] }])
+  const browser = await chromium.launch()
+  resources.browser = browser
+  const page = await newEnglishPage(browser), tripwire = watchConsole(page)
+  onTestFailed(() => saveFailureShot(page, 'web-e2e-cua-permissions'))
+  await page.goto(scaffold.authenticatedUrl)
+  await connectFreshWorkspace(page, scaffold.workspaceCwd)
+  const agent = scaffold.ctx.agents.list()[0]!
+  await scaffold.ctx.agentPresets.select(agent, 'ptc')
+  scaffold.ctx.approval.setPolicy(agent, 'never')
+  await scaffold.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'], value: [] }])
+  // Application consent remains independent of the session's tool-approval policy.
+  const grant = scaffold.ctx.tools.execute({ agent, signal: new AbortController().signal,
+    callId: ToolCallId('cua-app-approval'), name: 'run_code',
+    arguments: { code: 'return await tools.cua({ method: "getApp", params: { selector: "Fixture" } })',
+      description: 'Request application access' } })
+  const approval = page.locator('[data-approval-key]')
+  await Promise.race([approval.waitFor(), grant.then((result) => {
+    throw new Error(`Application selection completed before consent: ${JSON.stringify(result)}`)
+  })])
+  expect(await approval.getByText('Fixture', { exact: true }).count()).toBe(1)
+  expect(await approval.getByRole('textbox').count()).toBe(0)
+  await expect.poll(() => approval.locator('img').evaluate((image: HTMLImageElement) => image.naturalWidth)).toBe(1)
+  expect(await approval.getByText('/Applications/Fixture.app', { exact: true }).count()).toBe(0)
+  await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/application-approval.expected.md', import.meta.url)),
+    await captureStableAria(page, '[data-approval-key]', scaffold.workspaceCwd), webSnapshotMode())
+  await approval.getByRole('button', { name: 'Always allow', exact: true }).click()
+  expect((await grant).isError).toBe(false)
+  await approval.waitFor({ state: 'hidden' })
+  await page.getByRole('button', { name: 'Plugins', exact: true }).click()
+  const card = page.locator('[data-plugin-package="@deepseek-ai/dsh-cua-bundle"]')
+  expect(await card.getByRole('button', { name: /Accessibility permission|Screen Recording permission/ }).count()).toBe(0)
+  await page.setViewportSize({ width: 1680, height: 600 })
+  const plugins = page.locator('[data-plugin-panel]')
+  const openDetails = page.getByRole('button', { name: 'View Computer Use', exact: true })
+  await openDetails.scrollIntoViewIfNeeded()
+  expect(await plugins.evaluate(element => element.scrollTop)).toBeGreaterThan(0)
+  await openDetails.click()
+  await expect.poll(() => plugins.evaluate(element => element.scrollTop)).toBe(0)
+  const panel = page.locator('[data-cua-settings]')
+  const accessibility = panel.getByRole('group', { name: 'Accessibility', exact: true })
+  await accessibility.getByText('Not allowed', { exact: true }).waitFor()
+  expect(await plugins.evaluate(element => element.scrollTop)).toBe(0)
+  expect(await panel.getByRole('region', { name: 'Authorize Computer Use', exact: true }).getByRole('group').count()).toBe(3)
+  expect(await panel.getByRole('region', { name: 'Manage applications Computer Use can access', exact: true }).count()).toBe(1)
+  await expect.poll(() => panel.locator('li img').evaluate((image: HTMLImageElement) => image.naturalWidth)).toBe(1)
+  expect(await panel.getByText('/fixture/app', { exact: true }).count()).toBe(0)
+  expect(await accessibility.getByText('Visual Studio Code.app', { exact: true }).count()).toBe(1)
+  expect(await accessibility.textContent()).toContain('In System Settings, allow')
+  expect(await accessibility.textContent()).toContain('to read interface controls, click, and type.')
+  expect(await panel.getByRole('group', { name: 'Screen Recording', exact: true }).getByText('Visual Studio Code.app', { exact: true }).count()).toBe(1)
+  await expect.poll(() => accessibility.locator('img').evaluate((image: HTMLImageElement) => image.naturalWidth)).toBe(1)
+  await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')
+  await compareOrRefreshGolden(expected, await captureStableAria(page, '[data-cua-settings]', scaffold.workspaceCwd), webSnapshotMode())
+  try {
+    for (const width of [1680, 390]) {
+      await page.setViewportSize({ width, height: 1000 })
+      for (const colorScheme of ['light', 'dark'] as const) {
+        await page.emulateMedia({ colorScheme })
+        await expect.poll(() => page.evaluate(() => document.body.hasAttribute('data-ds-dark-theme'))).toBe(colorScheme === 'dark')
+        expect(await panel.evaluate(element => element.scrollWidth <= element.clientWidth)).toBe(true)
+        if (webSnapshotMode() === 'refresh') {
+          const directory = fileURLToPath(new URL('../../../.artifacts', import.meta.url))
+          await mkdir(directory, { recursive: true })
+          const path = join(directory, `cua-permission-design-${process.pid}-${width}-${colorScheme}.png`)
+          await panel.screenshot({ path, animations: 'disabled' })
+          console.log(`CUA permission design: ${path}`)
+        }
+      }
+    }
+  } finally {
+    await page.emulateMedia({ colorScheme: null })
+    await page.setViewportSize({ width: 1680, height: 1000 })
+  }
+  await accessibility.getByRole('button', { name: 'Request permission', exact: true }).click()
+  await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')
+  expect(await accessibility.getByText('Not allowed', { exact: true }).count()).toBe(1)
+  await writeFile(state, JSON.stringify({ accessibility: true, screenRecording: false, launchApplication }))
+  // Headless pages retain document focus; model returning from System Settings at the window-event boundary.
+  await page.evaluate(() => { window.dispatchEvent(new Event('focus')) })
+  await accessibility.getByText('Allowed', { exact: true }).waitFor()
+  const screen = panel.getByRole('group', { name: 'Screen Recording', exact: true })
+  await screen.getByRole('button', { name: 'Open System Settings', exact: true }).click()
+  await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')
+  await panel.getByRole('button', { name: 'Revoke', exact: true }).click()
+  await panel.getByRole('heading', { name: 'Always-allowed applications', exact: true }).waitFor({ state: 'hidden' })
+  await panel.getByRole('heading', { name: 'Applications not allowed', exact: true }).waitFor()
+  await panel.getByRole('button', { name: 'Allow asking again', exact: true }).click()
+  await panel.getByText('Fixture', { exact: true }).waitFor({ state: 'hidden' })
+  const saved = await readFile(join(scaffold.harnessHome, 'profiles/scaffold/cordis.patch.yml'), 'utf8')
+  expect(saved).toContain('allowedApps: []')
+  const events = (await readFile(audit, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as { event: string; method: string; params: object })
+    .filter(record => record.event === 'call').map(({ method, params }) => ({ method, params }))
+  expect(events).toContainEqual({ method: 'requestPermission', params: { permission: 'accessibility' } })
+  expect(events.filter(event => event.method === 'openPermissionSettings')).toEqual([
+    { method: 'openPermissionSettings', params: { permission: 'screenRecording' } },
+  ])
+  expect(events.every(event => ['permissionStatus', 'requestPermission', 'openPermissionSettings', 'applicationIcons', 'getApp'].includes(event.method))).toBe(true)
+  const trace = await page.evaluateHandle(() => {
+    const errors: string[] = []
+    const observer = new MutationObserver(() => {
+      for (const node of document.querySelectorAll('[data-cua-settings] [role="alert"]')) {
+        const text = node.textContent?.trim()
+        if (text && errors.at(-1) !== text) errors.push(text)
+      }
+    })
+    observer.observe(document.body, { childList: true, subtree: true, characterData: true })
+    return { errors, stop: () => { observer.disconnect() } }
+  })
+  try {
+    const toggle = page.locator('[data-plugin-panel]').getByRole('switch', { name: 'Enable Computer Use', exact: true })
+    for (let cycle = 0; cycle < 3; cycle++) {
+      await toggle.click()
+      await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('false')
+      await expect.poll(() => toggle.isEnabled()).toBe(true)
+      await toggle.click()
+      await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+      const setup = page.getByRole('dialog', { name: 'Set up Computer Use before use', exact: true })
+      await setup.getByRole('button', { name: 'Later', exact: true }).click()
+      await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')
+      expect(await trace.evaluate(value => value.errors)).toEqual([])
+    }
+  } finally {
+    await trace.evaluate((value) => { value.stop() })
+    await trace.dispose()
+  }
+  expect(tripwire.pageErrors).toEqual([])
+}, 60_000)
diff --git a/apps/web/tests/expected/cua-permissions/application-approval.expected.md b/apps/web/tests/expected/cua-permissions/application-approval.expected.md
new file mode 100644
index 0000000000..96f5eb74e3
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/application-approval.expected.md
@@ -0,0 +1,8 @@
+- text: Waiting for approval
+- group "Approval details":
+  - strong: Fixture
+  - text: Allow Computer Use to launch, read, capture and control this application?
+  - paragraph: Session access lasts until DSH restarts or Computer Use is disabled.
+- button "Reject"
+- button "Allow for this session"
+- button "Always allow"
diff --git a/apps/web/tests/expected/cua-permissions/default-mode.expected.md b/apps/web/tests/expected/cua-permissions/default-mode.expected.md
new file mode 100644
index 0000000000..36996c4d69
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/default-mode.expected.md
@@ -0,0 +1,4 @@
+- group "新会话默认模式":
+  - strong: 新会话默认模式
+  - paragraph: Computer Use 仅在 PTC 模式中可用。
+  - button "设为 PTC"
diff --git a/apps/web/tests/expected/cua-permissions/enabling.expected.md b/apps/web/tests/expected/cua-permissions/enabling.expected.md
new file mode 100644
index 0000000000..2a90e7fb3b
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/enabling.expected.md
@@ -0,0 +1,5 @@
+- listitem:
+  - button "查看 Computer Use": Computer Use
+  - text: 实验性 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+  - status "正在应用 Computer Use 的更改"
+  - switch "启用 Computer Use" [disabled]
diff --git a/apps/web/tests/expected/cua-permissions/missing.expected.md b/apps/web/tests/expected/cua-permissions/missing.expected.md
new file mode 100644
index 0000000000..d8fafe9400
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/missing.expected.md
@@ -0,0 +1,26 @@
+- region "Authorize Computer Use":
+  - heading "Authorize Computer Use" [level=3]
+  - group "Default mode for new sessions":
+    - strong: Default mode for new sessions
+    - paragraph: Computer Use is available only in PTC mode.
+    - button "Set to PTC"
+  - group "Accessibility":
+    - strong: Accessibility
+    - paragraph: In System Settings, allow Visual Studio Code.app to read interface controls, click, and type.
+    - text: Not allowed
+    - button "Request permission"
+    - button "Open System Settings"
+  - group "Screen Recording":
+    - strong: Screen Recording
+    - paragraph: In System Settings, allow Visual Studio Code.app to capture application windows.
+    - text: Not allowed
+    - button "Request permission"
+    - button "Open System Settings"
+  - paragraph: Enable the application in System Settings. Follow the macOS prompt if it names another application.
+- region "Manage applications Computer Use can access":
+  - heading "Manage applications Computer Use can access" [level=3]
+  - heading "Always-allowed applications" [level=4]
+  - list:
+    - listitem:
+      - strong: Fixture
+      - button "Revoke"
diff --git a/apps/web/tests/expected/cua-permissions/setup.expected.md b/apps/web/tests/expected/cua-permissions/setup.expected.md
new file mode 100644
index 0000000000..0ee5870bf3
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/setup.expected.md
@@ -0,0 +1,6 @@
+- dialog "使用 Computer Use 前需要设置":
+  - heading "使用 Computer Use 前需要设置" [level=2]
+  - button "关闭"
+  - paragraph: Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。
+  - button "稍后"
+  - button "前往设置"
diff --git a/apps/web/tests/expected/cua-permissions/unsupported-platform.expected.md b/apps/web/tests/expected/cua-permissions/unsupported-platform.expected.md
new file mode 100644
index 0000000000..b6aa94aa05
--- /dev/null
+++ b/apps/web/tests/expected/cua-permissions/unsupported-platform.expected.md
@@ -0,0 +1 @@
+- status: 此插件不支持运行 DSH 的主机操作系统
diff --git a/apps/web/tests/expected/plugin-config/official-unsupported-platform.expected.md b/apps/web/tests/expected/plugin-config/official-unsupported-platform.expected.md
new file mode 100644
index 0000000000..837d709aad
--- /dev/null
+++ b/apps/web/tests/expected/plugin-config/official-unsupported-platform.expected.md
@@ -0,0 +1,53 @@
+- heading "插件" [level=1]
+- text: 安装、启用和配置插件
+- button "插件说明"
+- button "刷新"
+- group "添加插件":
+  - button "添加插件"
+  - button "选择添加插件方式"
+- heading "内置插件配置" [level=3]
+- list:
+  - listitem:
+    - button "查看 子智能体": 子智能体
+    - text: 设置子智能体的递归层级、数量和模型。
+  - listitem:
+    - button "查看 网页搜索": 网页搜索
+    - text: 设置 DeepSeek 的搜索提供方。
+  - listitem:
+    - button "查看 Agent 循环": Agent 循环
+    - text: 控制 Agent 派发工具调用的方式。
+  - listitem:
+    - button "查看 终端": 终端
+    - text: 限制每条命令最多能跑多久、最多输出多少内容。
+- heading "实验性插件" [level=3]
+- button "更多"
+- list:
+  - listitem:
+    - button "查看 智能体团队": 智能体团队
+    - text: 实验性 启用团队协作、团队工具、成员列表和共享任务看板。
+    - switch "启用 智能体团队"
+  - listitem:
+    - button "查看 语音输入": 语音输入
+    - text: 实验性 在本机使用 SenseVoice 转写录音，首次使用需安装依赖。
+    - switch "启用 语音输入"
+  - listitem:
+    - button "查看 自动授权审查": 自动授权审查
+    - text: 实验性 提供自动审查权限模式，由模型在每次工具调用前判断是否授权。
+    - switch "启用 自动授权审查"
+  - listitem:
+    - button "查看 开发者工具": 开发者工具
+    - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
+    - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 异常 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use" [disabled]
+    - status: 此插件不支持运行 DSH 的主机操作系统
+- heading "已安装插件" [level=3]
+- list:
+  - listitem:
+    - button "查看 @fixture/live-client": "@fixture/live-client"
+    - switch "启用 @fixture/live-client"
+  - listitem:
+    - button "查看 dsh-web-scaffold-defaults": dsh-web-scaffold-defaults
+    - switch "启用 dsh-web-scaffold-defaults" [checked]
diff --git a/apps/web/tests/expected/plugin-config/official.expected.md b/apps/web/tests/expected/plugin-config/official.expected.md
index 37d3a232b4..aa6597193e 100644
--- a/apps/web/tests/expected/plugin-config/official.expected.md
+++ b/apps/web/tests/expected/plugin-config/official.expected.md
@@ -38,6 +38,10 @@
     - button "查看 开发者工具": 开发者工具
     - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
     - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use"
 - heading "已安装插件" [level=3]
 - list:
   - listitem:
diff --git a/apps/web/tests/expected/plugin-manager/live-enabled-unsupported-platform.expected.md b/apps/web/tests/expected/plugin-manager/live-enabled-unsupported-platform.expected.md
new file mode 100644
index 0000000000..827875e341
--- /dev/null
+++ b/apps/web/tests/expected/plugin-manager/live-enabled-unsupported-platform.expected.md
@@ -0,0 +1,54 @@
+- heading "插件" [level=1]
+- text: 安装、启用和配置插件
+- button "插件说明"
+- button "刷新"
+- group "添加插件":
+  - button "添加插件"
+  - button "选择添加插件方式"
+- heading "内置插件配置" [level=3]
+- list:
+  - listitem:
+    - button "查看 子智能体": 子智能体
+    - text: 设置子智能体的递归层级、数量和模型。
+  - listitem:
+    - button "查看 网页搜索": 网页搜索
+    - text: 设置 DeepSeek 的搜索提供方。
+  - listitem:
+    - button "查看 Agent 循环": Agent 循环
+    - text: 控制 Agent 派发工具调用的方式。
+  - listitem:
+    - button "查看 终端": 终端
+    - text: 限制每条命令最多能跑多久、最多输出多少内容。
+- heading "实验性插件" [level=3]
+- button "更多"
+- list:
+  - listitem:
+    - button "查看 智能体团队": 智能体团队
+    - text: 实验性 启用团队协作、团队工具、成员列表和共享任务看板。
+    - switch "启用 智能体团队"
+  - listitem:
+    - button "查看 语音输入": 语音输入
+    - text: 实验性 在本机使用 SenseVoice 转写录音，首次使用需安装依赖。
+    - switch "启用 语音输入"
+  - listitem:
+    - button "查看 自动授权审查": 自动授权审查
+    - text: 实验性 提供自动审查权限模式，由模型在每次工具调用前判断是否授权。
+    - switch "启用 自动授权审查"
+  - listitem:
+    - button "查看 开发者工具": 开发者工具
+    - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
+    - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 异常 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use" [disabled]
+    - status: 此插件不支持运行 DSH 的主机操作系统
+- heading "已安装插件" [level=3]
+- list:
+  - listitem:
+    - button "查看 @fixture/bundle": "@fixture/bundle"
+    - text: Registry description for the fixture bundle.
+    - switch "启用 @fixture/bundle" [checked]
+  - listitem:
+    - button "查看 dsh-web-scaffold-defaults": dsh-web-scaffold-defaults
+    - switch "启用 dsh-web-scaffold-defaults" [checked]
diff --git a/apps/web/tests/expected/plugin-manager/live-enabled.expected.md b/apps/web/tests/expected/plugin-manager/live-enabled.expected.md
index eab9dd48e1..d677e7a74d 100644
--- a/apps/web/tests/expected/plugin-manager/live-enabled.expected.md
+++ b/apps/web/tests/expected/plugin-manager/live-enabled.expected.md
@@ -38,6 +38,10 @@
     - button "查看 开发者工具": 开发者工具
     - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
     - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use"
 - heading "已安装插件" [level=3]
 - list:
   - listitem:
diff --git a/apps/web/tests/expected/plugin-manager/manager-unsupported-platform.expected.md b/apps/web/tests/expected/plugin-manager/manager-unsupported-platform.expected.md
new file mode 100644
index 0000000000..dac35198f9
--- /dev/null
+++ b/apps/web/tests/expected/plugin-manager/manager-unsupported-platform.expected.md
@@ -0,0 +1,54 @@
+- heading "插件" [level=1]
+- text: 安装、启用和配置插件
+- button "插件说明"
+- button "刷新"
+- group "添加插件":
+  - button "添加插件"
+  - button "选择添加插件方式"
+- heading "内置插件配置" [level=3]
+- list:
+  - listitem:
+    - button "查看 子智能体": 子智能体
+    - text: 设置子智能体的递归层级、数量和模型。
+  - listitem:
+    - button "查看 网页搜索": 网页搜索
+    - text: 设置 DeepSeek 的搜索提供方。
+  - listitem:
+    - button "查看 Agent 循环": Agent 循环
+    - text: 控制 Agent 派发工具调用的方式。
+  - listitem:
+    - button "查看 终端": 终端
+    - text: 限制每条命令最多能跑多久、最多输出多少内容。
+- heading "实验性插件" [level=3]
+- button "更多"
+- list:
+  - listitem:
+    - button "查看 智能体团队": 智能体团队
+    - text: 实验性 启用团队协作、团队工具、成员列表和共享任务看板。
+    - switch "启用 智能体团队"
+  - listitem:
+    - button "查看 语音输入": 语音输入
+    - text: 实验性 在本机使用 SenseVoice 转写录音，首次使用需安装依赖。
+    - switch "启用 语音输入"
+  - listitem:
+    - button "查看 自动授权审查": 自动授权审查
+    - text: 实验性 提供自动审查权限模式，由模型在每次工具调用前判断是否授权。
+    - switch "启用 自动授权审查"
+  - listitem:
+    - button "查看 开发者工具": 开发者工具
+    - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
+    - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 异常 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use" [disabled]
+    - status: 此插件不支持运行 DSH 的主机操作系统
+- heading "已安装插件" [level=3]
+- list:
+  - listitem:
+    - button "查看 @fixture/bundle": "@fixture/bundle"
+    - text: Registry description for the fixture bundle.
+    - switch "启用 @fixture/bundle"
+  - listitem:
+    - button "查看 dsh-web-scaffold-defaults": dsh-web-scaffold-defaults
+    - switch "启用 dsh-web-scaffold-defaults" [checked]
diff --git a/apps/web/tests/expected/plugin-manager/manager.expected.md b/apps/web/tests/expected/plugin-manager/manager.expected.md
index f3dd4a7bc6..cc835ea7e3 100644
--- a/apps/web/tests/expected/plugin-manager/manager.expected.md
+++ b/apps/web/tests/expected/plugin-manager/manager.expected.md
@@ -38,6 +38,10 @@
     - button "查看 开发者工具": 开发者工具
     - text: 实验性 查看调试会话原始数据、聊天消息分组数据，以及调试 NodeJS 后端
     - switch "启用 开发者工具"
+  - listitem:
+    - button "查看 Computer Use": Computer Use
+    - text: 实验性 目前仅支持 macOS，Windows 支持正在开发中。开启会将 PTC 模式改为可持久化，并为已有及新建 PTC 会话加载 Computer Use。请切换到 PTC 模式来使用 Computer Use，并授予辅助功能和屏幕录制权限。
+    - switch "启用 Computer Use"
 - heading "已安装插件" [level=3]
 - list:
   - listitem:
diff --git a/apps/web/tests/expected/plugin-manager/refresh.expected.md b/apps/web/tests/expected/plugin-manager/refresh.expected.md
index 75dda78845..85d666fd3e 100644
--- a/apps/web/tests/expected/plugin-manager/refresh.expected.md
+++ b/apps/web/tests/expected/plugin-manager/refresh.expected.md
@@ -6,7 +6,7 @@ Focus at 500ms:
 - tooltip "刷新"
 failure: pending
 - button "刷新" [disabled]
-{"busy":"true","spinners":1,"cards":11,"skeletons":0,"alerts":[],"retry":0,"toasts":[]}
+{"busy":"true","spinners":1,"cards":12,"skeletons":0,"alerts":[],"retry":0,"toasts":[]}
 failure: settled
 - button "刷新"
-{"busy":"false","spinners":0,"cards":11,"skeletons":0,"alerts":[],"retry":0,"toasts":["刷新失败，请重试"]}
+{"busy":"false","spinners":0,"cards":12,"skeletons":0,"alerts":[],"retry":0,"toasts":["刷新失败，请重试"]}
diff --git a/apps/web/tests/plugin-config.e2e.ts b/apps/web/tests/plugin-config.e2e.ts
index fabf193a95..4040b0e072 100644
--- a/apps/web/tests/plugin-config.e2e.ts
+++ b/apps/web/tests/plugin-config.e2e.ts
@@ -19,7 +19,8 @@ import {
 import { ZH_BROWSER_LOCALE, saveFailureShot } from './support.ts'
 
 const SNAPSHOT_DIR = fileURLToPath(new URL('./expected/plugin-config', import.meta.url))
-const OFFICIAL_EXPECTED = join(SNAPSHOT_DIR, 'official.expected.md')
+const OFFICIAL_EXPECTED = join(SNAPSHOT_DIR, process.platform === 'darwin'
+  ? 'official.expected.md' : 'official-unsupported-platform.expected.md')
 const ROW_EXPECTED = join(SNAPSHOT_DIR, 'row.expected.md')
 const BUNDLE_EXPECTED = join(SNAPSHOT_DIR, 'bundle.expected.md')
 const FIXTURE_PLUGINS = fileURLToPath(new URL('./fixtures/plugins', import.meta.url))
@@ -440,7 +441,7 @@ describe('web e2e: plugin configuration pages', () => {
 
   it.skipIf(MODE === 'record')('keeps the fixture inventory closed', async () => {
     expect(tripwire.warnings).toEqual([])
-    await assertFixtureInventory(SNAPSHOT_DIR, ['bundle.expected.md', 'official.expected.md', 'row.expected.md', 'subagent.expected.md', 'web-search.expected.md'])
+    await assertFixtureInventory(SNAPSHOT_DIR, ['bundle.expected.md', 'official.expected.md', 'official-unsupported-platform.expected.md', 'row.expected.md', 'subagent.expected.md', 'web-search.expected.md'])
   })
 
 
diff --git a/apps/web/tests/plugin-manager.e2e.ts b/apps/web/tests/plugin-manager.e2e.ts
index 05d3bbecda..323102289a 100644
--- a/apps/web/tests/plugin-manager.e2e.ts
+++ b/apps/web/tests/plugin-manager.e2e.ts
@@ -21,8 +21,9 @@ import {
 } from './support.ts'
 
 const SNAPSHOT_DIR = fileURLToPath(new URL('./expected/plugin-manager', import.meta.url))
-const MANAGER_EXPECTED = join(SNAPSHOT_DIR, 'manager.expected.md')
-const LIVE_EXPECTED = join(SNAPSHOT_DIR, 'live-enabled.expected.md')
+const PLATFORM_SUFFIX = process.platform === 'darwin' ? '' : '-unsupported-platform'
+const MANAGER_EXPECTED = join(SNAPSHOT_DIR, `manager${PLATFORM_SUFFIX}.expected.md`)
+const LIVE_EXPECTED = join(SNAPSHOT_DIR, `live-enabled${PLATFORM_SUFFIX}.expected.md`)
 const EXPORTS_EXPECTED = join(SNAPSHOT_DIR, 'exports.expected.md')
 const EXPORTS_EN_EXPECTED = join(SNAPSHOT_DIR, 'exports-en.expected.md')
 const FIXTURE_PLUGINS = fileURLToPath(new URL('./fixtures/plugins', import.meta.url))
@@ -298,7 +299,7 @@ describe('web e2e: plugin manager', () => {
           width: node.getBoundingClientRect().width,
           height: node.getBoundingClientRect().height,
         })))
-        expect(blankActions).toEqual(Array.from({ length: 4 }, () => ({ children: 0, background: 'rgba(0, 0, 0, 0)', width: 36, height: 20 })))
+        expect(blankActions).toEqual(Array.from({ length: 4 }, () => ({ children: 0, background: 'rgba(0, 0, 0, 0)', width: 58, height: 20 })))
         if (shots !== undefined) {
           for (const colorScheme of ['light', 'dark'] as const) {
             await probe.emulateMedia({ colorScheme })
@@ -585,7 +586,7 @@ describe('web e2e: plugin manager', () => {
     expect(await panel.locator('[data-plugin-group="more"] [data-plugin-package]').count())
       .toBe(OPTIONAL_BUNDLES.length + ON_DEMAND_BUNDLES.length)
     expect(await panel.getByText('实验性', { exact: true }).count())
-      .toBe(OPTIONAL_BUNDLES.filter(name => name.startsWith('@deepseek-ai/dsh-experimental-')).length)
+      .toBe((await scaffold.ctx.pluginManager.listBundles()).filter(bundle => bundle.optional && (bundle.experimental === true || bundle.name.startsWith('@deepseek-ai/dsh-experimental-'))).length)
     expect(await panel.locator('[data-plugin-group="bundles"]').count()).toBe(0)
     await panel.getByRole('button', { name: '返回插件', exact: true }).click()
     expect(await panel.locator('[data-plugin-group="bundles"] [data-plugin-package]').count()).toBe(2)
@@ -1114,6 +1115,7 @@ describe('web e2e: plugin manager', () => {
     await assertFixtureInventory(SNAPSHOT_DIR, [
       'manager.expected.md', 'live-enabled.expected.md', 'missing-bundle.expected.md', 'exports.expected.md', 'exports-en.expected.md', 'icons.expected.md', 'loading.expected.md', 'refresh.expected.md',
       'ime-enter.expected.md', 'header-responsive.expected.md', 'preview.expected.md',
+      'manager-unsupported-platform.expected.md', 'live-enabled-unsupported-platform.expected.md',
     ])
   })
 })
diff --git a/apps/web/tests/preview-boot.e2e.ts b/apps/web/tests/preview-boot.e2e.ts
index 0e32a5a7d6..a6d1faaadb 100644
--- a/apps/web/tests/preview-boot.e2e.ts
+++ b/apps/web/tests/preview-boot.e2e.ts
@@ -681,15 +681,23 @@ async function toggleOptionalBundles(page: Page): Promise<void> {
     }
   })
   expect(result.optional.map(entry => entry.name).sort()).toEqual([...OPTIONAL_BUNDLES].sort())
-  expect(result.optional.filter(entry => entry.enabled || entry.availability !== 'installation' || entry.error !== null)).toEqual([])
+  expect(result.optional.filter(entry => entry.enabled || entry.availability !== 'installation')).toEqual([])
+  expect(result.optional.filter(entry => entry.error !== null)).toEqual([
+    expect.objectContaining({ name: '@deepseek-ai/dsh-cua-bundle', error: { code: 'unsupported-platform' } }),
+  ])
   // Metadata resolves through the Worker's Node internal modules: every optional bundle shows its title and icon.
   expect(result.optional.filter(entry => entry.metaError !== null || entry.title !== 'object' || entry.icon !== 'string')).toEqual([])
   expect(result.inventoryErrors).toEqual([])
   console.info(`preview boot: optional bundle toggles ${JSON.stringify(result.toggles.map(({ name, enable, disable, error }) => ({ name, enable, disable, error })))}`)
-  expect(result.toggles.filter(toggle => toggle.enable !== 'applied' || toggle.disable !== 'applied')
+  expect(result.toggles.find(toggle => toggle.name === '@deepseek-ai/dsh-cua-bundle')).toMatchObject({
+    enable: 'failed', disable: 'applied', error: { code: 'unsupported-platform' },
+    changed: 0, inactive: [], restored: true,
+  })
+  const supported = result.toggles.filter(toggle => toggle.name !== '@deepseek-ai/dsh-cua-bundle')
+  expect(supported.filter(toggle => toggle.enable !== 'applied' || toggle.disable !== 'applied')
     .map(({ name, enable, disable }) => ({ name, enable, disable }))).toEqual([])
   // Each bundle changes Loader rows, every enabled row it changes runs, and switching it off restores the prior rows.
-  expect(result.toggles.filter(toggle => toggle.changed === 0 || toggle.inactive.length > 0 || !toggle.restored)
+  expect(supported.filter(toggle => toggle.changed === 0 || toggle.inactive.length > 0 || !toggle.restored)
     .map(({ name, changed, inactive, restored }) => ({ name, changed, inactive, restored }))).toEqual([])
   const pluginsWith = (bundle: string): Array<{ moduleName: string; enabled: boolean; fiberPhase: string | null }> =>
     result.toggles.find(toggle => toggle.name === bundle)?.plugins ?? []
diff --git a/apps/web/tsconfig.json b/apps/web/tsconfig.json
index e135be295f..ede25bfc23 100644
--- a/apps/web/tsconfig.json
+++ b/apps/web/tsconfig.json
@@ -81,6 +81,9 @@
     "tests/plugin-config.e2e.ts",
     "tests/input-plugin-extensions.e2e.ts",
     "tests/plugin-manager.e2e.ts",
+    "tests/cua-optin.e2e.ts",
+    "tests/bundle-platform.e2e.ts",
+    "tests/cua-permissions.e2e.ts",
     "tests/schedule-header.e2e.ts",
     "tests/worktree-opt-in.e2e.ts",
     "tests/session-inspector.e2e.ts",
diff --git a/package.json b/package.json
index a5e45dbf91..ef08495a93 100644
--- a/package.json
+++ b/package.json
@@ -216,7 +216,8 @@
     "verify-official-bundle-catalog": "tsx scripts/gen-official-bundle-catalog.ts --check",
     "gen-provider-data": "tsx packages/llm/llm-pi-ai/scripts/gen-provider-data.ts",
     "verify-provider-data": "tsx packages/llm/llm-pi-ai/scripts/gen-provider-data.ts --check",
-    "verify-product-use": "tsx scripts/verify-product-use.ts"
+    "verify-product-use": "tsx scripts/verify-product-use.ts",
+    "build:cua": "tsx scripts/build-cua.ts"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-hooks-claude-code": "workspace:*",
@@ -290,6 +291,7 @@
     "@deepseek-ai/dsh-working-directory": "workspace:*",
     "@deepseek-ai/dsh-experimental-worktree": "workspace:*",
     "@deepseek-ai/dsh-experimental-tool-worktree": "workspace:*",
+    "@deepseek-ai/dsh-cua-bundle": "workspace:*",
     "@deepseek-ai/dsh-experimental-cua-macos": "workspace:*"
   }
 }
diff --git a/packages/session/session-persistence-jsonl/tests/retired-content-admission.spec.ts b/packages/session/session-persistence-jsonl/tests/retired-content-admission.spec.ts
index 1d10cb2fde..ddf49e64e4 100644
--- a/packages/session/session-persistence-jsonl/tests/retired-content-admission.spec.ts
+++ b/packages/session/session-persistence-jsonl/tests/retired-content-admission.spec.ts
@@ -1,13 +1,13 @@
 /** Interpreted retired content must fail before migration publication or recoverable native-tail suppression. */
 import { Context } from '@deepseek-ai/cordis'
-import { SessionId } from '@deepseek-ai/dsh-session'
+import { SESSION_FORMAT_VERSION, SessionId } from '@deepseek-ai/dsh-session'
 import { SessionFormatUnsupportedError, SessionPersistenceCorruptionError } from '@deepseek-ai/dsh-session-persistence'
 import * as JsonlSessionPersistence from '@deepseek-ai/dsh-session-persistence-jsonl'
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 import { describe, expect, it, onTestFinished } from 'vitest'
-import { generationLogPath } from '../src/format.ts'
+import { generationLogPath, SessionLogScanner } from '../src/format.ts'
 import { compressZstdFrame } from '../src/zstd.ts'
 
 const id = SessionId('retired-content-admission')
@@ -55,3 +55,12 @@ describe.each(modes)('retired content in JSONL ($compression, $access)', ({ comp
     expect(await readFile(path)).toEqual(bytes)
   })
 })
+
+it.each(['strict', 'recoverable'] as const)('classifies retired native PTC tags as unsupported during %s scanning', (recovery) => {
+  const header = { type: 'session', version: SESSION_FORMAT_VERSION, id, createdAt: 1, isSeeded: false, delegationDepth: 0 }
+  for (const type of ['tool/code-dispatch-start', 'tool/code-dispatch']) {
+    const scanner = new SessionLogScanner(Buffer.from(JSON.stringify(header) + '\n'), recovery)
+    const row = { type, seq: 0, time: 1, data: {} }
+    expect(() => { scanner.write(Buffer.from(JSON.stringify(row) + '\n')) }).toThrow(SessionFormatUnsupportedError)
+  }
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5f38bae356..39b6e38f4e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -35,6 +35,9 @@ importers:
       '@deepseek-ai/dsh-cua':
         specifier: workspace:*
         version: link:packages/experimental/cua
+      '@deepseek-ai/dsh-cua-bundle':
+        specifier: workspace:*
+        version: link:packages/experimental/cua-bundle
       '@deepseek-ai/dsh-experimental-browser-use-chrome-devtools-mcp':
         specifier: workspace:*
         version: link:packages/experimental/browser-use-chrome-devtools-mcp
@@ -299,6 +302,9 @@ importers:
       '@deepseek-ai/dsh-cordis-client-runner':
         specifier: workspace:*
         version: link:../../packages/extensions/cordis-client-runner
+      '@deepseek-ai/dsh-cua-bundle':
+        specifier: workspace:*
+        version: link:../../packages/experimental/cua-bundle
       '@deepseek-ai/dsh-experimental-agent-team-profile':
         specifier: workspace:*
         version: link:../../packages/experimental/agent-team-profile
@@ -6371,6 +6377,9 @@ importers:
       '@deepseek-ai/dsh-client-store':
         specifier: workspace:*
         version: link:../store
+      '@deepseek-ai/dsh-client-ui-approval':
+        specifier: workspace:*
+        version: link:../ui-approval
       '@deepseek-ai/dsh-client-ui-chat':
         specifier: workspace:*
         version: link:../ui-chat
@@ -8279,6 +8288,60 @@ importers:
         specifier: ^18.2.0
         version: 18.3.1(react@18.3.1)
 
+  packages/experimental/client-ui-cua:
+    devDependencies:
+      '@deepseek-ai/cordis':
+        specifier: workspace:~
+        version: link:../../../vendor/cordis
+      '@deepseek-ai/dsh-api-gateway':
+        specifier: workspace:*
+        version: link:../../api/gateway
+      '@deepseek-ai/dsh-api-remotes':
+        specifier: workspace:*
+        version: link:../../api/remotes
+      '@deepseek-ai/dsh-client-locale':
+        specifier: workspace:*
+        version: link:../../client/locale
+      '@deepseek-ai/dsh-client-store':
+        specifier: workspace:*
+        version: link:../../client/store
+      '@deepseek-ai/dsh-client-test-runtime':
+        specifier: workspace:*
+        version: link:../../test-support/client-runtime
+      '@deepseek-ai/dsh-client-ui-layout':
+        specifier: workspace:*
+        version: link:../../client/ui-layout
+      '@deepseek-ai/dsh-client-ui-plugin-manager':
+        specifier: workspace:*
+        version: link:../../client/ui-plugin-manager
+      '@deepseek-ai/dsh-client-ui-primitives':
+        specifier: workspace:*
+        version: link:../../client/ui-primitives
+      '@deepseek-ai/dsh-client-ui-renderer':
+        specifier: workspace:*
+        version: link:../../client/ui-renderer
+      '@deepseek-ai/dsh-client-ui-settings':
+        specifier: workspace:*
+        version: link:../../client/ui-settings
+      '@deepseek-ai/dsh-client-ui-slots':
+        specifier: workspace:*
+        version: link:../../client/ui-slots
+      '@deepseek-ai/dsh-cua':
+        specifier: workspace:*
+        version: link:../cua
+      '@deepseek-ai/dsh-typert-protocol':
+        specifier: workspace:*
+        version: link:../../typert/protocol
+      '@testing-library/react':
+        specifier: ^16.1.0
+        version: 16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@18.3.7(@types/react@18.3.31))(@types/react@18.3.31)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react:
+        specifier: ^18.2.0
+        version: 18.3.1
+      react-dom:
+        specifier: ^18.2.0
+        version: 18.3.1(react@18.3.1)
+
   packages/experimental/client-ui-voice-input:
     devDependencies:
       '@deepseek-ai/cordis':
@@ -8473,6 +8536,9 @@ importers:
       '@deepseek-ai/dsh-brand':
         specifier: workspace:*
         version: link:../../util/brand
+      '@deepseek-ai/dsh-typert-protocol':
+        specifier: workspace:*
+        version: link:../../typert/protocol
       '@deepseek-ai/dsh-util-values':
         specifier: workspace:*
         version: link:../../util/values
@@ -8504,6 +8570,9 @@ importers:
       '@deepseek-ai/dsh-agent-loop-testkit':
         specifier: workspace:*
         version: link:../../test-support/agent-loop-testkit
+      '@deepseek-ai/dsh-agent-preset-registry':
+        specifier: workspace:*
+        version: link:../../preset/agent-preset-registry
       '@deepseek-ai/dsh-app-boot':
         specifier: workspace:*
         version: link:../../boot/app-boot
@@ -8543,6 +8612,9 @@ importers:
       '@deepseek-ai/dsh-sandbox-policy':
         specifier: workspace:*
         version: link:../../sandbox/sandbox-policy
+      '@deepseek-ai/dsh-scope':
+        specifier: workspace:*
+        version: link:../../core/scope
       '@deepseek-ai/dsh-session':
         specifier: workspace:*
         version: link:../../core/session
@@ -8574,6 +8646,31 @@ importers:
         specifier: ^0.35.3
         version: 0.35.5(@types/node@22.20.1)
 
+  packages/experimental/cua-bundle:
+    dependencies:
+      '@deepseek-ai/dsh-client-ui-cua':
+        specifier: workspace:*
+        version: link:../client-ui-cua
+      '@deepseek-ai/dsh-computer-use':
+        specifier: workspace:*
+        version: link:../../computer-use/computer-use
+      '@deepseek-ai/dsh-experimental-cua-macos':
+        specifier: workspace:*
+        version: link:../cua-macos
+      '@deepseek-ai/dsh-ptc-runtime-node':
+        specifier: workspace:*
+        version: link:../../ptc-runtime/ptc-runtime-node
+    devDependencies:
+      '@deepseek-ai/cordis':
+        specifier: workspace:~
+        version: link:../../../vendor/cordis
+      '@deepseek-ai/cordis-plugin-include':
+        specifier: workspace:~
+        version: link:../../../vendor/include
+      js-yaml:
+        specifier: ^4.2.0
+        version: 4.3.2
+
   packages/experimental/cua-macos:
     dependencies:
       '@deepseek-ai/dsh-atomic-write':
diff --git a/scripts/build-cua.spec.ts b/scripts/build-cua.spec.ts
new file mode 100644
index 0000000000..42e385c813
--- /dev/null
+++ b/scripts/build-cua.spec.ts
@@ -0,0 +1,31 @@
+/** Native preparation follows the same persisted bundle selection as the Web switch. */
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { expect, it, onTestFinished } from 'vitest'
+import { computerUseSelected } from './build-cua.ts'
+
+it('does not create or select a profile when Computer Use has not been enabled', async () => {
+  const home = await mkdtemp(join(tmpdir(), 'cua-selection-'))
+  onTestFinished(() => rm(home, { recursive: true, force: true }))
+  expect(computerUseSelected(home, 'web')).toBe(false)
+  const directory = join(home, 'profiles/web')
+  await mkdir(directory, { recursive: true })
+  await writeFile(join(directory, 'package.json'), '{}')
+  expect(computerUseSelected(home, 'web')).toBe(false)
+})
+
+it('reads enable and disable changes from the existing profile manifest', async () => {
+  const home = await mkdtemp(join(tmpdir(), 'cua-selection-'))
+  onTestFinished(() => rm(home, { recursive: true, force: true }))
+  const directory = join(home, 'profiles/web')
+  await mkdir(directory, { recursive: true })
+  for (const enabled of [false, true, false]) {
+    const bundles = ['@deepseek-ai/dsh-base', ...(enabled ? ['@deepseek-ai/dsh-cua-bundle'] : [])]
+    await writeFile(join(directory, 'package.json'), JSON.stringify({ dsh: { profile: { bundles } } }))
+    expect(computerUseSelected(home, 'web')).toBe(enabled)
+    expect(computerUseSelected(home, 'another-profile')).toBe(false)
+  }
+  await writeFile(join(directory, 'package.json'), JSON.stringify({ dsh: { profile: { bundles: 'cua' } } }))
+  expect(() => computerUseSelected(home, 'web')).toThrow('string array')
+})
diff --git a/scripts/build-cua.ts b/scripts/build-cua.ts
new file mode 100644
index 0000000000..66670f320d
--- /dev/null
+++ b/scripts/build-cua.ts
@@ -0,0 +1,57 @@
+/** Prepare native components only when selected by the existing Web profile. */
+import { existsSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { parseArgs } from 'node:util'
+import { Context } from '@deepseek-ai/cordis'
+import { readProfileManifest } from '@deepseek-ai/dsh-app-boot'
+import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import { buildNativeExecutable } from '../packages/experimental/cua-macos/src/native-build.ts'
+
+/**
+ * Read the existing plugin selection without creating or mutating a profile.
+ * @param home - Harness home used by the application launch.
+ * @param profile - Profile whose optional bundle selection controls preparation.
+ * @returns Whether Computer Use is selected in that profile.
+ */
+export function computerUseSelected(home: string, profile: string): boolean {
+  const directory = join(home, 'profiles', profile)
+  if (!existsSync(join(directory, 'package.json'))) return false
+  const manifest = readProfileManifest('build:cua', directory)
+  const bundles = manifest.dsh?.profile?.bundles
+  if (bundles === undefined) return false
+  if (!Array.isArray(bundles) || !bundles.every(name => typeof name === 'string')) throw new Error('build:cua: profile bundles must be a string array')
+  return bundles.includes('@deepseek-ai/dsh-cua-bundle')
+}
+
+async function main(): Promise<void> {
+  const { values } = parseArgs({ options: {
+    force: { type: 'boolean', default: false }, profile: { type: 'string', default: 'web' },
+    arch: { type: 'string' },
+  }, allowPositionals: false })
+  const selected = values.force || computerUseSelected(resolveDshHome(), values.profile)
+  if (!selected || process.platform !== 'darwin') return
+  const architecture = values.arch ?? process.arch
+  if (architecture !== 'arm64' && architecture !== 'x64') throw new Error(`build:cua: unsupported architecture ${architecture}`)
+  const ctx = new Context()
+  const controller = new AbortController()
+  const stop = () => { controller.abort() }
+  process.on('SIGINT', stop)
+  process.on('SIGTERM', stop)
+  try {
+    await ctx.plugin(Subprocess)
+    const helper = await buildNativeExecutable({
+      packageRoot: resolve(import.meta.dirname, '../packages/experimental/cua-macos'),
+      architecture, subprocess: ctx.subprocess, signal: controller.signal,
+      timeoutMs: 600_000, graceMs: 3000,
+    })
+    console.log(`build:cua: ready ${helper}`)
+  } finally {
+    try { await ctx.fiber.dispose() } finally {
+      process.removeListener('SIGINT', stop)
+      process.removeListener('SIGTERM', stop)
+    }
+  }
+}
+
+if (import.meta.main) await main()
diff --git a/scripts/build.spec.ts b/scripts/build.spec.ts
index dae111f219..2a5d8aa0ca 100644
--- a/scripts/build.spec.ts
+++ b/scripts/build.spec.ts
@@ -12,7 +12,8 @@ const artifactGraph = {
   'desktop-bundle': ['host-bundle'],
   'client-src': ['desktop-bundle'],
   'client-bundle': ['client-src'],
-  'web': ['client-bundle'],
+  'cua': ['client-bundle'],
+  'web': ['cua'],
 }
 
 function graph(gates: ReturnType<typeof buildGates>): Record<string, string[] | undefined> {
diff --git a/scripts/build.ts b/scripts/build.ts
index b5008c3f85..5728fda122 100644
--- a/scripts/build.ts
+++ b/scripts/build.ts
@@ -69,7 +69,7 @@ export function parseBuildArguments(args: readonly string[]): BuildArguments {
 /**
  * Construct the build steps of one scope as a gate dependency graph.
  * Artifact steps keep the serial order native, Host compilation, Host bundle (Typert),
- * Desktop bundle, Client compilation, Client bundle, then Web. The typecheck scope runs Host
+ * Desktop bundle, Client compilation, Client bundle, configured CUA preparation, then Web. The typecheck scope runs Host
  * compilation beside the bundle-free Typert pass, which reads only source, and then Client
  * compilation, which needs both outputs; it writes no bundle. In the complete and typecheck
  * scopes each aggregate check waits only for its own face's package compilation; alone, the
@@ -94,7 +94,8 @@ export function buildGates(
     for (const step of libraryBuildSteps(root, 'all')) {
       gates.push(libraryGate(step, step.id === 'host-src' ? ['native'] : step.needs, env))
     }
-    gates.push(pnpmGate('web', 'Web build', ['run', 'build:web'], ['client-bundle'], env))
+    gates.push(pnpmGate('cua', 'configured CUA helper', ['run', 'build:cua'], ['client-bundle'], env))
+    gates.push(pnpmGate('web', 'Web build', ['run', 'build:web'], ['cua'], env))
   }
   if (scope === 'typecheck') {
     for (const step of contractSteps(root, 'all')) gates.push(libraryGate(step, step.needs, env))
diff --git a/scripts/check-workspace-constraints.ts b/scripts/check-workspace-constraints.ts
index cf9493a5d2..126b1a5155 100644
--- a/scripts/check-workspace-constraints.ts
+++ b/scripts/check-workspace-constraints.ts
@@ -179,7 +179,7 @@ export function readWorkspaceManifests(repositoryRoot: string): WorkspaceManifes
 
 const packageFileExtras: Readonly<Record<string, readonly string[]>> = {
   // CUA publishes its client API and attributed native source for local macOS builds.
-  '@deepseek-ai/dsh-cua': ['lib/api.js', 'lib/bridge.js', 'lib/native-client.js', 'lib/protocol.js'],
+  '@deepseek-ai/dsh-cua': ['lib/types.js', 'lib/api.js', 'lib/bridge.js', 'lib/native-client.js', 'lib/protocol.js'],
   '@deepseek-ai/dsh-experimental-cua-macos': ['native/bin', 'native/Package.swift', 'native/Sources', 'native/tests/swift', 'native/tests/test_swift.py', 'native/LICENSE.cua-driver', 'native/upstream.json', 'native/README.md', 'native/README.zh.md', 'native/protocol.schema.json'],
   '@deepseek-ai/dsh-webhook-github': ['examples/github-review/cordis.yml', 'examples/github-review/github-ready-review-rule.mjs'],
   // Owned Worker bundles import this public bootstrap before their business entry.
diff --git a/scripts/experimental-package-policy.ts b/scripts/experimental-package-policy.ts
index 466acaed2a..68c63fcd7e 100644
--- a/scripts/experimental-package-policy.ts
+++ b/scripts/experimental-package-policy.ts
@@ -3,6 +3,8 @@
 /** Existing npm names retained by capabilities now housed under experimental/. */
 export const EXPERIMENTAL_PACKAGE_NAME_EXCEPTIONS: Readonly<Record<string, string>> = {
   'packages/experimental/cua': '@deepseek-ai/dsh-cua',
+  'packages/experimental/cua-bundle': '@deepseek-ai/dsh-cua-bundle',
+  'packages/experimental/client-ui-cua': '@deepseek-ai/dsh-client-ui-cua',
   'packages/experimental/tool-session-query': '@deepseek-ai/dsh-tool-session-query',
   'packages/experimental/session-title-all-prompts-llm': '@deepseek-ai/dsh-session-title-all-prompts-llm',
   'packages/experimental/tool-terminal': '@deepseek-ai/dsh-tool-terminal',
diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts
index ebd7527142..b949195b19 100644
--- a/scripts/gen-cordis-catalog.ts
+++ b/scripts/gen-cordis-catalog.ts
@@ -78,6 +78,7 @@ export const SERVICE_PAGE: Record<string, string> = {
   ptcRuntime: 'ptc-runtime.md',
   browserUse: 'browser-use.md',
   computerUse: 'computer-use.md',
+  cuaAccess: 'computer-use.md',
   commands: 'commands.md',
   compaction: 'compaction.md',
   cordisInspect: 'extensions.md',
@@ -323,6 +324,12 @@ export const LINK_MAP: Readonly<Record<string, string>> = {
   InspectOptions: 'boot.md',
   BrowserUseProviderName: 'browser-use.md',
   ComputerUseProviderName: 'computer-use.md',
+  CuaApplicationId: 'computer-use.md',
+  CuaApplicationGrant: 'computer-use.md',
+  CuaPermissionProcess: 'computer-use.md',
+  CuaApplicationState: 'computer-use.md',
+  CuaSystemPermission: 'computer-use.md',
+  CuaSystemPermissionState: 'computer-use.md',
   RenderedDocumentBytes: 'office-to-pdf.md',
   OfficeToPdfRequest: 'office-to-pdf.md',
   OfficeToPdfResult: 'office-to-pdf.md',
diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts
index 69eedf37b2..71c72570dd 100644
--- a/scripts/gen-doc-graphs.ts
+++ b/scripts/gen-doc-graphs.ts
@@ -215,6 +215,11 @@ const SERVICE_ROLES: ServiceRole[] = [
     consumers: ['experimental-computer-use-cua-driver-mcp', 'experimental-computer-use-cua-driver-native'],
     note: 'One provider-owned name per service instance. Each provider also owns its model tools; the service has no common action API, runtime selection, or Session workflow lock.',
   },
+  {
+    key: 'cuaAccess', pkg: 'cua', title: 'Computer Use permission controls',
+    mode: 'core', consumers: ['client-ui-cua'],
+    note: 'The native provider owns application consent and cancellation; the optional Client page queries and changes those decisions through its Remote.',
+  },
   {
     key: 'officeToPdf', pkg: 'office-to-pdf', title: 'Office to PDF conversion',
     mode: 'core', consumers: ['client-ui-sidebar-documentpreview'],
diff --git a/scripts/optional-bundles.spec.ts b/scripts/optional-bundles.spec.ts
index 674919b570..40de24d3d8 100644
--- a/scripts/optional-bundles.spec.ts
+++ b/scripts/optional-bundles.spec.ts
@@ -91,6 +91,9 @@ describe.each(['web', 'desktop'] as const)('%s optional bundle overrides', (surf
 })
 
 describe('optional bundles', () => {
+  it('admits Computer Use only on macOS Hosts', () => {
+    expect(bundles.get('@deepseek-ai/dsh-cua-bundle')?.manifest.dsh?.bundle?.platforms).toEqual(['darwin'])
+  })
   const shipped = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app'].map(name => bundle(name).patches)
 
   it('ships at least one bundle switched off', () => {
diff --git a/scripts/release/families.spec.ts b/scripts/release/families.spec.ts
index 164232eedb..4d1d58455e 100644
--- a/scripts/release/families.spec.ts
+++ b/scripts/release/families.spec.ts
@@ -62,10 +62,12 @@ describe('release families', () => {
       '@deepseek-ai/dsh-experimental-client-ui-agent-team',
       '@deepseek-ai/dsh-experimental-client-ui-claude-code-mods',
       '@deepseek-ai/dsh-experimental-client-ui-cot-translation',
+      '@deepseek-ai/dsh-client-ui-cua',
       '@deepseek-ai/dsh-experimental-client-ui-voice-input',
       '@deepseek-ai/dsh-experimental-computer-use-cua-driver-mcp',
       '@deepseek-ai/dsh-experimental-computer-use-cua-driver-native',
       '@deepseek-ai/dsh-experimental-cot-translation-bundle',
+      '@deepseek-ai/dsh-cua-bundle',
       '@deepseek-ai/dsh-experimental-cua-macos',
       '@deepseek-ai/dsh-cua',
       '@deepseek-ai/dsh-hook-protocol',
diff --git a/scripts/verify-default-product-isolation.spec.ts b/scripts/verify-default-product-isolation.spec.ts
index 1c7f0a9229..9cd21e12d4 100644
--- a/scripts/verify-default-product-isolation.spec.ts
+++ b/scripts/verify-default-product-isolation.spec.ts
@@ -113,15 +113,16 @@ describe('default product isolation', () => {
     expect(verifyDefaultProductIsolation(root).failures).toEqual([])
   })
 
-  it.each([true, false])('ships an optional bundle switched off with legacy icon=%s', (legacy) => {
+  it.each([[true, false], [false, false], [true, true], [false, true]])('ships an optional bundle switched off with legacy icon=%s and metadata=%s', (legacy, declared) => {
     const root = fixture()
-    const layer = '@deepseek-ai/dsh-experimental-layer'
-    write(root, 'packages/experimental/layer/package.json', {
+    const layer = declared ? '@deepseek-ai/dsh-prototype-layer' : '@deepseek-ai/dsh-experimental-layer'
+    const directory = declared ? 'packages/bundle/prototype-layer' : 'packages/experimental/layer'
+    write(root, `${directory}/package.json`, {
       name: layer, ...legacy ? { icon: './icon.svg' } : {},
       exports: { ...legacy ? {} : { './icon': './icon.svg' }, './locale/*.json': './locale/*.json' },
-      dependencies: { [experimental]: 'workspace:^' }, dsh: { bundle: { patch: './cordis.patch.yml' } },
+      dependencies: { [experimental]: 'workspace:^' }, dsh: { bundle: { patch: './cordis.patch.yml', ...declared ? { experimental: true } : {} } },
     })
-    write(root, 'packages/experimental/layer/cordis.patch.yml', [{ insert: [{ name: experimental }] }])
+    write(root, `${directory}/cordis.patch.yml`, [{ insert: [{ name: experimental }] }])
     manifest(root, 'apps/cli/package.json', { dependencies: { [core]: 'workspace:^', [layer]: 'workspace:^' } })
     write(root, profile, `export const PROFILE_TEMPLATES = { web: { bundles: ['${base}'] } }\n`
       + `export const DEFAULT_PROFILE_BUNDLES = ['${base}']\n`
diff --git a/scripts/verify-default-product-isolation.ts b/scripts/verify-default-product-isolation.ts
index 0120368412..66e6c369d4 100644
--- a/scripts/verify-default-product-isolation.ts
+++ b/scripts/verify-default-product-isolation.ts
@@ -107,7 +107,8 @@ export function verifyDefaultProductIsolation(root: string): ProductIsolationRes
   const sources = new Set<string>()
   const configs = new Set<string>()
   let webPluginCount = 0
-  const isExperimental = (pkg: Package): boolean => isExperimentalPackageName(pkg.manifest.name)
+  const isExperimental = (pkg: Package): boolean => pkg.manifest.dsh?.bundle?.experimental === true
+    || isExperimentalPackageName(pkg.manifest.name)
     || display(pkg.directory).startsWith('packages/experimental/')
   const add = (pkg: Package, origin: string): void => {
     if (isExperimental(pkg)) {
diff --git a/scripts/verify-package-readme-model-experience.ts b/scripts/verify-package-readme-model-experience.ts
index 2c313a3dea..bed5aa89d8 100644
--- a/scripts/verify-package-readme-model-experience.ts
+++ b/scripts/verify-package-readme-model-experience.ts
@@ -144,6 +144,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
   'packages/client/ui-permission-presets': { kind: 'indirect', reason: 'The picker submits the host /permission command; the knob events it appends own the model-visible effect through the sandbox/approval consumers.' },
   'packages/client/ui-settings-plugins': { kind: 'none', reason: 'Browser-side settings surface; registers no model surface.' },
   'packages/client/ui-settings-shell': { kind: 'none', reason: 'Browser-side settings surface; registers no model surface.' },
+  'packages/experimental/client-ui-cua': { kind: 'none', reason: 'Browser permission controls; the native provider owns tools and guidance.' },
   'packages/client/ui-settings-session-log': { kind: 'none', reason: 'Browser preference controls request metadata, not model input.' },
   'packages/client/ui-settings-agent-loop': { kind: 'none', reason: 'Browser-side settings surface; registers no model surface.' },
   'packages/client/ui-settings-subagent': { kind: 'none', reason: 'Browser-side settings surface; registers no model surface.' },
diff --git a/snapshots/session/cua-native/consent-fixture.mjs b/snapshots/session/cua-native/consent-fixture.mjs
deleted file mode 100644
index e0b0fe035e..0000000000
--- a/snapshots/session/cua-native/consent-fixture.mjs
+++ /dev/null
@@ -1,14 +0,0 @@
-/** Scripted human consent for the native application replay. */
-import { join } from 'node:path'
-import { startFixtureHost } from './fixture-host.mjs'
-export const name = 'cua-consent-fixture'
-export const inject = ['userQuestions']
-
-/** Answer through the existing human-question service while native dispatch stays real. */
-export async function apply(ctx) {
-  const close = await startFixtureHost(join(process.cwd(), 'native-helper.mjs'))
-  ctx.effect(() => close)
-  ctx.on('user-questions/request', async request => ({ answers: request.questions.map(question => ({
-    id: question.id, selected: ['Allow for this task'],
-  })) }))
-}
diff --git a/snapshots/session/cua-native/cordis.snapshot.yml b/snapshots/session/cua-native/cordis.snapshot.yml
index f6708af93d..958f41ca53 100644
--- a/snapshots/session/cua-native/cordis.snapshot.yml
+++ b/snapshots/session/cua-native/cordis.snapshot.yml
@@ -50,11 +50,13 @@
     - id: cua-native
       name: '@deepseek-ai/dsh-experimental-cua-macos'
       config:
+        agentPreset: false
         helperPath: !!js process.cwd() + '/native-helper.mjs'
+        allowedApps: [{"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app"}]
 
 - id: user-questions
   name: '@deepseek-ai/dsh-user-questions'
 
 - insert:
-    - id: cua-consent-fixture
-      name: './consent-fixture.mjs'
+    - id: cua-permission-fixture
+      name: './permission-fixture.mjs'
diff --git a/snapshots/session/cua-native/cordis.yml b/snapshots/session/cua-native/cordis.yml
index b60d7872d4..c25eadc41d 100644
--- a/snapshots/session/cua-native/cordis.yml
+++ b/snapshots/session/cua-native/cordis.yml
@@ -32,11 +32,13 @@
     - id: cua-native
       name: '@deepseek-ai/dsh-experimental-cua-macos'
       config:
+        agentPreset: false
         helperPath: !!js process.cwd() + '/native-helper.mjs'
+        allowedApps: [{"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app"}]
 
 - id: user-questions
   name: '@deepseek-ai/dsh-user-questions'
 
 - insert:
-    - id: cua-consent-fixture
-      name: './consent-fixture.mjs'
+    - id: cua-permission-fixture
+      name: './permission-fixture.mjs'
diff --git a/snapshots/session/cua-native/permission-fixture.mjs b/snapshots/session/cua-native/permission-fixture.mjs
new file mode 100644
index 0000000000..e1580ceedc
--- /dev/null
+++ b/snapshots/session/cua-native/permission-fixture.mjs
@@ -0,0 +1,23 @@
+/** Scripted human answers and a permission-page revocation in the recorded CUA scenario. */
+import { join } from 'node:path'
+import { startFixtureHost } from './fixture-host.mjs'
+export const name = 'cua-permission-fixture'
+export const inject = ['userQuestions', 'cuaAccess', 'tools']
+
+/** Supply external human decisions while retaining the real permission policy and tool pipeline. */
+export async function apply(ctx) {
+  const close = await startFixtureHost(join(process.cwd(), 'native-helper.mjs'))
+  ctx.effect(() => close)
+  ctx.on('user-questions/request', async (request) => ({ answers: request.questions.map(question => ({
+    id: question.id,
+    selected: [question.question.includes('Denied Fixture') ? 'Deny' : 'Allow for this session'],
+  })) }))
+  ctx.on('tools/post-execute', async (execution, _result, next) => {
+    const decision = await next()
+    if (execution.name === 'cua' && execution.arguments.method === 'getApp'
+      && execution.arguments.params.selector === 'Revocable Fixture') {
+      await ctx.cuaAccess.revoke('c'.repeat(64))
+    }
+    return decision
+  })
+}
diff --git a/snapshots/session/cua-native/replay.override.json b/snapshots/session/cua-native/replay.override.json
index 916561a389..57e1373f80 100644
--- a/snapshots/session/cua-native/replay.override.json
+++ b/snapshots/session/cua-native/replay.override.json
@@ -32,6 +32,105 @@
       }
     ]
   },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-unauthorized-getState",
+          "name": "cua",
+          "arguments": "{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\"}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-unauthorized-screenshot",
+          "name": "cua",
+          "arguments": "{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-unauthorized-click",
+          "name": "cua",
+          "arguments": "{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
   {
     "kind": "chunks",
     "chunks": [
@@ -1616,6 +1715,105 @@
       }
     ]
   },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-consent-denied",
+          "name": "cua",
+          "arguments": "{\"method\":\"getApp\",\"params\":{\"selector\":\"Denied Fixture\"}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-consent-revocable",
+          "name": "cua",
+          "arguments": "{\"method\":\"getApp\",\"params\":{\"selector\":\"Revocable Fixture\"}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
+  {
+    "kind": "chunks",
+    "chunks": [
+      {
+        "type": "block-start",
+        "index": 0,
+        "blockType": "tool-call"
+      },
+      {
+        "type": "block-end",
+        "index": 0,
+        "block": {
+          "type": "tool-call",
+          "id": "cua-consent-revoked",
+          "name": "cua",
+          "arguments": "{\"method\":\"getState\",\"params\":{\"appHandle\":\"revoked-app\"}}"
+        }
+      },
+      {
+        "type": "usage",
+        "usage": {
+          "inputTokens": 3,
+          "outputTokens": 3
+        }
+      },
+      {
+        "type": "finish",
+        "reason": {
+          "kind": "tool-calls"
+        }
+      }
+    ]
+  },
   {
     "kind": "chunks",
     "chunks": [
diff --git a/snapshots/session/cua-native/session.v4.jsonl b/snapshots/session/cua-native/session.v4.jsonl
index b608bb43c4..2b978c0888 100644
--- a/snapshots/session/cua-native/session.v4.jsonl
+++ b/snapshots/session/cua-native/session.v4.jsonl
@@ -2,261 +2,291 @@
 {"type":"permission/preset","data":{"preset":"danger-full-access"}}
 {"type":"sandbox/mode","data":{"mode":"danger-full-access"}}
 {"type":"approval/policy","data":{"policy":"never"}}
-{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Inspect CUA capabilities, select the Fixture application, increment its counter once, then read fresh state and capture the window. Also inspect the AXless canvas window: capture it, dispatch one coordinate click at [20,20], and read its fresh empty AX state."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"}]}}
+{"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"inserted":[{"content":[{"type":"text","text":"Inspect CUA capabilities, select the Fixture application, increment its counter once, then read fresh state and capture the window. Also inspect the AXless canvas window: capture it, dispatch one coordinate click at [20,20], and read its fresh empty AX state. Finally verify a denied application selection and refusal of a handle after application access is revoked."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"}]}}
 {"type":"turn/start","data":{"turn":1}}
 {"type":"agent/inbox/spliced","data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
 {"type":"step/start","data":{"turn":1,"step":1}}
 {"type":"system/message","data":{"turn":1,"step":1,"message":{"role":"system","content":[{"type":"text","text":"{{system}}"}],"source":{"kind":"system-prompt"},"id":"{{message:2}}"}},"surfaceOp":"append"}
-{"type":"user/message","data":{"content":[{"type":"text","text":"Inspect CUA capabilities, select the Fixture application, increment its counter once, then read fresh state and capture the window. Also inspect the AXless canvas window: capture it, dispatch one coordinate click at [20,20], and read its fresh empty AX state."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
+{"type":"user/message","data":{"content":[{"type":"text","text":"Inspect CUA capabilities, select the Fixture application, increment its counter once, then read fresh state and capture the window. Also inspect the AXless canvas window: capture it, dispatch one coordinate click at [20,20], and read its fresh empty AX state. Finally verify a denied application selection and refusal of a handle after application access is revoked."}],"source":{"kind":"user"},"role":"user","id":"{{message:1}}"},"surfaceOp":"append"}
 {"type":"user/message","data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent working directory: \"{{cwd}}\".\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"runtime-context","form":"snapshot","sections":[{"name":"working-directory:current","text":"Current working directory: \"{{cwd}}\"."},{"name":"sandbox:policy","text":"Current DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations."},{"name":"approval:policy","text":"Approval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}]},"role":"user","id":"{{message:3}}"},"surfaceOp":"append"}
 {"type":"request/header","data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"tools":"{{tools}}"},"reason":"initial"}}
 {"type":"request/context","data":{"provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"}}
 {"type":"session/title","data":{"title":"Inspect CUA capabilities, select the","messageSeqs":[8],"source":{"kind":"fallback"}}}
-{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-1","name":"cua","arguments":"{\"method\":\"getCapabilities\",\"params\":{}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:4}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554024,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554025,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-1","name":"cua","arguments":"{\"method\":\"getCapabilities\",\"params\":{}}"}}},{"type":"chunk","time":1791947554025,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554025,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":1,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-1","name":"cua","arguments":"{\"method\":\"getCapabilities\",\"params\":{}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:4}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947688973,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947688973,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-1","name":"cua","arguments":"{\"method\":\"getCapabilities\",\"params\":{}}"}}},{"type":"chunk","time":1791947688973,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947688973,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
 {"type":"tool/call","data":{"turn":1,"step":1,"callId":"cua-native-1","name":"cua","arguments":"{\"method\":\"getCapabilities\",\"params\":{}}"}}
 {"type":"tool/result","data":{"turn":1,"step":1,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-1"},"toolCallId":"cua-native-1","content":[{"type":"text","text":"{\"platform\":\"macos\",\"sessionLocked\":false,\"permissions\":{\"accessibility\":true,\"screenRecording\":true},\"methods\":[\"getCapabilities\",\"listApps\",\"getApp\",\"activate\",\"show\",\"listWindows\",\"getState\",\"hover\",\"click\",\"setValue\",\"typeText\",\"paste\",\"pressKey\",\"scroll\",\"drag\",\"screenshot\"],\"coordinateSpace\":\"screenshot-pixels\",\"browser\":false}"}],"isError":false,"id":"{{message:5}}"}},"sourceEventSeqs":[14],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":1}}
 {"type":"step/start","data":{"turn":1,"step":2}}
-{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:6}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554613,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554614,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}}},{"type":"chunk","time":1791947554614,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554614,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":2,"callId":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-2"},"toolCallId":"cua-native-2","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"name\":\"Fixture\",\"bundleId\":\"test.fixture\"}"}],"isError":false,"id":"{{message:7}}"}},"sourceEventSeqs":[19],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":2,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-unauthorized-getState","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:6}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689573,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689573,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-unauthorized-getState","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947689573,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689573,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":2,"callId":"cua-unauthorized-getState","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":2,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-unauthorized-getState"},"toolCallId":"cua-unauthorized-getState","content":[{"type":"text","text":"Error: APP_ACCESS_REQUIRED: Select the application with getApp and obtain user consent before reading or controlling it"}],"isError":true,"id":"{{message:7}}"}},"sourceEventSeqs":[19],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":2}}
 {"type":"step/start","data":{"turn":1,"step":3}}
-{"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:8}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554635,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554635,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}}},{"type":"chunk","time":1791947554635,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554635,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":3,"callId":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":3,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-3"},"toolCallId":"cua-native-3","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-1\",\"tree\":\"AX scope=window offsets=UTF-16 bounds=global-points\\n- [0] AXButton \\\"Increment\\\" id=\\\"increment\\\" actions=[\\\"AXPress\\\"] bounds=[60,80,100,20]\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 0\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\n  - [3] AXMenuItem \\\"Fixture command\\\"\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:9}}"}},"sourceEventSeqs":[24],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":3,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-unauthorized-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:8}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689596,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689596,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-unauthorized-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947689596,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689596,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":3,"callId":"cua-unauthorized-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":3,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-unauthorized-screenshot"},"toolCallId":"cua-unauthorized-screenshot","content":[{"type":"text","text":"Error: APP_ACCESS_REQUIRED: Select the application with getApp and obtain user consent before reading or controlling it"}],"isError":true,"id":"{{message:9}}"}},"sourceEventSeqs":[24],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":3}}
 {"type":"step/start","data":{"turn":1,"step":4}}
-{"type":"assistant/message","data":{"turn":1,"step":4,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:10}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554651,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554651,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947554651,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554651,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":4,"callId":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":4,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-4"},"toolCallId":"cua-native-4","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:11}}"}},"sourceEventSeqs":[29],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":4,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-unauthorized-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:10}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689615,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689615,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-unauthorized-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947689615,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689615,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":4,"callId":"cua-unauthorized-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":4,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-unauthorized-click"},"toolCallId":"cua-unauthorized-click","content":[{"type":"text","text":"Error: APP_ACCESS_REQUIRED: Select the application with getApp and obtain user consent before reading or controlling it"}],"isError":true,"id":"{{message:11}}"}},"sourceEventSeqs":[29],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":4}}
 {"type":"step/start","data":{"turn":1,"step":5}}
-{"type":"assistant/message","data":{"turn":1,"step":5,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:12}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554667,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554667,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554667,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554667,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":5,"callId":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":5,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-5"},"toolCallId":"cua-native-5","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-2\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 1\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:13}}"}},"sourceEventSeqs":[34],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":5,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:12}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689634,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689634,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}}},{"type":"chunk","time":1791947689634,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689634,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":5,"callId":"cua-native-2","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"test.fixture\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":5,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-2"},"toolCallId":"cua-native-2","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"name\":\"Fixture\",\"bundleId\":\"test.fixture\"}"}],"isError":false,"id":"{{message:13}}"}},"sourceEventSeqs":[34],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":5}}
 {"type":"step/start","data":{"turn":1,"step":6}}
-{"type":"assistant/message","data":{"turn":1,"step":6,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:14}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554684,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554684,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554684,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554684,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":6,"callId":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":6,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-6"},"toolCallId":"cua-native-6","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:15}}"}},"sourceEventSeqs":[39],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":6,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:14}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689657,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689657,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}}},{"type":"chunk","time":1791947689657,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689657,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":6,"callId":"cua-native-3","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"includeMenus\":true,\"details\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":6,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-3"},"toolCallId":"cua-native-3","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-1\",\"tree\":\"AX scope=window offsets=UTF-16 bounds=global-points\\n- [0] AXButton \\\"Increment\\\" id=\\\"increment\\\" actions=[\\\"AXPress\\\"] bounds=[60,80,100,20]\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 0\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\n  - [3] AXMenuItem \\\"Fixture command\\\"\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:15}}"}},"sourceEventSeqs":[39],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":6}}
 {"type":"step/start","data":{"turn":1,"step":7}}
-{"type":"assistant/message","data":{"turn":1,"step":7,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:16}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554733,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554733,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947554733,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554733,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":7,"callId":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":7,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-7"},"toolCallId":"cua-native-7","content":[{"type":"text","text":"[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true},{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}]"}],"isError":false,"id":"{{message:17}}"}},"sourceEventSeqs":[44],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":7,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:16}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689683,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689683,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947689683,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689683,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":7,"callId":"cua-native-4","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-1\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":7,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-4"},"toolCallId":"cua-native-4","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:17}}"}},"sourceEventSeqs":[44],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":7}}
 {"type":"step/start","data":{"turn":1,"step":8}}
-{"type":"assistant/message","data":{"turn":1,"step":8,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:18}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554749,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554749,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947554749,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554749,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":8,"callId":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
-{"type":"tool/result","data":{"turn":1,"step":8,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-8"},"toolCallId":"cua-native-8","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"tree\":\"\",\"windows\":[{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:19}}"}},"sourceEventSeqs":[49],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":8,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:18}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689706,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689706,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947689706,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689706,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":8,"callId":"cua-native-5","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":8,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-5"},"toolCallId":"cua-native-5","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-2\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 1\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:19}}"}},"sourceEventSeqs":[49],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":8}}
 {"type":"step/start","data":{"turn":1,"step":9}}
-{"type":"assistant/message","data":{"turn":1,"step":9,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:20}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554765,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554765,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947554765,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554765,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":9,"callId":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
-{"type":"tool/result","data":{"turn":1,"step":9,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-9"},"toolCallId":"cua-native-9","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":8,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:21}}"}},"sourceEventSeqs":[54],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":9,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:20}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689729,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689729,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947689729,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689729,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":9,"callId":"cua-native-6","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":9,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-6"},"toolCallId":"cua-native-6","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:21}}"}},"sourceEventSeqs":[54],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":9}}
 {"type":"step/start","data":{"turn":1,"step":10}}
-{"type":"assistant/message","data":{"turn":1,"step":10,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:22}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554791,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554791,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}}},{"type":"chunk","time":1791947554791,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554791,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":10,"callId":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":10,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-10"},"toolCallId":"cua-native-10","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:23}}"}},"sourceEventSeqs":[59],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":10,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:22}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689792,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689792,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947689792,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689792,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":10,"callId":"cua-native-7","name":"cua","arguments":"{\"method\":\"listWindows\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":10,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-7"},"toolCallId":"cua-native-7","content":[{"type":"text","text":"[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true},{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}]"}],"isError":false,"id":"{{message:23}}"}},"sourceEventSeqs":[59],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":10}}
 {"type":"step/start","data":{"turn":1,"step":11}}
-{"type":"assistant/message","data":{"turn":1,"step":11,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:24}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554807,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554807,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947554807,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554807,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":11,"callId":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
-{"type":"tool/result","data":{"turn":1,"step":11,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-11"},"toolCallId":"cua-native-11","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"tree\":\"\",\"windows\":[{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:25}}"}},"sourceEventSeqs":[64],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":11,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:24}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689834,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689834,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947689834,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689834,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":11,"callId":"cua-native-8","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
+{"type":"tool/result","data":{"turn":1,"step":11,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-8"},"toolCallId":"cua-native-8","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"tree\":\"\",\"windows\":[{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:25}}"}},"sourceEventSeqs":[64],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":11}}
 {"type":"step/start","data":{"turn":1,"step":12}}
-{"type":"assistant/message","data":{"turn":1,"step":12,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:26}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554823,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554823,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554823,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554823,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":12,"callId":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":12,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-show"},"toolCallId":"cua-native-show","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"windowId\":7,\"foregroundChanged\":false}"}],"isError":false,"id":"{{message:27}}"}},"sourceEventSeqs":[69],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":12,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:26}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689861,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689861,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947689861,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689861,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":12,"callId":"cua-native-9","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
+{"type":"tool/result","data":{"turn":1,"step":12,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-9"},"toolCallId":"cua-native-9","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":8,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:27}}"}},"sourceEventSeqs":[69],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":12}}
 {"type":"step/start","data":{"turn":1,"step":13}}
-{"type":"assistant/message","data":{"turn":1,"step":13,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:28}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554839,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554839,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947554839,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554839,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":13,"callId":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":13,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-activate-first"},"toolCallId":"cua-native-activate-first","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-native-activate-first\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":42,\"focusedWindowId\":7,\"frontWindowId\":99,\"frontWindowPid\":42},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":true,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:29}}"}},"sourceEventSeqs":[74],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":13,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:28}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689896,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689896,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}}},{"type":"chunk","time":1791947689896,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689896,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":13,"callId":"cua-native-10","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-3\",\"x\":0,\"y\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":13,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-10"},"toolCallId":"cua-native-10","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:29}}"}},"sourceEventSeqs":[74],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":13}}
 {"type":"step/start","data":{"turn":1,"step":14}}
-{"type":"assistant/message","data":{"turn":1,"step":14,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:30}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554856,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554856,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947554856,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554856,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":14,"callId":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":14,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-activate-repeat"},"toolCallId":"cua-native-activate-repeat","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-native-activate-repeat\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":false,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:31}}"}},"sourceEventSeqs":[79],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":14,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:30}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689918,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689918,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}},{"type":"chunk","time":1791947689918,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689918,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":14,"callId":"cua-native-11","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8}}"}}
+{"type":"tool/result","data":{"turn":1,"step":14,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-11"},"toolCallId":"cua-native-11","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"tree\":\"\",\"windows\":[{\"windowId\":8,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"AXless canvas\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:31}}"}},"sourceEventSeqs":[79],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":14}}
 {"type":"step/start","data":{"turn":1,"step":15}}
-{"type":"assistant/message","data":{"turn":1,"step":15,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:32}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554872,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554872,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}}},{"type":"chunk","time":1791947554872,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554872,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":15,"callId":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":15,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-transition"},"toolCallId":"cua-native-transition","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:33}}"}},"sourceEventSeqs":[84],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":15,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:32}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689940,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689940,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947689940,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689940,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":15,"callId":"cua-native-show","name":"cua","arguments":"{\"method\":\"show\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":15,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-show"},"toolCallId":"cua-native-show","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"windowId\":7,\"foregroundChanged\":false}"}],"isError":false,"id":"{{message:33}}"}},"sourceEventSeqs":[84],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":15}}
 {"type":"step/start","data":{"turn":1,"step":16}}
-{"type":"assistant/message","data":{"turn":1,"step":16,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:34}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554888,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554888,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554888,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554888,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":16,"callId":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":16,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-stale-read"},"toolCallId":"cua-native-stale-read","content":[{"type":"text","text":"Error: STALE_SNAPSHOT: Accessibility tree changed during observation; read fresh getAXState"}],"isError":true,"id":"{{message:35}}"}},"sourceEventSeqs":[89],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":16,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:34}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689961,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689961,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947689961,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689961,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":16,"callId":"cua-native-activate-first","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":16,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-activate-first"},"toolCallId":"cua-native-activate-first","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-native-activate-first\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":42,\"focusedWindowId\":7,\"frontWindowId\":99,\"frontWindowPid\":42},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":true,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:35}}"}},"sourceEventSeqs":[89],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":16}}
 {"type":"step/start","data":{"turn":1,"step":17}}
-{"type":"assistant/message","data":{"turn":1,"step":17,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:36}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554904,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554904,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947554904,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554904,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":17,"callId":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":17,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-stale-index"},"toolCallId":"cua-native-stale-index","content":[{"type":"text","text":"Error: STALE_SNAPSHOT: Read fresh state before acting"}],"isError":true,"id":"{{message:37}}"}},"sourceEventSeqs":[94],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":17,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:36}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947689983,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947689983,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947689983,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947689983,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":17,"callId":"cua-native-activate-repeat","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":17,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-activate-repeat"},"toolCallId":"cua-native-activate-repeat","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-native-activate-repeat\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":false,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:37}}"}},"sourceEventSeqs":[94],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":17}}
 {"type":"step/start","data":{"turn":1,"step":18}}
-{"type":"assistant/message","data":{"turn":1,"step":18,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:38}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554920,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554920,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}}},{"type":"chunk","time":1791947554920,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554920,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":18,"callId":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":18,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-other-window"},"toolCallId":"cua-native-other-window","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:39}}"}},"sourceEventSeqs":[99],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":18,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:38}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690002,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690002,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}}},{"type":"chunk","time":1791947690002,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690002,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":18,"callId":"cua-native-transition","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"Return\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":18,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-transition"},"toolCallId":"cua-native-transition","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:39}}"}},"sourceEventSeqs":[99],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":18}}
 {"type":"step/start","data":{"turn":1,"step":19}}
-{"type":"assistant/message","data":{"turn":1,"step":19,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:40}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554936,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554936,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554936,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554936,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":19,"callId":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":19,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-fresh-read"},"toolCallId":"cua-native-fresh-read","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-5\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 1\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:41}}"}},"sourceEventSeqs":[104],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":19,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:40}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690019,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690019,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690019,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690019,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":19,"callId":"cua-native-stale-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":19,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-stale-read"},"toolCallId":"cua-native-stale-read","content":[{"type":"text","text":"Error: STALE_SNAPSHOT: Accessibility tree changed during observation; read fresh getAXState"}],"isError":true,"id":"{{message:41}}"}},"sourceEventSeqs":[104],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":19}}
 {"type":"step/start","data":{"turn":1,"step":20}}
-{"type":"assistant/message","data":{"turn":1,"step":20,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:42}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554954,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554954,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947554954,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554954,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":20,"callId":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":20,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-fresh-click"},"toolCallId":"cua-native-fresh-click","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:43}}"}},"sourceEventSeqs":[109],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":20,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:42}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690040,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690040,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947690040,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690040,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":20,"callId":"cua-native-stale-index","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-2\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":20,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-stale-index"},"toolCallId":"cua-native-stale-index","content":[{"type":"text","text":"Error: STALE_SNAPSHOT: Read fresh state before acting"}],"isError":true,"id":"{{message:43}}"}},"sourceEventSeqs":[109],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":20}}
 {"type":"step/start","data":{"turn":1,"step":21}}
-{"type":"assistant/message","data":{"turn":1,"step":21,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:44}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554970,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554970,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947554970,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554970,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":21,"callId":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":21,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-verify"},"toolCallId":"cua-native-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-6\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 2\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:45}}"}},"sourceEventSeqs":[114],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":21,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:44}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690064,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690064,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}}},{"type":"chunk","time":1791947690064,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690064,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":21,"callId":"cua-native-other-window","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":8,\"snapshotId\":\"fixture-snapshot-4\",\"x\":0,\"y\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":21,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-other-window"},"toolCallId":"cua-native-other-window","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:45}}"}},"sourceEventSeqs":[114],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":21}}
 {"type":"step/start","data":{"turn":1,"step":22}}
-{"type":"assistant/message","data":{"turn":1,"step":22,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:46}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947554987,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947554987,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947554987,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947554987,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":22,"callId":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
-{"type":"tool/result","data":{"turn":1,"step":22,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-observe"},"toolCallId":"cua-native-geometry-observe","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 2\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":9,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"Transformed window\",\"bounds\":{\"x\":16,\"y\":512,\"width\":131,\"height\":145},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:47}}"}},"sourceEventSeqs":[119],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":22,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:46}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690087,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690087,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690087,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690087,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":22,"callId":"cua-native-fresh-read","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":22,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-fresh-read"},"toolCallId":"cua-native-fresh-read","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-5\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 1\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:47}}"}},"sourceEventSeqs":[119],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":22}}
 {"type":"step/start","data":{"turn":1,"step":23}}
-{"type":"assistant/message","data":{"turn":1,"step":23,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:48}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555003,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555003,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947555003,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555003,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":23,"callId":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
-{"type":"tool/result","data":{"turn":1,"step":23,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-capture"},"toolCallId":"cua-native-geometry-capture","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:49}}"}},"sourceEventSeqs":[124],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":23,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:48}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690111,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690111,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947690111,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690111,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":23,"callId":"cua-native-fresh-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-5\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":23,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-fresh-click"},"toolCallId":"cua-native-fresh-click","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:49}}"}},"sourceEventSeqs":[124],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":23}}
 {"type":"step/start","data":{"turn":1,"step":24}}
-{"type":"assistant/message","data":{"turn":1,"step":24,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:50}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555020,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555020,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}}},{"type":"chunk","time":1791947555020,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555020,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":24,"callId":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":24,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-click"},"toolCallId":"cua-native-geometry-click","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:51}}"}},"sourceEventSeqs":[129],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":24,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:50}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690141,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690141,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690141,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690141,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":24,"callId":"cua-native-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":24,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-verify"},"toolCallId":"cua-native-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-6\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 2\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:51}}"}},"sourceEventSeqs":[129],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":24}}
 {"type":"step/start","data":{"turn":1,"step":25}}
-{"type":"assistant/message","data":{"turn":1,"step":25,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:52}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555037,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555037,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}}},{"type":"chunk","time":1791947555037,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555037,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":25,"callId":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":25,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-scroll"},"toolCallId":"cua-native-geometry-scroll","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:53}}"}},"sourceEventSeqs":[134],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":25,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:52}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690162,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690162,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947690162,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690162,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":25,"callId":"cua-native-geometry-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
+{"type":"tool/result","data":{"turn":1,"step":25,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-observe"},"toolCallId":"cua-native-geometry-observe","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 2\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":9,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"Transformed window\",\"bounds\":{\"x\":16,\"y\":512,\"width\":131,\"height\":145},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:53}}"}},"sourceEventSeqs":[134],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":25}}
 {"type":"step/start","data":{"turn":1,"step":26}}
-{"type":"assistant/message","data":{"turn":1,"step":26,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:54}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555054,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555054,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}}},{"type":"chunk","time":1791947555054,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555054,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":26,"callId":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":26,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-drag"},"toolCallId":"cua-native-geometry-drag","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:55}}"}},"sourceEventSeqs":[139],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":26,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:54}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690186,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690186,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947690186,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690186,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":26,"callId":"cua-native-geometry-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
+{"type":"tool/result","data":{"turn":1,"step":26,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-capture"},"toolCallId":"cua-native-geometry-capture","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:55}}"}},"sourceEventSeqs":[139],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":26}}
 {"type":"step/start","data":{"turn":1,"step":27}}
-{"type":"assistant/message","data":{"turn":1,"step":27,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:56}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555071,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555071,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947555071,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555071,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":27,"callId":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":27,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-ax"},"toolCallId":"cua-native-geometry-ax","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:57}}"}},"sourceEventSeqs":[144],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":27,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:56}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690221,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690221,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}}},{"type":"chunk","time":1791947690221,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690221,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":27,"callId":"cua-native-geometry-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"snapshotId\":\"fixture-snapshot-7\",\"x\":20,\"y\":20,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":27,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-click"},"toolCallId":"cua-native-geometry-click","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:57}}"}},"sourceEventSeqs":[144],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":27}}
 {"type":"step/start","data":{"turn":1,"step":28}}
-{"type":"assistant/message","data":{"turn":1,"step":28,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:58}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555087,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555087,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947555087,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555087,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":28,"callId":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
-{"type":"tool/result","data":{"turn":1,"step":28,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-verify"},"toolCallId":"cua-native-geometry-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":9,\"snapshotId\":\"fixture-snapshot-8\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":9,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"Transformed window\",\"bounds\":{\"x\":16,\"y\":512,\"width\":131,\"height\":145},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:59}}"}},"sourceEventSeqs":[149],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":28,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:58}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690248,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690248,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}}},{"type":"chunk","time":1791947690248,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690248,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":28,"callId":"cua-native-geometry-scroll","name":"cua","arguments":"{\"method\":\"scroll\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"x\":20,\"y\":20,\"deltaLinesX\":0,\"deltaLinesY\":-1,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":28,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-scroll"},"toolCallId":"cua-native-geometry-scroll","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:59}}"}},"sourceEventSeqs":[149],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":28}}
 {"type":"step/start","data":{"turn":1,"step":29}}
-{"type":"assistant/message","data":{"turn":1,"step":29,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:60}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555103,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555103,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}}},{"type":"chunk","time":1791947555103,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555103,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":29,"callId":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":29,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy-arm"},"toolCallId":"cua-capture-busy-arm","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:61}}"}},"sourceEventSeqs":[154],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":29,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:60}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690267,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690267,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}}},{"type":"chunk","time":1791947690267,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690267,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":29,"callId":"cua-native-geometry-drag","name":"cua","arguments":"{\"method\":\"drag\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9,\"fromX\":20,\"fromY\":20,\"toX\":30,\"toY\":30,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":29,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-drag"},"toolCallId":"cua-native-geometry-drag","content":[{"type":"text","text":"Error: WINDOW_CHANGED: Window display and accessibility bounds disagree. Read fresh state; if unchanged, use AX actions or explicitly restore the window before capture or coordinate input"}],"isError":true,"id":"{{message:61}}"}},"sourceEventSeqs":[154],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":29}}
 {"type":"step/start","data":{"turn":1,"step":30}}
-{"type":"assistant/message","data":{"turn":1,"step":30,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:62}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555120,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555120,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555120,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555120,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":30,"callId":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":30,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy"},"toolCallId":"cua-capture-busy","content":[{"type":"text","text":"Error: CAPTURE_BUSY: A previous system capture is still pending; other native operations remain available\nScreenshot diagnostics:\n[cua-screenshot] {\"requestId\":\"cua-capture-busy\",\"stage\":\"helper.failed\",\"elapsedMs\":1,\"errorCode\":\"CAPTURE_BUSY\"}"}],"isError":true,"id":"{{message:63}}"}},"sourceEventSeqs":[159],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":30,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:62}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690294,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690294,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947690294,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690294,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":30,"callId":"cua-native-geometry-ax","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-7\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":30,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-ax"},"toolCallId":"cua-native-geometry-ax","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:63}}"}},"sourceEventSeqs":[159],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":30}}
 {"type":"step/start","data":{"turn":1,"step":31}}
-{"type":"assistant/message","data":{"turn":1,"step":31,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:64}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555141,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555141,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555141,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555141,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":31,"callId":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":31,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy-ax"},"toolCallId":"cua-capture-busy-ax","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-9\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:65}}"}},"sourceEventSeqs":[164],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":31,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:64}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690314,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690314,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}},{"type":"chunk","time":1791947690314,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690314,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":31,"callId":"cua-native-geometry-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":9}}"}}
+{"type":"tool/result","data":{"turn":1,"step":31,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-native-geometry-verify"},"toolCallId":"cua-native-geometry-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":9,\"snapshotId\":\"fixture-snapshot-8\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":9,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"Transformed window\",\"bounds\":{\"x\":16,\"y\":512,\"width\":131,\"height\":145},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:65}}"}},"sourceEventSeqs":[164],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":31}}
 {"type":"step/start","data":{"turn":1,"step":32}}
-{"type":"assistant/message","data":{"turn":1,"step":32,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:66}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555157,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555157,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}}},{"type":"chunk","time":1791947555157,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555157,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":32,"callId":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":32,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-callback"},"toolCallId":"cua-capture-callback","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:67}}"}},"sourceEventSeqs":[169],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":32,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:66}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690340,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690340,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}}},{"type":"chunk","time":1791947690340,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690340,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":32,"callId":"cua-capture-busy-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F11\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":32,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy-arm"},"toolCallId":"cua-capture-busy-arm","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:67}}"}},"sourceEventSeqs":[169],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":32}}
 {"type":"step/start","data":{"turn":1,"step":33}}
-{"type":"assistant/message","data":{"turn":1,"step":33,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:68}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555173,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555173,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555173,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555173,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":33,"callId":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":33,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-recovered"},"toolCallId":"cua-capture-recovered","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:69}}"}},"sourceEventSeqs":[174],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":33,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:68}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690365,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690365,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690365,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690365,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":33,"callId":"cua-capture-busy","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":33,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy"},"toolCallId":"cua-capture-busy","content":[{"type":"text","text":"Error: CAPTURE_BUSY: A previous system capture is still pending; other native operations remain available\nScreenshot diagnostics:\n[cua-screenshot] {\"requestId\":\"cua-capture-busy\",\"stage\":\"helper.failed\",\"elapsedMs\":1,\"errorCode\":\"CAPTURE_BUSY\"}"}],"isError":true,"id":"{{message:69}}"}},"sourceEventSeqs":[174],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":33}}
 {"type":"step/start","data":{"turn":1,"step":34}}
-{"type":"assistant/message","data":{"turn":1,"step":34,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:70}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555199,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555199,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947555199,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555199,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":34,"callId":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}}
-{"type":"tool/result","data":{"turn":1,"step":34,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-enter"},"toolCallId":"cua-hover-enter","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:71}}"}},"sourceEventSeqs":[179],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":34,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:70}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690394,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690394,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690394,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690394,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":34,"callId":"cua-capture-busy-ax","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":34,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-busy-ax"},"toolCallId":"cua-capture-busy-ax","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-9\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:71}}"}},"sourceEventSeqs":[179],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":34}}
 {"type":"step/start","data":{"turn":1,"step":35}}
-{"type":"assistant/message","data":{"turn":1,"step":35,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:72}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555215,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555215,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555215,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555216,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":35,"callId":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":35,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-observe"},"toolCallId":"cua-hover-observe","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- AXStaticText \\\"Hover information\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:73}}"}},"sourceEventSeqs":[184],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":35,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:72}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690414,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690414,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}}},{"type":"chunk","time":1791947690414,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690414,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":35,"callId":"cua-capture-callback","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F10\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":35,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-callback"},"toolCallId":"cua-capture-callback","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:73}}"}},"sourceEventSeqs":[184],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":35}}
 {"type":"step/start","data":{"turn":1,"step":36}}
-{"type":"assistant/message","data":{"turn":1,"step":36,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:74}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555231,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555231,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555231,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555231,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":36,"callId":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":36,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-capture"},"toolCallId":"cua-hover-capture","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:75}}"}},"sourceEventSeqs":[189],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":36,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:74}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690434,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690434,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690434,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690434,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":36,"callId":"cua-capture-recovered","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":36,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-capture-recovered"},"toolCallId":"cua-capture-recovered","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:75}}"}},"sourceEventSeqs":[189],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":36}}
 {"type":"step/start","data":{"turn":1,"step":37}}
-{"type":"assistant/message","data":{"turn":1,"step":37,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:76}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555256,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555256,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947555256,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555256,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":37,"callId":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":37,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-popup"},"toolCallId":"cua-hover-popup","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:77}}"}},"sourceEventSeqs":[194],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":37,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:76}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690466,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690466,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}}},{"type":"chunk","time":1791947690466,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690466,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":37,"callId":"cua-hover-enter","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"snapshotId\":\"fixture-snapshot-9\",\"elementIndex\":0}}"}}
+{"type":"tool/result","data":{"turn":1,"step":37,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-enter"},"toolCallId":"cua-hover-enter","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:77}}"}},"sourceEventSeqs":[194],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":37}}
 {"type":"step/start","data":{"turn":1,"step":38}}
-{"type":"assistant/message","data":{"turn":1,"step":38,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:78}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555273,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555273,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947555273,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555273,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":38,"callId":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":38,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-click"},"toolCallId":"cua-hover-click","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:79}}"}},"sourceEventSeqs":[199],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":38,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:78}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690495,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690495,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690495,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690495,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":38,"callId":"cua-hover-observe","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":38,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-observe"},"toolCallId":"cua-hover-observe","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 3\\\"\\n- AXStaticText \\\"Hover information\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:79}}"}},"sourceEventSeqs":[199],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":38}}
 {"type":"step/start","data":{"turn":1,"step":39}}
-{"type":"assistant/message","data":{"turn":1,"step":39,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:80}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555291,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555291,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947555291,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555291,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":39,"callId":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}}
-{"type":"tool/result","data":{"turn":1,"step":39,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-exit"},"toolCallId":"cua-hover-exit","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:81}}"}},"sourceEventSeqs":[204],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":39,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:80}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690517,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690517,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690517,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690517,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":39,"callId":"cua-hover-capture","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":39,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-capture"},"toolCallId":"cua-hover-capture","content":[{"type":"text","text":"{\"pixelWidth\":1,\"pixelHeight\":1,\"windowId\":7,\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"coordinateSpace\":\"screenshot-pixels\"}"},{"type":"image","attachment":{"attachmentId":"sha256:999f1d1527ee7e79266f16add5430fff76b1225d742464a5b1ff1f02971bb8ee","mediaType":"image/png","width":1,"height":1,"bytes":90}}],"isError":false,"id":"{{message:81}}"}},"sourceEventSeqs":[204],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":39}}
 {"type":"step/start","data":{"turn":1,"step":40}}
-{"type":"assistant/message","data":{"turn":1,"step":40,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:82}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555307,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555307,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555307,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555307,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":40,"callId":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":40,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-verify"},"toolCallId":"cua-hover-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-11\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:83}}"}},"sourceEventSeqs":[209],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":40,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:82}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690565,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690565,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947690565,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690565,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":40,"callId":"cua-hover-popup","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":100,\"y\":200,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":40,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-popup"},"toolCallId":"cua-hover-popup","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:83}}"}},"sourceEventSeqs":[209],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":40}}
 {"type":"step/start","data":{"turn":1,"step":41}}
-{"type":"assistant/message","data":{"turn":1,"step":41,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:84}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555323,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555323,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}}},{"type":"chunk","time":1791947555323,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555323,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":41,"callId":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":41,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-background"},"toolCallId":"cua-paste-background","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:85}}"}},"sourceEventSeqs":[214],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":41,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:84}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690590,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690590,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947690590,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690590,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":41,"callId":"cua-hover-click","name":"cua","arguments":"{\"method\":\"click\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"snapshotId\":\"fixture-snapshot-10\",\"x\":100,\"y\":200,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":41,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-click"},"toolCallId":"cua-hover-click","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:85}}"}},"sourceEventSeqs":[214],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":41}}
 {"type":"step/start","data":{"turn":1,"step":42}}
-{"type":"assistant/message","data":{"turn":1,"step":42,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:86}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555339,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555339,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}},{"type":"chunk","time":1791947555339,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555339,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":42,"callId":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":42,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-unread"},"toolCallId":"cua-paste-unread","content":[{"type":"text","text":"Error: PASTE_NOT_CONSUMED: Paste command was dispatched, but clipboard data was not requested within the read deadline. Bring the target app to the foreground and focus its text input. Inspect the contents before deciding whether to retry; a delayed paste may still run."}],"isError":true,"id":"{{message:87}}"}},"sourceEventSeqs":[219],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":42,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:86}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690613,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690613,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}}},{"type":"chunk","time":1791947690613,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690613,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":42,"callId":"cua-hover-exit","name":"cua","arguments":"{\"method\":\"hover\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7,\"x\":0,\"y\":200,\"relative\":true}}"}}
+{"type":"tool/result","data":{"turn":1,"step":42,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-exit"},"toolCallId":"cua-hover-exit","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"hoverRoute\":\"accessibility\",\"systemPointerMoved\":false}"}],"isError":false,"id":"{{message:87}}"}},"sourceEventSeqs":[219],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":42}}
 {"type":"step/start","data":{"turn":1,"step":43}}
-{"type":"assistant/message","data":{"turn":1,"step":43,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:88}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555356,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555356,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555356,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555356,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":43,"callId":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":43,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-inspect"},"toolCallId":"cua-paste-inspect","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-12\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:89}}"}},"sourceEventSeqs":[224],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":43,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:88}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690633,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690633,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690633,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690633,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":43,"callId":"cua-hover-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":43,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-hover-verify"},"toolCallId":"cua-hover-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-11\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:89}}"}},"sourceEventSeqs":[224],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":43}}
 {"type":"step/start","data":{"turn":1,"step":44}}
-{"type":"assistant/message","data":{"turn":1,"step":44,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:90}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555372,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555372,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947555372,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555372,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":44,"callId":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":44,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-activate"},"toolCallId":"cua-paste-activate","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-paste-activate\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":42,\"focusedWindowId\":7,\"frontWindowId\":99,\"frontWindowPid\":42},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":true,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:91}}"}},"sourceEventSeqs":[229],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":44,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:90}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690653,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690653,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}}},{"type":"chunk","time":1791947690653,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690653,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":44,"callId":"cua-paste-background","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F9\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":44,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-background"},"toolCallId":"cua-paste-background","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:91}}"}},"sourceEventSeqs":[229],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":44}}
 {"type":"step/start","data":{"turn":1,"step":45}}
-{"type":"assistant/message","data":{"turn":1,"step":45,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:92}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555388,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555388,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555388,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555388,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":45,"callId":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":45,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-focus"},"toolCallId":"cua-paste-focus","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-13\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:93}}"}},"sourceEventSeqs":[234],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":45,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:92}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690672,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690672,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}},{"type":"chunk","time":1791947690672,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690672,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":45,"callId":"cua-paste-unread","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":45,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-unread"},"toolCallId":"cua-paste-unread","content":[{"type":"text","text":"Error: PASTE_NOT_CONSUMED: Paste command was dispatched, but clipboard data was not requested within the read deadline. Bring the target app to the foreground and focus its text input. Inspect the contents before deciding whether to retry; a delayed paste may still run."}],"isError":true,"id":"{{message:93}}"}},"sourceEventSeqs":[234],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":45}}
 {"type":"step/start","data":{"turn":1,"step":46}}
-{"type":"assistant/message","data":{"turn":1,"step":46,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:94}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555404,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555404,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}},{"type":"chunk","time":1791947555404,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555404,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":46,"callId":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":46,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-consumed"},"toolCallId":"cua-paste-consumed","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:95}}"}},"sourceEventSeqs":[239],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":46,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:94}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690696,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690696,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690696,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690696,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":46,"callId":"cua-paste-inspect","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":46,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-inspect"},"toolCallId":"cua-paste-inspect","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-12\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:95}}"}},"sourceEventSeqs":[239],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":46}}
 {"type":"step/start","data":{"turn":1,"step":47}}
-{"type":"assistant/message","data":{"turn":1,"step":47,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:96}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555421,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555421,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555421,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555421,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":47,"callId":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":47,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-verify"},"toolCallId":"cua-paste-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-14\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"fixture paste\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:97}}"}},"sourceEventSeqs":[244],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":47,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:96}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690714,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690714,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}},{"type":"chunk","time":1791947690714,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690714,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":47,"callId":"cua-paste-activate","name":"cua","arguments":"{\"method\":\"activate\",\"params\":{\"appHandle\":\"fixture-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":47,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-activate"},"toolCallId":"cua-paste-activate","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false,\"foreground\":{\"requestId\":\"cua-paste-activate\",\"operation\":\"activate\",\"targetPid\":9,\"targetWindowId\":null,\"before\":{\"frontPid\":42,\"focusedWindowId\":7,\"frontWindowId\":99,\"frontWindowPid\":42},\"after\":{\"frontPid\":9,\"focusedWindowId\":7,\"frontWindowId\":7,\"frontWindowPid\":9},\"activationRequested\":true,\"raiseRequested\":false}}"}],"isError":false,"id":"{{message:97}}"}},"sourceEventSeqs":[244],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":47}}
 {"type":"step/start","data":{"turn":1,"step":48}}
-{"type":"assistant/message","data":{"turn":1,"step":48,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:98}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555437,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555437,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}}},{"type":"chunk","time":1791947555437,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555437,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":48,"callId":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}}
-{"type":"tool/result","data":{"turn":1,"step":48,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-debug-arm"},"toolCallId":"cua-debug-arm","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:99}}"}},"sourceEventSeqs":[249],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":48,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:98}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690734,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690734,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690734,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690734,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":48,"callId":"cua-paste-focus","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":48,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-focus"},"toolCallId":"cua-paste-focus","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-13\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:99}}"}},"sourceEventSeqs":[249],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":48}}
 {"type":"step/start","data":{"turn":1,"step":49}}
-{"type":"assistant/message","data":{"turn":1,"step":49,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:100}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555453,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947555453,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947555453,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555453,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
-{"type":"tool/call","data":{"turn":1,"step":49,"callId":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
-{"type":"tool/result","data":{"turn":1,"step":49,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-debug-screenshot"},"toolCallId":"cua-debug-screenshot","content":[{"type":"text","text":"Error: NATIVE_PROTOCOL: Helper returned an invalid response; acquire fresh application handles\nScreenshot diagnostics:\n[cua-screenshot] {\"requestId\":\"cua-debug-screenshot\",\"stage\":\"capture-image.begin\",\"elapsedMs\":1}"}],"isError":true,"id":"{{message:101}}"}},"sourceEventSeqs":[254],"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":49,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:100}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690757,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690757,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}},{"type":"chunk","time":1791947690757,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690757,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":49,"callId":"cua-paste-consumed","name":"cua","arguments":"{\"method\":\"paste\",\"params\":{\"appHandle\":\"fixture-app\",\"text\":\"fixture paste\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":49,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-consumed"},"toolCallId":"cua-paste-consumed","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:101}}"}},"sourceEventSeqs":[254],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":49}}
 {"type":"step/start","data":{"turn":1,"step":50}}
-{"type":"assistant/message","data":{"turn":1,"step":50,"message":{"role":"assistant","content":[{"type":"text","text":"Observed Count: 4 after hovering, observing and clicking the revealed control. Moving away dismissed the hover information. Geometry conflicts rejected capture and coordinate gestures; the advertised AX button action remained available. No automatic activation or input retry was requested."}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:102}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947555473,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"chunk","time":1791947555473,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"Observed Count: 4 after hovering, observing and clicking the revealed control. Moving away dismissed the hover information. Geometry conflicts rejected capture and coordinate gestures; the advertised AX button action remained available. No automatic activation or input retry was requested."}}},{"type":"chunk","time":1791947555473,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947555473,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"assistant/message","data":{"turn":1,"step":50,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:102}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690778,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690778,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690778,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690778,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":50,"callId":"cua-paste-verify","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":50,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-paste-verify"},"toolCallId":"cua-paste-verify","content":[{"type":"text","text":"{\"appHandle\":\"fixture-app\",\"pid\":9,\"windowId\":7,\"snapshotId\":\"fixture-snapshot-14\",\"tree\":\"AX scope=window offsets=UTF-16\\n- [0] AXButton \\\"Increment\\\"\\n- [1] AXTextField valueWritable=true selectionWritable=true value=\\\"fixture paste\\\" placeholder=\\\"Fixture text\\\"\\n- AXStaticText \\\"Count: 4\\\"\\n- [2] AXMenuBarItem \\\"File\\\"\\nMenu contents omitted; request includeMenus=true to expand.\",\"windows\":[{\"windowId\":7,\"pid\":9,\"appName\":\"Fixture\",\"title\":\"CUA fixture\",\"bounds\":{\"x\":40,\"y\":60,\"width\":320,\"height\":200},\"isOnScreen\":true,\"onCurrentSpace\":true}],\"truncated\":false}"}],"isError":false,"id":"{{message:103}}"}},"sourceEventSeqs":[259],"surfaceOp":"append"}
 {"type":"step/end","data":{"turn":1,"step":50}}
+{"type":"step/start","data":{"turn":1,"step":51}}
+{"type":"assistant/message","data":{"turn":1,"step":51,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:104}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690801,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690801,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}}},{"type":"chunk","time":1791947690801,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690801,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":51,"callId":"cua-debug-arm","name":"cua","arguments":"{\"method\":\"pressKey\",\"params\":{\"appHandle\":\"fixture-app\",\"key\":\"F12\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":51,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-debug-arm"},"toolCallId":"cua-debug-arm","content":[{"type":"text","text":"{\"dispatched\":true,\"verified\":false}"}],"isError":false,"id":"{{message:105}}"}},"sourceEventSeqs":[264],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":51}}
+{"type":"step/start","data":{"turn":1,"step":52}}
+{"type":"assistant/message","data":{"turn":1,"step":52,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:106}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690821,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690821,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}},{"type":"chunk","time":1791947690821,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690821,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":52,"callId":"cua-debug-screenshot","name":"cua","arguments":"{\"method\":\"screenshot\",\"params\":{\"appHandle\":\"fixture-app\",\"windowId\":7}}"}}
+{"type":"tool/result","data":{"turn":1,"step":52,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-debug-screenshot"},"toolCallId":"cua-debug-screenshot","content":[{"type":"text","text":"Error: NATIVE_PROTOCOL: Helper returned an invalid response; acquire fresh application handles\nScreenshot diagnostics:\n[cua-screenshot] {\"requestId\":\"cua-debug-screenshot\",\"stage\":\"capture-image.begin\",\"elapsedMs\":1}"}],"isError":true,"id":"{{message:107}}"}},"sourceEventSeqs":[269],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":52}}
+{"type":"step/start","data":{"turn":1,"step":53}}
+{"type":"assistant/message","data":{"turn":1,"step":53,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-consent-denied","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Denied Fixture\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:108}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947690852,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947690852,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-consent-denied","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Denied Fixture\"}}"}}},{"type":"chunk","time":1791947690852,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947690852,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":53,"callId":"cua-consent-denied","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Denied Fixture\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":53,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-consent-denied"},"toolCallId":"cua-consent-denied","content":[{"type":"text","text":"Error: APP_ACCESS_DENIED: The user denied access to Denied Fixture. Do not retry or use another tool to bypass this decision."}],"isError":true,"id":"{{message:109}}"}},"sourceEventSeqs":[274],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":53}}
+{"type":"step/start","data":{"turn":1,"step":54}}
+{"type":"assistant/message","data":{"turn":1,"step":54,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-consent-revocable","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Revocable Fixture\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:110}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947691022,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947691022,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-consent-revocable","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Revocable Fixture\"}}"}}},{"type":"chunk","time":1791947691022,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947691022,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":54,"callId":"cua-consent-revocable","name":"cua","arguments":"{\"method\":\"getApp\",\"params\":{\"selector\":\"Revocable Fixture\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":54,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-consent-revocable"},"toolCallId":"cua-consent-revocable","content":[{"type":"text","text":"{\"appHandle\":\"revoked-app\",\"pid\":17,\"name\":\"Revocable Fixture\"}"}],"isError":false,"id":"{{message:111}}"}},"sourceEventSeqs":[279],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":54}}
+{"type":"step/start","data":{"turn":1,"step":55}}
+{"type":"assistant/message","data":{"turn":1,"step":55,"message":{"role":"assistant","content":[{"type":"tool-call","id":"cua-consent-revoked","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"revoked-app\"}}"}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:112}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947691192,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}},{"type":"chunk","time":1791947691192,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"cua-consent-revoked","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"revoked-app\"}}"}}},{"type":"chunk","time":1791947691192,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947691192,"chunk":{"type":"finish","reason":{"kind":"tool-calls"}}}]},"surfaceOp":"append"}
+{"type":"tool/call","data":{"turn":1,"step":55,"callId":"cua-consent-revoked","name":"cua","arguments":"{\"method\":\"getState\",\"params\":{\"appHandle\":\"revoked-app\"}}"}}
+{"type":"tool/result","data":{"turn":1,"step":55,"message":{"role":"tool","source":{"kind":"tool","callId":"cua-consent-revoked"},"toolCallId":"cua-consent-revoked","content":[{"type":"text","text":"Error: APP_ACCESS_REVOKED: Application access was revoked; stop using this application"}],"isError":true,"id":"{{message:113}}"}},"sourceEventSeqs":[284],"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":55}}
+{"type":"step/start","data":{"turn":1,"step":56}}
+{"type":"assistant/message","data":{"turn":1,"step":56,"message":{"role":"assistant","content":[{"type":"text","text":"Observed Count: 4 after hovering, observing and clicking the revealed control. Moving away dismissed the hover information. Geometry conflicts rejected capture and coordinate gestures; the advertised AX button action remained available. No automatic activation or input retry was requested."}],"source":{"kind":"model","provider":"deepseek-official","model":"deepseek-v4-flash-vision-exp"},"id":"{{message:114}}"},"usage":{"inputTokens":3,"outputTokens":3},"stream":[{"type":"chunk","time":1791947691212,"chunk":{"type":"block-start","index":0,"blockType":"text"}},{"type":"chunk","time":1791947691212,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"Observed Count: 4 after hovering, observing and clicking the revealed control. Moving away dismissed the hover information. Geometry conflicts rejected capture and coordinate gestures; the advertised AX button action remained available. No automatic activation or input retry was requested."}}},{"type":"chunk","time":1791947691212,"chunk":{"type":"usage","usage":{"inputTokens":3,"outputTokens":3}}},{"type":"chunk","time":1791947691212,"chunk":{"type":"finish","reason":{"kind":"stop"}}}]},"surfaceOp":"append"}
+{"type":"step/end","data":{"turn":1,"step":56}}
 {"type":"turn/end","data":{"turn":1,"reason":{"kind":"completed"}}}
diff --git a/snapshots/session/cua-native/system-prompt.expected.md b/snapshots/session/cua-native/system-prompt.expected.md
index fa48bb45ab..c43ddf6dd8 100644
--- a/snapshots/session/cua-native/system-prompt.expected.md
+++ b/snapshots/session/cua-native/system-prompt.expected.md
@@ -29,7 +29,7 @@ Use the workflow tool ONLY when the user explicitly asks for a workflow or for l
 
 Start independent delegations with `subagent` or `subagent_fork` together in one assistant message and continue useful work while they run.
 
-Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user explicitly grants access again. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
+Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user allows another request on the permission page. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
 
 Initialize the object API once in persistent PTC. Reuse its variables in later calls; put temporary declarations inside { ... } blocks to avoid redeclaration errors. All object methods are async. getAXState returns text, not a structured state object. Its text separates values and placeholders, and reports subroles, help, URLs, disabled/focused/selected/expanded state and UTF-16 selection ranges when available. Writability is true, false or unknown on relevant controls; omitted state fields do not assert false. selection=unavailable means the reported range exceeds the observed text. Compact output omits ordinary Press/Pick (click), ShowMenu (right click) and ScrollToVisible actions; details=true lists every available action. Use the displayed action name with performSecondaryAction; ambiguous aliases require the complete name from details=true. Truncation reports the reached provider limit. Narrow the window or increase that provider limit before reading again.
 
@@ -66,7 +66,7 @@ App and Window methods:
 
 Raw operation tools use { method, params }, including params: {} for parameterless methods. getApp selects without activating the app. Keep applications in the background for observation and routine input. Do not activate or raise an app during initialization, before each action, or merely because another app is foreground. Prefer advertised AX actions. If a window is hidden or minimized, try app.show() or window.show() and read fresh state. show requests unhide and unminimize without activation, raising or switching Spaces; it chooses the explicit, focused, main or sole AX window. A null windowId means no window was selected for restoration. foregroundChanged compares the front app and top window before and after the request; null means unavailable, and delayed focus changes remain possible. If restoration is unsupported or the window remains unusable, including another Space or Stage Manager, explain the needed foreground step, use app.activate() or an advertised raise action, and read fresh state. Completing the task takes priority when foreground access is necessary. Avoid repeated activation when the user switches away; continue background-capable steps and report what requires foreground access. Applications may still change focus in response to input.
 
-Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to grant macOS Accessibility or Screen Recording access in System Settings. After granting access, observe fresh state before continuing; do not automatically replay prior input.
+Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to complete the Computer Use permission setup for macOS Accessibility or Screen Recording. After granting access, observe fresh state before continuing; do not automatically replay prior input.
 
 Hover first uses advertised AX alternate UI without moving the system cursor, preserving revealed descendants until the pointer target leaves their region. When unavailable, it moves the visible system cursor without pressing a button; that route requires the target point to be unobscured in the foreground app. FOREGROUND_REQUIRED requires explicit activation or raising and a fresh observation before retrying. Returning, AX reads and screenshots do not restore the previous point. Wait for the application's hover delay, observe, then hover into the revealed controls before clicking. Use successive hover calls for intermediate points. The result reports hoverRoute and systemPointerMoved. Other input or application changes can interrupt the interaction; app objects do not reserve applications between calls.
 
diff --git a/snapshots/session/cua-native/workspace/native-helper.mjs b/snapshots/session/cua-native/workspace/native-helper.mjs
index c4510416c3..2bbaa83188 100755
--- a/snapshots/session/cua-native/workspace/native-helper.mjs
+++ b/snapshots/session/cua-native/workspace/native-helper.mjs
@@ -125,6 +125,12 @@ function createApplicationState(socket, record, application, captureBroker, conn
   function refuse(code, message) { throw Object.assign(new Error(message), { code }) }
   function call(requestId, method, params) {
     record('call', { requestId, method, params })
+    if (method === 'applicationIcons') return Object.fromEntries(params.paths.map(path => [path, `data:image/png;base64,${png}`]))
+    if (method === 'openPermissionSettings') return { opened: true }
+    if (method === 'permissionStatus' || method === 'requestPermission') {
+      const state = JSON.parse(readFileSync(new URL('./permissions.json', import.meta.url), 'utf8'))
+      return { ...state, helper: { pid: process.pid }, parent: { pid: process.ppid } }
+    }
     if (method === 'getCapabilities') return { platform: 'macos', sessionLocked: false, permissions: { accessibility: true, screenRecording: true }, methods, coordinateSpace: 'window-points', browser: false }
     if (method === 'listApps') return [{ pid: app.pid, name: app.name, bundleId: app.bundleId }]
     if (method === 'getApp') {
@@ -136,7 +142,7 @@ function createApplicationState(socket, record, application, captureBroker, conn
       }
       if (!['Fixture', 'test.fixture', '9'].includes(params.selector)) refuse('APP_NOT_FOUND', 'Select the running Fixture application')
       acquired = true
-      return { ...app, authorization: {"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app", "persistable": true} }
+      return { ...app, applicationIcon: `data:image/png;base64,${png}`, authorization: {"id": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "name": "Fixture", "executablePath": "/fixture/app", "persistable": true} }
     }
     if (!acquired || params.appHandle !== app.appHandle) refuse('APP_NOT_FOUND', 'Acquire an application in this helper first')
     if (method === 'show') return { dispatched: true, verified: false, windowId: params.windowId ?? window.windowId, foregroundChanged: false }
diff --git a/snapshots/session/cua-ptc/consent-fixture.mjs b/snapshots/session/cua-ptc/consent-fixture.mjs
index 3e6dd4064c..85e83bcf69 100644
--- a/snapshots/session/cua-ptc/consent-fixture.mjs
+++ b/snapshots/session/cua-ptc/consent-fixture.mjs
@@ -15,6 +15,6 @@ export async function apply(ctx) {
     try { await close() } finally { await unlink(helper) }
   })
   ctx.on('user-questions/request', async request => ({ answers: request.questions.map(question => ({
-    id: question.id, selected: ['Allow for this task'],
+    id: question.id, selected: ['Allow for this session'],
   })) }))
 }
diff --git a/snapshots/session/cua-ptc/cordis.snapshot.yml b/snapshots/session/cua-ptc/cordis.snapshot.yml
index c2f9b23c4b..e42a3ce149 100644
--- a/snapshots/session/cua-ptc/cordis.snapshot.yml
+++ b/snapshots/session/cua-ptc/cordis.snapshot.yml
@@ -50,6 +50,7 @@
     - id: cua-native
       name: '@deepseek-ai/dsh-experimental-cua-macos'
       config:
+        agentPreset: false
         helperPath: !!js process.cwd() + '/native-helper.mjs'
 
 - id: user-questions
diff --git a/snapshots/session/cua-ptc/cordis.yml b/snapshots/session/cua-ptc/cordis.yml
index 60a3be9c9e..ac932bb223 100644
--- a/snapshots/session/cua-ptc/cordis.yml
+++ b/snapshots/session/cua-ptc/cordis.yml
@@ -32,6 +32,7 @@
     - id: cua-native
       name: '@deepseek-ai/dsh-experimental-cua-macos'
       config:
+        agentPreset: false
         helperPath: !!js process.cwd() + '/native-helper.mjs'
 
 - id: user-questions
diff --git a/snapshots/session/cua-ptc/system-prompt.expected.md b/snapshots/session/cua-ptc/system-prompt.expected.md
index 724b9bc2f3..1836fffaed 100644
--- a/snapshots/session/cua-ptc/system-prompt.expected.md
+++ b/snapshots/session/cua-ptc/system-prompt.expected.md
@@ -31,7 +31,7 @@ Use the workflow tool ONLY when the user explicitly asks for a workflow or for l
 
 Start independent delegations with `subagent` or `subagent_fork` together in one assistant message and continue useful work while they run.
 
-Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user explicitly grants access again. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
+Use cua with method getCapabilities and params {} to inspect permissions and sessionLocked. If sessionLocked is true or an operation reports SESSION_LOCKED, stop UI attempts and ask the user to unlock macOS. A null sessionLocked means no usable console session was verified. After unlocking, read fresh state; screenshots from a locked desktop are not current observations. Use listApps or cua.getState to discover running applications, and findApps(query) to search installed applications by name, bundle ID or absolute path. getApp requests user consent before launching a stopped application in the background, or before observations and input on a running one. If access is denied or revoked, stop using that application until the user allows another request on the permission page. Never switch tools to bypass a refusal. Keep the returned appHandle; every app operation requires it. listWindows returns window IDs and point bounds. Raw getState returns AX text and snapshotId. Menu-bar entries are shown by default; includeMenus=true expands their contents. details=true adds identifiers, global-point bounds and complete action names. Both options also apply to getAXState. Each read replaces the indices for that app/window scope. Use its element indices only with that snapshotId. Raw screenshot and coordinate operations require a windowId. Coordinates are pixels in the latest returned screenshot, measured from its top-left. Set relative:true for integer thousandths from 0 to 1000 instead. The Host converts both modes to native window points; AX detail bounds remain global macOS points. A verified window can expose no AX elements. Its empty snapshot permits screenshots and coordinate input; element-index actions require an element from a fresh AX observation.
 
 Initialize the object API once in persistent PTC. Reuse its variables in later calls; put temporary declarations inside { ... } blocks to avoid redeclaration errors. All object methods are async. getAXState returns text, not a structured state object. Its text separates values and placeholders, and reports subroles, help, URLs, disabled/focused/selected/expanded state and UTF-16 selection ranges when available. Writability is true, false or unknown on relevant controls; omitted state fields do not assert false. selection=unavailable means the reported range exceeds the observed text. Compact output omits ordinary Press/Pick (click), ShowMenu (right click) and ScrollToVisible actions; details=true lists every available action. Use the displayed action name with performSecondaryAction; ambiguous aliases require the complete name from details=true. Truncation reports the reached provider limit. Narrow the window or increase that provider limit before reading again.
 
@@ -68,7 +68,7 @@ App and Window methods:
 
 Raw operation tools use { method, params }, including params: {} for parameterless methods. getApp selects without activating the app. Keep applications in the background for observation and routine input. Do not activate or raise an app during initialization, before each action, or merely because another app is foreground. Prefer advertised AX actions. If a window is hidden or minimized, try app.show() or window.show() and read fresh state. show requests unhide and unminimize without activation, raising or switching Spaces; it chooses the explicit, focused, main or sole AX window. A null windowId means no window was selected for restoration. foregroundChanged compares the front app and top window before and after the request; null means unavailable, and delayed focus changes remain possible. If restoration is unsupported or the window remains unusable, including another Space or Stage Manager, explain the needed foreground step, use app.activate() or an advertised raise action, and read fresh state. Completing the task takes priority when foreground access is necessary. Avoid repeated activation when the user switches away; continue background-capable steps and report what requires foreground access. Applications may still change focus in response to input.
 
-Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to grant macOS Accessibility or Screen Recording access in System Settings. After granting access, observe fresh state before continuing; do not automatically replay prior input.
+Await operations sequentially. After input, read fresh state to verify the effect. A successful action means dispatched, not verified completion. Cancellation may leave partial effects; never retry uncertain input without observing. STALE_APP requires getApp again; STALE_SNAPSHOT requires getState again. Absolute coordinate input requires a fresh screenshot of that window. Relative input can use a successful AX observation or screenshot. SCREENSHOT_REQUIRED means capture a fresh screenshot before using pixel coordinates. For click and hover, coordinate targets must be [x, y], for example hover([650, 400], {relative:true}). A bare number such as hover(650) is always an AX element index. The relative option applies only to coordinate targets, not AX indices. Window resizing since the latest observation rejects coordinate input; movement alone preserves window-local coordinates. WINDOW_CHANGED requires fresh state before any retry; use an advertised AX action or explicitly restore the window before screenshot or coordinate input, then observe again. PERMISSION_DENIED requires the user to complete the Computer Use permission setup for macOS Accessibility or Screen Recording. After granting access, observe fresh state before continuing; do not automatically replay prior input.
 
 Hover first uses advertised AX alternate UI without moving the system cursor, preserving revealed descendants until the pointer target leaves their region. When unavailable, it moves the visible system cursor without pressing a button; that route requires the target point to be unobscured in the foreground app. FOREGROUND_REQUIRED requires explicit activation or raising and a fresh observation before retrying. Returning, AX reads and screenshots do not restore the previous point. Wait for the application's hover delay, observe, then hover into the revealed controls before clicking. Use successive hover calls for intermediate points. The result reports hoverRoute and systemPointerMoved. Other input or application changes can interrupt the interaction; app objects do not reserve applications between calls.
 
diff --git a/tsconfig.base.json b/tsconfig.base.json
index 2b3e9aad37..9f4f16ab18 100644
--- a/tsconfig.base.json
+++ b/tsconfig.base.json
@@ -301,6 +301,9 @@
       "@deepseek-ai/dsh-experimental-client-ui-agent-team/client": ["./packages/experimental/client-ui-agent-team/src/client/index.ts"],
       "@deepseek-ai/dsh-client-ui-settings-plugins": ["./packages/client/ui-settings-plugins/src"],
       "@deepseek-ai/dsh-client-ui-settings-shell": ["./packages/client/ui-settings-shell/src"],
+      "@deepseek-ai/dsh-client-ui-cua": ["./packages/experimental/client-ui-cua/src/index.ts"],
+      "@deepseek-ai/dsh-client-ui-cua/client": ["./packages/experimental/client-ui-cua/src/client/index.ts"],
+      "@deepseek-ai/dsh-cua/types": ["./packages/experimental/cua/src/types.ts"],
       "@deepseek-ai/dsh-client-ui-settings-agent-loop": ["./packages/client/ui-settings-agent-loop/src"],
       "@deepseek-ai/dsh-client-ui-settings-session-log": ["./packages/client/ui-settings-session-log/src"],
       "@deepseek-ai/dsh-client-ui-settings-subagent": ["./packages/client/ui-settings-subagent/src"],
@@ -397,6 +400,7 @@
       "@deepseek-ai/dsh-config-editor": ["./packages/boot/config-editor/src"],
       "@deepseek-ai/dsh-credentials": ["./packages/credentials/credentials/src"],
       "@deepseek-ai/dsh-credentials-local": ["./packages/credentials/credentials-local/src"],
+      "@deepseek-ai/dsh-cua-bundle": ["./packages/experimental/cua-bundle/src"],
       "@deepseek-ai/dsh-deepseek-llm-api-extensions": ["./packages/llm/deepseek-llm-api-extensions/src"],
       "@deepseek-ai/dsh-deque": ["./packages/util/deque/src"],
       "@deepseek-ai/dsh-file-reference": ["./packages/context/file-reference/src"],
diff --git a/tsconfig.client.json b/tsconfig.client.json
index b2f0423c7c..7bf256becb 100644
--- a/tsconfig.client.json
+++ b/tsconfig.client.json
@@ -131,6 +131,7 @@
     { "path": "./packages/client/ui-settings-plugins" },
     { "path": "./packages/client/ui-settings-shell" },
     { "path": "./packages/client/ui-settings-agent-loop" },
+    { "path": "./packages/experimental/client-ui-cua" },
     { "path": "./packages/client/ui-settings-session-log" },
     { "path": "./packages/client/ui-settings-subagent" },
     { "path": "./packages/client/ui-settings-web-search" },
diff --git a/tsconfig.host.json b/tsconfig.host.json
index 6eb4662f88..851c760b34 100644
--- a/tsconfig.host.json
+++ b/tsconfig.host.json
@@ -73,6 +73,9 @@
     "apps/web/tests/plugin-config.e2e.ts",
     "apps/web/tests/input-plugin-extensions.e2e.ts",
     "apps/web/tests/plugin-manager.e2e.ts",
+    "apps/web/tests/cua-optin.e2e.ts",
+    "apps/web/tests/bundle-platform.e2e.ts",
+    "apps/web/tests/cua-permissions.e2e.ts",
     "apps/web/tests/schedule-header.e2e.ts",
     "apps/web/tests/worktree-opt-in.e2e.ts",
     "apps/web/tests/session-inspector.e2e.ts",
@@ -274,6 +277,7 @@
     { "path": "./packages/experimental/computer-use-cua-driver-mcp" },
     { "path": "./packages/experimental/computer-use-cua-driver-native" },
     { "path": "./packages/experimental/cua" },
+    { "path": "./packages/experimental/cua-bundle" },
     { "path": "./packages/experimental/cua-macos" },
     { "path": "./packages/client/ui-sidebar-documentpreview/tsconfig.host.json" },
     { "path": "./packages/client/ui-sidebar-browser/tsconfig.host.json" },
diff --git a/vitest.config.ts b/vitest.config.ts
index 9c717c0ced..7857266cd1 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -331,6 +331,9 @@ export default defineConfig({
         // The speech entry also imports generated Remote definitions; voice-input.e2e.ts
         // exercises the built entry, while source tests cover mountVoiceInput.
         'packages/experimental/client-ui-voice-input/src/client/index.ts',
+        // The permission entry binds generated Remote code; cua-permissions.e2e.ts covers
+        // its built entry, while source tests exercise mountCuaPermissions and its UI.
+        'packages/experimental/client-ui-cua/src/client/index.ts',
         // The mods band entry imports the bridge's generated Remote contribution, which exists only in lib;
         // the Web snapshot exercises the built entry, while source tests cover mountModsBand.
         'packages/experimental/client-ui-claude-code-mods/src/client/index.ts',

From 72047d6ecdbc41e32176199a13326bee618331ca Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 16:35:13 +0800
Subject: [PATCH 10/44] docs(cua): document permissions, support limits and
 APIs

---
 ...capabilities-as-optional-bundles.i18n.yaml |  8 +-
 ...mental-capabilities-as-optional-bundles.md |  6 +-
 ...tal-capabilities-as-optional-bundles.zh.md |  6 +-
 ...26-09-26-cua-application-consent.i18n.yaml | 12 +--
 .../2026-09-26-cua-application-consent.md     | 23 +++--
 .../2026-09-26-cua-application-consent.zh.md  | 23 +++--
 docs/capability-seams.i18n.yaml               |  4 +-
 docs/capability-seams.md                      |  6 ++
 docs/capability-seams.zh.md                   |  6 ++
 docs/config-catalog.md                        |  4 +-
 docs/config-catalog.zh.md                     |  4 +-
 docs/event-producer-consumer.md               | 12 +--
 docs/event-producer-consumer.zh.md            | 12 +--
 docs/module-graph.md                          | 24 +++--
 docs/module-graph.zh.md                       | 24 +++--
 docs/persistence-catalog.i18n.yaml            |  4 +-
 docs/persistence-catalog.md                   |  2 +-
 docs/persistence-catalog.zh.md                |  2 +-
 docs/persistence-schema.json                  |  2 +-
 docs/subsystems/boot.md                       |  6 +-
 docs/subsystems/boot.zh.md                    |  6 +-
 docs/subsystems/computer-use.i18n.yaml        |  4 +-
 docs/subsystems/computer-use.md               | 66 +++++++++++++
 docs/subsystems/computer-use.zh.md            | 66 +++++++++++++
 docs/subsystems/settings.md                   |  3 +-
 docs/subsystems/settings.zh.md                |  3 +-
 docs/subsystems/user-questions.i18n.yaml      |  4 +-
 docs/subsystems/user-questions.md             | 19 +++-
 docs/subsystems/user-questions.zh.md          | 19 +++-
 .../cua-preset-scope/guide.i18n.yaml          | 16 ++++
 .../v0.2.1-alpha.2/cua-preset-scope/guide.md  | 18 ++++
 .../cua-preset-scope/guide.zh.md              | 18 ++++
 packages/computer-use/README.i18n.yaml        |  8 +-
 packages/computer-use/README.md               |  5 +-
 packages/computer-use/README.zh.md            |  5 +-
 .../computer-use/README.i18n.yaml             |  8 +-
 packages/computer-use/computer-use/README.md  |  5 +-
 .../computer-use/computer-use/README.zh.md    |  5 +-
 packages/experimental/README.i18n.yaml        |  4 +-
 packages/experimental/README.md               |  2 +
 packages/experimental/README.zh.md            |  2 +
 .../src/client/slot-catalog.ts                | 35 +++----
 .../extensions/tool-cordis/src/api-catalog.ts | 93 +++++++++++++++++--
 .../references/packages.md                    |  1 +
 44 files changed, 486 insertions(+), 119 deletions(-)
 create mode 100644 docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.i18n.yaml
 create mode 100644 docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.md
 create mode 100644 docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.zh.md

diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
index 448629299d..1f0d3fcbee 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
@@ -9,11 +9,11 @@
   en: 2ba6c43b20a3d347
   zh: 5647179ddaa38ad9
 /agent-note-ship-experimental-capabilities-as-optional-bundles/decision:
-  en: 6c8583bdefc5e36c
-  zh: 0928b4f2876bbfe4
+  en: 2d40970162451a14
+  zh: 4e7801c3b5e0d7a3
 /agent-note-ship-experimental-capabilities-as-optional-bundles/alternatives-considered:
   en: d6f40bf02df37ab7
   zh: e5b85ce9d41e8754
 /agent-note-ship-experimental-capabilities-as-optional-bundles/consequences:
-  en: 38d27583533cd028
-  zh: 9bf11f5489c1aa43
+  en: 3659d2071d2f8310
+  zh: 64361fe474e21162
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
index dbdd104da0..201fc77de8 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
@@ -12,12 +12,14 @@ The Web plugin page offered two optional bundles, Agent Teams and voice input. A
 
 `OPTIONAL_BUNDLES` owns the installation's default-off selections, including maintained optional capabilities and experimental capabilities. Every bundle declares `icon` and exports `./locale/*.json` with `meta.title` and `meta.description`; the Official group displays that metadata. A bundle's presentation does not determine its [experimental status](../../../../packages/experimental/README.md#status). The isolation check validates admission and still rejects experimental dependencies of nonexperimental bundles.
 
-An optional bundle's dependencies are downloaded with every `dsh` installation. [Reasoning translation](2026-10-05-anonymous-reasoning-translation.md) uses three experimental packages without adding third-party runtime dependencies. Admission therefore considers installation cost and whether a switch supplies a usable composition without an additional configuration form. Browser and computer providers remain explicit compositions because they add substantial runtimes or require an external executable. Stagehand requires model credentials; Python PTC replaces a core provider and conflicts with TypeScript workflow consumers. Demonstrative hooks, webhooks, and mods stay outside the list. [Session Inspector](../feature/2026-09-24-session-inspector.md) owns the Inspector's distinct activation behavior.
+An optional bundle's dependencies are downloaded with every `dsh` installation. [Reasoning translation](2026-10-05-anonymous-reasoning-translation.md) uses three experimental packages without adding third-party runtime dependencies. Admission therefore considers installation cost and whether a switch supplies a usable composition without an additional configuration form. External browser and Cua Driver providers remain explicit compositions because they add substantial runtimes or require an external executable. Stagehand requires model credentials; Python PTC replaces a core provider and conflicts with TypeScript workflow consumers. Demonstrative hooks, webhooks, and mods stay outside the list. [Session Inspector](../feature/2026-09-24-session-inspector.md) owns the Inspector's distinct activation behavior.
 
 Bundles insert ordinary Host rows; optional model tools register in the global tool layer, so every preset, including minimal, receives them. Plugin management, profile composition, and reload need no bundle-specific behavior. Search, Ralph, and terminals supply their own isolated services in a Host group. Search opens one in-memory index on demand; the Host search policy stays unchanged. Badge skills and title providers act on the Host. Switching a bundle registers or removes its tools for live Agents, and later user patch layers retain precedence. A replacement title provider may register once the previous provider's disposal starts; the previous provider's late results never commit.
 
 Claude Code and Codex install on demand through the separate `ON_DEMAND_BUNDLES` catalog; the [on-demand native-bundle decision](2026-10-05-official-on-demand-bundles.md) owns the cost, version, and offline-discovery trade-offs.
 
+Computer Use is a shipped optional bundle in the experimental group. Its repository-owned native component is prepared only for enabled profiles, without an external Cua Driver runtime. It declares `dsh.bundle.experimental: true` for the experimental card label; existing experimental package names retain their labels.
+
 ## Alternatives considered
 
 **Ship every provider as an optional bundle.** Composes and displays correctly, but grows every install by provider runtimes for a capability most installations never switch on; voice input's `sherpa-onnx-node` is the one accepted precedent.
@@ -31,3 +33,5 @@ Claude Code and Codex install on demand through the separate `ON_DEMAND_BUNDLES`
 ## Consequences
 
 Official discovery does not imply experimental status or a different plugin lifecycle. Switching a bundle off keeps its installed files; failed activation retains the existing saved-selection behavior. Bundle rows are ordinary Host rows with their usual switches. Individual and combined composition tests cover the Host rows and every preset's tool catalog; live switching and recorded Sessions cover activation and model-visible behavior.
+
+Computer Use keeps its permission service and native provider on the Host, and registers tools in Agent scopes whose bound preset is `ptc`. Existing Agent events and `createScope()` maintain current, new and resumed Agents, following the browser-use runtime’s ownership pattern. Preset declarations and retained revisions stay unchanged; no preset extension registry is needed. Enablement persists the PTC runtime. If the new-session default is not PTC, the activation dialog explains the PTC-only design and offers to change it; only confirmation saves the default through the existing settings form. Disablement retains these settings. Web regressions cover both default choices, live opt-in, blank-session preset changes, inherited children and disposal, plus retained PTC state across repeated toggles.
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
index 6c9df974e8..4d0a4f976c 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
@@ -12,12 +12,14 @@ Web 插件页只提供两个可选 bundle：Agent Teams 与语音输入。Auto r
 
 `OPTIONAL_BUNDLES` 管理安装随附且默认关闭的选项，包括维护中的可选能力与实验性能力。每个 bundle 声明 `icon`，并导出带 `meta.title` 与 `meta.description` 的 `./locale/*.json`；官方分组显示这些元数据。Bundle 的展示方式不决定其[实验性状态](../../../../packages/experimental/README.zh.md#status)。隔离检查校验准入，并继续拒绝非实验 bundle 的实验性依赖。
 
-可选 bundle 的依赖随每次 `dsh` 安装下载。[思考过程翻译](2026-10-05-anonymous-reasoning-translation.zh.md)使用三个实验包，不增加第三方运行时依赖。因此准入需要考虑安装成本，以及开关能否在不增加配置表单的情况下提供可用组合。浏览器与电脑提供方仍使用显式组合，因为它们会增加较大的运行时或要求外部可执行文件。Stagehand 需要模型凭据；Python PTC 替换核心提供方，并与 TypeScript workflow 消费方冲突。演示性钩子、webhook 与模组不进入名单。[Session Inspector](../feature/2026-09-24-session-inspector.zh.md) 管理 Inspector 特有的激活行为。
+可选 bundle 的依赖随每次 `dsh` 安装下载。[思考过程翻译](2026-10-05-anonymous-reasoning-translation.zh.md)使用三个实验包，不增加第三方运行时依赖。因此准入需要考虑安装成本，以及开关能否在不增加配置表单的情况下提供可用组合。外部浏览器与 Cua Driver 提供方仍使用显式组合，因为它们会增加较大的运行时或要求外部可执行文件。Stagehand 需要模型凭据；Python PTC 替换核心提供方，并与 TypeScript workflow 消费方冲突。演示性钩子、webhook 与模组不进入名单。[Session Inspector](../feature/2026-09-24-session-inspector.zh.md) 管理 Inspector 特有的激活行为。
 
 Bundle 插入普通 Host 行；可选模型工具注册到全局工具层，因此包括 minimal 在内的所有预设都会获得它们。插件管理、profile 组合与重载无需针对 bundle 的特殊行为。搜索、Ralph 与终端在 Host 组内提供自己的隔离服务。搜索按需打开一个内存索引；Host 搜索策略保持不变。徽章技能与标题提供方作用于 Host。切换 bundle 会为运行中的 Agent 注册或移除其工具，后续用户 patch 层继续优先。前一个标题提供方开始清理后，替代提供方即可注册；前一个提供方的迟到结果不会提交。
 
 Claude Code 与 Codex 通过独立的 `ON_DEMAND_BUNDLES` 目录按需安装，其成本、版本与离线发现取舍由[按需原生 bundle 决策](2026-10-05-official-on-demand-bundles.zh.md)管理。
 
+Computer Use 是 experimental 包组内随安装提供的可选组合包。其仓库自有原生组件只为已启用的配置档准备，不引入外部 Cua Driver 运行时。它通过 `dsh.bundle.experimental: true` 显示实验性卡片标签；已有实验包名保留对应标签。
+
 ## 考虑过的替代方案
 
 **把所有提供方都做成可选 bundle。** 组合与展示都正确，但会为多数安装从不启用的能力把提供方运行时塞进每次安装；语音输入的 `sherpa-onnx-node` 是唯一被接受的先例。
@@ -31,3 +33,5 @@ Claude Code 与 Codex 通过独立的 `ON_DEMAND_BUNDLES` 目录按需安装，
 ## 后果
 
 官方发现不表示实验性状态，也不引入不同的插件生命周期。关闭 bundle 保留已安装文件；激活失败保留现有的已保存选择行为。Bundle 行是普通 Host 行，使用常规开关。独立与组合测试覆盖 Host 行及每个预设的工具目录；实时切换与已记录 Session 覆盖激活和模型可见行为。
+
+Computer Use 将权限服务和原生提供方保留在 Host，在已绑定 `ptc` preset 的 Agent 作用域中注册工具。沿用 browser-use runtime 的所有权方式，通过现有 Agent 事件和 `createScope()` 维护当前、新建和恢复的 Agent。preset 声明和保留版本保持不变，无需 preset 扩展注册表。启用保存 PTC 执行方式。若新会话默认模式不是 PTC，启用弹窗会说明仅针对 PTC 的设计并询问是否切换，确认后才通过现有设置表单保存默认值。关闭保留这些设置。Web 回归覆盖默认值的两种选择、即时启用、空白会话切换 preset、继承 preset 的子 Agent、销毁，以及反复开关时保留 PTC 状态。
diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
index a5e3035bd0..4f7d6bb80e 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
@@ -9,11 +9,11 @@
   en: b32a7ce6483b9b48
   zh: ec0938ad032b99d8
 /agent-note-application-consent-for-native-computer-use/decision:
-  en: 92247ff599c1103f
-  zh: 26845420a9711c83
+  en: 554368de34086124
+  zh: 79ac64bcd4f7a26b
 /agent-note-application-consent-for-native-computer-use/alternatives-considered:
-  en: 4693dcd217c4fedb
-  zh: 1dc9bf9067314006
+  en: 80cd5fd93a42d937
+  zh: 2a0e241b1b8c2e1d
 /agent-note-application-consent-for-native-computer-use/consequences:
-  en: 0146a69ab2086edc
-  zh: 4257bc1ab4432c3f
+  en: 4bda3366af65250a
+  zh: 7c83561b4db07284
diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
index 3fb91170e5..3c13cdb5cc 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
@@ -10,29 +10,38 @@ macOS privileges authorize an execution host, not a user's choice of target appl
 
 ## Decision
 
-The CUA executor owns application consent for every object-API and native-tool dispatch. It uses the existing User Questions service for human decisions and the provider's existing profile configuration for saved grants. General tool approval and operating-system privileges remain separate requirements. Arbitrary persistent PTC code and separately authorized shell tools retain their own execution authority.
+The CUA executor owns application consent for every object-API and native-tool dispatch. It uses the existing User Questions service for human decisions and the provider's existing profile configuration for saved grants. Its fixed approval presentation reuses the tool-approval card without adopting the session's tool-approval policy. Native icons and names are presentation metadata, excluded from saved identities and model results. General tool approval and operating-system privileges remain separate requirements. Arbitrary persistent PTC code and separately authorized shell tools retain their own execution authority.
 
-A saved identity combines the canonical executable path with a verified designated signing requirement, represented by a SHA-256 digest. The path prevents authorization from following a copied application, and the signing requirement distinguishes replacements while allowing matching signed updates. Unverifiable and ad-hoc applications receive task access only, tied to a process instance and Agent connection lifetime. Labels do not establish identity.
+System-permission buttons call the native helper on the DSH host and remain available to remote browsers. The [usage documentation](../../../../packages/experimental/client-ui-cua/README.md#use-this-package) explains where to complete authorization; the page has no persistent remote-access notice.
+
+A saved identity combines the canonical executable path with a verified designated signing requirement, represented by a SHA-256 digest. The path prevents authorization from following a copied application, and the signing requirement distinguishes replacements while allowing matching signed updates. Unverifiable and ad-hoc applications receive session access only, tied to a process instance. Labels do not establish identity.
 
 Cold application selection prepares an executable identity and handle without launching. The same consent decision guards the private launch continuation, and the helper checks the executable again before launch and binds the resulting process afterward. Signed selections retain the normal designated-requirement identity; an unverifiable executable uses a content identity for this pending selection and cannot create a saved grant. Preparing metadata before asking avoids starting an application the user refuses.
 
-Selections of the same application within one task are serialized, so a pending question does not produce competing decisions. Saved-grant additions read the current configuration inside one mutation queue. Refusals prevent another prompt within the task; an explicitly restored saved grant takes precedence at dispatch.
+Session decisions are kept in memory by Session ID and application identity. Agent disposal and helper replacement release native handles without discarding these decisions; provider disposal or DSH restart clears them. This scope covers follow-up turns without relying on the model to decide when a user intent has ended.
 
-Removing a saved grant invalidates Agent connections retaining the application's handles and cancels active operations; Agent/provider disposal awaits native connection cleanup. Reauthorization uses a fresh connection, so old app and window snapshots cannot become valid again. The [native object decision](2026-09-17-experimental-cua-object-api.md) continues to own process identity, coordinate semantics, and separation from the evaluator.
+Selections of the same application within one session are serialized, so a pending question does not produce competing decisions. Saved-grant additions and revocations share one mutation queue and read the current grant list inside it. Provider shutdown cancels writes still waiting for HMR admission; admitted writes settle before disposal completes. Refusals prevent another prompt until the user permits asking again; a restored saved grant takes precedence in both dispatch and the permission-page projection.
+
+Revocation invalidates the Agent connections that retain the application's handles, then awaits native cleanup. Reauthorization uses a fresh connection, so old app and window snapshots cannot become valid again. The [native object decision](2026-09-17-experimental-cua-object-api.md) continues to own process identity, coordinate semantics, and separation from the evaluator.
 
 ## Alternatives considered
 
 **Trust model instructions or hide controls.** Retained objects and direct tool calls can still reach native operations. The executor must enforce the decision at dispatch.
 
-**Persist application names or unsigned paths.** A replacement can reuse both. Durable grants require a verifiable signing identity; task-only access supports unsigned development applications without that promise.
+**Persist application names or unsigned paths.** A replacement can reuse both. Durable grants require a verifiable signing identity; session access supports unsigned development applications without that promise.
 
-**Add an approval database or Session control stream.** Profile settings already own user configuration, and User Questions already owns interactive answers.
+**Add an approval database or Session control stream.** Profile settings already own user configuration, and User Questions already owns interactive answers. The permission UI observes the provider and its owning settings namespace without another authorization store or event channel.
+
+**Disable permission buttons based on the browser address.** A user may operate the DSH host through screen sharing and complete authorization there. Port forwarding and proxies make the address an unreliable indication of whether the browser and DSH run on the same computer.
+
+**Use the nearest GUI ancestor as the permission target.** A source-built Desktop app can sit between Terminal and the helper while macOS still attributes Accessibility and Screen Recording to Terminal. Process responsibility supplies the system’s attribution; ancestry alone does not. The optional SPI adds compatibility risk, so lookup failure omits the application instead of guessing.
 
 **Keep the native context after revocation.** Its application lookup can return an earlier handle and retain window snapshots. Closing the Agent connection discards its native context through existing transport cleanup; preserving unrelated handles would require a native per-application retirement protocol.
 
 ## Consequences
 
-Revoking one application also invalidates other application handles on the same Agent connection. Those applications require fresh selection; saved grants remain reusable, while task grants expire. Other tasks with independent connections remain unaffected unless they also hold access to the revoked application.
+Refusing or revoking one application also invalidates other application handles on the same Agent connection. Those applications require fresh selection; session and saved grants remain reusable. Other sessions with independent connections remain unaffected unless they also hold access to the revoked application.
 
+Explicit enablement may start the shared helper for a read-only permission probe. The helper captures the application identified by macOS process responsibility before readiness releases the launcher, retaining its name and icon after reparenting. The optional native query is dynamically resolved; unavailable attribution uses generic system-prompt guidance. The macOS prompt remains authoritative. Enabling does not request macOS authorization or inspect application content.
 
 Application decisions and failure results are exercised through policy regressions and the recorded CUA scenario. Desktop binary distribution, signing, and packaged-host permissions remain outside the source-launch workflow.
diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
index 73d4640db7..42b667f485 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
@@ -10,29 +10,38 @@ macOS 权限授权执行宿主，不能表达用户允许操作哪些目标应
 
 ## 决策
 
-CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。人工决定复用 User Questions 服务，长期许可保存在 provider 的现有 profile 配置中。通用工具审批和操作系统权限仍是独立要求。任意 persistent PTC 代码和另行授权的 shell 工具保留各自的执行权限。
+CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。人工决定复用 User Questions 服务，长期许可保存在 provider 的现有 profile 配置中。通用工具审批和操作系统权限仍是独立要求。任意 persistent PTC 代码和另行授权的 shell 工具保留各自的执行权限。 固定审批呈现复用工具审批卡片，同时保留独立于会话工具审批策略的授权规则。本机图标和名称仅用于展示，不进入保存的身份信息或模型结果。
 
-长期身份由规范化可执行文件路径和经过验证的签名指定要求组成，以 SHA-256 摘要表示。路径阻止许可跟随应用副本，签名要求区分替换程序，并允许符合相同签名要求的更新。签名不可验证或使用 ad-hoc 签名的应用只能获得任务授权，许可绑定进程实例和 Agent 连接生命周期。显示名称不用于确定身份。
+系统权限按钮调用运行 DSH 的电脑上的原生 helper，远程访问时仍可使用。授权地点写在[使用说明](../../../../packages/experimental/client-ui-cua/README.zh.md#use-this-package)中，页面不常驻远程访问提示。
+
+长期身份由规范化可执行文件路径和经过验证的签名指定要求组成，以 SHA-256 摘要表示。路径阻止许可跟随应用副本，签名要求区分替换程序，并允许符合相同签名要求的更新。签名不可验证或使用 ad-hoc 签名的应用只能获得会话授权，许可绑定进程实例。显示名称不用于确定身份。
 
 选择尚未运行的应用时，先准备可执行文件身份和句柄，不立即启动。同一授权决定保护内部启动续接，helper 在启动前再次核对可执行文件，并在启动后绑定实际进程。已签名应用沿用签名指定要求身份；签名不可验证的程序使用本次待启动选择的内容身份，不能生成长期许可。先准备元数据再询问，可以避免启动用户拒绝的应用。
 
-同一任务对同一应用的选择串行执行，避免未完成的问题产生相互冲突的决定。长期许可的新增在同一写入队列内读取当前配置。拒绝会阻止任务内的再次询问；用户显式恢复的长期许可在执行检查时优先于旧拒绝记录。
+会话决定按 Session ID 和应用身份保存在内存中。Agent 销毁或 helper 重建会释放原生句柄，但保留授权决定；提供方卸载或 DSH 重启后清除。会话范围可以覆盖用户的后续指令，无须由模型判断一次用户意图何时结束。
 
-删除长期许可会使保留目标应用句柄的 Agent 连接失效，并取消活动操作；Agent 或提供方销毁时等待对应的原生连接清理。重新授权使用新连接，因此旧应用对象和窗口快照不能重新生效。[原生对象决策](2026-09-17-experimental-cua-object-api.zh.md)继续负责进程身份、坐标语义和与执行器分离的设计。
+同一会话对同一应用的选择串行执行，避免未完成的问题产生相互冲突的决定。长期许可的新增和撤销共用写入队列，并在队列内读取当前许可列表。提供方关闭时取消尚在等待 HMR 调度的写入，已开始的写入会在销毁完成前结束。拒绝会阻止再次询问，直到用户允许重询；重新添加的长期许可在执行检查和权限页中均优先于旧拒绝记录。
+
+撤销使保留目标应用句柄的 Agent 连接失效，并等待原生清理完成。重新授权使用新连接，因此旧应用对象和窗口快照不能重新生效。[原生对象决策](2026-09-17-experimental-cua-object-api.zh.md)继续负责进程身份、坐标语义和与执行器分离的设计。
 
 ## 考虑过的替代方案
 
 **依赖模型指引或隐藏控件。** 保留的对象和直接工具调用仍能到达原生操作。执行器必须在派发时检查用户决定。
 
-**保存应用名称或未签名路径。** 替换程序可以复用二者。长期许可需要可验证的签名身份；任务授权支持未签名的开发应用，但不承诺跨进程复用。
+**保存应用名称或未签名路径。** 替换程序可以复用二者。长期许可需要可验证的签名身份；会话授权支持未签名的开发应用，但不承诺跨进程复用。
 
-**新增审批数据库或 Session 控制流。** Profile settings 已负责用户配置，User Questions 已负责交互回答。
+**新增审批数据库或 Session 控制流。** Profile settings 已负责用户配置，User Questions 已负责交互回答。权限界面查询 provider，并监听其配置 namespace，无须另一份授权存储或事件通道。
+
+**根据浏览器访问地址禁用权限按钮。** 用户可能通过屏幕共享操作运行 DSH 的电脑，并在该电脑上完成授权。端口转发和代理使访问地址无法可靠判断浏览器与 DSH 是否运行在同一台电脑上。
+
+**把最近的 GUI 祖先当作授权对象。** 源码构建的 Desktop 可以位于 Terminal 和 helper 之间，但 macOS 仍将辅助功能和屏幕录制归属于 Terminal。责任进程记录提供系统认定的归属，仅凭父进程链无法确定。可选内部接口有兼容性风险，因此查询失败时省略应用信息，不再猜测。
 
 **撤销后保留原生状态。** 原生应用查找可能返回旧句柄并保留窗口快照。关闭 Agent 连接可以通过现有传输清理释放其原生状态；保留其他应用的句柄则需要新增按应用销毁状态的原生协议。
 
 ## 影响
 
-撤销一个应用也会使同一 Agent 连接中其他应用的句柄失效。这些应用需要重新选择；长期许可仍可复用，任务许可随之失效。其他任务使用独立连接，除非也持有被撤销应用的许可，否则不受影响。
+拒绝或撤销一个应用也会使同一 Agent 连接中其他应用的句柄失效。这些应用需要重新选择；会话许可和长期许可仍可复用。其他会话使用独立连接，除非也持有被撤销应用的许可，否则不受影响。
 
+显式启用可以启动共享 helper 进行只读权限检查。helper 在发布就绪状态、让启动器退出之前，记录 macOS 责任进程对应的应用，因此父进程改变后仍能提供应用名称和图标。可选的本机查询通过动态加载解析，无法取得归属时显示通用系统弹窗指引。授权归属仍以 macOS 提示为准。启用不会申请 macOS 授权或检查应用内容。
 
 授权决定和失败结果由策略回归测试及 CUA 录制会话验证。桌面安装包的二进制分发、签名和打包宿主权限不属于源码启动流程。
diff --git a/docs/capability-seams.i18n.yaml b/docs/capability-seams.i18n.yaml
index c2056c9963..b17f0977d5 100644
--- a/docs/capability-seams.i18n.yaml
+++ b/docs/capability-seams.i18n.yaml
@@ -6,5 +6,5 @@
   en: 41d772192075e133
   zh: 5ef3da69b4de1d8a
 /capability-seams-and-core-services:
-  en: c0c69a4be20d2157
-  zh: 9218ae36d2fe4a04
+  en: 5d74ca5fe890183e
+  zh: 6bda51e202364d97
diff --git a/docs/capability-seams.md b/docs/capability-seams.md
index 1b73ed96df..34c0fa6eba 100644
--- a/docs/capability-seams.md
+++ b/docs/capability-seams.md
@@ -50,6 +50,9 @@ flowchart LR
   svc_computerUse["ctx.computerUse<br/>Computer-use provider registration"]
   pkg_experimental_computer_use_cua_driver_mcp["experimental-computer-use-cua-driver-mcp"]
   pkg_experimental_computer_use_cua_driver_native["experimental-computer-use-cua-driver-native"]
+  pkg_cua["cua"]
+  svc_cuaAccess["ctx.cuaAccess<br/>Computer Use permission controls"]
+  pkg_client_ui_cua["client-ui-cua"]
   pkg_office_to_pdf["office-to-pdf"]
   svc_officeToPdf["ctx.officeToPdf<br/>Office to PDF conversion"]
   pkg_client_ui_sidebar_documentpreview["client-ui-sidebar-documentpreview"]
@@ -333,6 +336,7 @@ flowchart LR
   pkg_cordis_host_runner --> svc_dynamicCordisRunner
   pkg_credentials --> svc_credentials
   pkg_credentials_local --> svc_credentials
+  pkg_cua --> svc_cuaAccess
   pkg_deepseek_account --> svc_deepseekAccount
   pkg_deepseek_account_platform --> svc_deepseekAccount
   pkg_deepseek_llm_api_extensions --> svc_deepseekLlmApiExtensions
@@ -482,6 +486,7 @@ flowchart LR
   svc_credentials --> pkg_api_settings_controller
   svc_credentials --> pkg_llm_deepseek
   svc_credentials --> pkg_llm_pi_ai
+  svc_cuaAccess --> pkg_client_ui_cua
   svc_deepseekAccount --> pkg_api_account_controller
   svc_deepseekAccount --> pkg_llm_deepseek
   svc_deepseekLlmApiExtensions --> pkg_llm_deepseek
@@ -624,6 +629,7 @@ flowchart LR
 | `ctx.mcpResources` | `seam` | [`mcp-resources`](../packages/mcp/mcp-resources) | [`mcp-client`](../packages/mcp/mcp-client) | [`mcp-resources`](../packages/mcp/mcp-resources) | - | Connection-owned providers serve shared resource tools in the calling agent scope. |
 | `ctx.browserUse` | `seam` | [`browser-use`](../packages/browser-use/browser-use) | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp), [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp), [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp), [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp), [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | - | One provider-owned name per service instance. Providers own their tools and browser resources per live Session; the shared service has no browser operation API. |
 | `ctx.computerUse` | `seam` | [`computer-use`](../packages/computer-use/computer-use) | [`experimental-computer-use-cua-driver-mcp`](../packages/experimental/computer-use-cua-driver-mcp), [`experimental-computer-use-cua-driver-native`](../packages/experimental/computer-use-cua-driver-native) | [`experimental-computer-use-cua-driver-mcp`](../packages/experimental/computer-use-cua-driver-mcp), [`experimental-computer-use-cua-driver-native`](../packages/experimental/computer-use-cua-driver-native) | - | One provider-owned name per service instance. Each provider also owns its model tools; the service has no common action API, runtime selection, or Session workflow lock. |
+| `ctx.cuaAccess` | `core` | [`cua`](../packages/experimental/cua) | - | [`client-ui-cua`](../packages/experimental/client-ui-cua) | - | The native provider owns application consent and cancellation; the optional Client page queries and changes those decisions through its Remote. |
 | `ctx.officeToPdf` | `core` | [`office-to-pdf`](../packages/document/office-to-pdf) | - | [`client-ui-sidebar-documentpreview`](../packages/client/ui-sidebar-documentpreview) | - | Authorized Office bytes are converted on the Host using the declared native target engine, or Node WASM when no native target is declared. |
 | `ctx.attachments` | `seam` | [`attachment`](../packages/attachment/attachment) | [`attachment-local`](../packages/attachment/attachment-local) | [`api-session-controller`](../packages/api/session-controller), [`tool-fs`](../packages/fs/tool-fs), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`llm-deepseek`](../packages/llm/llm-deepseek) | - | The host commits accepted images before session events; provider adapters resolve authorized durable references into provider-native content. |
 | `ctx.fileUploads` | `core` | [`client-file-upload`](../packages/client/file-upload) | - | [`api-session-controller`](../packages/api/session-controller) | - | Owns streaming intake, durable storage, and staged receipt lifetime; the Session controller binds receipts to accepted submissions. |
diff --git a/docs/capability-seams.zh.md b/docs/capability-seams.zh.md
index 7e66fc677a..9ea3b9da85 100644
--- a/docs/capability-seams.zh.md
+++ b/docs/capability-seams.zh.md
@@ -52,6 +52,9 @@ flowchart LR
   svc_computerUse["ctx.computerUse<br/>Computer-use provider registration"]
   pkg_experimental_computer_use_cua_driver_mcp["experimental-computer-use-cua-driver-mcp"]
   pkg_experimental_computer_use_cua_driver_native["experimental-computer-use-cua-driver-native"]
+  pkg_cua["cua"]
+  svc_cuaAccess["ctx.cuaAccess<br/>Computer Use permission controls"]
+  pkg_client_ui_cua["client-ui-cua"]
   pkg_office_to_pdf["office-to-pdf"]
   svc_officeToPdf["ctx.officeToPdf<br/>Office to PDF conversion"]
   pkg_client_ui_sidebar_documentpreview["client-ui-sidebar-documentpreview"]
@@ -335,6 +338,7 @@ flowchart LR
   pkg_cordis_host_runner --> svc_dynamicCordisRunner
   pkg_credentials --> svc_credentials
   pkg_credentials_local --> svc_credentials
+  pkg_cua --> svc_cuaAccess
   pkg_deepseek_account --> svc_deepseekAccount
   pkg_deepseek_account_platform --> svc_deepseekAccount
   pkg_deepseek_llm_api_extensions --> svc_deepseekLlmApiExtensions
@@ -484,6 +488,7 @@ flowchart LR
   svc_credentials --> pkg_api_settings_controller
   svc_credentials --> pkg_llm_deepseek
   svc_credentials --> pkg_llm_pi_ai
+  svc_cuaAccess --> pkg_client_ui_cua
   svc_deepseekAccount --> pkg_api_account_controller
   svc_deepseekAccount --> pkg_llm_deepseek
   svc_deepseekLlmApiExtensions --> pkg_llm_deepseek
@@ -626,6 +631,7 @@ flowchart LR
 | `ctx.mcpResources` | `seam` | [`mcp-resources`](../packages/mcp/mcp-resources) | [`mcp-client`](../packages/mcp/mcp-client) | [`mcp-resources`](../packages/mcp/mcp-resources) | - | 连接所有者提供的操作在调用 agent 的作用域内服务于共享资源工具。 |
 | `ctx.browserUse` | `seam` | [`browser-use`](../packages/browser-use/browser-use) | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp), [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp), [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp), [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp), [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | - | 每个服务实例注册一个提供方拥有的名称。提供方按实时 Session 拥有自己的工具与浏览器资源；共享服务不提供浏览器操作 API。 |
 | `ctx.computerUse` | `seam` | [`computer-use`](../packages/computer-use/computer-use) | [`experimental-computer-use-cua-driver-mcp`](../packages/experimental/computer-use-cua-driver-mcp), [`experimental-computer-use-cua-driver-native`](../packages/experimental/computer-use-cua-driver-native) | [`experimental-computer-use-cua-driver-mcp`](../packages/experimental/computer-use-cua-driver-mcp), [`experimental-computer-use-cua-driver-native`](../packages/experimental/computer-use-cua-driver-native) | - | 每个服务实例只注册一个提供方自定的名称。各提供方也拥有自己的模型工具；服务不提供通用操作 API、运行时选择或 Session 流程锁。 |
+| `ctx.cuaAccess` | `core` | [`cua`](../packages/experimental/cua) | - | [`client-ui-cua`](../packages/experimental/client-ui-cua) | - | 原生 provider 负责应用授权和取消操作；可选的 Client 权限页面通过 Remote 查询和修改授权。 |
 | `ctx.officeToPdf` | `core` | [`office-to-pdf`](../packages/document/office-to-pdf) | - | [`client-ui-sidebar-documentpreview`](../packages/client/ui-sidebar-documentpreview) | - | 已授权的 Office 字节在宿主上使用已声明的原生目标引擎转换；未声明原生目标时使用 Node WASM。 |
 | `ctx.attachments` | `seam` | [`attachment`](../packages/attachment/attachment) | [`attachment-local`](../packages/attachment/attachment-local) | [`api-session-controller`](../packages/api/session-controller), [`tool-fs`](../packages/fs/tool-fs), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`llm-deepseek`](../packages/llm/llm-deepseek) | - | 宿主会在会话事件之前提交已接受的图片；提供方适配器将已授权的持久引用解析为提供方原生内容。 |
 | `ctx.fileUploads` | `core` | [`client-file-upload`](../packages/client/file-upload) | - | [`api-session-controller`](../packages/api/session-controller) | - | 负责流式接收、持久存储和暂存回执生命周期；Session Controller 将回执绑定到已接受的提交。 |
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 60484ba795..ec773fabcd 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -2423,7 +2423,7 @@ export interface PlanModeConfig {
 ## `@deepseek-ai/dsh-plugin-manager`
 
 - `inject`: `loader` · `profileContext`
-- `source`: [`packages/boot/plugin-manager/src/index.ts:42`](../packages/boot/plugin-manager/src/index.ts)
+- `source`: [`packages/boot/plugin-manager/src/index.ts:43`](../packages/boot/plugin-manager/src/index.ts)
 
 ```ts config-catalog
 /** The pnpm executable, registries, and limits for diagnostics, lookups and connection checks. */
@@ -4609,6 +4609,7 @@ These load from a `cordis.yml` entry with no `config:` block; they declare no co
 | `@deepseek-ai/dsh-client-ui-commands` | — | [`packages/client/ui-commands/src/index.ts`](../packages/client/ui-commands/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-conversation` | — | [`packages/client/ui-conversation/src/index.ts`](../packages/client/ui-conversation/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-cordis` | — | [`packages/extensions/ui-cordis/src/index.ts`](../packages/extensions/ui-cordis/src/index.ts) |
+| `@deepseek-ai/dsh-client-ui-cua` | — | [`packages/experimental/client-ui-cua/src/index.ts`](../packages/experimental/client-ui-cua/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-deepseek-model-label-1017` | — | [`packages/client/ui-deepseek-model-label-1017/src/index.ts`](../packages/client/ui-deepseek-model-label-1017/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-deliverables` | `systemPrompt` · `connection` · `sessionQuery` · `sessionController` · `workspaceFiles` · `fs` · `sandboxPolicy` · `workspaceChanges` | [`packages/client/ui-deliverables/src/index.ts`](../packages/client/ui-deliverables/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-directory-picker-browse` | — | [`packages/client/ui-directory-picker-browse/src/index.ts`](../packages/client/ui-directory-picker-browse/src/index.ts) |
@@ -4746,6 +4747,7 @@ Imported as libraries by other packages; a `cordis.yml` cannot load them.
 | `@deepseek-ai/dsh-client-web` | — | [`packages/client/web/src/index.ts`](../packages/client/web/src/index.ts) |
 | `@deepseek-ai/dsh-cmdline` | — | [`packages/boot/cmdline/src/index.ts`](../packages/boot/cmdline/src/index.ts) |
 | `@deepseek-ai/dsh-cua` | — | [`packages/experimental/cua/src/index.ts`](../packages/experimental/cua/src/index.ts) |
+| `@deepseek-ai/dsh-cua-bundle` | — | [`packages/experimental/cua-bundle/src/index.ts`](../packages/experimental/cua-bundle/src/index.ts) |
 | `@deepseek-ai/dsh-deque` | — | [`packages/util/deque/src/index.ts`](../packages/util/deque/src/index.ts) |
 | `@deepseek-ai/dsh-experimental-agent-team-profile` | — | [`packages/experimental/agent-team-profile/src/index.ts`](../packages/experimental/agent-team-profile/src/index.ts) |
 | `@deepseek-ai/dsh-experimental-badge-skill-bundle` | — | [`packages/experimental/badge-skill-bundle/src/index.ts`](../packages/experimental/badge-skill-bundle/src/index.ts) |
diff --git a/docs/config-catalog.zh.md b/docs/config-catalog.zh.md
index 8460650010..6b26524904 100644
--- a/docs/config-catalog.zh.md
+++ b/docs/config-catalog.zh.md
@@ -2425,7 +2425,7 @@ export interface PlanModeConfig {
 ## `@deepseek-ai/dsh-plugin-manager`
 
 - `inject`: `loader` · `profileContext`
-- `source`: [`packages/boot/plugin-manager/src/index.ts:42`](../packages/boot/plugin-manager/src/index.ts)
+- `source`: [`packages/boot/plugin-manager/src/index.ts:43`](../packages/boot/plugin-manager/src/index.ts)
 
 ```ts config-catalog
 /** The pnpm executable, registries, and limits for diagnostics, lookups and connection checks. */
@@ -4611,6 +4611,7 @@ export interface Config {
 | `@deepseek-ai/dsh-client-ui-commands` | — | [`packages/client/ui-commands/src/index.ts`](../packages/client/ui-commands/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-conversation` | — | [`packages/client/ui-conversation/src/index.ts`](../packages/client/ui-conversation/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-cordis` | — | [`packages/extensions/ui-cordis/src/index.ts`](../packages/extensions/ui-cordis/src/index.ts) |
+| `@deepseek-ai/dsh-client-ui-cua` | — | [`packages/experimental/client-ui-cua/src/index.ts`](../packages/experimental/client-ui-cua/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-deepseek-model-label-1017` | — | [`packages/client/ui-deepseek-model-label-1017/src/index.ts`](../packages/client/ui-deepseek-model-label-1017/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-deliverables` | `systemPrompt` · `connection` · `sessionQuery` · `sessionController` · `workspaceFiles` · `fs` · `sandboxPolicy` · `workspaceChanges` | [`packages/client/ui-deliverables/src/index.ts`](../packages/client/ui-deliverables/src/index.ts) |
 | `@deepseek-ai/dsh-client-ui-directory-picker-browse` | — | [`packages/client/ui-directory-picker-browse/src/index.ts`](../packages/client/ui-directory-picker-browse/src/index.ts) |
@@ -4748,6 +4749,7 @@ export interface Config {
 | `@deepseek-ai/dsh-client-web` | — | [`packages/client/web/src/index.ts`](../packages/client/web/src/index.ts) |
 | `@deepseek-ai/dsh-cmdline` | — | [`packages/boot/cmdline/src/index.ts`](../packages/boot/cmdline/src/index.ts) |
 | `@deepseek-ai/dsh-cua` | — | [`packages/experimental/cua/src/index.ts`](../packages/experimental/cua/src/index.ts) |
+| `@deepseek-ai/dsh-cua-bundle` | — | [`packages/experimental/cua-bundle/src/index.ts`](../packages/experimental/cua-bundle/src/index.ts) |
 | `@deepseek-ai/dsh-deque` | — | [`packages/util/deque/src/index.ts`](../packages/util/deque/src/index.ts) |
 | `@deepseek-ai/dsh-experimental-agent-team-profile` | — | [`packages/experimental/agent-team-profile/src/index.ts`](../packages/experimental/agent-team-profile/src/index.ts) |
 | `@deepseek-ai/dsh-experimental-badge-skill-bundle` | — | [`packages/experimental/badge-skill-bundle/src/index.ts`](../packages/experimental/badge-skill-bundle/src/index.ts) |
diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md
index 3d1bbaf987..bddc1d7d73 100644
--- a/docs/event-producer-consumer.md
+++ b/docs/event-producer-consumer.md
@@ -9,9 +9,9 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | Event | Mode | Declared in | Dispatchers | Listeners |
 | --- | --- | --- | --- | --- |
 | `agent-loop/config-start-failed` | `emit` | [`packages/core/agent-loop/src/index.ts:249`](../packages/core/agent-loop/src/index.ts) | [`agent-loop`](../packages/core/agent-loop) (`events.dispatch`) | - |
-| `agent-preset/selected` | `emit` | [`packages/preset/agent-preset-registry/src/types.ts:69`](../packages/preset/agent-preset-registry/src/types.ts) | [`agent-preset-registry`](../packages/preset/agent-preset-registry) (`emit`) | `remotes` |
+| `agent-preset/selected` | `emit` | [`packages/preset/agent-preset-registry/src/types.ts:69`](../packages/preset/agent-preset-registry/src/types.ts) | [`agent-preset-registry`](../packages/preset/agent-preset-registry) (`emit`) | [`cua`](../packages/experimental/cua), `remotes` |
 | `agent/assistant-stream` | `emit` | [`packages/core/agent/src/runtime-types.ts:363`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`headless`](../packages/bundle/headless), `session-controller` |
-| `agent/created` | `serial` | [`packages/core/agent/src/runtime-types.ts:261`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`serial`) | `agent-team`, `browser-use-runtime`, `claude-code-mods`, [`file-reference-local`](../packages/context/file-reference-local), [`goal`](../packages/goal/goal), [`goal-round-driver`](../packages/goal/goal-round-driver), [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`loader-smoke`](../packages/test-support/loader-smoke), `session-controller`, `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
+| `agent/created` | `serial` | [`packages/core/agent/src/runtime-types.ts:261`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`serial`) | `agent-team`, `browser-use-runtime`, `claude-code-mods`, [`cua`](../packages/experimental/cua), [`file-reference-local`](../packages/context/file-reference-local), [`goal`](../packages/goal/goal), [`goal-round-driver`](../packages/goal/goal-round-driver), [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`loader-smoke`](../packages/test-support/loader-smoke), `session-controller`, `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
 | `agent/disposed` | `emit` | [`packages/core/agent/src/runtime-types.ts:270`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`agent-loop`](../packages/core/agent-loop), `claude-code-mods`, [`file-reference-local`](../packages/context/file-reference-local), [`goal-round-driver`](../packages/goal/goal-round-driver), `session-controller`, [`subagent`](../packages/subagent/subagent), `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
 | `agent/error` | `emit` | [`packages/core/agent/src/runtime-types.ts:393`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/acp/acp), [`deepseek-account`](../packages/credentials/deepseek-account), [`goal-round-driver`](../packages/goal/goal-round-driver), [`headless`](../packages/bundle/headless), `server`, `session-controller`, [`session-telemetry`](../packages/session/session-telemetry), [`subagent`](../packages/subagent/subagent) |
 | `agent/inbox/claimed` | `emit` | [`packages/core/agent/src/runtime-types.ts:299`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/acp/acp), [`goal-round-driver`](../packages/goal/goal-round-driver), [`subagent`](../packages/subagent/subagent), [`tool-jobs`](../packages/jobs/tool-jobs), [`user-questions`](../packages/interaction/user-questions) |
@@ -56,9 +56,9 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `llm/adapters-updated` | `emit` | [`packages/llm/llm/src/types.ts:23`](../packages/llm/llm/src/types.ts) | [`llm`](../packages/llm/llm) (`events.dispatch`) | [`acp`](../packages/acp/acp), `remotes` |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:75`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`llm-replay`](../packages/test-support/llm-replay), [`session-checkpoint-policy`](../packages/session/session-checkpoint-policy), [`session-title`](../packages/session/session-title) |
 | `permission-presets/catalog-changed` | `emit` | [`packages/interaction/permission-presets/src/types.ts:48`](../packages/interaction/permission-presets/src/types.ts) | [`permission-presets`](../packages/interaction/permission-presets) (`events.dispatch`) | `remotes` |
-| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:269`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:275`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:282`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:271`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:277`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:284`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
 | `plugin-market/changed` | `emit` | [`packages/boot/plugin-market/src/types.ts:136`](../packages/boot/plugin-market/src/types.ts) | [`plugin-market`](../packages/boot/plugin-market) (`emit`) | `remotes` |
 | `schedule/changed` | `emit` | [`packages/schedule/schedule/src/types.ts:478`](../packages/schedule/schedule/src/types.ts) | [`schedule`](../packages/schedule/schedule) (`emit`) | `remotes` |
 | `session-telemetry/record` | `waterfall` | [`packages/session/session-telemetry/src/index.ts:44`](../packages/session/session-telemetry/src/index.ts) | [`session-telemetry`](../packages/session/session-telemetry) (`waterfall`) | - |
@@ -80,7 +80,7 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `tools/pre-execute` | `waterfall` | [`packages/core/tools/src/index.ts:154`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | `auto-review`, [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`tool-jobs`](../packages/jobs/tool-jobs), [`workspace-changes`](../packages/deliverables/workspace-changes) |
 | `tools/ptc-dispatch-log` | `waterfall` | [`packages/core/tools/src/index.ts:191`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`spill-policy`](../packages/spill/spill-policy) |
 | `tools/result` | `emit` | [`packages/core/tools/src/index.ts:199`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`events.dispatch`) | [`agent-instructions`](../packages/context/agent-instructions), `claude-code-mods`, [`subagent`](../packages/subagent/subagent), [`tool-present`](../packages/deliverables/tool-present) |
-| `user-questions/request` | `waterfall` | [`packages/interaction/user-questions/src/types.ts:157`](../packages/interaction/user-questions/src/types.ts) | [`user-questions`](../packages/interaction/user-questions) (`waterfall`) | `remotes` |
+| `user-questions/request` | `waterfall` | [`packages/interaction/user-questions/src/types.ts:174`](../packages/interaction/user-questions/src/types.ts) | [`user-questions`](../packages/interaction/user-questions) (`waterfall`) | `remotes` |
 | `webserver/index-inject` | `emit` | [`packages/host/webserver/src/index.ts:39`](../packages/host/webserver/src/index.ts) | `webserver` (`emit`) | `connection`, `inspector`, `modules`, `remote-access`, `shortcuts`, `ui-sidebar-documentpreview`, `ui-theme` |
 | `workflow/agent-end` | `emit` | [`packages/workflow/workflow/src/index.ts:79`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | [`tool-workflow`](../packages/workflow/tool-workflow) |
 | `workflow/agent-start` | `emit` | [`packages/workflow/workflow/src/index.ts:68`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | [`tool-workflow`](../packages/workflow/tool-workflow) |
diff --git a/docs/event-producer-consumer.zh.md b/docs/event-producer-consumer.zh.md
index 213180e82e..48debfd18b 100644
--- a/docs/event-producer-consumer.zh.md
+++ b/docs/event-producer-consumer.zh.md
@@ -11,9 +11,9 @@
 | Event | Mode | Declared in | Dispatchers | Listeners |
 | --- | --- | --- | --- | --- |
 | `agent-loop/config-start-failed` | `emit` | [`packages/core/agent-loop/src/index.ts:249`](../packages/core/agent-loop/src/index.ts) | [`agent-loop`](../packages/core/agent-loop) (`events.dispatch`) | - |
-| `agent-preset/selected` | `emit` | [`packages/preset/agent-preset-registry/src/types.ts:69`](../packages/preset/agent-preset-registry/src/types.ts) | [`agent-preset-registry`](../packages/preset/agent-preset-registry) (`emit`) | `remotes` |
+| `agent-preset/selected` | `emit` | [`packages/preset/agent-preset-registry/src/types.ts:69`](../packages/preset/agent-preset-registry/src/types.ts) | [`agent-preset-registry`](../packages/preset/agent-preset-registry) (`emit`) | [`cua`](../packages/experimental/cua), `remotes` |
 | `agent/assistant-stream` | `emit` | [`packages/core/agent/src/runtime-types.ts:363`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`headless`](../packages/bundle/headless), `session-controller` |
-| `agent/created` | `serial` | [`packages/core/agent/src/runtime-types.ts:261`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`serial`) | `agent-team`, `browser-use-runtime`, `claude-code-mods`, [`file-reference-local`](../packages/context/file-reference-local), [`goal`](../packages/goal/goal), [`goal-round-driver`](../packages/goal/goal-round-driver), [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`loader-smoke`](../packages/test-support/loader-smoke), `session-controller`, `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
+| `agent/created` | `serial` | [`packages/core/agent/src/runtime-types.ts:261`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`serial`) | `agent-team`, `browser-use-runtime`, `claude-code-mods`, [`cua`](../packages/experimental/cua), [`file-reference-local`](../packages/context/file-reference-local), [`goal`](../packages/goal/goal), [`goal-round-driver`](../packages/goal/goal-round-driver), [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`loader-smoke`](../packages/test-support/loader-smoke), `session-controller`, `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
 | `agent/disposed` | `emit` | [`packages/core/agent/src/runtime-types.ts:270`](../packages/core/agent/src/runtime-types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`agent-loop`](../packages/core/agent-loop), `claude-code-mods`, [`file-reference-local`](../packages/context/file-reference-local), [`goal-round-driver`](../packages/goal/goal-round-driver), `session-controller`, [`subagent`](../packages/subagent/subagent), `tool-agent-team`, [`tool-subagent`](../packages/subagent/tool-subagent) |
 | `agent/error` | `emit` | [`packages/core/agent/src/runtime-types.ts:393`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/acp/acp), [`deepseek-account`](../packages/credentials/deepseek-account), [`goal-round-driver`](../packages/goal/goal-round-driver), [`headless`](../packages/bundle/headless), `server`, `session-controller`, [`session-telemetry`](../packages/session/session-telemetry), [`subagent`](../packages/subagent/subagent) |
 | `agent/inbox/claimed` | `emit` | [`packages/core/agent/src/runtime-types.ts:299`](../packages/core/agent/src/runtime-types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/acp/acp), [`goal-round-driver`](../packages/goal/goal-round-driver), [`subagent`](../packages/subagent/subagent), [`tool-jobs`](../packages/jobs/tool-jobs), [`user-questions`](../packages/interaction/user-questions) |
@@ -58,9 +58,9 @@
 | `llm/adapters-updated` | `emit` | [`packages/llm/llm/src/types.ts:23`](../packages/llm/llm/src/types.ts) | [`llm`](../packages/llm/llm) (`events.dispatch`) | [`acp`](../packages/acp/acp), `remotes` |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:75`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`llm-replay`](../packages/test-support/llm-replay), [`session-checkpoint-policy`](../packages/session/session-checkpoint-policy), [`session-title`](../packages/session/session-title) |
 | `permission-presets/catalog-changed` | `emit` | [`packages/interaction/permission-presets/src/types.ts:48`](../packages/interaction/permission-presets/src/types.ts) | [`permission-presets`](../packages/interaction/permission-presets) (`events.dispatch`) | `remotes` |
-| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:269`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:275`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:282`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:271`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:277`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:284`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
 | `plugin-market/changed` | `emit` | [`packages/boot/plugin-market/src/types.ts:136`](../packages/boot/plugin-market/src/types.ts) | [`plugin-market`](../packages/boot/plugin-market) (`emit`) | `remotes` |
 | `schedule/changed` | `emit` | [`packages/schedule/schedule/src/types.ts:478`](../packages/schedule/schedule/src/types.ts) | [`schedule`](../packages/schedule/schedule) (`emit`) | `remotes` |
 | `session-telemetry/record` | `waterfall` | [`packages/session/session-telemetry/src/index.ts:44`](../packages/session/session-telemetry/src/index.ts) | [`session-telemetry`](../packages/session/session-telemetry) (`waterfall`) | - |
@@ -82,7 +82,7 @@
 | `tools/pre-execute` | `waterfall` | [`packages/core/tools/src/index.ts:154`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | `auto-review`, [`hooks-claude-code`](../packages/experimental/hooks-claude-code), [`hooks-codex`](../packages/experimental/hooks-codex), [`tool-jobs`](../packages/jobs/tool-jobs), [`workspace-changes`](../packages/deliverables/workspace-changes) |
 | `tools/ptc-dispatch-log` | `waterfall` | [`packages/core/tools/src/index.ts:191`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`spill-policy`](../packages/spill/spill-policy) |
 | `tools/result` | `emit` | [`packages/core/tools/src/index.ts:199`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`events.dispatch`) | [`agent-instructions`](../packages/context/agent-instructions), `claude-code-mods`, [`subagent`](../packages/subagent/subagent), [`tool-present`](../packages/deliverables/tool-present) |
-| `user-questions/request` | `waterfall` | [`packages/interaction/user-questions/src/types.ts:157`](../packages/interaction/user-questions/src/types.ts) | [`user-questions`](../packages/interaction/user-questions) (`waterfall`) | `remotes` |
+| `user-questions/request` | `waterfall` | [`packages/interaction/user-questions/src/types.ts:174`](../packages/interaction/user-questions/src/types.ts) | [`user-questions`](../packages/interaction/user-questions) (`waterfall`) | `remotes` |
 | `webserver/index-inject` | `emit` | [`packages/host/webserver/src/index.ts:39`](../packages/host/webserver/src/index.ts) | `webserver` (`emit`) | `connection`, `inspector`, `modules`, `remote-access`, `shortcuts`, `ui-sidebar-documentpreview`, `ui-theme` |
 | `workflow/agent-end` | `emit` | [`packages/workflow/workflow/src/index.ts:79`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | [`tool-workflow`](../packages/workflow/tool-workflow) |
 | `workflow/agent-start` | `emit` | [`packages/workflow/workflow/src/index.ts:68`](../packages/workflow/workflow/src/index.ts) | [`workflow`](../packages/workflow/workflow) (`events.dispatch`) | [`tool-workflow`](../packages/workflow/tool-workflow) |
diff --git a/docs/module-graph.md b/docs/module-graph.md
index cd5c488ee3..a460119e58 100644
--- a/docs/module-graph.md
+++ b/docs/module-graph.md
@@ -246,7 +246,9 @@ flowchart TD
     pkg_office_to_pdf["office-to-pdf"]
   end
   subgraph group_experimental["packages/experimental"]
+    pkg_client_ui_cua["client-ui-cua"]
     pkg_cua["cua"]
+    pkg_cua_bundle["cua-bundle"]
     pkg_experimental_agent_team["experimental-agent-team"]
     pkg_experimental_agent_team_profile["experimental-agent-team-profile"]
     pkg_experimental_api_speech_to_text["experimental-api-speech-to-text"]
@@ -903,14 +905,6 @@ flowchart TD
   pkg_workspace_changes --> pkg_session
   pkg_workspace_changes --> pkg_subprocess
   pkg_workspace_changes --> pkg_tools
-  pkg_cua --> pkg_agent
-  pkg_cua --> pkg_attachment
-  pkg_cua --> pkg_computer_use
-  pkg_cua --> pkg_llm
-  pkg_cua --> pkg_subprocess
-  pkg_cua --> pkg_system_prompt
-  pkg_cua --> pkg_tools
-  pkg_cua --> pkg_user_questions
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_agent
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_browser_use
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_system_prompt
@@ -1074,6 +1068,16 @@ flowchart TD
   pkg_api_settings_controller --> pkg_settings
   pkg_api_settings_controller --> pkg_typert_protocol
   pkg_web_app --> pkg_shell_env
+  pkg_cua --> pkg_agent
+  pkg_cua --> pkg_agent_preset_registry
+  pkg_cua --> pkg_attachment
+  pkg_cua --> pkg_computer_use
+  pkg_cua --> pkg_llm
+  pkg_cua --> pkg_scope
+  pkg_cua --> pkg_subprocess
+  pkg_cua --> pkg_system_prompt
+  pkg_cua --> pkg_tools
+  pkg_cua --> pkg_user_questions
   pkg_experimental_auto_review --> pkg_agent
   pkg_experimental_auto_review --> pkg_agent_instructions
   pkg_experimental_auto_review --> pkg_llm
@@ -1528,6 +1532,8 @@ flowchart TD
 | [`client-web`](../packages/client/web) | `client` | — |
 | [`credentials`](../packages/credentials/credentials) | `credentials` | — |
 | [`office-to-pdf`](../packages/document/office-to-pdf) | `document` | — |
+| [`client-ui-cua`](../packages/experimental/client-ui-cua) | `experimental` | — |
+| [`cua-bundle`](../packages/experimental/cua-bundle) | `experimental` | — |
 | [`experimental-agent-team-profile`](../packages/experimental/agent-team-profile) | `experimental` | — |
 | [`experimental-badge-skill-bundle`](../packages/experimental/badge-skill-bundle) | `experimental` | — |
 | [`experimental-client-ui-agent-team`](../packages/experimental/client-ui-agent-team) | `experimental` | — |
@@ -1692,7 +1698,6 @@ flowchart TD
 | [`file-reference-local`](../packages/context/file-reference-local) | `context` | [`agent`](../packages/core/agent), [`file-reference`](../packages/context/file-reference), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`tool-present`](../packages/deliverables/tool-present) | `deliverables` | [`agent`](../packages/core/agent), [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`workspace-changes`](../packages/deliverables/workspace-changes) | `deliverables` | [`agent`](../packages/core/agent), [`fs`](../packages/fs/fs), [`session`](../packages/core/session), [`subprocess`](../packages/subprocess/subprocess), [`tools`](../packages/core/tools) |
-| [`cua`](../packages/experimental/cua) | `experimental` | [`agent`](../packages/core/agent), [`attachment`](../packages/attachment/attachment), [`computer-use`](../packages/computer-use/computer-use), [`llm`](../packages/llm/llm), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-questions`](../packages/interaction/user-questions) |
 | [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
@@ -1725,6 +1730,7 @@ flowchart TD
 | [`session-query`](../packages/session-query/session-query) | `session-query` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-title`](../packages/session/session-title), [`tool-todo`](../packages/todo/tool-todo) |
 | [`api-settings-controller`](../packages/api/settings-controller) | `api` | [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`credentials`](../packages/credentials/credentials), [`native-command`](../packages/util/native-command), [`session`](../packages/core/session), [`settings`](../packages/settings/settings), [`typert-protocol`](../packages/typert/protocol) |
 | [`web-app`](../packages/bundle/web-app) | `bundle` | [`shell-env`](../packages/shell/shell-env) |
+| [`cua`](../packages/experimental/cua) | `experimental` | [`agent`](../packages/core/agent), [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`attachment`](../packages/attachment/attachment), [`computer-use`](../packages/computer-use/computer-use), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-questions`](../packages/interaction/user-questions) |
 | [`experimental-auto-review`](../packages/experimental/auto-review) | `experimental` | [`agent`](../packages/core/agent), [`agent-instructions`](../packages/context/agent-instructions), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`webhook`](../packages/experimental/webhook) | `experimental` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`session-title`](../packages/session/session-title), [`workspace`](../packages/workspace/workspace) |
 | [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`app-boot`](../packages/boot/app-boot), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`tools`](../packages/core/tools) |
diff --git a/docs/module-graph.zh.md b/docs/module-graph.zh.md
index 54d9623382..e7765fad95 100644
--- a/docs/module-graph.zh.md
+++ b/docs/module-graph.zh.md
@@ -248,7 +248,9 @@ flowchart TD
     pkg_office_to_pdf["office-to-pdf"]
   end
   subgraph group_experimental["packages/experimental"]
+    pkg_client_ui_cua["client-ui-cua"]
     pkg_cua["cua"]
+    pkg_cua_bundle["cua-bundle"]
     pkg_experimental_agent_team["experimental-agent-team"]
     pkg_experimental_agent_team_profile["experimental-agent-team-profile"]
     pkg_experimental_api_speech_to_text["experimental-api-speech-to-text"]
@@ -905,14 +907,6 @@ flowchart TD
   pkg_workspace_changes --> pkg_session
   pkg_workspace_changes --> pkg_subprocess
   pkg_workspace_changes --> pkg_tools
-  pkg_cua --> pkg_agent
-  pkg_cua --> pkg_attachment
-  pkg_cua --> pkg_computer_use
-  pkg_cua --> pkg_llm
-  pkg_cua --> pkg_subprocess
-  pkg_cua --> pkg_system_prompt
-  pkg_cua --> pkg_tools
-  pkg_cua --> pkg_user_questions
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_agent
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_browser_use
   pkg_experimental_browser_use_chrome_devtools_mcp --> pkg_system_prompt
@@ -1076,6 +1070,16 @@ flowchart TD
   pkg_api_settings_controller --> pkg_settings
   pkg_api_settings_controller --> pkg_typert_protocol
   pkg_web_app --> pkg_shell_env
+  pkg_cua --> pkg_agent
+  pkg_cua --> pkg_agent_preset_registry
+  pkg_cua --> pkg_attachment
+  pkg_cua --> pkg_computer_use
+  pkg_cua --> pkg_llm
+  pkg_cua --> pkg_scope
+  pkg_cua --> pkg_subprocess
+  pkg_cua --> pkg_system_prompt
+  pkg_cua --> pkg_tools
+  pkg_cua --> pkg_user_questions
   pkg_experimental_auto_review --> pkg_agent
   pkg_experimental_auto_review --> pkg_agent_instructions
   pkg_experimental_auto_review --> pkg_llm
@@ -1530,6 +1534,8 @@ flowchart TD
 | [`client-web`](../packages/client/web) | `client` | — |
 | [`credentials`](../packages/credentials/credentials) | `credentials` | — |
 | [`office-to-pdf`](../packages/document/office-to-pdf) | `document` | — |
+| [`client-ui-cua`](../packages/experimental/client-ui-cua) | `experimental` | — |
+| [`cua-bundle`](../packages/experimental/cua-bundle) | `experimental` | — |
 | [`experimental-agent-team-profile`](../packages/experimental/agent-team-profile) | `experimental` | — |
 | [`experimental-badge-skill-bundle`](../packages/experimental/badge-skill-bundle) | `experimental` | — |
 | [`experimental-client-ui-agent-team`](../packages/experimental/client-ui-agent-team) | `experimental` | — |
@@ -1694,7 +1700,6 @@ flowchart TD
 | [`file-reference-local`](../packages/context/file-reference-local) | `context` | [`agent`](../packages/core/agent), [`file-reference`](../packages/context/file-reference), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`tool-present`](../packages/deliverables/tool-present) | `deliverables` | [`agent`](../packages/core/agent), [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-projection`](../packages/session/session-projection), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`workspace-changes`](../packages/deliverables/workspace-changes) | `deliverables` | [`agent`](../packages/core/agent), [`fs`](../packages/fs/fs), [`session`](../packages/core/session), [`subprocess`](../packages/subprocess/subprocess), [`tools`](../packages/core/tools) |
-| [`cua`](../packages/experimental/cua) | `experimental` | [`agent`](../packages/core/agent), [`attachment`](../packages/attachment/attachment), [`computer-use`](../packages/computer-use/computer-use), [`llm`](../packages/llm/llm), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-questions`](../packages/interaction/user-questions) |
 | [`experimental-browser-use-chrome-devtools-mcp`](../packages/experimental/browser-use-chrome-devtools-mcp) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`experimental-browser-use-playwright-mcp`](../packages/experimental/browser-use-playwright-mcp) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`experimental-browser-use-stagehand-native`](../packages/experimental/browser-use-stagehand-native) | `experimental` | [`agent`](../packages/core/agent), [`browser-use`](../packages/browser-use/browser-use), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) |
@@ -1727,6 +1732,7 @@ flowchart TD
 | [`session-query`](../packages/session-query/session-query) | `session-query` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-persistence`](../packages/session/session-persistence), [`session-projection`](../packages/session/session-projection), [`session-projection-cache`](../packages/session/session-projection-cache), [`session-title`](../packages/session/session-title), [`tool-todo`](../packages/todo/tool-todo) |
 | [`api-settings-controller`](../packages/api/settings-controller) | `api` | [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`credentials`](../packages/credentials/credentials), [`native-command`](../packages/util/native-command), [`session`](../packages/core/session), [`settings`](../packages/settings/settings), [`typert-protocol`](../packages/typert/protocol) |
 | [`web-app`](../packages/bundle/web-app) | `bundle` | [`shell-env`](../packages/shell/shell-env) |
+| [`cua`](../packages/experimental/cua) | `experimental` | [`agent`](../packages/core/agent), [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`attachment`](../packages/attachment/attachment), [`computer-use`](../packages/computer-use/computer-use), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`subprocess`](../packages/subprocess/subprocess), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-questions`](../packages/interaction/user-questions) |
 | [`experimental-auto-review`](../packages/experimental/auto-review) | `experimental` | [`agent`](../packages/core/agent), [`agent-instructions`](../packages/context/agent-instructions), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`tools`](../packages/core/tools), [`working-directory`](../packages/session/working-directory) |
 | [`webhook`](../packages/experimental/webhook) | `experimental` | [`agent`](../packages/core/agent), [`agent-default-model`](../packages/core/agent-default-model), [`agent-preset-registry`](../packages/preset/agent-preset-registry), [`llm`](../packages/llm/llm), [`permission-presets`](../packages/interaction/permission-presets), [`session`](../packages/core/session), [`session-title`](../packages/session/session-title), [`workspace`](../packages/workspace/workspace) |
 | [`tool-cordis`](../packages/extensions/tool-cordis) | `extensions` | [`agent`](../packages/core/agent), [`app-boot`](../packages/boot/app-boot), [`cordis-host-runner`](../packages/extensions/cordis-host-runner), [`tools`](../packages/core/tools) |
diff --git a/docs/persistence-catalog.i18n.yaml b/docs/persistence-catalog.i18n.yaml
index 5b57d28fca..11c4b226a4 100644
--- a/docs/persistence-catalog.i18n.yaml
+++ b/docs/persistence-catalog.i18n.yaml
@@ -1857,8 +1857,8 @@
   en: 993991e8f05665bb
   zh: a03931839e647bac
 /session-persistence-event-catalog/resolved-persistence-types/kind-user-question-reply:
-  en: 77a8fc6a2f3a9319
-  zh: 4dc1de1358b51a8d
+  en: 246940ea354e5493
+  zh: 9f3f462ec3bc2000
 /session-persistence-event-catalog/resolved-persistence-types/kind-webhook-form-notice:
   en: 0b74295f7c5c8f11
   zh: 5f1213cec87f6be0
diff --git a/docs/persistence-catalog.md b/docs/persistence-catalog.md
index 5cd3716140..10a122aed9 100644
--- a/docs/persistence-catalog.md
+++ b/docs/persistence-catalog.md
@@ -7647,7 +7647,7 @@ SHA-256: `5654685d7557ec747e74887237065e626a5bdfa426ca43f7fbb0b6fee9b0916c`
 
 SHA-256: `c55827fba7018198772c50e37cb7d3f60a3d8bb6e94b07de72dee0d9f8968005`
 
-Sources: [`packages/interaction/user-questions/src/types.ts:117`](../packages/interaction/user-questions/src/types.ts)
+Sources: [`packages/interaction/user-questions/src/types.ts:134`](../packages/interaction/user-questions/src/types.ts)
 
 | Property | Presence | Type |
 |---|---|---|
diff --git a/docs/persistence-catalog.zh.md b/docs/persistence-catalog.zh.md
index c12ce2c6ad..db08fc8919 100644
--- a/docs/persistence-catalog.zh.md
+++ b/docs/persistence-catalog.zh.md
@@ -7649,7 +7649,7 @@ SHA-256: `5654685d7557ec747e74887237065e626a5bdfa426ca43f7fbb0b6fee9b0916c`
 
 SHA-256: `c55827fba7018198772c50e37cb7d3f60a3d8bb6e94b07de72dee0d9f8968005`
 
-来源：[`packages/interaction/user-questions/src/types.ts:117`](../packages/interaction/user-questions/src/types.ts)
+来源：[`packages/interaction/user-questions/src/types.ts:134`](../packages/interaction/user-questions/src/types.ts)
 
 | 属性 | 存在性 | 类型 |
 |---|---|---|
diff --git a/docs/persistence-schema.json b/docs/persistence-schema.json
index 87853fac33..669559d1e5 100644
--- a/docs/persistence-schema.json
+++ b/docs/persistence-schema.json
@@ -25420,7 +25420,7 @@
       "digest": "c55827fba7018198772c50e37cb7d3f60a3d8bb6e94b07de72dee0d9f8968005",
       "names": [],
       "sources": [
-        "packages/interaction/user-questions/src/types.ts:117"
+        "packages/interaction/user-questions/src/types.ts:134"
       ]
     },
     {
diff --git a/docs/subsystems/boot.md b/docs/subsystems/boot.md
index ba75525a03..e2f0818357 100644
--- a/docs/subsystems/boot.md
+++ b/docs/subsystems/boot.md
@@ -85,9 +85,10 @@ configuration(): Array<{ entry: Entry; inherited: Record<string, unknown>; overr
 /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
  * @param entry Current Loader entry, also used to detect replacement during the write.
  * @param change Derive a raw config from the current entry and its inherited layer.
+ * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  * @returns Fulfillment after Loader reconciliation completes.
  */
-async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>
+async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>
 ```
 
 Source: [`packages/boot/config-editor/src/index.ts`](../../packages/boot/config-editor/src/index.ts)
@@ -101,9 +102,10 @@ Hot reload service with Cordis-compatible module configuration and events.
 ```ts cordis-catalog
 /** Serialize a caller-owned mutation with all automatic reload paths.
  * @param operation Work that must not overlap module or configuration replacement.
+ * @param signal Cancel admission while queued; an operation already running must finish.
  * @returns The operation result after its asynchronous work completes.
  */
-runExclusive<T>(operation: () => Promise<T>): Promise<T>
+runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>
 
 /** Watch a configuration path through the same queue as module replacement.
  * @param filename Absolute path, which may not exist yet.
diff --git a/docs/subsystems/boot.zh.md b/docs/subsystems/boot.zh.md
index f6260e8583..addd887756 100644
--- a/docs/subsystems/boot.zh.md
+++ b/docs/subsystems/boot.zh.md
@@ -85,9 +85,10 @@ configuration(): Array<{ entry: Entry; inherited: Record<string, unknown>; overr
 /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
  * @param entry Current Loader entry, also used to detect replacement during the write.
  * @param change Derive a raw config from the current entry and its inherited layer.
+ * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  * @returns Fulfillment after Loader reconciliation completes.
  */
-async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>
+async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>
 ```
 
 Source: [`packages/boot/config-editor/src/index.ts`](../../packages/boot/config-editor/src/index.ts)
@@ -101,9 +102,10 @@ Hot reload service with Cordis-compatible module configuration and events.
 ```ts cordis-catalog
 /** Serialize a caller-owned mutation with all automatic reload paths.
  * @param operation Work that must not overlap module or configuration replacement.
+ * @param signal Cancel admission while queued; an operation already running must finish.
  * @returns The operation result after its asynchronous work completes.
  */
-runExclusive<T>(operation: () => Promise<T>): Promise<T>
+runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>
 
 /** Watch a configuration path through the same queue as module replacement.
  * @param filename Absolute path, which may not exist yet.
diff --git a/docs/subsystems/computer-use.i18n.yaml b/docs/subsystems/computer-use.i18n.yaml
index a0cf7675d0..286917595c 100644
--- a/docs/subsystems/computer-use.i18n.yaml
+++ b/docs/subsystems/computer-use.i18n.yaml
@@ -3,8 +3,8 @@
 # After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/computer-use.md
 /computer-use:
-  en: a82a6d1ec3fa9724
-  zh: 17483872a54d6899
+  en: 7b0903dd1514a86b
+  zh: 951b5da2fdab02c4
 /computer-use/choose-a-provider:
   en: fa2e0d7b41c0450b
   zh: af9a799711f901e6
diff --git a/docs/subsystems/computer-use.md b/docs/subsystems/computer-use.md
index 6331c0f492..50e6b132fc 100644
--- a/docs/subsystems/computer-use.md
+++ b/docs/subsystems/computer-use.md
@@ -4,9 +4,19 @@ English | [中文](computer-use.zh.md)
 
 Computer use lets a model observe and operate the local desktop through a configured provider. The shared DSH capability is called **computer use**; **Cua Driver** names the upstream implementation.
 
+[Computer Use](../../packages/experimental/cua-bundle/README.md) provides an optional experimental switch for macOS CUA and persistent PTC.
 
 The [`macOS CUA provider`](../../packages/experimental/cua-macos/README.md) uses the [shared CUA objects and executor](../../packages/experimental/cua/README.md), which enforce application consent through User Questions and profile configuration.
 
+The CUA provider owns `ctx.cuaAccess` for system-permission status, explicit system requests, and application revocation. Its [permission page](../../packages/experimental/client-ui-cua/README.md) projects these controls; app/window operations enforce the provider's consent policy before dispatch.
+
+| Permission type | Meaning |
+|---|---|
+| `CuaApplicationId`, `CuaApplicationGrant` | An executable/signature identity and its displayed saved decision. |
+| `CuaSystemPermission` | Accessibility or Screen Recording, selected by the human. |
+| `CuaPermissionProcess`, `CuaSystemPermissionState` | Native privilege checks, observed helper/parent processes, and the application identified by macOS process responsibility at helper startup. Application metadata is absent if the optional system query or application lookup is unavailable. |
+| `CuaApplicationState` | Saved grants, refused applications, and whether persistence is available. Session-only grants remain internal to the provider. System observations and application icons are queried separately so the page can display each result as it arrives. |
+
 ## Choose a provider
 
 Mount [`dsh-computer-use`](../../packages/computer-use/computer-use/README.md) and one provider in the same composition. Both Cua Driver providers are experimental public npm packages and require explicit activation.
@@ -56,4 +66,60 @@ register(name: ComputerUseProviderName): () => Promise<void>
 ```
 
 Source: [`packages/computer-use/computer-use/src/index.ts`](../../packages/computer-use/computer-use/src/index.ts)
+
+<a id="ctxcuaaccess--cuaaccess"></a>
+
+### `ctx.cuaAccess` — `CuaAccess`
+
+Browser controls for provider-owned native permission and application decisions.
+
+```ts cordis-catalog
+/**
+ * Read application decisions without waiting for the native helper.
+ * @returns Saved grants and refused applications with their persistence owner.
+ */
+@Remote applications(): CuaApplicationState
+
+/**
+ * Inspect system privileges independently of application decisions and icons.
+ * @returns Fresh native preflight and launch metadata.
+ */
+@Remote async systemStatus(): Promise<CuaSystemPermissionState>
+
+/**
+ * Load presentation icons separately from application decisions.
+ * @returns Optional native PNG icons keyed by executable path for saved and blocked applications.
+ */
+@Remote async applicationIcons(): Promise<Record<string, string>>
+
+/**
+ * Request a system privilege explicitly selected by the user.
+ * @param permission macOS privilege to request.
+ * @returns Preflight state after requesting; a false value never implies consent.
+ */
+@Remote async requestPermission(permission: CuaSystemPermission): Promise<CuaSystemPermissionState>
+
+/**
+ * Open the macOS privacy pane selected by the user.
+ * @param permission Corresponding system privilege.
+ * @returns Completion after macOS accepted the open request.
+ */
+@Remote async openSettings(permission: CuaSystemPermission): Promise<void>
+
+/**
+ * Remove saved and session access and join affected operations.
+ * @param id Application identity displayed on the permission page.
+ * @returns Completion after persistence and cancellation; dispatched input cannot be undone.
+ */
+@Remote revoke(id: CuaApplicationId): Promise<void>
+
+/**
+ * Clear this application's refusals across sessions so each session may ask for access again.
+ * @param id Refused or revoked application displayed on the permission page.
+ * @returns Completion after clearing refusals; no permission is granted and no action is replayed.
+ */
+@Remote async retryApproval(id: CuaApplicationId): Promise<void>
+```
+
+Source: [`packages/experimental/cua/src/access.ts`](../../packages/experimental/cua/src/access.ts)
 <!-- END GENERATED cordis-surface -->
diff --git a/docs/subsystems/computer-use.zh.md b/docs/subsystems/computer-use.zh.md
index cd4901bd1a..83797dcb7f 100644
--- a/docs/subsystems/computer-use.zh.md
+++ b/docs/subsystems/computer-use.zh.md
@@ -4,9 +4,19 @@
 
 计算机操作让模型通过配置的提供方观察并操作本地桌面。DSH 的共享能力称为 **computer use（计算机操作）**；**Cua Driver** 是上游实现的名称。
 
+[Computer Use](../../packages/experimental/cua-bundle/README.zh.md) 提供 macOS CUA 和 persistent PTC 的可选实验性开关。
 
 [macOS CUA 提供方](../../packages/experimental/cua-macos/README.zh.md)使用[共享 CUA 对象与执行器](../../packages/experimental/cua/README.zh.md)，通过 User Questions 和配置档设置执行应用授权。
 
+CUA provider 通过 `ctx.cuaAccess` 提供系统权限状态、用户主动申请和应用授权撤销。[权限页面](../../packages/experimental/client-ui-cua/README.zh.md)投影这些控件；app/window 操作在分派前执行 provider 的授权检查。
+
+| 权限类型 | 含义 |
+|---|---|
+| `CuaApplicationId`、`CuaApplicationGrant` | 可执行文件和签名身份，以及显示给用户的已保存决定。 |
+| `CuaSystemPermission` | 用户选择申请的辅助功能或屏幕录制权限。 |
+| `CuaPermissionProcess`、`CuaSystemPermissionState` | 观测到的 helper、父进程和原生权限状态，以及 helper 启动时由 macOS 责任进程记录识别出的应用。可选系统查询或应用查找不可用时，省略应用信息。 |
+| `CuaApplicationState` | 持久授权、拒绝记录，以及能否持久保存。会话授权只保留在 provider 内部。系统权限和应用图标分别查询，页面在各项结果返回后分别显示。 |
+
 ## 选择提供方
 
 在同一组合中挂载 [`dsh-computer-use`](../../packages/computer-use/computer-use/README.zh.md) 和一个提供方。两个 Cua Driver 提供方都是公开发布到 npm 的实验性包，均需显式启用。
@@ -56,4 +66,60 @@ register(name: ComputerUseProviderName): () => Promise<void>
 ```
 
 Source: [`packages/computer-use/computer-use/src/index.ts`](../../packages/computer-use/computer-use/src/index.ts)
+
+<a id="ctxcuaaccess--cuaaccess"></a>
+
+### `ctx.cuaAccess` — `CuaAccess`
+
+Browser controls for provider-owned native permission and application decisions.
+
+```ts cordis-catalog
+/**
+ * Read application decisions without waiting for the native helper.
+ * @returns Saved grants and refused applications with their persistence owner.
+ */
+@Remote applications(): CuaApplicationState
+
+/**
+ * Inspect system privileges independently of application decisions and icons.
+ * @returns Fresh native preflight and launch metadata.
+ */
+@Remote async systemStatus(): Promise<CuaSystemPermissionState>
+
+/**
+ * Load presentation icons separately from application decisions.
+ * @returns Optional native PNG icons keyed by executable path for saved and blocked applications.
+ */
+@Remote async applicationIcons(): Promise<Record<string, string>>
+
+/**
+ * Request a system privilege explicitly selected by the user.
+ * @param permission macOS privilege to request.
+ * @returns Preflight state after requesting; a false value never implies consent.
+ */
+@Remote async requestPermission(permission: CuaSystemPermission): Promise<CuaSystemPermissionState>
+
+/**
+ * Open the macOS privacy pane selected by the user.
+ * @param permission Corresponding system privilege.
+ * @returns Completion after macOS accepted the open request.
+ */
+@Remote async openSettings(permission: CuaSystemPermission): Promise<void>
+
+/**
+ * Remove saved and session access and join affected operations.
+ * @param id Application identity displayed on the permission page.
+ * @returns Completion after persistence and cancellation; dispatched input cannot be undone.
+ */
+@Remote revoke(id: CuaApplicationId): Promise<void>
+
+/**
+ * Clear this application's refusals across sessions so each session may ask for access again.
+ * @param id Refused or revoked application displayed on the permission page.
+ * @returns Completion after clearing refusals; no permission is granted and no action is replayed.
+ */
+@Remote async retryApproval(id: CuaApplicationId): Promise<void>
+```
+
+Source: [`packages/experimental/cua/src/access.ts`](../../packages/experimental/cua/src/access.ts)
 <!-- END GENERATED cordis-surface -->
diff --git a/docs/subsystems/settings.md b/docs/subsystems/settings.md
index ff047b7414..35bfb04492 100644
--- a/docs/subsystems/settings.md
+++ b/docs/subsystems/settings.md
@@ -66,8 +66,9 @@ async replace(ns: string, section: object, expectedRevision?: number): Promise<v
  * @param ns Profile entry id.
  * @param ops Ordered form edits.
  * @param expectedRevision Revision returned by describe.
+ * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  */
-async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>
+async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>
 ```
 
 Source: [`packages/settings/settings/src/index.ts`](../../packages/settings/settings/src/index.ts)
diff --git a/docs/subsystems/settings.zh.md b/docs/subsystems/settings.zh.md
index cb2fbeb694..043002f98a 100644
--- a/docs/subsystems/settings.zh.md
+++ b/docs/subsystems/settings.zh.md
@@ -66,8 +66,9 @@ async replace(ns: string, section: object, expectedRevision?: number): Promise<v
  * @param ns Profile entry id.
  * @param ops Ordered form edits.
  * @param expectedRevision Revision returned by describe.
+ * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  */
-async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>
+async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>
 ```
 
 Source: [`packages/settings/settings/src/index.ts`](../../packages/settings/settings/src/index.ts)
diff --git a/docs/subsystems/user-questions.i18n.yaml b/docs/subsystems/user-questions.i18n.yaml
index 10731879a7..696f802d38 100644
--- a/docs/subsystems/user-questions.i18n.yaml
+++ b/docs/subsystems/user-questions.i18n.yaml
@@ -9,8 +9,8 @@
   en: 88cceb3cf383248e
   zh: 8e1d2627823b1ffc
 /user-interaction/presentation-intent:
-  en: aca3811ea3f0c2ef
-  zh: 6cf2aea40c7dece8
+  en: 6605b0582b4ecd5a
+  zh: 01491d5470146a74
 /user-interaction/question-item:
   en: 1ad4373e6fdfe4c7
   zh: efb8d41ebe7224f8
diff --git a/docs/subsystems/user-questions.md b/docs/subsystems/user-questions.md
index e409bff747..da71ccd63d 100644
--- a/docs/subsystems/user-questions.md
+++ b/docs/subsystems/user-questions.md
@@ -22,7 +22,7 @@ interface AskUserQuestionOption {
 
 ## Presentation intent
 
-`AskUserQuestionIntent` optionally declares a known decision kind. It is tagged on `kind` so intents can be added; a UI that does not recognise a tag renders the generic option list. An intent changes presentation only — a UI honouring it answers with the same option labels a generic UI would send, so the caller reads the same answer fields either way. `approve` names the affirmative option instead of relying on option order. `ask()` rejects the two assertions no type can carry: an `approve` naming none of its own question's options, and an intent on a question with no `detail`.
+`AskUserQuestionIntent` changes presentation while preserving option labels and the caller’s decision policy. `plan-review` names the approve option and requires plan detail. `approval` requires one blocking question with detail and distinct reject, approve and optional always-allow labels covering exactly the offered options. It rejects multi-select and timed waits. An unrecognized intent remains a generic option list.
 
 ```ts type-equiv
 /**
@@ -43,6 +43,23 @@ type AskUserQuestionIntent = {
   approve: string
   /** Logged tool invocation whose arguments contain the reviewed plan. */
   callId?: ToolCallId
+} | {
+  /** A blocking permission decision with fixed actions and no free-text answer. */
+  kind: 'approval'
+  /** Option label granting the scope described by the caller. */
+  approve: string
+  /** Option label refusing the requested access. */
+  reject: string
+  /** Optional persistent grant offered only when the caller supports it. */
+  always?: string
+  /** Metadata for human recognition, independent of the caller's authorization identity. */
+  subject?: { name: string; icon?: string }
+  /** Localized presentation; option labels remain the wire answer values. */
+  display?: {
+    question: { en: string; [locale: string]: string }
+    detail?: { en: string; [locale: string]: string }
+    approve?: { en: string; [locale: string]: string }
+  }
 }
 ```
 
diff --git a/docs/subsystems/user-questions.zh.md b/docs/subsystems/user-questions.zh.md
index 7b75b08dc6..b8e4d54d85 100644
--- a/docs/subsystems/user-questions.zh.md
+++ b/docs/subsystems/user-questions.zh.md
@@ -22,7 +22,7 @@ interface AskUserQuestionOption {
 
 ## 呈现意图
 
-`AskUserQuestionIntent` 可选地声明一种已知的决策类型。它以 `kind` 作为标记，以便后续加入更多意图；不认识某个标记的 UI 会渲染通用选项列表。意图只改变呈现——遵循它的 UI 回答的选项标签与通用 UI 相同，因此调用方读到的答案字段一致。`approve` 指明表示同意的选项，而不依赖选项顺序。`ask()` 拒绝两种类型无法表达的断言：`approve` 未命名该问题自己的任何选项，以及没有 `detail` 的问题声明了意图。
+`AskUserQuestionIntent` 改变呈现方式，保留选项标签和调用方的决策规则。`plan-review` 指定批准选项，并要求提供计划正文。`approval` 要求只有一个阻塞式问题，带有说明以及互不相同的拒绝、允许和可选的始终允许标签，完整对应已提供的选项，不支持多选或计时等待。未识别的意图仍显示为通用选项列表。
 
 ```ts type-equiv
 /**
@@ -43,6 +43,23 @@ type AskUserQuestionIntent = {
   approve: string
   /** Logged tool invocation whose arguments contain the reviewed plan. */
   callId?: ToolCallId
+} | {
+  /** A blocking permission decision with fixed actions and no free-text answer. */
+  kind: 'approval'
+  /** Option label granting the scope described by the caller. */
+  approve: string
+  /** Option label refusing the requested access. */
+  reject: string
+  /** Optional persistent grant offered only when the caller supports it. */
+  always?: string
+  /** Metadata for human recognition, independent of the caller's authorization identity. */
+  subject?: { name: string; icon?: string }
+  /** Localized presentation; option labels remain the wire answer values. */
+  display?: {
+    question: { en: string; [locale: string]: string }
+    detail?: { en: string; [locale: string]: string }
+    approve?: { en: string; [locale: string]: string }
+  }
 }
 ```
 
diff --git a/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.i18n.yaml b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.i18n.yaml
new file mode 100644
index 0000000000..bb91afebfd
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.i18n.yaml
@@ -0,0 +1,16 @@
+# Bilingual-pair consistency record for guide.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.md
+/:
+  en: 36d6b79b48c08dd5
+  zh: 814caece159e9b0e
+/cua-defaults-to-ptc-session-scopes:
+  en: 1d6eee8020ebed3b
+  zh: d14279f527983c3c
+/cua-defaults-to-ptc-session-scopes/change:
+  en: dac96a29e3751249
+  zh: d48cb030f43c07e4
+/cua-defaults-to-ptc-session-scopes/migration:
+  en: f3d82fe45e41c712
+  zh: e55e424f5a2c096a
diff --git a/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.md b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.md
new file mode 100644
index 0000000000..7db56c3afd
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.md
@@ -0,0 +1,18 @@
+---
+kind: upgrade-guide
+description: "Standalone native CUA compositions must explicitly select global tool registration."
+---
+
+# CUA defaults to PTC session scopes
+
+English | [中文](guide.zh.md)
+
+## Change
+
+The native CUA provider defaults `agentPreset` to `ptc`. It registers tools for existing and new PTC Agents, including when a saved application-grants configuration omits the new field. Custom compositions without an Agent preset registry no longer receive global CUA tools by default.
+
+## Migration
+
+1. For the standard Computer Use switch, keep the default; existing application grants remain usable.
+2. For a standalone composition that needs global tools, add `agentPreset: false` under the native CUA entry’s `config` in its profile patch or overlay. Preserve its other fields, including `allowedApps` and `helperPath`.
+3. Restart or let HMR apply the edit, then confirm that the intended Agent exposes `cua` in native mode or through the PTC SDK.
diff --git a/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.zh.md b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.zh.md
new file mode 100644
index 0000000000..ff6f6ccbc0
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-alpha.2/cua-preset-scope/guide.zh.md
@@ -0,0 +1,18 @@
+---
+kind: upgrade-guide
+description: "独立原生 CUA 组合需要显式选择全局工具注册。"
+---
+
+# CUA 默认使用 PTC 会话作用域
+
+[English](guide.md) | 中文
+
+## 变更
+
+原生 CUA 提供方的 `agentPreset` 默认为 `ptc`。工具注册到已有和新建 PTC Agent，即使保存的应用授权配置没有这个新字段也会生效。不包含 Agent preset 注册表的自定义组合不再默认获得全局 CUA 工具。
+
+## 迁移
+
+1. 使用标准 Computer Use 开关时保持默认值，已有应用授权仍可使用。
+2. 独立组合若需要全局工具，在 profile patch 或 overlay 的原生 CUA 条目 `config` 下添加 `agentPreset: false`，保留 `allowedApps`、`helperPath` 等其他字段。
+3. 重启或等待 HMR 应用后，确认目标 Agent 能在原生模式或 PTC SDK 中使用 `cua`。
diff --git a/packages/computer-use/README.i18n.yaml b/packages/computer-use/README.i18n.yaml
index c6e98fc6e5..1b2c63a951 100644
--- a/packages/computer-use/README.i18n.yaml
+++ b/packages/computer-use/README.i18n.yaml
@@ -9,8 +9,8 @@
   en: 77ea90624a004773
   zh: fe6dbf8414a5aff0
 /packages-computer-use/summary:
-  en: 3820da56a601d3f1
-  zh: 358e65f8a7cf7446
+  en: 7e5fcf9bb48c9677
+  zh: abee2be288115045
 /packages-computer-use/table-of-contents:
   en: 1eb35b015a6c423f
   zh: a8a3dceee2c9e943
@@ -18,8 +18,8 @@
   en: 9aa86e6451f60c3d
   zh: c5e6816e90f2d74b
 /packages-computer-use/related-documentation:
-  en: ad08d3417a0d4630
-  zh: cfe8e03033c2fede
+  en: 58198f9f17e6120f
+  zh: 188fa0ec5c4678f3
 /packages-computer-use/dev-note:
   en: b75c8458928b72b9
   zh: 003ba4e17b4b5269
diff --git a/packages/computer-use/README.md b/packages/computer-use/README.md
index 1b07c668ad..d19b0a3b07 100644
--- a/packages/computer-use/README.md
+++ b/packages/computer-use/README.md
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-Computer-use providers let models observe and operate a desktop. This group owns exclusive provider registration. Each provider owns its operations, tools, and platform requirements; the experimental Cua Driver providers live in the experimental group.
+Computer-use providers let models observe and operate a desktop. This group contains the shared registry that prevents multiple providers from being enabled in one composition. DSH's [CUA implementation](../experimental/cua/README.md), platform providers, and opt-in bundle currently live in `experimental`, alongside the Cua Driver adapters. The CUA package documents the platform requirements for promotion to this group.
 
 ## Table of Contents
 
@@ -32,7 +32,8 @@ Choose one provider and mount the shared registration service.
 ## Related documentation
 
 - [Computer use](../../docs/subsystems/computer-use.md) — capability ownership and provider choices.
-- [Experimental packages](../experimental/README.md) — Cua Driver MCP and native providers.
+- [Computer Use bundle](../experimental/cua-bundle/README.md) — enable native CUA and access its permission controls.
+- [Experimental packages](../experimental/README.md) — native CUA packages and Cua Driver adapters.
 
 <a id="dev-note"></a>
 ## Dev Note
diff --git a/packages/computer-use/README.zh.md b/packages/computer-use/README.zh.md
index d1aa763117..34204bc7a0 100644
--- a/packages/computer-use/README.zh.md
+++ b/packages/computer-use/README.zh.md
@@ -9,7 +9,7 @@ kind: "package-group"
 
 ## 概述
 
-计算机操作提供方让模型观察并操作桌面。本组负责提供方的独占注册。各提供方拥有自己的操作、工具和平台要求；实验性 Cua Driver 提供方位于 experimental 组。
+计算机操作提供方让模型观察并操作桌面。本组包含共享注册器，防止同一组合同时启用多个提供方。DSH 的 [CUA 实现](../experimental/cua/README.zh.md)、平台提供方和启用组合包目前位于 `experimental`，Cua Driver 适配包也位于该组。CUA 包文档说明了迁入本组所需的平台支持条件。
 
 ## 目录
 
@@ -32,7 +32,8 @@ kind: "package-group"
 ## 相关文档
 
 - [计算机操作](../../docs/subsystems/computer-use.zh.md) — 能力归属和提供方选择。
-- [实验性包](../experimental/README.zh.md) — Cua Driver MCP 和原生提供方。
+- [Computer Use 组合包](../experimental/cua-bundle/README.zh.md)：启用原生 CUA 并使用权限管理功能。
+- [实验性包](../experimental/README.zh.md)：原生 CUA 包和 Cua Driver 适配包。
 
 <a id="dev-note"></a>
 ## 开发备注
diff --git a/packages/computer-use/computer-use/README.i18n.yaml b/packages/computer-use/computer-use/README.i18n.yaml
index f35f34159f..94dc062523 100644
--- a/packages/computer-use/computer-use/README.i18n.yaml
+++ b/packages/computer-use/computer-use/README.i18n.yaml
@@ -9,8 +9,8 @@
   en: 2efee0c5f0d577bc
   zh: fef4b81bfc121052
 /deepseek-ai-dsh-computer-use/summary:
-  en: 4de047849e68701f
-  zh: 90a32c0e279b4b05
+  en: 4cb331c550852b23
+  zh: d638995ab250397b
 /deepseek-ai-dsh-computer-use/table-of-contents:
   en: d152484eb41ac6b4
   zh: 405b30feaf48c087
@@ -21,8 +21,8 @@
   en: 181679887837591a
   zh: cc2e96766ce0aa63
 /deepseek-ai-dsh-computer-use/further-exploration:
-  en: b1bdbcbc150036b3
-  zh: 1d356e0522587abc
+  en: 987295d677466c04
+  zh: 9d7b40a04786490e
 /deepseek-ai-dsh-computer-use/model-experience:
   en: 8780c250dfaefaaa
   zh: 1c4b3598a131fb65
diff --git a/packages/computer-use/computer-use/README.md b/packages/computer-use/computer-use/README.md
index 32fccb6d6f..fb39d02482 100644
--- a/packages/computer-use/computer-use/README.md
+++ b/packages/computer-use/computer-use/README.md
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-A deployment can enable one computer-use provider at a time. Loading another provider fails with the registered provider name. Each provider supplies its own tools and desktop operations. This package adds no model-visible tools and does not coordinate concurrent Sessions.
+A deployment can enable one computer-use provider at a time. Loading another provider fails with the registered provider name. Both DSH's native CUA and the Cua Driver adapters use this registry. Each provider supplies its own tools and desktop operations. This package adds no model-visible tools and does not coordinate concurrent Sessions.
 
 ## Table of Contents
 
@@ -53,6 +53,9 @@ One private name owns the slot. Cordis effects remove contributions when their p
 ## Further Exploration
 
 - [Computer use](../../../docs/subsystems/computer-use.md) — provider selection and shared-desktop limits.
+- [Computer Use bundle](../../experimental/cua-bundle/README.md) — enable DSH's native CUA and permission controls.
+- [Shared CUA library](../../experimental/cua/README.md) — application/window objects, tool execution, and application consent.
+- [macOS CUA provider](../../experimental/cua-macos/README.md) — DSH's Swift implementation and native helper lifecycle.
 - [Cua Driver MCP provider](../../experimental/computer-use-cua-driver-mcp/README.md) — use an installed driver.
 - [Cua Driver native provider](../../experimental/computer-use-cua-driver-native/README.md) — use the npm runtime.
 
diff --git a/packages/computer-use/computer-use/README.zh.md b/packages/computer-use/computer-use/README.zh.md
index 1b3dfb4e77..81e6b7e264 100644
--- a/packages/computer-use/computer-use/README.zh.md
+++ b/packages/computer-use/computer-use/README.zh.md
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-部署每次可启用一个计算机操作提供方。加载另一个提供方时会失败，并报告已注册的提供方名称。各提供方提供自己的工具和桌面操作。本包不添加模型可见工具，也不协调并发 Session。
+部署每次可启用一个计算机操作提供方。加载另一个提供方时会失败，并报告已注册的提供方名称。DSH 原生 CUA 和 Cua Driver 适配包都使用此注册器。各提供方提供自己的工具和桌面操作。本包不添加模型可见工具，也不协调并发 Session。
 
 ## 目录
 
@@ -53,6 +53,9 @@ kind: "package-reference"
 ## 延伸阅读
 
 - [计算机操作](../../../docs/subsystems/computer-use.zh.md) — 提供方选择和共享桌面限制。
+- [Computer Use 组合包](../../experimental/cua-bundle/README.zh.md)：启用 DSH 原生 CUA 和权限管理功能。
+- [共享 CUA 库](../../experimental/cua/README.zh.md)：应用与窗口对象、工具执行和应用授权。
+- [macOS CUA 提供方](../../experimental/cua-macos/README.zh.md)：DSH 的 Swift 实现和原生辅助进程生命周期。
 - [Cua Driver MCP 提供方](../../experimental/computer-use-cua-driver-mcp/README.zh.md) — 使用已安装的驱动。
 - [Cua Driver 原生提供方](../../experimental/computer-use-cua-driver-native/README.zh.md) — 使用 npm 运行时。
 
diff --git a/packages/experimental/README.i18n.yaml b/packages/experimental/README.i18n.yaml
index 2121352763..5838be781b 100644
--- a/packages/experimental/README.i18n.yaml
+++ b/packages/experimental/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: b55aeb927737b90d
   zh: 0b215fcb5c2c7908
 /packages-experimental/packages:
-  en: 9e10442fb0ad989d
-  zh: 4fa2d4a74b0d411f
+  en: 6b903f7a4d992a83
+  zh: 07f250b9d5c093fa
 /packages-experimental/related-documentation:
   en: 1cb9d3448d44e48d
   zh: cd326d70a746b896
diff --git a/packages/experimental/README.md b/packages/experimental/README.md
index 8b53177bf8..901321786f 100644
--- a/packages/experimental/README.md
+++ b/packages/experimental/README.md
@@ -69,6 +69,8 @@ Promotion requires a named product role, documented public behavior and limitati
 | [`ptc-runtime-python`](ptc-runtime-python/README.md) | CPython subprocess backend for the PTC execution seam | `ctx.ptcRuntime` |
 | [CUA](cua/README.md) | Shared application/window objects, consent, and logged execution. | Library |
 | [macOS CUA](cua-macos/README.md) | Swift native execution and platform preparation. | `ctx.computerUse` |
+| [`cua-bundle`](cua-bundle/README.md) | Optional Computer Use switch with persistent PTC | — |
+| [`client-ui-cua`](client-ui-cua/README.md) | Computer Use permission setup and application access controls | — |
 | [`computer-use-cua-driver-mcp`](computer-use-cua-driver-mcp/README.md) | Use an installed Cua Driver through MCP | `ctx.computerUse` |
 | [`computer-use-cua-driver-native`](computer-use-cua-driver-native/README.md) | Embed the Cua Driver native npm runtime | `ctx.computerUse` |
 | [`browser-use-playwright-mcp`](browser-use-playwright-mcp/README.md) | Playwright browser tools over MCP | `ctx.browserUse` |
diff --git a/packages/experimental/README.zh.md b/packages/experimental/README.zh.md
index e812835982..4d411b85cf 100644
--- a/packages/experimental/README.zh.md
+++ b/packages/experimental/README.zh.md
@@ -69,6 +69,8 @@ kind: "package-group"
 | [`ptc-runtime-python`](ptc-runtime-python/README.zh.md) | PTC 执行 seam 的 CPython 子进程后端 | `ctx.ptcRuntime` |
 | [CUA](cua/README.zh.md) | 共享应用与窗口对象、授权和已记录的执行。 | 库 |
 | [macOS CUA](cua-macos/README.zh.md) | Swift 原生执行与平台组件准备。 | `ctx.computerUse` |
+| [`cua-bundle`](cua-bundle/README.zh.md) | 默认关闭的 Computer Use 开关与 persistent PTC 组合 | — |
+| [`client-ui-cua`](client-ui-cua/README.zh.md) | Computer Use 权限设置与应用授权管理 | — |
 | [`computer-use-cua-driver-mcp`](computer-use-cua-driver-mcp/README.zh.md) | 通过 MCP 使用已安装的 Cua Driver | `ctx.computerUse` |
 | [`computer-use-cua-driver-native`](computer-use-cua-driver-native/README.zh.md) | 嵌入 Cua Driver 原生 npm 运行时 | `ctx.computerUse` |
 | [`browser-use-playwright-mcp`](browser-use-playwright-mcp/README.zh.md) | 通过 MCP 提供 Playwright 浏览器工具 | `ctx.browserUse` |
diff --git a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
index 50bcbe529a..339730b2a5 100644
--- a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
+++ b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
@@ -113,13 +113,13 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     keyDomain: '',
     hookContext: '',
     slotInject: '',
-    declaredBy: 'an entry in \'conversation.composer\' (client-ui-approval), so it exists while that entry is mounted',
+    declaredBy: 'factory \'conversation.approval.card\' (client-ui-approval), so it exists while that definition is registered',
     occupants: [
       'client-ui-chat ApprovalCommand',
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.approval.detail\', () => ctx.slots.register(\n      { name: \'conversation.approval.detail\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-approval/src/client/contract/slots.ts:37',
+    source: 'packages/client/ui-approval/src/client/contract/slots.ts:47',
   },
   {
     key: 'conversation.chat.assistant-actions',
@@ -2250,7 +2250,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.add.actions\', () => ctx.slots.register(\n      { name: \'plugins.add.actions\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:118',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:120',
   },
   {
     key: 'plugins.bundle.activation',
@@ -2281,16 +2281,17 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       'useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean',
       'useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean',
     ],
-    keyDomain: 'open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-experimental-voice-input-bundle',
+    keyDomain: 'open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-cua-bundle, @deepseek-ai/dsh-experimental-voice-input-bundle',
     hookContext: '',
     slotInject: '',
     declaredBy: 'an entry in \'main\' (client-ui-plugin-manager), so it exists while that entry is mounted',
     occupants: [
+      'client-ui-cua PermissionSetup key \'@deepseek-ai/dsh-cua-bundle\'',
       'experimental-client-ui-voice-input VoiceSetupPrompt key \'@deepseek-ai/dsh-experimental-voice-input-bundle\'',
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.bundle.activation\', () => ctx.slots.register(\n      { name: \'plugins.bundle.activation\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:126',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:128',
   },
   {
     key: 'plugins.bundle.config',
@@ -2307,7 +2308,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       },
     ],
     ownerProps: [
-      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
+      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Whether the owning bundle is being changed; supplied on bundle configuration pages. */\n  readonly busy?: boolean\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
     ],
     ownerPropsReferences: [
       'ConfigPageForm',
@@ -2323,17 +2324,18 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       'useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean',
       'useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean',
     ],
-    keyDomain: 'open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-experimental-cot-translation-bundle, @deepseek-ai/dsh-experimental-voice-input-bundle',
+    keyDomain: 'open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-cua-bundle, @deepseek-ai/dsh-experimental-cot-translation-bundle, @deepseek-ai/dsh-experimental-voice-input-bundle',
     hookContext: '',
     slotInject: '',
     declaredBy: 'an entry in \'main\' (client-ui-plugin-manager), so it exists while that entry is mounted',
     occupants: [
       'experimental-client-ui-cot-translation TranslationSettings key \'@deepseek-ai/dsh-experimental-cot-translation-bundle\'',
+      'client-ui-cua PermissionPanel key \'@deepseek-ai/dsh-cua-bundle\'',
       'experimental-client-ui-voice-input VoicePreparation key \'@deepseek-ai/dsh-experimental-voice-input-bundle\'',
     ],
     replaceRisk: 'shadows-shipped-ui',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.bundle.config\', () => ctx.slots.register(\n      { name: \'plugins.bundle.config\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:142',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:144',
   },
   {
     key: 'plugins.detail.actions',
@@ -2385,7 +2387,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.detail.actions\', () => ctx.slots.register(\n      { name: \'plugins.detail.actions\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:156',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:158',
   },
   {
     key: 'plugins.detail.badge',
@@ -2437,7 +2439,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.detail.badge\', () => ctx.slots.register(\n      { name: \'plugins.detail.badge\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:161',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:163',
   },
   {
     key: 'plugins.detail.section',
@@ -2489,7 +2491,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.detail.section\', () => ctx.slots.register(\n      { name: \'plugins.detail.section\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:168',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:170',
   },
   {
     key: 'plugins.item',
@@ -2518,7 +2520,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       },
     ],
     ownerProps: [
-      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
+      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Whether the owning bundle is being changed; supplied on bundle configuration pages. */\n  readonly busy?: boolean\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
     ],
     ownerPropsReferences: [
       'ConfigPageForm',
@@ -2546,7 +2548,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.item\', () => ctx.slots.register(\n      { name: \'plugins.item\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:136',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:138',
   },
   {
     key: 'plugins.row.config',
@@ -2563,7 +2565,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       },
     ],
     ownerProps: [
-      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
+      '/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: \'summary\' | \'page\'\n  /** Whether the owning bundle is being changed; supplied on bundle configuration pages. */\n  readonly busy?: boolean\n  /** Host-owned configuration values and write actions for this page\'s entry. */\n  readonly form?: ConfigPageForm | undefined\n}',
     ],
     ownerPropsReferences: [
       'ConfigPageForm',
@@ -2586,7 +2588,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     occupants: [],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.row.config\', () => ctx.slots.register(\n      { name: \'plugins.row.config\', key: \'<one key the owner dispatches>\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:150',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:152',
   },
   {
     key: 'plugins.tab',
@@ -2640,7 +2642,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'plugins.tab\', () => ctx.slots.register(\n      { name: \'plugins.tab\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
-    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:124',
+    source: 'packages/client/ui-plugin-manager/src/client/slot-contract.ts:126',
   },
   {
     key: 'rightbar',
@@ -3399,6 +3401,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       'client-ui-workspace SessionRenameDialog id \'workspace.session-rename\'',
       'client-ui-workspace SessionArchiveConfirmDialog id \'workspace.session-archive\'',
       'client-ui-workspace RowActionToast id \'workspace.row-toast\'',
+      'client-ui-cua PermissionToast id \'cua-permission-outcome\'',
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'shell.overlay\', () => ctx.slots.register(\n      { name: \'shell.overlay\', id: \'my-entry\', order: 100, label: \'My entry\' },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index be3e316263..79b93d88d3 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -731,9 +731,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         returns: 'Detached layer values alongside their Loader entries.',
       },
       {
-        signature: 'async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>',
+        signature: 'async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>',
         description: 'Validate, persist, and reconcile a plugin\'s next config; ordinary fields keep normal lifecycle rules.',
-        parameters: [{ name: 'entry', description: 'Current Loader entry, also used to detect replacement during the write.' }, { name: 'change', description: 'Derive a raw config from the current entry and its inherited layer.' }],
+        parameters: [{ name: 'entry', description: 'Current Loader entry, also used to detect replacement during the write.' }, { name: 'change', description: 'Derive a raw config from the current entry and its inherited layer.' }, { name: 'signal', description: 'Cancel while waiting for HMR admission; admitted writes finish normally.' }],
         returns: 'Fulfillment after Loader reconciliation completes.',
       },
     ],
@@ -910,6 +910,55 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
       },
     ],
   },
+  {
+    key: 'cuaAccess',
+    summary: 'Browser controls for provider-owned native permission and application decisions.',
+    description: 'Browser controls for provider-owned native permission and application decisions.',
+    methods: [
+      {
+        signature: '@Remote applications(): CuaApplicationState',
+        description: 'Read application decisions without waiting for the native helper.',
+        parameters: [],
+        returns: 'Saved grants and refused applications with their persistence owner.',
+      },
+      {
+        signature: '@Remote async systemStatus(): Promise<CuaSystemPermissionState>',
+        description: 'Inspect system privileges independently of application decisions and icons.',
+        parameters: [],
+        returns: 'Fresh native preflight and launch metadata.',
+      },
+      {
+        signature: '@Remote async applicationIcons(): Promise<Record<string, string>>',
+        description: 'Load presentation icons separately from application decisions.',
+        parameters: [],
+        returns: 'Optional native PNG icons keyed by executable path for saved and blocked applications.',
+      },
+      {
+        signature: '@Remote async requestPermission(permission: CuaSystemPermission): Promise<CuaSystemPermissionState>',
+        description: 'Request a system privilege explicitly selected by the user.',
+        parameters: [{ name: 'permission', description: 'macOS privilege to request.' }],
+        returns: 'Preflight state after requesting; a false value never implies consent.',
+      },
+      {
+        signature: '@Remote async openSettings(permission: CuaSystemPermission): Promise<void>',
+        description: 'Open the macOS privacy pane selected by the user.',
+        parameters: [{ name: 'permission', description: 'Corresponding system privilege.' }],
+        returns: 'Completion after macOS accepted the open request.',
+      },
+      {
+        signature: '@Remote revoke(id: CuaApplicationId): Promise<void>',
+        description: 'Remove saved and session access and join affected operations.',
+        parameters: [{ name: 'id', description: 'Application identity displayed on the permission page.' }],
+        returns: 'Completion after persistence and cancellation; dispatched input cannot be undone.',
+      },
+      {
+        signature: '@Remote async retryApproval(id: CuaApplicationId): Promise<void>',
+        description: 'Clear this application\'s refusals across sessions so each session may ask for access again.',
+        parameters: [{ name: 'id', description: 'Refused or revoked application displayed on the permission page.' }],
+        returns: 'Completion after clearing refusals; no permission is granted and no action is replayed.',
+      },
+    ],
+  },
   {
     key: 'deepseekAccount',
     summary: 'Account operations; only Host consumers can obtain a request credential.',
@@ -1284,9 +1333,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         parameters: [],
       },
       {
-        signature: 'runExclusive<T>(operation: () => Promise<T>): Promise<T>',
+        signature: 'runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>',
         description: 'Serialize a caller-owned mutation with all automatic reload paths.',
-        parameters: [{ name: 'operation', description: 'Work that must not overlap module or configuration replacement.' }],
+        parameters: [{ name: 'operation', description: 'Work that must not overlap module or configuration replacement.' }, { name: 'signal', description: 'Cancel admission while queued; an operation already running must finish.' }],
         returns: 'The operation result after its asynchronous work completes.',
       },
       {
@@ -2676,9 +2725,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'section', description: 'Complete form values.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }],
       },
       {
-        signature: 'async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>',
+        signature: 'async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>',
         description: 'Apply field edits without restating redacted secrets; unsetting an array index removes its element.',
-        parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'ops', description: 'Ordered form edits.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }],
+        parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'ops', description: 'Ordered form edits.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }, { name: 'signal', description: 'Cancel while waiting for HMR admission; admitted writes finish normally.' }],
       },
     ],
   },
@@ -4827,7 +4876,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'AskUserQuestionIntent',
-    declaration: 'export type AskUserQuestionIntent = {\n    kind: \'plan-review\';\n    approve: string;\n    callId?: ToolCallId;\n};',
+    declaration: 'export type AskUserQuestionIntent = {\n    kind: \'plan-review\';\n    approve: string;\n    callId?: ToolCallId;\n} | {\n    kind: \'approval\';\n    approve: string;\n    reject: string;\n    always?: string;\n    subject?: {\n        name: string;\n        icon?: string;\n    };\n    display?: {\n        question: {\n            en: string;\n            [locale: string]: string;\n        };\n        detail?: {\n            en: string;\n            [locale: string]: string;\n        };\n        approve?: {\n            en: string;\n            [locale: string]: string;\n        };\n    };\n};',
   },
   {
     name: 'AskUserQuestionItem',
@@ -4979,7 +5028,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'BundleInfo',
-    declaration: 'export interface BundleInfo {\n    name: string;\n    official: boolean;\n    availability: \'installation\' | \'profile\' | \'missing\';\n    installTarget?: {\n        spec: string;\n        version: string;\n    };\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}',
+    declaration: 'export interface BundleInfo {\n    name: string;\n    experimental?: boolean;\n    official: boolean;\n    availability: \'installation\' | \'profile\' | \'missing\';\n    installTarget?: {\n        spec: string;\n        version: string;\n    };\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}',
   },
   {
     name: 'BundleRowInfo',
@@ -5305,6 +5354,30 @@ export const TYPE_API: readonly TypeApiEntry[] = [
     name: 'CronScheduleRecord',
     declaration: 'export interface CronScheduleRecord {\n    readonly id: ScheduleId;\n    readonly kind: \'cron\';\n    readonly title: string;\n    readonly prompt: string;\n    readonly expression: string;\n    readonly timeZone: string;\n    readonly scheduledAt: string;\n}',
   },
+  {
+    name: 'CuaApplicationGrant',
+    declaration: 'export interface CuaApplicationGrant {\n    id: CuaApplicationId;\n    name: string;\n    executablePath: string;\n}',
+  },
+  {
+    name: 'CuaApplicationId',
+    declaration: 'export type CuaApplicationId = Branded<\'CuaApplicationId\'>;',
+  },
+  {
+    name: 'CuaApplicationState',
+    declaration: 'export interface CuaApplicationState {\n    settingsNamespace: string | null;\n    allowedApps: readonly CuaApplicationGrant[];\n    blockedApps: readonly CuaApplicationGrant[];\n    persistentAvailable: boolean;\n}',
+  },
+  {
+    name: 'CuaPermissionProcess',
+    declaration: 'export interface CuaPermissionProcess {\n    pid: number;\n    path?: string | undefined;\n    name?: string | undefined;\n}',
+  },
+  {
+    name: 'CuaSystemPermission',
+    declaration: 'export type CuaSystemPermission = \'accessibility\' | \'screenRecording\';',
+  },
+  {
+    name: 'CuaSystemPermissionState',
+    declaration: 'export interface CuaSystemPermissionState {\n    accessibility: boolean;\n    screenRecording: boolean;\n    helper: CuaPermissionProcess;\n    parent: CuaPermissionProcess;\n    launchApplication?: {\n        name: string;\n        path: string;\n        icon?: string | undefined;\n    } | undefined;\n}',
+  },
   {
     name: 'DailyInput',
     declaration: 'export interface DailyInput {\n    readonly time: string;\n    readonly time_zone: string;\n}',
@@ -6027,7 +6100,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'ManagementError',
-    declaration: 'export interface ManagementError {\n    code: ReadOnlyReason | \'unknown-plugin\' | \'invalid-spec\' | \'already-installed\' | \'ambiguous-install\' | \'not-bundle\' | \'not-removable\' | \'stop-profile\' | \'bundle-in-use\' | \'stale-approval\' | \'incompatible-version\' | \'operation-error\';\n    diagnostic?: string;\n    incompatible?: IncompatiblePlugin[];\n}',
+    declaration: 'export interface ManagementError {\n    code: ReadOnlyReason | \'unknown-plugin\' | \'invalid-spec\' | \'already-installed\' | \'ambiguous-install\' | \'not-bundle\' | \'not-removable\' | \'stop-profile\' | \'bundle-in-use\' | \'stale-approval\' | \'incompatible-version\' | \'unsupported-platform\' | \'operation-error\';\n    diagnostic?: string;\n    incompatible?: IncompatiblePlugin[];\n}',
   },
   {
     name: 'ManualCompactAgentContext',
@@ -6423,7 +6496,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'PluginInventoryEntry',
-    declaration: 'export interface PluginInventoryEntry {\n    readonly entryId: PluginEntryId;\n    readonly moduleName: string;\n    readonly meta?: PluginLocalizedMeta;\n    readonly enabled: boolean;\n    readonly fiberPhase: PluginFiberPhase;\n}',
+    declaration: 'export interface PluginInventoryEntry {\n    readonly entryId: PluginEntryId;\n    readonly moduleName: string;\n    readonly meta?: PluginLocalizedMeta;\n    readonly enabled: boolean;\n    readonly fiberPhase: PluginFiberPhase;\n    readonly diagnostic?: string;\n}',
   },
   {
     name: 'PluginLocalizedMeta',
diff --git a/packages/preset/agent-preset/skills/cordis-composition-reference/references/packages.md b/packages/preset/agent-preset/skills/cordis-composition-reference/references/packages.md
index eee345a99c..1623e0b819 100644
--- a/packages/preset/agent-preset/skills/cordis-composition-reference/references/packages.md
+++ b/packages/preset/agent-preset/skills/cordis-composition-reference/references/packages.md
@@ -184,6 +184,7 @@ Every package below exports a Cordis plugin that a bundle patch can name in a Lo
 
 | Package | Config | Description |
 |---|---|---|
+| `@deepseek-ai/dsh-client-ui-cua` | no | Computer Use permission setup and application access controls |
 | `@deepseek-ai/dsh-experimental-agent-team` | yes | Implicit-root Agent Teams roster, direct peer messaging, and shared task DAG |
 | `@deepseek-ai/dsh-experimental-api-speech-to-text` | yes | Authenticated experimental speech transcription for browser clients |
 | `@deepseek-ai/dsh-experimental-auto-review` | no | Per-tool LLM authorization review for the DeepSeek Harness Auto permission preset |

From b4d5ccc416ccf1bd8d90e31dd9eb75b74bdaf42c Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 17:12:49 +0800
Subject: [PATCH 11/44] refactor(cua): own approval presentation and preserve
 shared UI defaults

---
 apps/web/tests/approval-composer.e2e.ts       | 11 +++
 apps/web/tests/cua-optin.e2e.ts               |  8 ++
 apps/web/tests/cua-permissions.e2e.ts         |  3 +
 docs/subsystems/user-questions.i18n.yaml      |  4 +-
 docs/subsystems/user-questions.md             |  2 +-
 docs/subsystems/user-questions.zh.md          |  2 +-
 packages/client/ui-approval/README.i18n.yaml  |  4 +-
 packages/client/ui-approval/README.md         |  2 +-
 packages/client/ui-approval/README.zh.md      |  2 +-
 .../ui-approval/src/client/ApprovalCard.tsx   |  2 +-
 .../src/client/ApprovalPanel.module.css       |  5 +-
 .../src/client/PluginManagerPage.module.css   |  3 +-
 .../client/ui-user-questions/README.i18n.yaml |  8 +-
 packages/client/ui-user-questions/README.md   |  4 +-
 .../client/ui-user-questions/README.zh.md     |  4 +-
 .../client/ui-user-questions/package.json     |  6 +-
 .../src/client/QuestionApproval.tsx           | 31 -------
 .../src/client/QuestionComposer.tsx           |  3 -
 .../src/client/contract/slots.ts              |  4 +-
 .../ui-user-questions/src/client/index.ts     |  8 +-
 .../tests/browser-plugin.client.spec.ts       | 12 +--
 .../tests/plan-review-panel.client.spec.tsx   |  2 -
 .../tests/question-approval.client.spec.tsx   | 50 -----------
 .../user-questions-composer.client.spec.tsx   |  2 -
 .../client/ui-user-questions/tsconfig.json    |  3 -
 .../client-ui-cua/README.i18n.yaml            |  4 +-
 packages/experimental/client-ui-cua/README.md |  2 +-
 .../experimental/client-ui-cua/README.zh.md   |  2 +-
 .../experimental/client-ui-cua/package.json   | 10 ++-
 .../src/client/ApplicationApproval.tsx        | 46 ++++++++++
 .../client-ui-cua/src/client/mount.ts         |  7 ++
 .../application-approval.client.spec.tsx      | 83 +++++++++++++++++++
 .../client-ui-cua/tests/mount.client.spec.ts  |  8 ++
 .../experimental/client-ui-cua/tsconfig.json  |  9 ++
 .../interaction/user-questions/src/index.ts   |  6 ++
 .../tests/user-questions.spec.ts              |  6 +-
 pnpm-lock.yaml                                | 12 ++-
 37 files changed, 237 insertions(+), 143 deletions(-)
 delete mode 100644 packages/client/ui-user-questions/src/client/QuestionApproval.tsx
 delete mode 100644 packages/client/ui-user-questions/tests/question-approval.client.spec.tsx
 create mode 100644 packages/experimental/client-ui-cua/src/client/ApplicationApproval.tsx
 create mode 100644 packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx

diff --git a/apps/web/tests/approval-composer.e2e.ts b/apps/web/tests/approval-composer.e2e.ts
index a3a8959014..bdb23ec123 100644
--- a/apps/web/tests/approval-composer.e2e.ts
+++ b/apps/web/tests/approval-composer.e2e.ts
@@ -112,6 +112,17 @@ describe.each(MODE === 'record' ? ['button'] as const : ['button', 'keyboard'] a
     await panel.waitFor({ timeout: MODE === 'record' ? 180_000 : 60_000 })
     const scroll = panel.locator('[data-approval-scroll]')
     await expect.poll(() => scroll.getByText(/tok/).count(), { timeout: 15_000 }).toBeGreaterThan(0)
+    const defaults = await panel.evaluate((root: HTMLElement) => {
+      const before = root.style.textAlign
+      root.style.textAlign = 'center'
+      try {
+        return {
+          alignment: getComputedStyle(root.querySelector('[data-approval-scroll]')!).textAlign,
+          wrapping: getComputedStyle(root.querySelector('button')!.parentElement!).flexWrap,
+        }
+      } finally { root.style.textAlign = before }
+    })
+    expect(defaults).toEqual({ alignment: 'center', wrapping: 'nowrap' })
 
     if (MODE !== 'record') {
       const snapshot = await captureStableAria(page, '[data-approval-key]', scaffold.workspaceCwd)
diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index c3f0e15eba..83262c977b 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -44,6 +44,14 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     expect(await card.textContent()).toContain('请切换到 PTC 模式')
     expect(await card.textContent()).toContain('Windows 支持正在开发中')
     expect(await card.textContent()).not.toContain('Swift')
+    const description = await card.getByRole('button', { name: '查看 Computer Use', exact: true }).evaluate((button) => {
+      const element = document.getElementById(button.getAttribute('aria-describedby')!)!
+      const style = getComputedStyle(element)
+      return { lines: style.webkitLineClamp, height: element.getBoundingClientRect().height,
+        lineHeight: Number.parseFloat(style.lineHeight) }
+    })
+    expect(description.lines).toBe('1')
+    expect(description.height).toBeLessThanOrEqual(description.lineHeight + 1)
     const originalAgent = scaffold.ctx.agents.list()[0]!
     const ptcAgent = (await scaffold.ctx.agents.create({
       sessionId: SessionId('cua-existing-ptc'),
diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index ff3f6c92a6..dd85dbb87a 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -65,6 +65,9 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   })])
   expect(await approval.getByText('Fixture', { exact: true }).count()).toBe(1)
   expect(await approval.getByRole('textbox').count()).toBe(0)
+  expect(await approval.locator('[data-approval-scroll]').evaluate(element => getComputedStyle(element).textAlign)).toBe('left')
+  expect(await approval.getByRole('button', { name: 'Always allow', exact: true })
+    .evaluate(button => getComputedStyle(button.parentElement!).flexWrap)).toBe('wrap')
   await expect.poll(() => approval.locator('img').evaluate((image: HTMLImageElement) => image.naturalWidth)).toBe(1)
   expect(await approval.getByText('/Applications/Fixture.app', { exact: true }).count()).toBe(0)
   await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/application-approval.expected.md', import.meta.url)),
diff --git a/docs/subsystems/user-questions.i18n.yaml b/docs/subsystems/user-questions.i18n.yaml
index 696f802d38..808a19468f 100644
--- a/docs/subsystems/user-questions.i18n.yaml
+++ b/docs/subsystems/user-questions.i18n.yaml
@@ -9,8 +9,8 @@
   en: 88cceb3cf383248e
   zh: 8e1d2627823b1ffc
 /user-interaction/presentation-intent:
-  en: 6605b0582b4ecd5a
-  zh: 01491d5470146a74
+  en: 9aa9b7fb16455a6e
+  zh: d820978a3f652e92
 /user-interaction/question-item:
   en: 1ad4373e6fdfe4c7
   zh: efb8d41ebe7224f8
diff --git a/docs/subsystems/user-questions.md b/docs/subsystems/user-questions.md
index da71ccd63d..7ff030b698 100644
--- a/docs/subsystems/user-questions.md
+++ b/docs/subsystems/user-questions.md
@@ -22,7 +22,7 @@ interface AskUserQuestionOption {
 
 ## Presentation intent
 
-`AskUserQuestionIntent` changes presentation while preserving option labels and the caller’s decision policy. `plan-review` names the approve option and requires plan detail. `approval` requires one blocking question with detail and distinct reject, approve and optional always-allow labels covering exactly the offered options. It rejects multi-select and timed waits. An unrecognized intent remains a generic option list.
+`AskUserQuestionIntent` changes presentation while preserving option labels and the caller’s decision policy. `plan-review` names the approve option and requires plan detail. `approval` requires one blocking question with detail and distinct reject, approve and optional always-allow labels covering exactly the offered options. It rejects multi-select and timed waits. The CUA frontend renders its fixed approvals through the existing composer chain; ordinary questions and plan review keep their existing renderers.
 
 ```ts type-equiv
 /**
diff --git a/docs/subsystems/user-questions.zh.md b/docs/subsystems/user-questions.zh.md
index b8e4d54d85..176db66aec 100644
--- a/docs/subsystems/user-questions.zh.md
+++ b/docs/subsystems/user-questions.zh.md
@@ -22,7 +22,7 @@ interface AskUserQuestionOption {
 
 ## 呈现意图
 
-`AskUserQuestionIntent` 改变呈现方式，保留选项标签和调用方的决策规则。`plan-review` 指定批准选项，并要求提供计划正文。`approval` 要求只有一个阻塞式问题，带有说明以及互不相同的拒绝、允许和可选的始终允许标签，完整对应已提供的选项，不支持多选或计时等待。未识别的意图仍显示为通用选项列表。
+`AskUserQuestionIntent` 改变呈现方式，保留选项标签和调用方的决策规则。`plan-review` 指定批准选项，并要求提供计划正文。`approval` 要求只有一个阻塞式问题，带有说明以及互不相同的拒绝、允许和可选的始终允许标签，完整对应已提供的选项，不支持多选或计时等待。CUA 前端通过现有 composer 呈现自己的固定审批；普通问答和计划审阅继续使用原有呈现。
 
 ```ts type-equiv
 /**
diff --git a/packages/client/ui-approval/README.i18n.yaml b/packages/client/ui-approval/README.i18n.yaml
index 206aa36eb9..da9aa9eb7e 100644
--- a/packages/client/ui-approval/README.i18n.yaml
+++ b/packages/client/ui-approval/README.i18n.yaml
@@ -21,8 +21,8 @@
   en: adf7112e0691b89e
   zh: 14eeddcff985119f
 /deepseek-ai-dsh-client-ui-approval/known-limitations-and-deferred-work:
-  en: 96d9b96df10e88eb
-  zh: cdeab788ad08bb33
+  en: 23588a4cd32f363c
+  zh: 19402f024f0f926a
 /deepseek-ai-dsh-client-ui-approval/known-limitations-and-deferred-work/dev-note:
   en: e67f633dc6fe7773
   zh: e88aeb617ffb74ea
diff --git a/packages/client/ui-approval/README.md b/packages/client/ui-approval/README.md
index 0d8a384c53..61389c5000 100644
--- a/packages/client/ui-approval/README.md
+++ b/packages/client/ui-approval/README.md
@@ -35,7 +35,7 @@ None; approval request and response rendering does not alter a model request.
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- The shared `conversation.approval.card` Factory presents reject, allow and an optional always-allow action, with caller-owned scope, subject metadata and answer callbacks. Tool approvals retain their two outcomes. Application consent can reuse the card without adopting tool-approval policy. Icons and labels identify the subject visually; the caller owns identity verification and saved grants.
+- The shared `conversation.approval.card` Factory presents reject, allow and an optional always-allow action, with caller-owned scope, subject metadata and answer callbacks. Tool approvals retain their two outcomes. Application consent can reuse the card without adopting tool-approval policy. Subject metadata enables left-aligned content and wrapping actions; callers that omit it retain inherited alignment and a single action row. Icons and labels identify the subject visually; the caller owns identity verification and saved grants.
 
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-approval/README.zh.md b/packages/client/ui-approval/README.zh.md
index 1474190a22..310eff5b89 100644
--- a/packages/client/ui-approval/README.zh.md
+++ b/packages/client/ui-approval/README.zh.md
@@ -35,7 +35,7 @@ kind: "package-reference"
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- 共用的 `conversation.approval.card` Factory 展示拒绝、允许和可选的始终允许操作，授权范围、对象信息和回答回调由调用方提供。工具审批保留原来的两种选择。应用授权可以复用卡片，同时保留独立的授权规则。图标和名称用于识别对象，身份校验和授权保存由调用方负责。
+- 共用的 `conversation.approval.card` Factory 展示拒绝、允许和可选的始终允许操作，授权范围、对象信息和回答回调由调用方提供。工具审批保留原来的两种选择。应用授权可以复用卡片，同时保留独立的授权规则。传入对象信息时，内容左对齐，按钮允许换行；未传入时沿用继承的对齐方式和单排按钮。图标和名称用于识别对象，身份校验和授权保存由调用方负责。
 
 
 <a id="dev-note"></a>
diff --git a/packages/client/ui-approval/src/client/ApprovalCard.tsx b/packages/client/ui-approval/src/client/ApprovalCard.tsx
index a4cf3cd0f3..50d1b4cffb 100644
--- a/packages/client/ui-approval/src/client/ApprovalCard.tsx
+++ b/packages/client/ui-approval/src/client/ApprovalCard.tsx
@@ -55,7 +55,7 @@ function ApprovalFlow(props: FactoryComponentPropsOf<'conversation.approval.card
       onKeyUpCapture={() => { compositionEnded.current = false }}
       onCompositionStartCapture={() => { composing.current = true }}
       onCompositionEndCapture={() => { composing.current = false; compositionEnded.current = true }}>
-      <div className={css.card}>
+      <div className={subject === undefined ? css.card : `${css.card} ${css.withSubject}`}>
         <div className={css.strip}><StateDot state={answered ? 'ongoing' : 'warning'} />{t('waiting')}</div>
         <div
           className={css.body}
diff --git a/packages/client/ui-approval/src/client/ApprovalPanel.module.css b/packages/client/ui-approval/src/client/ApprovalPanel.module.css
index 90c9a87d5c..b6a21e092e 100644
--- a/packages/client/ui-approval/src/client/ApprovalPanel.module.css
+++ b/packages/client/ui-approval/src/client/ApprovalPanel.module.css
@@ -34,7 +34,6 @@
   gap: 6px;
   box-sizing: border-box;
   max-height: var(--dsh-composer-text-max-height);
-  text-align: left;
   overflow-y: auto;
   padding: 12px 16px 0;
 }
@@ -57,7 +56,6 @@
 .actionRow {
   display: flex;
   justify-content: flex-end;
-  flex-wrap: wrap;
   gap: 8px;
   padding: 14px 16px;
 }
@@ -87,3 +85,6 @@
   font-size: 13px;
   line-height: 20px;
 }
+
+.withSubject .body { text-align: left; }
+.withSubject .actionRow { flex-wrap: wrap; }
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index 19e932d475..d4a6984533 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -346,13 +346,12 @@
 }
 
 .cardDesc {
-  min-height: 2lh;
   font-size: 13px;
   line-height: 18px;
   color: var(--dsw-alias-label-tertiary);
   display: -webkit-box;
   -webkit-box-orient: vertical;
-  -webkit-line-clamp: 2;
+  -webkit-line-clamp: 1;
   overflow: hidden;
 }
 
diff --git a/packages/client/ui-user-questions/README.i18n.yaml b/packages/client/ui-user-questions/README.i18n.yaml
index 407fc475bd..e317d03367 100644
--- a/packages/client/ui-user-questions/README.i18n.yaml
+++ b/packages/client/ui-user-questions/README.i18n.yaml
@@ -12,8 +12,8 @@
   en: 1aa6291852d48a08
   zh: 414eed268fb2cf1f
 /deepseek-ai-dsh-client-ui-user-questions/table-of-contents:
-  en: 9a599485cc9f47b9
-  zh: 17a17d7a943fb1b7
+  en: d152484eb41ac6b4
+  zh: 09388d293f9be9cb
 /deepseek-ai-dsh-client-ui-user-questions/use-this-package:
   en: 8d3815c19858ac85
   zh: 94fc905fa202d334
@@ -21,8 +21,8 @@
   en: cc19c065d0aeac1e
   zh: 91c8cbe08b438e7f
 /deepseek-ai-dsh-client-ui-user-questions/use-this-package/reading-a-settled-question-back:
-  en: 10975f68ff9c6fcc
-  zh: 92246aadc363f0eb
+  en: 8e8449ab411b9916
+  zh: 0129d68b84458e8e
 /deepseek-ai-dsh-client-ui-user-questions/use-this-package/the-plan-review-card:
   en: 6b12f1362c614a39
   zh: 27d9cf54d4cbd5d2
diff --git a/packages/client/ui-user-questions/README.md b/packages/client/ui-user-questions/README.md
index 5603188fce..21bd536737 100644
--- a/packages/client/ui-user-questions/README.md
+++ b/packages/client/ui-user-questions/README.md
@@ -20,8 +20,6 @@ The Web client shows an agent's question beside the chat input. Users choose opt
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
-An `approval` intent reuses the shared approval card for fixed choices. It displays caller-supplied subject metadata and localized copy, with no text field or question pager; the existing question channel still delivers the selected label.
-
 -----
 
 <a id="use-this-package"></a>
@@ -39,6 +37,8 @@ Each late reply is shown once, including when it opens a new Turn. Replies follo
 
 A question that already settled opens as a read-only card: the same pager over the recorded answers, marked `Answered`. Every option and text field is disabled, Skip and the submit action are gone, a question the user skipped says so in place of its empty answer, and a free-text field appears only where the recorded answer used one. Closing it removes the card, and the tool call row builds another from the same record.
 
+Fixed approval questions use the same pending-question and answer channel. Their feature plugin supplies the composer presentation; the generic question form leaves these requests to that contribution.
+
 ### The plan-review card
 
 A `plan-review` intent — set by `dsh-plan-mode` on the `exit_plan_mode` review — renders a compact approval card: a `Plan review` strip with a `View full plan` link, the plan title and a two-line plain-text summary, and `Request changes` / `Approve` actions. The strip uses the shared warning dot and changes it to the ongoing loader while either action settles. The complete plan opens in the sidebar through the link or its permanent Chat card. Approve answers with the asker's approval label; `Request changes` rejects the wait as `ASK_CANCELLED`, returning the composer for the user's feedback without submitting an approval. The card has no separate refusal button.
diff --git a/packages/client/ui-user-questions/README.zh.md b/packages/client/ui-user-questions/README.zh.md
index 959620b0b4..6cc13b0bd6 100644
--- a/packages/client/ui-user-questions/README.zh.md
+++ b/packages/client/ui-user-questions/README.zh.md
@@ -20,8 +20,6 @@ Web 客户端在聊天输入框旁显示 agent（智能体）的提问。用户
 - [已知限制与延期工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
-`approval` 意图复用共用审批卡片展示固定选项，显示调用方提供的对象信息和本地化文案，不提供文本输入或问题翻页，仍通过现有问答通道返回选中的标签。
-
 -----
 
 <a id="use-this-package"></a>
@@ -39,6 +37,8 @@ Web 客户端在聊天输入框旁显示 agent（智能体）的提问。用户
 
 已经结束的问题以只读卡片打开：同一个翻页器走过已记录的回答，并标注「已回答」。所有选项与文本框都被禁用，跳过与提交动作消失，用户当时跳过的问题会在空回答处说明这一点，自由文本框只出现在当时确实用过它的回答上。关闭它会移除该卡片，工具调用行会用同一份记录再建一个。
 
+固定审批问题沿用同一个待答问题和回答通道，由功能插件提供 composer 呈现；通用问答表单将这类请求留给该呈现处理。
+
 ### plan-review 卡片
 
 `plan-review` 意图——由 `dsh-plan-mode` 在 `exit_plan_mode` 审阅上设置——渲染紧凑审批卡片：顶部为带“查看全文”链接的“计划待审”条带，正文显示计划标题和两行纯文本摘要，底部提供“要求修改”和“同意执行”。条带使用共享 warning 状态点，并在任一操作结算期间切换为 ongoing loading。通过链接或聊天历史中的常驻卡片可在侧边栏阅读完整计划。“同意执行”用提问方的批准标签回答；“要求修改”以 `ASK_CANCELLED` 拒绝等待，让编辑器归位供用户输入反馈，不会提交批准。卡片不单列拒绝按钮。
diff --git a/packages/client/ui-user-questions/package.json b/packages/client/ui-user-questions/package.json
index 09eac415c4..19fd208e09 100644
--- a/packages/client/ui-user-questions/package.json
+++ b/packages/client/ui-user-questions/package.json
@@ -35,8 +35,7 @@
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-renderer",
         "@deepseek-ai/dsh-client-ui-session",
-        "@deepseek-ai/dsh-client-ui-chat",
-        "@deepseek-ai/dsh-client-ui-approval"
+        "@deepseek-ai/dsh-client-ui-chat"
       ],
       "platform": "web"
     }
@@ -72,8 +71,7 @@
     "clsx": "^2.0.0",
     "@deepseek-ai/dsh-llm": "workspace:*",
     "@deepseek-ai/dsh-client-ui-chat": "workspace:*",
-    "@deepseek-ai/dsh-client-ui-tool": "workspace:*",
-    "@deepseek-ai/dsh-client-ui-approval": "workspace:*"
+    "@deepseek-ai/dsh-client-ui-tool": "workspace:*"
   },
   "files": [
     "locale/*.json",
diff --git a/packages/client/ui-user-questions/src/client/QuestionApproval.tsx b/packages/client/ui-user-questions/src/client/QuestionApproval.tsx
deleted file mode 100644
index da255a8471..0000000000
--- a/packages/client/ui-user-questions/src/client/QuestionApproval.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-/** Fixed-action question presentation using the shared approval card. */
-import type { AskUserQuestionItem, AskUserQuestionIntent } from '@deepseek-ai/dsh-user-questions/types'
-import type {} from '@deepseek-ai/dsh-client-ui-approval/client'
-import type { QuestionComposerProps } from './contract/slots.ts'
-
-/**
- * Keep the question answer channel while rendering permission choices without a text field.
- * @param props Blocking question, its approval presentation and renderer bindings.
- * @returns The shared approval card with exactly the caller's offered actions.
- */
-export function QuestionApproval(props: QuestionComposerProps & {
-  item: AskUserQuestionItem
-  intent: Extract<AskUserQuestionIntent, { kind: 'approval' }>
-}) {
-  const { matched: pending, item, intent, resolveText } = props
-  const always = intent.always
-  const answer = (label: string) => pending.answer({ answers: [{ id: item.id, selected: [label] }] })
-  return props.renderFactorySlot('conversation.approval.card', {
-    requestKey: pending.key,
-    title: intent.display === undefined ? item.question : resolveText(intent.display.question),
-    ...(item.detail === undefined ? {} : {
-      description: intent.display?.detail === undefined ? item.detail : resolveText(intent.display.detail),
-    }),
-    ...(intent.subject === undefined ? {} : { subject: intent.subject }),
-    allowLabel: intent.display?.approve === undefined ? intent.approve : resolveText(intent.display.approve),
-    canAnswer: () => pending.snapshot().channel !== 'none' && !pending.snapshot().closed,
-    onAllow: () => answer(intent.approve),
-    onReject: () => answer(intent.reject),
-    ...(always === undefined ? {} : { onAlways: () => answer(always) }),
-  })
-}
diff --git a/packages/client/ui-user-questions/src/client/QuestionComposer.tsx b/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
index 906c92e726..8d3ad551ba 100644
--- a/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
+++ b/packages/client/ui-user-questions/src/client/QuestionComposer.tsx
@@ -11,7 +11,6 @@ import {
 import { planReviewOf, type QuestionAnswer, type QuestionCardSnapshot, type QuestionComposerProps } from './contract/slots.ts'
 import type { PendingQuestion } from './contract/slots.ts'
 import type { QuestionDraftAnswer, QuestionDraftProgress } from './draft-store.ts'
-import { QuestionApproval } from './QuestionApproval.tsx'
 import { PlanReviewPanel } from './PlanReviewPanel.tsx'
 import css from './QuestionComposer.module.css'
 
@@ -140,8 +139,6 @@ function AnswerField(props: AnswerFieldProps) {
 export function QuestionComposer(props: QuestionComposerProps) {
   const question = props.matched
   const review = useMemo(() => planReviewOf(question.questions), [question])
-  const item = question.questions[0]
-  if (item?.intent?.kind === 'approval') return <QuestionApproval {...props} item={item} intent={item.intent} />
   return review === undefined
     ? (
       <QuestionFlow
diff --git a/packages/client/ui-user-questions/src/client/contract/slots.ts b/packages/client/ui-user-questions/src/client/contract/slots.ts
index 8d61f8c0e4..4d1e9fd0e9 100644
--- a/packages/client/ui-user-questions/src/client/contract/slots.ts
+++ b/packages/client/ui-user-questions/src/client/contract/slots.ts
@@ -1,5 +1,5 @@
 /** Question composer props and one pending Remote waterfall response. */
-import type { InjectFace, PropsLocale, PropsRenderFactories, PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
+import type { InjectFace, PropsLocale, PropsRenderSlots, PropsRuntime, PropsStore } from '@deepseek-ai/dsh-client-ui-slots'
 // The client module declares the conversation.composer SlotMap entry required by PropsRuntime.
 import type { ToolCallId } from '@deepseek-ai/dsh-llm/brand'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
@@ -569,8 +569,6 @@ export type QuestionComposerProps =
   PropsRuntime<'conversation.composer'>
   & PropsStore<ReturnType<typeof createQuestionDraftStore>>
   & PropsRenderSlots<'conversation.plan-review.actions'>
-  & PropsRenderFactories
-  & { resolveText: (text: { en: string; [locale: string]: string }) => string }
   & InjectFace<{ keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined } }>
   & { matched: QuestionWait }
   & PropsLocale<'question'>
diff --git a/packages/client/ui-user-questions/src/client/index.ts b/packages/client/ui-user-questions/src/client/index.ts
index c7962a307e..c96c3d5a89 100644
--- a/packages/client/ui-user-questions/src/client/index.ts
+++ b/packages/client/ui-user-questions/src/client/index.ts
@@ -15,7 +15,6 @@ import type { InboxWireState } from '@deepseek-ai/dsh-agent/types'
 import type {} from '@deepseek-ai/dsh-api-remotes/client'
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
 import type {} from '@deepseek-ai/dsh-client-ui-chat/client'
-import type {} from '@deepseek-ai/dsh-client-ui-approval/client'
 import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type { PendingInteractionPublisher } from '@deepseek-ai/dsh-client-ui-session/client'
@@ -384,12 +383,11 @@ export function apply(ctx: ClientContext): void {
     {
       name: 'conversation.composer',
       select: ({ pendingInteraction }: ComposerChainProps): PendingQuestion | null =>
-        pendingInteraction instanceof PendingQuestion ? pendingInteraction : null,
+        pendingInteraction instanceof PendingQuestion && pendingInteraction.questions[0]?.intent?.kind !== 'approval'
+          ? pendingInteraction : null,
       locale: NS,
       store: questionDraftStore,
-      inject: () => ({ keyedHooks: { questionCard: (key: string) => cards.source(key) },
-        resolveText: (text: { en: string; [locale: string]: string }) => ctx.locale.resolveText(text),
-      }),
+      inject: () => ({ keyedHooks: { questionCard: (key: string) => cards.source(key) } }),
       children: { 'conversation.plan-review.actions': { kind: 'list', scope: 'session' } },
     },
     QuestionComposer,
diff --git a/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts b/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
index 2b0db5710e..f12d6b7336 100644
--- a/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
+++ b/packages/client/ui-user-questions/tests/browser-plugin.client.spec.ts
@@ -370,14 +370,7 @@ describe('apply', () => {
     const store = entry.store as ReturnType<typeof createQuestionDraftStore>
     expect(store.create(SESSION_ID).getSnapshot()).toEqual({ progressByRequest: {} })
     const pending = b.pending.getSnapshot()[0]!
-    const face = (entry.inject as () => {
-      keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined }
-      resolveText: (text: { en: string; zh: string }) => string
-    })()
-    b.locale.setLocale('zh')
-    expect(face.resolveText({ en: 'Allow for this session', zh: '本会话允许' })).toBe('本会话允许')
-    b.locale.setLocale('en')
-    expect(face.resolveText({ en: 'Allow for this session', zh: '本会话允许' })).toBe('Allow for this session')
+    const face = (entry.inject as () => { keyedHooks: { questionCard: (key: string) => PendingQuestion | undefined } })()
     expect(face.keyedHooks.questionCard(pending.key)).toBe(pending)
     expect(face.keyedHooks.questionCard('question:missing')).toBeUndefined()
     const select = entry.select as (
@@ -385,6 +378,9 @@ describe('apply', () => {
     ) => PendingQuestion | null
     expect(select({ pendingInteraction: undefined })).toBeNull()
     expect(select({ pendingInteraction: pending })).toBe(pending)
+    expect(select({ pendingInteraction: new PendingQuestion(SESSION_ID, PLAN_QUESTIONS) })?.kind).toBe('plan-review')
+    expect(select({ pendingInteraction: new PendingQuestion(SESSION_ID, [{ id: 'cua-app-access', question: 'Allow?',
+      intent: { kind: 'approval', approve: 'Allow', reject: 'Deny' } }]) })).toBeNull()
     expect(pending).toMatchObject({ kind: 'question', sessionId: SESSION_ID, questions: QUESTIONS, callId: undefined })
     expect(pending.snapshot()).toEqual({
       state: 'open', waitState: 'counting', countdown: undefined,
diff --git a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
index dc4bd7eae1..2ed8e0c27a 100644
--- a/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/plan-review-panel.client.spec.tsx
@@ -114,8 +114,6 @@ const questionDraftStore = createQuestionDraftStore().create(SID)
 const kit: Omit<QuestionComposerProps, 'matched'> = {
   useQuestionCard: () => { throw new Error('plan review does not read question card state') },
   renderSlot: () => null,
-  renderFactorySlot: () => null,
-  resolveText: text => text.en,
   SessionProvider: ({ children }) => children,
   sessionId: SID,
   session: undefined,
diff --git a/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx b/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx
deleted file mode 100644
index 0f9ba38744..0000000000
--- a/packages/client/ui-user-questions/tests/question-approval.client.spec.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-// @vitest-environment jsdom
-/** Fixed decisions retain the caller's answer labels and pending-question lifetime. */
-import { cleanup, render } from '@testing-library/react'
-import { afterEach, expect, it, vi } from 'vitest'
-import type { SessionId } from '@deepseek-ai/dsh-session/types'
-import type { AskUserQuestionItem, AskUserQuestionIntent } from '@deepseek-ai/dsh-user-questions/types'
-import type { ApprovalCardInput } from '@deepseek-ai/dsh-client-ui-approval/client'
-import { PendingQuestion, createWaterfallRequest, type QuestionComposerProps } from '../src/client/contract/slots.ts'
-import { QuestionComposer } from '../src/client/QuestionComposer.tsx'
-
-afterEach(cleanup)
-
-it.each(['allow', 'reject', 'always'] as const)('returns the exact %s option from the shared card', async (choice) => {
-  const intent: Extract<AskUserQuestionIntent, { kind: 'approval' }> = {
-    kind: 'approval', approve: 'task-value', reject: 'deny-value', always: 'saved-value',
-    subject: { name: 'Calculator' }, display: { question: { en: 'Allow?', zh: '允许吗？' },
-      detail: { en: 'Scope', zh: '本次任务' }, approve: { en: 'Task', zh: '本次任务允许' } },
-  }
-  const item: AskUserQuestionItem = { id: 'access', question: 'English question', detail: 'English detail', intent }
-  const pending = new PendingQuestion('s1' as SessionId, [item])
-  const request = createWaterfallRequest(undefined, undefined, () => {})
-  pending.attachWaterfall(request.channel)
-  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
-  render(<QuestionComposer {...{ matched: pending, renderFactorySlot: factory,
-    resolveText: text => text.zh ?? text.en } as QuestionComposerProps} />)
-  const [name, card] = factory.mock.calls[0]!
-  expect(name).toBe('conversation.approval.card')
-  expect(card).toMatchObject({ title: '允许吗？', description: '本次任务', allowLabel: '本次任务允许', subject: { name: 'Calculator' } })
-  expect(card.canAnswer()).toBe(true)
-  await ({ allow: card.onAllow, reject: card.onReject, always: card.onAlways! })[choice]()
-  expect(await request.result).toEqual({ answers: [{ id: 'access', selected: [{ allow: 'task-value', reject: 'deny-value', always: 'saved-value' }[choice]] }] })
-  pending.close()
-  expect(card.canAnswer()).toBe(false)
-})
-
-it('keeps unsupported persistence absent and uses caller text when no localized metadata exists', () => {
-  const item: AskUserQuestionItem = { id: 'access', question: 'Allow?',
-    intent: { kind: 'approval', approve: 'Task', reject: 'Deny' } }
-  const pending = new PendingQuestion('s1' as SessionId, [item])
-  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
-  const props = { matched: pending, renderFactorySlot: factory, resolveText: text => text.en } as QuestionComposerProps
-  const view = render(<QuestionComposer {...props} />)
-  expect(factory.mock.calls[0]?.[1]).toMatchObject({ title: 'Allow?', allowLabel: 'Task' })
-  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('onAlways')
-  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('subject')
-  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('description')
-  expect(factory.mock.calls[0]?.[1].canAnswer()).toBe(false)
-  view.rerender(<QuestionComposer {...props} matched={new PendingQuestion('s1' as SessionId, [{ ...item, detail: 'Scope' }])} />)
-  expect(factory.mock.calls.at(-1)?.[1].description).toBe('Scope')
-})
diff --git a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
index a250f44481..8ece0da777 100644
--- a/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
+++ b/packages/client/ui-user-questions/tests/user-questions-composer.client.spec.tsx
@@ -113,8 +113,6 @@ const inputState: InputState = {
  *  plain stubs per the client testing discipline). */
 const kitBase: Omit<QuestionComposerProps, 'matched' | 'useStore' | 'useQuestionCard' | 'actions'> = {
   renderSlot: () => null,
-  renderFactorySlot: () => null,
-  resolveText: text => text.en,
   SessionProvider: ({ children }) => children,
   session: undefined,
   sessionId: SID,
diff --git a/packages/client/ui-user-questions/tsconfig.json b/packages/client/ui-user-questions/tsconfig.json
index 3a4bfbf9c4..8368699f96 100644
--- a/packages/client/ui-user-questions/tsconfig.json
+++ b/packages/client/ui-user-questions/tsconfig.json
@@ -58,9 +58,6 @@
     },
     {
       "path": "../../util/brand"
-    },
-    {
-      "path": "../ui-approval"
     }
   ]
 }
diff --git a/packages/experimental/client-ui-cua/README.i18n.yaml b/packages/experimental/client-ui-cua/README.i18n.yaml
index 7a10437d5e..5ed0ccc29f 100644
--- a/packages/experimental/client-ui-cua/README.i18n.yaml
+++ b/packages/experimental/client-ui-cua/README.i18n.yaml
@@ -12,8 +12,8 @@
   en: 4e62e511b5d14986
   zh: 1fce04dbad7515f7
 /deepseek-ai-dsh-client-ui-cua/table-of-contents:
-  en: c606f8af967e93e9
-  zh: c569e0decbd74353
+  en: 1a1d0bf8154bf602
+  zh: c6d8b33e1bac3206
 /deepseek-ai-dsh-client-ui-cua/use-this-package:
   en: ecf4a8b23d6f976d
   zh: 46793f29118b4eff
diff --git a/packages/experimental/client-ui-cua/README.md b/packages/experimental/client-ui-cua/README.md
index 7cf82917e0..01560f53bf 100644
--- a/packages/experimental/client-ui-cua/README.md
+++ b/packages/experimental/client-ui-cua/README.md
@@ -20,7 +20,7 @@ Open Computer Use in Plugins to check Accessibility and Screen Recording, reques
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
-Application permission prompts and permission-page lists show native icons and application names. Paths remain available on hover. Icons are presentation metadata and are never saved with grants. The prompt offers session access, refusal and, for verifiable applications with writable settings, persistent access through the shared approval card.
+Application permission prompts and permission-page lists show native icons and application names. Paths remain available on hover. Icons are presentation metadata and are never saved with grants. This plugin registers the application-approval presentation in the existing composer chain and reuses the shared approval card. The pending question still owns waiting, cancellation and answers. The prompt offers session access, refusal and, for verifiable applications with writable settings, persistent access.
 
 -----
 
diff --git a/packages/experimental/client-ui-cua/README.zh.md b/packages/experimental/client-ui-cua/README.zh.md
index 08b112c67f..108c4b0a19 100644
--- a/packages/experimental/client-ui-cua/README.zh.md
+++ b/packages/experimental/client-ui-cua/README.zh.md
@@ -20,7 +20,7 @@ kind: "package-reference"
 - [已知限制与后续工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
-应用授权提示和权限页列表显示本机图标与应用名称，悬停可查看列表中的路径。图标仅用于展示，不随授权保存。提示复用共用审批卡片，提供本会话允许和拒绝；应用签名可验证且配置可写时，还提供始终允许。
+应用授权提示和权限页列表显示本机图标与应用名称，悬停可查看列表中的路径。图标仅用于展示，不随授权保存。本插件通过现有 composer 注册应用审批呈现，复用共用审批卡片，等待、取消和回答仍由原待答问题负责。提示提供本会话允许和拒绝；应用签名可验证且配置可写时，还提供始终允许。
 
 -----
 
diff --git a/packages/experimental/client-ui-cua/package.json b/packages/experimental/client-ui-cua/package.json
index 6554c14387..2237022d49 100644
--- a/packages/experimental/client-ui-cua/package.json
+++ b/packages/experimental/client-ui-cua/package.json
@@ -32,7 +32,10 @@
         "@deepseek-ai/dsh-client-locale",
         "@deepseek-ai/dsh-client-ui-plugin-manager",
         "@deepseek-ai/dsh-client-ui-settings",
-        "@deepseek-ai/dsh-client-ui-layout"
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-user-questions",
+        "@deepseek-ai/dsh-client-ui-approval",
+        "@deepseek-ai/dsh-client-ui-conversation"
       ],
       "platform": "web"
     }
@@ -62,7 +65,10 @@
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "@testing-library/react": "^16.1.0",
-    "@deepseek-ai/dsh-typert-protocol": "workspace:*"
+    "@deepseek-ai/dsh-typert-protocol": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-user-questions": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-approval": "workspace:*",
+    "@deepseek-ai/dsh-client-ui-conversation": "workspace:*"
   },
   "files": [
     "lib/index.js",
diff --git a/packages/experimental/client-ui-cua/src/client/ApplicationApproval.tsx b/packages/experimental/client-ui-cua/src/client/ApplicationApproval.tsx
new file mode 100644
index 0000000000..d49c90a2dd
--- /dev/null
+++ b/packages/experimental/client-ui-cua/src/client/ApplicationApproval.tsx
@@ -0,0 +1,46 @@
+/** Computer Use presentation over the existing pending-question answer channel. */
+import type { PropsRenderFactories, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
+import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
+import type {} from '@deepseek-ai/dsh-client-ui-user-questions/client'
+import type {} from '@deepseek-ai/dsh-client-ui-approval/client'
+
+/**
+ * Select only the provider's fixed application question; other interactions keep their renderer.
+ * @param pending The session's currently elected interaction.
+ * @returns Its application decision, or null for another interaction.
+ */
+export function selectApplicationApproval(pending: ComposerChainProps['pendingInteraction']) {
+  if (pending?.kind !== 'question' || pending.questions.length !== 1) return null
+  const item = pending.questions[0] as (typeof pending.questions)[number]
+  if (item.id !== 'cua-app-access' || item.intent?.kind !== 'approval') return null
+  return { pending, item, intent: item.intent }
+}
+
+/** Composer bindings for an application decision and caller-owned localized copy. */
+export type ApplicationApprovalProps = PropsRuntime<'conversation.composer'> & PropsRenderFactories & {
+  matched: NonNullable<ReturnType<typeof selectApplicationApproval>>
+  resolveText: (text: { en: string; [locale: string]: string }) => string
+}
+
+/**
+ * Render the shared approval card without creating another request or answer lifetime.
+ * @param props The existing pending question and renderer bindings.
+ * @returns Fixed actions with the provider's original answer labels.
+ */
+export function ApplicationApproval({ matched: { pending, item, intent }, resolveText, renderFactorySlot }: ApplicationApprovalProps) {
+  const always = intent.always
+  const answer = (label: string) => pending.answer({ answers: [{ id: item.id, selected: [label] }] })
+  return renderFactorySlot('conversation.approval.card', {
+    requestKey: pending.key,
+    title: intent.display === undefined ? item.question : resolveText(intent.display.question),
+    ...(item.detail === undefined ? {} : {
+      description: intent.display?.detail === undefined ? item.detail : resolveText(intent.display.detail),
+    }),
+    ...(intent.subject === undefined ? {} : { subject: intent.subject }),
+    allowLabel: intent.display?.approve === undefined ? intent.approve : resolveText(intent.display.approve),
+    canAnswer: () => pending.snapshot().channel !== 'none' && !pending.snapshot().closed,
+    onAllow: () => answer(intent.approve),
+    onReject: () => answer(intent.reject),
+    ...(always === undefined ? {} : { onAlways: () => answer(always) }),
+  })
+}
diff --git a/packages/experimental/client-ui-cua/src/client/mount.ts b/packages/experimental/client-ui-cua/src/client/mount.ts
index a475c43d8e..6fc97e4b49 100644
--- a/packages/experimental/client-ui-cua/src/client/mount.ts
+++ b/packages/experimental/client-ui-cua/src/client/mount.ts
@@ -8,7 +8,9 @@ import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
 import { PermissionController } from './controller.ts'
+import { ApplicationApproval, selectApplicationApproval } from './ApplicationApproval.tsx'
 import { PermissionPanel, PermissionSetup, PermissionToast } from './PermissionPanel.tsx'
 import { en, NS, zh, type CuaPermissionLocaleKey } from './locales.ts'
 
@@ -52,6 +54,11 @@ export async function mountCuaPermissions(ctx: Context, contribution: TypertRemo
       retryApproval: async (id) => { const result = await ctx.remote.cuaAccess.retryApproval(id); if (!result.ok) throw result.error },
     })
     const face = controller.face()
+    ctx.slots.inject('conversation.composer', () => ctx.slots.register({
+      name: 'conversation.composer', priority: -1, locale: NS,
+      select: ({ pendingInteraction }: ComposerChainProps) => selectApplicationApproval(pendingInteraction),
+      inject: () => ({ resolveText: (text: { en: string; [locale: string]: string }) => ctx.locale.resolveText(text) }),
+    }, ApplicationApproval))
     const preset = ctx.configForms.get<{ default: string; selectedDefault?: string }>('agent-preset-registry')
     const settings = {
       ...face,
diff --git a/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx b/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx
new file mode 100644
index 0000000000..2f227ea673
--- /dev/null
+++ b/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx
@@ -0,0 +1,83 @@
+// @vitest-environment jsdom
+/** Fixed decisions retain the caller's answer labels and pending-question lifetime. */
+import { cleanup, render } from '@testing-library/react'
+import { afterEach, expect, it, vi } from 'vitest'
+import type { ApprovalCardInput } from '@deepseek-ai/dsh-client-ui-approval/client'
+import { PendingQuestion, createWaterfallRequest } from '../../../client/ui-user-questions/src/client/contract/slots.ts'
+import { ApplicationApproval, selectApplicationApproval, type ApplicationApprovalProps } from '../src/client/ApplicationApproval.tsx'
+
+type AskUserQuestionItem = PendingQuestion['questions'][number]
+type ApprovalIntent = Extract<NonNullable<AskUserQuestionItem['intent']>, { kind: 'approval' }>
+type SessionId = ConstructorParameters<typeof PendingQuestion>[0]
+
+afterEach(cleanup)
+
+it('leaves ordinary questions, plan reviews and other approval intents to their existing renderers', () => {
+  const application: AskUserQuestionItem = { id: 'cua-app-access', question: 'Allow?', detail: 'Scope',
+    options: [{ label: 'Allow' }, { label: 'Deny' }], intent: { kind: 'approval', approve: 'Allow', reject: 'Deny' } }
+  expect(selectApplicationApproval(undefined)).toBeNull()
+  for (const questions of [[], [application, application], [{ ...application, id: 'another-feature' }],
+    [{ id: 'cua-app-access', question: 'Plain question' }],
+    [{ ...application, intent: { kind: 'plan-review' as const, approve: 'Allow' } }],
+  ]) {
+    expect(selectApplicationApproval(new PendingQuestion('s1' as SessionId, questions))).toBeNull()
+  }
+})
+
+it.each(['allow', 'reject', 'always'] as const)('returns the exact %s option from the shared card', async (choice) => {
+  const intent: ApprovalIntent = {
+    kind: 'approval', approve: 'task-value', reject: 'deny-value', always: 'saved-value',
+    subject: { name: 'Calculator' }, display: { question: { en: 'Allow?', zh: '允许吗？' },
+      detail: { en: 'Scope', zh: '本次任务' }, approve: { en: 'Task', zh: '本次任务允许' } },
+  }
+  const item: AskUserQuestionItem = { id: 'cua-app-access', question: 'English question', detail: 'English detail', intent }
+  const pending = new PendingQuestion('s1' as SessionId, [item])
+  const request = createWaterfallRequest(undefined, undefined, () => {})
+  pending.attachWaterfall(request.channel)
+  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
+  render(<ApplicationApproval {...{ matched: selectApplicationApproval(pending)!, renderFactorySlot: factory,
+    resolveText: text => text.zh ?? text.en } as ApplicationApprovalProps} />)
+  const [name, card] = factory.mock.calls[0]!
+  expect(name).toBe('conversation.approval.card')
+  expect(card).toMatchObject({ title: '允许吗？', description: '本次任务', allowLabel: '本次任务允许', subject: { name: 'Calculator' } })
+  expect(card.canAnswer()).toBe(true)
+  await ({ allow: card.onAllow, reject: card.onReject, always: card.onAlways! })[choice]()
+  expect(await request.result).toEqual({ answers: [{ id: 'cua-app-access', selected: [{ allow: 'task-value', reject: 'deny-value', always: 'saved-value' }[choice]] }] })
+  pending.close()
+  expect(card.canAnswer()).toBe(false)
+})
+
+it('keeps unsupported persistence absent and uses caller text when no localized metadata exists', () => {
+  const item: AskUserQuestionItem = { id: 'cua-app-access', question: 'Allow?',
+    intent: { kind: 'approval', approve: 'Task', reject: 'Deny' } }
+  const pending = new PendingQuestion('s1' as SessionId, [item])
+  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
+  const props = { matched: selectApplicationApproval(pending)!, renderFactorySlot: factory,
+    resolveText: text => text.en } as ApplicationApprovalProps
+  const view = render(<ApplicationApproval {...props} />)
+  expect(factory.mock.calls[0]?.[1]).toMatchObject({ title: 'Allow?', allowLabel: 'Task' })
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('onAlways')
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('subject')
+  expect(factory.mock.calls[0]?.[1]).not.toHaveProperty('description')
+  expect(factory.mock.calls[0]?.[1].canAnswer()).toBe(false)
+  const detailed = new PendingQuestion('s1' as SessionId, [{ ...item, detail: 'Scope' }])
+  view.rerender(<ApplicationApproval {...props} matched={selectApplicationApproval(detailed)!} />)
+  expect(factory.mock.calls.at(-1)?.[1].description).toBe('Scope')
+})
+
+it('uses the original question cancellation and refuses late approval', async () => {
+  const pending = new PendingQuestion('s1' as SessionId, [{ id: 'cua-app-access', question: 'Allow?',
+    intent: { kind: 'approval', approve: 'Allow', reject: 'Deny' } }])
+  const controller = new AbortController()
+  const request = createWaterfallRequest(undefined, controller.signal, channel => pending.detachWaterfall(channel))
+  pending.attachWaterfall(request.channel)
+  const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
+  render(<ApplicationApproval {...{ matched: selectApplicationApproval(pending)!, renderFactorySlot: factory,
+    resolveText: text => text.en } as ApplicationApprovalProps} />)
+  const card = factory.mock.calls[0]![1]
+  const rejected = expect(request.result).rejects.toMatchObject({ code: 'ASK_ABORTED' })
+  controller.abort()
+  await rejected
+  expect(card.canAnswer()).toBe(false)
+  await expect(card.onAllow()).rejects.toThrow('no channel accepts an answer yet')
+})
diff --git a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
index bf3962fe46..9ed2ccb3fe 100644
--- a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
+++ b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
@@ -59,6 +59,7 @@ async function fixture(fail = false) {
   ctx.slots.register({ name: 'root', children: {
     'plugins.bundle.activation': { kind: 'keyed', scope: 'root' },
     'plugins.bundle.config': { kind: 'keyed', scope: 'root' }, 'shell.overlay': { kind: 'list', scope: 'root' },
+    'conversation.composer': { kind: 'chain', scope: 'session' },
   } } as never, () => null)
   if (fail) vi.spyOn(ctx.slots, 'inject').mockImplementationOnce(() => { throw new Error('slot unavailable') })
   return { ctx, unmount, unsubscribe, status, systemStatus, applicationIcons,
@@ -73,6 +74,12 @@ it('withdraws the permission Remote and all controls with the optional plugin',
   try {
     const fiber = f.ctx.plugin({ inject: [...inject], apply: ctx => mountCuaPermissions(ctx, contribution) })
     await fiber
+    const approval = f.ctx.slots.entries('conversation.composer')[0]!
+    const select = approval.select as (owner: { pendingInteraction: undefined }) => unknown
+    expect(select({ pendingInteraction: undefined })).toBeNull()
+    const presentation = approval.inject!()
+    assert(typeof presentation.resolveText === 'function')
+    expect(presentation.resolveText({ en: 'Localized', zh: 'Localized' })).toBe('Localized')
     const entry = f.ctx.slots.entries('plugins.bundle.config')[0]!
     const actions = entry.inject!()
     actionsOf(actions)
@@ -117,6 +124,7 @@ it('withdraws the permission Remote and all controls with the optional plugin',
     await (settings.setPtcDefault as () => Promise<boolean>)()
     expect(f.setDefault).toHaveBeenCalledExactlyOnceWith('selectedDefault', 'ptc')
     await fiber.dispose()
+    expect(f.ctx.slots.entries('conversation.composer')).toHaveLength(0)
     expect(f.ctx.slots.entries('plugins.bundle.config')).toHaveLength(0)
     expect(f.ctx.slots.entries('shell.overlay')).toHaveLength(0)
     expect(f.unsubscribe).toHaveBeenCalledOnce()
diff --git a/packages/experimental/client-ui-cua/tsconfig.json b/packages/experimental/client-ui-cua/tsconfig.json
index 66cf034b76..8dff53e1c6 100644
--- a/packages/experimental/client-ui-cua/tsconfig.json
+++ b/packages/experimental/client-ui-cua/tsconfig.json
@@ -46,6 +46,15 @@
     },
     {
       "path": "../../typert/protocol"
+    },
+    {
+      "path": "../../client/ui-user-questions/tsconfig.json"
+    },
+    {
+      "path": "../../client/ui-approval/tsconfig.json"
+    },
+    {
+      "path": "../../client/ui-conversation/tsconfig.client.json"
     }
   ]
 }
diff --git a/packages/interaction/user-questions/src/index.ts b/packages/interaction/user-questions/src/index.ts
index f6ddfad702..a96c2456af 100644
--- a/packages/interaction/user-questions/src/index.ts
+++ b/packages/interaction/user-questions/src/index.ts
@@ -301,6 +301,12 @@ export class UserQuestionService extends TypertRemoteService {
         : [intent.approve]
       const options = question.options ?? []
       if (labels.some(label => !options.some(option => option.label === label))) {
+        if (intent.kind === 'plan-review') {
+          throw new UserQuestionError(
+            `question ${question.id} declares intent ${intent.kind} whose approve label `
+            + `${JSON.stringify(intent.approve)} names none of its options`,
+            'BAD_INTENT')
+        }
         throw new UserQuestionError(`question ${question.id} declares intent ${intent.kind} with an unoffered action`, 'BAD_INTENT')
       }
       if (question.detail === undefined) {
diff --git a/packages/interaction/user-questions/tests/user-questions.spec.ts b/packages/interaction/user-questions/tests/user-questions.spec.ts
index abb58cfabc..b2713ae9fc 100644
--- a/packages/interaction/user-questions/tests/user-questions.spec.ts
+++ b/packages/interaction/user-questions/tests/user-questions.spec.ts
@@ -309,7 +309,8 @@ describe('UserQuestionService', () => {
           ...(options === undefined ? {} : { options }),
           intent: { kind: 'plan-review', approve: 'Ship it' },
         }],
-      })).rejects.toMatchObject({ name: 'UserQuestionError', code: 'BAD_INTENT' })
+      })).rejects.toMatchObject({ name: 'UserQuestionError', code: 'BAD_INTENT',
+        message: 'question plan-review declares intent plan-review whose approve label "Ship it" names none of its options' })
     }
     expect(p.ask).not.toHaveBeenCalled()
   })
@@ -328,7 +329,8 @@ describe('UserQuestionService', () => {
         options: [{ label: 'Approve' }, { label: 'Keep planning' }],
         intent: { kind: 'plan-review', approve: 'Approve' },
       }],
-    })).rejects.toMatchObject({ name: 'UserQuestionError', code: 'BAD_INTENT' })
+    })).rejects.toMatchObject({ name: 'UserQuestionError', code: 'BAD_INTENT',
+      message: 'question plan-review declares intent plan-review without the detail it reviews' })
     expect(p.ask).not.toHaveBeenCalled()
   })
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 39b6e38f4e..009f6ccfd1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6377,9 +6377,6 @@ importers:
       '@deepseek-ai/dsh-client-store':
         specifier: workspace:*
         version: link:../store
-      '@deepseek-ai/dsh-client-ui-approval':
-        specifier: workspace:*
-        version: link:../ui-approval
       '@deepseek-ai/dsh-client-ui-chat':
         specifier: workspace:*
         version: link:../ui-chat
@@ -8308,6 +8305,12 @@ importers:
       '@deepseek-ai/dsh-client-test-runtime':
         specifier: workspace:*
         version: link:../../test-support/client-runtime
+      '@deepseek-ai/dsh-client-ui-approval':
+        specifier: workspace:*
+        version: link:../../client/ui-approval
+      '@deepseek-ai/dsh-client-ui-conversation':
+        specifier: workspace:*
+        version: link:../../client/ui-conversation
       '@deepseek-ai/dsh-client-ui-layout':
         specifier: workspace:*
         version: link:../../client/ui-layout
@@ -8326,6 +8329,9 @@ importers:
       '@deepseek-ai/dsh-client-ui-slots':
         specifier: workspace:*
         version: link:../../client/ui-slots
+      '@deepseek-ai/dsh-client-ui-user-questions':
+        specifier: workspace:*
+        version: link:../../client/ui-user-questions
       '@deepseek-ai/dsh-cua':
         specifier: workspace:*
         version: link:../cua

From 8b3d4f0b52ccabc87d077ca032037758f467aeda Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sat, 17 Oct 2026 17:16:37 +0800
Subject: [PATCH 12/44] docs(cua): refresh composer registration catalog

---
 .../extensions/cordis-client-runner/src/client/slot-catalog.ts   | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
index 339730b2a5..a9e158893b 100644
--- a/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
+++ b/packages/extensions/cordis-client-runner/src/client/slot-catalog.ts
@@ -604,6 +604,7 @@ export const CLIENT_SLOT_API: readonly ClientSlotEntry[] = [
       'client-ui-approval ApprovalPanel',
       'client-ui-subagent SubagentReadOnlyComposer',
       'client-ui-user-questions QuestionComposer',
+      'client-ui-cua ApplicationApproval',
     ],
     replaceRisk: 'none',
     example: 'return {\n  inject: [\'slots\'],\n  apply(ctx) {\n    ctx.slots.inject(\'conversation.composer\', () => ctx.slots.register(\n      { name: \'conversation.composer\', select: owner => null },\n      () => React.createElement(\'div\', null, \'hello\'),\n    ))\n  },\n}',

From d0de93543285a9704329a1a832b548f54a2ac9b6 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 10:30:24 +0800
Subject: [PATCH 13/44] fix(cua): satisfy type-aware lint checks

---
 packages/boot/hmr/src/index.ts                           | 1 +
 packages/boot/plugin-manager/src/patch.ts                | 9 ++++++---
 .../tests/application-approval.client.spec.tsx           | 2 +-
 .../client-ui-cua/tests/mount.client.spec.ts             | 4 ++--
 packages/experimental/cua/tests/access.spec.ts           | 2 +-
 5 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/packages/boot/hmr/src/index.ts b/packages/boot/hmr/src/index.ts
index 6a383787bf..961bf34e1a 100644
--- a/packages/boot/hmr/src/index.ts
+++ b/packages/boot/hmr/src/index.ts
@@ -268,6 +268,7 @@ class Hmr extends Service {
    */
   runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T> {
     if (this.executing.getStore()) return Promise.reject(new Error('HMR transactions cannot be nested'))
+    // oxlint-disable-next-line typescript/prefer-promise-reject-errors -- Preserve the caller's arbitrary AbortSignal reason.
     if (signal?.aborted) return Promise.reject(signal.reason)
     const result = Promise.withResolvers<T>()
     const cancel = () => { result.reject(signal?.reason) }
diff --git a/packages/boot/plugin-manager/src/patch.ts b/packages/boot/plugin-manager/src/patch.ts
index 26e41b7001..a523627d09 100644
--- a/packages/boot/plugin-manager/src/patch.ts
+++ b/packages/boot/plugin-manager/src/patch.ts
@@ -78,11 +78,14 @@ export async function prepareBundleConfiguration(
       && document.getIn([index, 'id']) === id && !item.has('insert')
       && (!item.has('name') || document.getIn([index, 'name']) === name))
     const previous = sequence.items[index]
-    let anchored = false
+    const anchors: string[] = []
     if (isNode(previous)) visit(previous, { Node(_key, node) {
-      if ('anchor' in node && node.anchor) anchored = true
+      if ('anchor' in node && node.anchor) {
+        anchors.push(node.anchor)
+        return visit.BREAK
+      }
     } })
-    if (index < 0 || anchored) document.add(document.createNode({ id, name, config }))
+    if (index < 0 || anchors.length > 0) document.add(document.createNode({ id, name, config }))
     else document.setIn([index, 'config'], document.createNode(config))
   }
   visit(document, { Map(_key, node) {
diff --git a/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx b/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx
index 2f227ea673..e40f26eb95 100644
--- a/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx
+++ b/packages/experimental/client-ui-cua/tests/application-approval.client.spec.tsx
@@ -69,7 +69,7 @@ it('uses the original question cancellation and refuses late approval', async ()
   const pending = new PendingQuestion('s1' as SessionId, [{ id: 'cua-app-access', question: 'Allow?',
     intent: { kind: 'approval', approve: 'Allow', reject: 'Deny' } }])
   const controller = new AbortController()
-  const request = createWaterfallRequest(undefined, controller.signal, channel => pending.detachWaterfall(channel))
+  const request = createWaterfallRequest(undefined, controller.signal, (channel) => { pending.detachWaterfall(channel) })
   pending.attachWaterfall(request.channel)
   const factory = vi.fn((_name: string, _input: ApprovalCardInput) => null)
   render(<ApplicationApproval {...{ matched: selectApplicationApproval(pending)!, renderFactorySlot: factory,
diff --git a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
index 9ed2ccb3fe..b878782a7b 100644
--- a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
+++ b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
@@ -11,6 +11,7 @@ import { expect, it, vi } from 'vitest'
 import type { PermissionFace } from '../src/client/controller.ts'
 import { mountCuaPermissions, inject } from '../src/client/mount.ts'
 import { apply as hostApply } from '../src/index.ts'
+import type { ApplicationApprovalProps } from '../src/client/ApplicationApproval.tsx'
 
 const contribution: TypertRemoteContribution = { package: '@deepseek-ai/dsh-cua', descriptors: [] }
 const value: CuaApplicationState & { system: CuaSystemPermissionState } = {
@@ -77,8 +78,7 @@ it('withdraws the permission Remote and all controls with the optional plugin',
     const approval = f.ctx.slots.entries('conversation.composer')[0]!
     const select = approval.select as (owner: { pendingInteraction: undefined }) => unknown
     expect(select({ pendingInteraction: undefined })).toBeNull()
-    const presentation = approval.inject!()
-    assert(typeof presentation.resolveText === 'function')
+    const presentation = approval.inject!() as Pick<ApplicationApprovalProps, 'resolveText'>
     expect(presentation.resolveText({ en: 'Localized', zh: 'Localized' })).toBe('Localized')
     const entry = f.ctx.slots.entries('plugins.bundle.config')[0]!
     const actions = entry.inject!()
diff --git a/packages/experimental/cua/tests/access.spec.ts b/packages/experimental/cua/tests/access.spec.ts
index 0e15e0129d..f42c25cb3b 100644
--- a/packages/experimental/cua/tests/access.spec.ts
+++ b/packages/experimental/cua/tests/access.spec.ts
@@ -13,7 +13,7 @@ import { NativeClient } from '../src/native-client.ts'
 const native = vi.hoisted(() => ({ instances: [] as Array<{
   disposed: boolean
   request: ReturnType<typeof vi.fn>
-  dispose: ReturnType<typeof vi.fn>
+  dispose: ReturnType<typeof vi.fn<() => Promise<void>>>
 }> }))
 
 vi.mock('../src/native-client.ts', async original => ({

From 5e98e0e8f7d87eeed75b77c335e0b1761679b541 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:19:18 +0800
Subject: [PATCH 14/44] fix(cua): retain busy-state typing for both settings
 rows

---
 .../experimental/client-ui-cua/src/client/PermissionPanel.tsx | 4 ++--
 .../experimental/client-ui-cua/tests/panel.client.spec.tsx    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx b/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
index 6fb4ed38a6..5f93df2714 100644
--- a/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
+++ b/packages/experimental/client-ui-cua/src/client/PermissionPanel.tsx
@@ -31,13 +31,13 @@ export type PermissionPanelProps = PermissionProps & DefaultPresetProps & Persis
 
 function DefaultPresetSetting(props: DefaultPresetProps) {
   const preset = props.useCuaDefaultPreset(value => value)
-  return <ConfigurationSetting kind="default" setting={preset} t={props.t} busy={props.busy} save={props.setPtcDefault}
+  return <ConfigurationSetting kind="default" setting={preset} t={props.t} busy={props.busy === true} save={props.setPtcDefault}
     configured={(preset.value?.selectedDefault ?? preset.value?.default) === 'ptc'} />
 }
 
 function PersistentPtcSetting(props: PersistentPtcProps) {
   const runtime = props.useCuaPtcRuntime(value => value)
-  return <ConfigurationSetting kind="persistent" setting={runtime} t={props.t} busy={props.busy} save={props.setPersistentPtc}
+  return <ConfigurationSetting kind="persistent" setting={runtime} t={props.t} busy={props.busy === true} save={props.setPersistentPtc}
     configured={runtime.value?.executionMode === 'persistent-in-memory'} />
 }
 
diff --git a/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
index 8dcea14468..f1ef5e2e29 100644
--- a/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
+++ b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
@@ -290,7 +290,7 @@ it('keeps content mounted and pauses observation while the bundle changes', () =
   f.publish({ ...observe(value), system: { value: value.system, busy: false, error: 'provider is reloading' }, busy: false })
   const view = render(<PermissionPanel {...f.props} busy />)
   const requirements = screen.getByRole('region', { name: en.title })
-  expect(within(requirements).getAllByRole('group')).toHaveLength(3)
+  expect(within(requirements).getAllByRole('group')).toHaveLength(4)
   expect(screen.queryByRole('alert')).toBeNull()
   expect(f.props.setActive).toHaveBeenLastCalledWith(false)
   expect(screen.getByRole('button', { name: en.request }).hasAttribute('disabled')).toBe(true)

From b6d4829ecf8f5a6747ffd1549d36dffe40400b59 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:29:15 +0800
Subject: [PATCH 15/44] test(cua): expect explicit runtime configuration copy

---
 apps/web/tests/cua-optin.e2e.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index 2df0e98003..5cdd9b62ff 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -40,7 +40,7 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     await toggle.waitFor()
     expect(await toggle.getAttribute('aria-checked')).toBe('false')
     expect(await card.getByText('实验性', { exact: true }).count()).toBe(1)
-    expect(await card.textContent()).toContain('将 PTC 模式改为可持久化')
+    expect(await card.textContent()).not.toContain('将 PTC 模式改为可持久化')
     expect(await card.textContent()).toContain('请切换到 PTC 模式')
     expect(await card.textContent()).toContain('Windows 支持正在开发中')
     expect(await card.textContent()).not.toContain('Swift')

From 7e04470d19527d031a3edde318d04742d3740d62 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:32:47 +0800
Subject: [PATCH 16/44] test(cua): isolate explicit execution-mode changes

---
 apps/web/tests/cua-optin.e2e.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index 5cdd9b62ff..82e66a97c0 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -115,7 +115,6 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     expect(scaffold.ctx.tools.schemas(child.agent).some(tool => tool.name === 'cua')).toBe(false)
     expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
     expect(scaffold.ctx.ptcRuntime.programFormat).toBe('function-body')
-    expect(scaffold.ctx.ptcRuntime === originalRuntime).toBe(true)
     await setup.waitFor()
     expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
     await setup.getByRole('button', { name: '稍后', exact: true }).click()
@@ -148,10 +147,11 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     await card.getByRole('button', { name: '查看 Computer Use', exact: true }).click()
     toggle = page.locator('[data-plugin-panel]').getByRole('switch', { name: '启用 Computer Use', exact: true })
     const persistent = page.getByRole('group', { name: 'PTC 执行方式', exact: true })
+    const beforePersistent = scaffold.ctx.ptcRuntime
     await persistent.getByRole('button', { name: '设为持久化', exact: true }).click()
     await persistent.getByRole('button', { name: '已设为持久化', exact: true }).waitFor()
     expect(scaffold.ctx.ptcRuntime.programFormat).toBe('repl')
-    expect(scaffold.ctx.ptcRuntime === originalRuntime).toBe(false)
+    expect(scaffold.ctx.ptcRuntime === beforePersistent).toBe(false)
     saved = await readFile(settingsPath, 'utf8')
     expect(saved).toContain('executionMode: persistent-in-memory')
     const runtime = scaffold.ctx.ptcRuntime

From 74e178cb0316aadd4c408dc6643223e64794b1c8 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:48:20 +0800
Subject: [PATCH 17/44] refactor(cua): remove automatic Coding Tools
 configuration

---
 apps/web/tests/cua-optin.e2e.ts               |  12 +-
 packages/boot/plugin-manager/README.i18n.yaml |   4 +-
 packages/boot/plugin-manager/README.md        |   4 +-
 packages/boot/plugin-manager/README.zh.md     |   4 +-
 packages/boot/plugin-manager/src/index.ts     |   9 +-
 packages/boot/plugin-manager/src/patch.ts     | 108 +++---------------
 .../boot/plugin-manager/tests/manager.spec.ts |  32 +-----
 .../boot/plugin-manager/tests/patch.spec.ts   |  94 +--------------
 .../experimental/cua-bundle/README.i18n.yaml  |   8 +-
 packages/experimental/cua-bundle/README.md    |   6 +-
 packages/experimental/cua-bundle/README.zh.md |   4 +-
 packages/experimental/cua-bundle/package.json |   6 -
 .../util/package-manifest/README.i18n.yaml    |   4 +-
 packages/util/package-manifest/README.md      |   1 -
 packages/util/package-manifest/README.zh.md   |   1 -
 packages/util/package-manifest/src/types.ts   |   4 -
 pnpm-lock.yaml                                |   3 -
 17 files changed, 45 insertions(+), 259 deletions(-)

diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index 82e66a97c0..bc287862aa 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -14,7 +14,7 @@ import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapsh
 import { connectFreshWorkspaceZh, writeComposerDraft, ZH_BROWSER_LOCALE } from './support.ts'
 
 // The shipped bundle admits only macOS Hosts; unsupported Hosts are exercised in bundle-platform.e2e.ts.
-it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('hot-reloads CUA and changes the default %s only from its detail page', async (selectedDefault) => {
+it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('hot-reloads CUA while preserving Coding Tools and changes the default %s only from its detail page', async (selectedDefault) => {
   const directory = await mkdtemp(join(tmpdir(), 'cua-optin-web-'))
   let ownedScaffold: WebScaffold | undefined
   let browser: Browser | undefined
@@ -28,6 +28,10 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     ] })
     const initialDefault = selectedDefault ?? 'standard'
     if (selectedDefault !== undefined) await scaffold.ctx.settings.update('agent-preset-registry', { selectedDefault })
+    const codingTools = selectedDefault !== undefined
+    await scaffold.ctx.settings.update('ui-settings', { enabled: codingTools })
+    const settingsPath = join(harnessHome, 'profiles/scaffold/cordis.patch.yml')
+    const beforeEnable = await readFile(settingsPath, 'utf8')
     browser = await chromium.launch()
     const page = await browser.newPage({ viewport: { width: 1680, height: 1000 }, locale: ZH_BROWSER_LOCALE })
     await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
@@ -119,11 +123,12 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
     await setup.getByRole('button', { name: '稍后', exact: true }).click()
     await setup.waitFor({ state: 'hidden' })
-    const settingsPath = join(harnessHome, 'profiles/scaffold/cordis.patch.yml')
     let saved = await readFile(settingsPath, 'utf8')
+    expect(saved).toBe(beforeEnable)
+    expect(scaffold.ctx.settings.describe().find(row => row.ns === 'ui-settings')?.value).toMatchObject({ enabled: codingTools })
     expect(saved).not.toContain('executionMode:')
     expect(load(saved)).toEqual(expect.arrayContaining([
-      expect.objectContaining({ id: 'ui-settings', config: { enabled: true } }),
+      expect.objectContaining({ id: 'ui-settings', config: { enabled: codingTools } }),
     ]))
     if (selectedDefault === undefined) {
       expect(load(saved)).not.toEqual(expect.arrayContaining([expect.objectContaining({ id: 'agent-preset-registry' })]))
@@ -208,6 +213,7 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     expect(await setup.getByText('Computer Use 插件已开启，但暂时无法检测系统权限。请前往插件详情页查看原因并重试。', { exact: true }).count()).toBe(1)
     expect(await setup.getByRole('button', { name: '设为 PTC', exact: true }).count()).toBe(0)
     expect(await readFile(settingsPath, 'utf8')).toBe(confirmedSettings)
+    expect(scaffold.ctx.settings.describe().find(row => row.ns === 'ui-settings')?.value).toMatchObject({ enabled: codingTools })
     await runtime.release(owner)
   } finally {
     try { await browser?.close() } finally {
diff --git a/packages/boot/plugin-manager/README.i18n.yaml b/packages/boot/plugin-manager/README.i18n.yaml
index f9267bfc4b..abe162bd93 100644
--- a/packages/boot/plugin-manager/README.i18n.yaml
+++ b/packages/boot/plugin-manager/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 87679c51aa3693f5
   zh: 11684a48a5806afb
 /deepseek-ai-dsh-plugin-manager/use-this-package:
-  en: 8e8a34186b091682
-  zh: c94654f370a1baa1
+  en: 69851ea018e162c7
+  zh: ec007c03f7a6b20b
 /deepseek-ai-dsh-plugin-manager/use-this-package/version-compatibility-and-exemptions:
   en: 483285658e267dd5
   zh: 846bec2daac59a96
diff --git a/packages/boot/plugin-manager/README.md b/packages/boot/plugin-manager/README.md
index 84bb313bba..3ae6a57d95 100644
--- a/packages/boot/plugin-manager/README.md
+++ b/packages/boot/plugin-manager/README.md
@@ -39,9 +39,7 @@ For a deployment without agent presets, enable the tool in the profile patch. Pr
 
 A plugin toggle updates only `disabled` in the last matching override in the profile's `cordis.patch.yml`, or appends an override when none matches. Matching uses the entry id and any module-name assertion. An override holding only `id` and `disabled` is removed, and none is appended, when the bundle layers and the remaining profile patches already give the entry the requested state, so the profile patch records only departures from the bundles. Home and invocation patches are left out of that comparison; they apply after the profile patch and do not decide what it records. A bundle toggle changes `package.json`'s ordered `dsh.profile.bundles` list. Disabling retains the dependency; enabling appends the bundle at the end, which can change configuration precedence. Installation enables a new bundle by default. Home and invocation patches retain their higher priority.
 
-Bundle platform declarations are checked before saving an enabled selection. Unsupported Hosts return `unsupported-platform` without applying runtime overrides. The bundle remains visible with its display metadata and can still be deselected. Automatic activation after a package operation uses the same check. The agent-facing next step asks the user to run the bundle on a supported Host.
-
-Bundles may declare `dsh.bundle.configureOnEnable`, mapping existing profile entry ids to top-level config fields. Explicit enablement merges changed fields into the user patch before the ordinary HMR reconciliation, preserving unrelated settings. Missing or ambiguous entries, whole-config `!!js` expressions, and conflicting home or launch overlays reject the operation before saving. Express the target config as a literal mapping to allow enablement edits; expressions on fields being set are replaced by the requested literals, while unrelated field expressions are preserved. Configuration anchors remain available to other entries; anchored overrides are retained and followed by the activation override. Matching values cause no rewrite. Disablement retains these settings. The CLI and manual bundle-list edits do not apply these enablement settings.
+Bundle platform declarations are checked before saving an enabled selection. Unsupported Hosts return `unsupported-platform`. The bundle remains visible with its display metadata and can still be deselected. Automatic activation after a package operation uses the same check. The agent-facing next step asks the user to run the bundle on a supported Host.
 
 A selected bundle that cannot load remains in `listBundles` with an `error`; `enabled` records the saved selection, not successful loading. The plugin page shows the error and allows deselection. A broken bundle cannot be enabled. Management bundles remain protected if their files become unreadable.
 
diff --git a/packages/boot/plugin-manager/README.zh.md b/packages/boot/plugin-manager/README.zh.md
index 847915a523..a3d481409a 100644
--- a/packages/boot/plugin-manager/README.zh.md
+++ b/packages/boot/plugin-manager/README.zh.md
@@ -39,9 +39,7 @@ kind: "package-reference"
 
 插件开关只更新 profile 的 `cordis.patch.yml` 中最后一条匹配覆盖项的 `disabled`；没有匹配项时追加。匹配依据是条目 id，以及覆盖项声明的模块名称。如果组合包层和其余 profile patch 已使条目处于所请求的状态，仅含 `id` 与 `disabled` 的覆盖项会被移除，也不会追加覆盖项，因此 profile patch 只记录与组合包不同的设置。该比较不计入 home 和单次启动 patch；它们在 profile patch 之后应用，不决定 profile patch 记录什么。组合包开关修改 `package.json` 的有序 `dsh.profile.bundles` 列表。关闭保留依赖；开启追加到列表末尾，可能改变配置优先级。安装新组合包默认启用。home 和单次启动 patch 保留更高优先级。
 
-组合包的平台声明会在保存启用选择前检查。Host 不受支持时返回 `unsupported-platform`，不应用运行时配置覆盖。组合包仍保留显示信息，并允许取消选择。包操作后的自动启用执行同一检查。给模型的下一步说明会提示用户在受支持的 Host 上运行该组合包。
-
-组合包可声明 `dsh.bundle.configureOnEnable`，将现有 profile 条目 id 映射到配置顶层字段。显式启用先将变化的字段合并到用户 patch，再通过正常 HMR 重组应用，保留无关设置；条目缺失、存在歧义、整段 config 使用 `!!js` 表达式，或 home、启动覆盖层冲突时，写入前拒绝操作。启用设置需要将目标 config 写成普通映射，目标字段上的表达式会被指定值替换，无关字段的表达式保留。配置中的锚点继续供其他条目引用；含锚点的覆盖项保留，启用覆盖项追加在后。值已匹配时不改写。关闭保留这些设置。CLI 和手动修改组合包列表不应用这些启用设置。
+组合包的平台声明会在保存启用选择前检查。Host 不受支持时返回 `unsupported-platform`。组合包仍保留显示信息，并允许取消选择。包操作后的自动启用执行同一检查。给模型的下一步说明会提示用户在受支持的 Host 上运行该组合包。
 
 已选择但无法加载的组合包仍会出现在 `listBundles` 中，并携带 `error`；`enabled` 表示保存的选择，不代表加载成功。插件页面显示错误并允许取消选择。损坏的组合包无法启用。管理组合包的文件变得不可读后仍受保护。
 
diff --git a/packages/boot/plugin-manager/src/index.ts b/packages/boot/plugin-manager/src/index.ts
index ac0ee3c5fd..0e7a7e4026 100644
--- a/packages/boot/plugin-manager/src/index.ts
+++ b/packages/boot/plugin-manager/src/index.ts
@@ -26,7 +26,7 @@ import { classifyInstallFailure } from './install-failure.ts'
 import { officialBundleInstallTarget } from './official-install-target.ts'
 import { dependencySpec, InvalidInstallSpecError, parseInstallSpec, type ParsedInstallSpec } from './install-spec.ts'
 import { attributeFailure, normalizeRegistry, NPMMIRROR_REGISTRY, registryPlan } from './registry.ts'
-import { flatten, prepareBundleConfiguration, writePluginEnabled } from './patch.ts'
+import { flatten, writePluginEnabled } from './patch.ts'
 import { incompatiblePlugin, ManagementFailure } from './failure.ts'
 import { approveBuilds, recordPendingBuilds } from './build-approval.ts'
 import { checkGithubConnection } from './github-connection.ts'
@@ -817,7 +817,6 @@ export class PluginManager extends TypertRemoteService {
   private async selectBundle(name: string, enabled: boolean): Promise<void> {
     const manifest = readProfileManifest('dsh', this.profile.dir)
     const previous = bundleSelection(manifest)
-    let enableConfiguration: string | undefined
     if (enabled || !previous.includes(name)) {
       const metadata = bundleManifest(name, this.profile.dir, this.profile.installAnchor)
       if (metadata === undefined) throw new ManagementFailure('not-bundle')
@@ -826,18 +825,12 @@ export class PluginManager extends TypertRemoteService {
         const compatibility = evaluatePluginCompatibility(metadata, readProfileVersionExemptions(this.profile.dir))
         if (compatibility !== undefined && !compatibility.exempted) throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)])
         this.bundleRows(name)
-        if (metadata.dsh?.bundle?.configureOnEnable !== undefined) {
-          enableConfiguration = await prepareBundleConfiguration(this.profile, metadata.dsh.bundle.configureOnEnable)
-        }
       }
     }
     if (!enabled && previous.includes(name)) {
       if (this.protectsManager(name)) throw new ManagementFailure('management-required')
     }
     const bundles = enabled ? [...previous, ...previous.includes(name) ? [] : [name]] : previous.filter(item => item !== name)
-    if (enableConfiguration !== undefined) {
-      await writeFileAtomic(this.profile.patchPath, enableConfiguration, { mode: 0o600 })
-    }
     if (JSON.stringify(previous) === JSON.stringify(bundles)) return
     manifest.dsh = { ...manifest.dsh, profile: { ...manifest.dsh?.profile, bundles } }
     await saveManifest(this.profile.dir, manifest)
diff --git a/packages/boot/plugin-manager/src/patch.ts b/packages/boot/plugin-manager/src/patch.ts
index a523627d09..0dfacb2de6 100644
--- a/packages/boot/plugin-manager/src/patch.ts
+++ b/packages/boot/plugin-manager/src/patch.ts
@@ -1,10 +1,8 @@
 /** Comment-preserving profile plugin enablement edits and the entry flattening they compare against. */
 import { readFile } from 'node:fs/promises'
-import { isMap, isNode, isScalar, isSeq, parseDocument, Scalar, visit } from 'yaml'
-import { isDeepStrictEqual } from 'node:util'
-import { z } from 'zod'
-import { isJsExpr, type EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
-import { composeEntries, loadOptionalPatches, loadProfileDirectory, readBundlePatches, readProfilePatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
+import { isMap, isNode, isScalar, isSeq, parseDocument } from 'yaml'
+import type { EntryOptions } from '@deepseek-ai/cordis-plugin-loader'
+import { composeEntries, loadOptionalPatches, readBundlePatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
 import { writeFileAtomic } from '@deepseek-ai/dsh-atomic-write'
 
 /** Flatten only the groups addressable by the profile's patch composer.
@@ -15,88 +13,6 @@ export function flatten(rows: EntryOptions[]): EntryOptions[] {
   return rows.flatMap(row => [row, ...(row.group && Array.isArray(row.config) ? flatten(row.config as EntryOptions[]) : [])])
 }
 
-/** Read the shared profile patch dialect while retaining comments and expression tags. */
-async function readPatchDocument(filename: string) {
-  let text: string
-  try {
-    text = await readFile(filename, 'utf8')
-  } catch (error) {
-    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-    text = '[]\n'
-  }
-  const document = parseDocument(text, {
-    customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value: string) => value }],
-  })
-  const error = document.errors[0]
-  if (error !== undefined) throw error
-  if (!isSeq(document.contents)) throw new Error('Profile patch must be a YAML sequence')
-  return { document, sequence: document.contents }
-}
-
-/**
- * Prepare persistent settings for explicit bundle enablement.
- * @param profile Profile whose existing entries receive top-level field overrides.
- * @param input Untrusted bundle manifest declaration, keyed by profile entry id.
- * @returns Complete profile patch text, or undefined when the requested settings already match.
- * @throws Invalid declarations, missing or ambiguous entries, whole-config expressions, and higher-layer overrides.
- */
-export async function prepareBundleConfiguration(
-  profile: ProfileContext, input: unknown,
-): Promise<string | undefined> {
-  const configuration = z.record(z.string().min(1), z.record(z.string(), z.json())).parse(input)
-  const loaded = loadProfileDirectory('dsh', profile.dir, profile.installAnchor)
-  const rows = flatten(composeEntries([...loaded.layers.map(layer => layer.patches), loaded.patches]))
-  const patches = Object.entries(configuration).map(([id, fields]) => {
-    const matches = rows.filter(row => row.id === id)
-    const entry = matches[0]
-    const current: unknown = entry?.config
-    if (isJsExpr(current)) {
-      throw new Error(`Bundle enablement cannot edit the whole-config expression for "${id}"; use a literal config mapping`)
-    }
-    if (matches.length !== 1 || entry === undefined || entry.group
-      || (current !== undefined && (current === null || typeof current !== 'object' || Array.isArray(current)))) {
-      throw new Error(`Bundle enablement requires one configurable profile entry "${id}"`)
-    }
-    const config = { ...current, ...fields }
-    return { id, name: entry.name, config }
-  })
-  const effective = flatten(composeEntries([readProfilePatches('dsh', profile, {
-    ...loaded, patches: [...loaded.patches, ...patches],
-  })]))
-  for (const [id, fields] of Object.entries(configuration)) {
-    const config: unknown = effective.find(row => row.id === id)?.config
-    if (config === null || typeof config !== 'object' || Array.isArray(config)
-      || Object.entries(fields).some(([key, value]) => !isDeepStrictEqual((config as Record<string, unknown>)[key], value))) {
-      throw new Error(`Bundle enablement configuration for "${id}" is overridden by a home patch or command-line overlay`)
-    }
-  }
-  if (patches.every(patch => isDeepStrictEqual(rows.find(row => row.id === patch.id)?.config, patch.config))) return undefined
-  const { document, sequence } = await readPatchDocument(profile.patchPath)
-  sequence.flow = false
-  for (const { id, name, config } of patches) {
-    const index = sequence.items.findLastIndex((item, index) => isMap(item)
-      && document.getIn([index, 'id']) === id && !item.has('insert')
-      && (!item.has('name') || document.getIn([index, 'name']) === name))
-    const previous = sequence.items[index]
-    const anchors: string[] = []
-    if (isNode(previous)) visit(previous, { Node(_key, node) {
-      if ('anchor' in node && node.anchor) {
-        anchors.push(node.anchor)
-        return visit.BREAK
-      }
-    } })
-    if (index < 0 || anchors.length > 0) document.add(document.createNode({ id, name, config }))
-    else document.setIn([index, 'config'], document.createNode(config))
-  }
-  visit(document, { Map(_key, node) {
-    if (node.items.length !== 1 || typeof node.get('__jsExpr') !== 'string') return
-    const expression = new Scalar(node.get('__jsExpr'))
-    expression.tag = 'tag:yaml.org,2002:js'
-    return expression
-  } })
-  return String(document)
-}
-
 /** Replace the last matching override or append one after existing insertions. An override that holds only `id` and
  * `disabled`, without anchors, is removed, or not appended, when the bundle layers and the remaining profile patches
  * already give the entry the requested literal `disabled` value; home patches and launch overlays are not consulted.
@@ -108,10 +24,22 @@ export async function prepareBundleConfiguration(
  */
 export async function writePluginEnabled(profile: ProfileContext, id: string, name: string, enabled: boolean): Promise<boolean> {
   const filename = profile.patchPath
-  const { document, sequence } = await readPatchDocument(filename)
+  let text: string
+  try {
+    text = await readFile(filename, 'utf8')
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
+    text = '[]\n'
+  }
+  const document = parseDocument(text, {
+    customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: (value: string) => value }],
+  })
+  const error = document.errors[0]
+  if (error !== undefined) throw error
+  if (!isSeq(document.contents)) throw new Error('Profile patch must be a YAML sequence')
   const patches = loadOptionalPatches('dsh', filename) ?? []
   const bundlePatches = readBundlePatches('dsh', profile)
-  const items = sequence.items
+  const items = document.contents.items
   const target = items.findLast((item, index) => {
     if (!isMap(item) || document.getIn([index, 'id']) !== id || item.has('insert')) return false
     const expectedName = document.getIn([index, 'name'])
@@ -134,7 +62,7 @@ export async function writePluginEnabled(profile: ProfileContext, id: string, na
       const comment = target.commentBefore
       const next = items[index]
       if (comment && isNode(next)) next.commentBefore = next.commentBefore ? `${comment}\n${next.commentBefore}` : comment
-      else if (comment && items.length === 0) sequence.commentBefore = comment
+      else if (comment && items.length === 0) document.contents.commentBefore = comment
       else if (comment) document.comment = document.comment ? `${comment}\n${document.comment}` : comment
     } else if (document.getIn([index, 'disabled']) === !enabled) {
       return false
diff --git a/packages/boot/plugin-manager/tests/manager.spec.ts b/packages/boot/plugin-manager/tests/manager.spec.ts
index ad1aa0b8d6..b1b14757a3 100644
--- a/packages/boot/plugin-manager/tests/manager.spec.ts
+++ b/packages/boot/plugin-manager/tests/manager.spec.ts
@@ -89,41 +89,11 @@ async function fixture(reload: 'live' | 'startup' = 'live', overlay = false, pre
   return { ctx, dir, manager: ctx.pluginManager, bundle, profile, stopHmr, overlays, connection }
 }
 
-it.each(['live', 'startup'] as const)('persists enablement settings, applies them with %s reload and retains them after disablement', async (reload) => {
-  const { manager, dir, ctx } = await fixture(reload, false, undefined, {}, undefined, (dir) => {
-    const core = join(dir, 'node_modules/core/cordis.patch.yml')
-    const patches = JSON.parse(readFileSync(core, 'utf8')) as Array<{ insert: object[] }>
-    patches[0]!.insert.push({ id: 'runtime', name: join(dir, 'node_modules/extra/plugin.mjs'),
-      config: { service: 'activationProbe', executionMode: 'per-call', timeout: 42 } })
-    writeFileSync(core, JSON.stringify(patches))
-    const path = join(dir, 'node_modules/extra/package.json')
-    const meta = JSON.parse(readFileSync(path, 'utf8')) as { dsh: { bundle: object } }
-    meta.dsh.bundle = { ...meta.dsh.bundle, configureOnEnable: { runtime: { executionMode: 'persistent-in-memory' } } }
-    writeFileSync(path, JSON.stringify(meta))
-  })
-  await manager.setBundleEnabled('extra', false)
-  const runtime = [...ctx.loader.entries()].find(entry => entry.options.id === 'runtime')!
-  expect(await manager.setBundleEnabled('extra', true)).toMatchObject({
-    application: reload === 'live' ? 'applied' : 'restart-required', changed: true,
-  })
-  expect(runtime.options.config).toEqual({ service: 'activationProbe', executionMode: reload === 'live' ? 'persistent-in-memory' : 'per-call', timeout: 42 })
-  const appliedFiber = runtime.fiber
-  const saved = readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')
-  expect(parse(saved)).toContainEqual({ id: 'runtime', name: pathToFileURL(join(dir, 'node_modules/extra/plugin.mjs')).href,
-    config: { service: 'activationProbe', executionMode: 'persistent-in-memory', timeout: 42 } })
-  await manager.setBundleEnabled('extra', false)
-  expect(readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')).toBe(saved)
-  expect(runtime.fiber === appliedFiber).toBe(true)
-  await manager.setBundleEnabled('extra', true)
-  expect(readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')).toBe(saved)
-  expect(runtime.fiber === appliedFiber).toBe(true)
-})
-
 it.each(['live', 'startup'] as const)('refuses an unsupported bundle before saving or applying it with %s reload', async (reload) => {
   const { manager, dir, ctx } = await fixture(reload, false, undefined, {}, undefined, (dir) => {
     const path = join(dir, 'node_modules/extra/package.json')
     writeFileSync(path, JSON.stringify({ name: 'extra', version: '1.0.0', description: 'Platform-limited bundle',
-      dsh: { bundle: { patch: './cordis.patch.yml', experimental: true, configureOnEnable: { absent: { mode: 'new' } }, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
+      dsh: { bundle: { patch: './cordis.patch.yml', experimental: true, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
     const manifest = readProfileManifest('test', dir)
     manifest.dsh = { profile: { bundles: ['core'] } }
     writeFileSync(join(dir, 'package.json'), JSON.stringify(manifest))
diff --git a/packages/boot/plugin-manager/tests/patch.spec.ts b/packages/boot/plugin-manager/tests/patch.spec.ts
index 0522173c3e..9580da1e52 100644
--- a/packages/boot/plugin-manager/tests/patch.spec.ts
+++ b/packages/boot/plugin-manager/tests/patch.spec.ts
@@ -5,102 +5,10 @@ import { tmpdir } from 'node:os'
 import { expect, it, onTestFinished } from 'vitest'
 import { applyEntryPatches } from '@deepseek-ai/cordis-plugin-include'
 import { initProfile, loadOptionalPatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
-import { prepareBundleConfiguration, writePluginEnabled } from '../src/patch.ts'
+import { writePluginEnabled } from '../src/patch.ts'
 
 const TOOL = { id: 'tool', name: 'package' }
 
-it('prepares durable activation settings while preserving prior fields, expressions and comments', async () => {
-  const profile = await fixture('# personal\n- id: runtime\n  config:\n    timeout: 42\n    command: !!js process.execPath\n- id: locale\n  config: { preference: zh }\n', [
-    { id: 'runtime', name: 'runtime-package', config: { executionMode: 'per-call' } },
-    { id: 'presets', name: 'preset-package', config: { default: 'standard' } },
-    { id: 'locale', name: 'locale-package' },
-  ])
-  const before = await readFile(profile.patchPath, 'utf8')
-  const input = { runtime: { executionMode: 'persistent-in-memory' }, presets: { selectedDefault: 'ptc' } }
-  const prepared = await prepareBundleConfiguration(profile, input)
-  expect(await readFile(profile.patchPath, 'utf8')).toBe(before)
-  expect(prepared).toContain('# personal')
-  expect(prepared).toContain('!!js process.execPath')
-  if (prepared === undefined) throw new Error('Expected changed enablement settings')
-  await writeFile(profile.patchPath, prepared)
-  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
-    { id: 'runtime', config: { timeout: 42, command: { __jsExpr: 'process.execPath' }, executionMode: 'persistent-in-memory' } },
-    { id: 'locale', config: { preference: 'zh' } },
-    { id: 'presets', name: 'preset-package', config: { default: 'standard', selectedDefault: 'ptc' } },
-  ])
-  expect(await prepareBundleConfiguration(profile, input)).toBeUndefined()
-})
-
-it('accepts unrelated launch overrides when the requested field has the intended effective value', async () => {
-  const profile = await fixture('[]\n', [{ id: 'runtime', name: 'runtime-package', config: { timeout: 42 } }])
-  const launch = { ...profile, overlays: [{ id: 'runtime', config: { executionMode: 'persistent-in-memory', timeout: 10 } }] }
-  const prepared = await prepareBundleConfiguration(launch, { runtime: { executionMode: 'persistent-in-memory' } })
-  if (prepared === undefined) throw new Error('Expected saved runtime configuration')
-  await writeFile(profile.patchPath, prepared)
-  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
-    { id: 'runtime', name: 'runtime-package', config: { timeout: 42, executionMode: 'persistent-in-memory' } },
-  ])
-})
-
-it('refuses a whole-config expression without evaluating it or replacing the user patch', async () => {
-  const before = '- id: runtime\n  config: !!js "(() => { throw new Error(\'must not evaluate\') })()"\n'
-  const profile = await fixture(before, [{ id: 'runtime', name: 'runtime-package' }])
-  await expect(prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } }))
-    .rejects.toThrow('Bundle enablement cannot edit the whole-config expression for "runtime"; use a literal config mapping')
-  expect(await readFile(profile.patchPath, 'utf8')).toBe(before)
-})
-
-it('replaces a target field expression while preserving unrelated expressions', async () => {
-  const profile = await fixture('- id: runtime\n  config:\n    executionMode: !!js process.env.MODE\n    timeout: !!js process.env.TIMEOUT\n', [
-    { id: 'runtime', name: 'runtime-package' },
-  ])
-  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
-  expect(prepared).toContain('executionMode: persistent-in-memory')
-  expect(prepared).toContain('timeout: !!js process.env.TIMEOUT')
-  expect(prepared).not.toContain('process.env.MODE')
-})
-
-it('retains configuration anchors referenced by other entries', async () => {
-  const profile = await fixture('- id: runtime\n  config: &runtimeConfig\n    timeout: &timeout 30000\n- id: other\n  config:\n    timeout: *timeout\n    inherited: *runtimeConfig\n', [
-    { id: 'runtime', name: 'runtime-package' }, { id: 'other', name: 'other-package' },
-  ])
-  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
-  if (prepared === undefined) throw new Error('Expected activation settings')
-  await writeFile(profile.patchPath, prepared)
-  expect(loadOptionalPatches('test', profile.patchPath)).toEqual([
-    { id: 'runtime', config: { timeout: 30000 } },
-    { id: 'other', config: { timeout: 30000, inherited: { timeout: 30000 } } },
-    { id: 'runtime', name: 'runtime-package', config: { timeout: 30000, executionMode: 'persistent-in-memory' } },
-  ])
-  expect(await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })).toBeUndefined()
-})
-
-it.each(['runtime-package', 'retired-runtime'])('keeps name-qualified activation overrides for %s', async (name) => {
-  const profile = await fixture(`- id: runtime\n  name: ${name}\n  config: { timeout: 42 }\n`, [
-    { id: 'runtime', name: 'runtime-package', config: { timeout: 10 } },
-  ])
-  const prepared = await prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })
-  if (prepared === undefined) throw new Error('Expected activation settings')
-  await writeFile(profile.patchPath, prepared)
-  const patch = { id: 'runtime', name: 'runtime-package', config: {
-    timeout: name === 'runtime-package' ? 42 : 10, executionMode: 'persistent-in-memory',
-  } }
-  expect(loadOptionalPatches('test', profile.patchPath)).toEqual(name === 'runtime-package' ? [patch] : [
-    { id: 'runtime', name, config: { timeout: 42 } }, patch,
-  ])
-})
-
-it('refuses invalid activation settings, absent entries and higher-layer overrides before writing', async () => {
-  const profile = await fixture('[]\n', [{ id: 'runtime', name: 'runtime-package', config: {} }])
-  for (const input of [[], { runtime: false }, { absent: { mode: 'new' } }]) {
-    await expect(prepareBundleConfiguration(profile, input)).rejects.toThrow()
-    expect(await readFile(profile.patchPath, 'utf8')).toBe('[]\n')
-  }
-  await writeFile(join(profile.home, 'cordis.patch.yml'), '- id: runtime\n  config: { executionMode: per-call }\n')
-  await expect(prepareBundleConfiguration(profile, { runtime: { executionMode: 'persistent-in-memory' } })).rejects.toThrow('overridden')
-  expect(await readFile(profile.patchPath, 'utf8')).toBe('[]\n')
-})
-
 /** Create a profile whose patch file holds `text` (none when omitted) and whose one selected bundle inserts `rows`. */
 async function fixture(text?: string, rows: object[] = []): Promise<ProfileContext> {
   const home = await mkdtemp(join(tmpdir(), 'manager-patch-'))
diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
index a8452d6e1e..452b3f522f 100644
--- a/packages/experimental/cua-bundle/README.i18n.yaml
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -15,11 +15,11 @@
   en: b563e4ec4727d0de
   zh: d0228da978238e05
 /deepseek-ai-dsh-cua-bundle/use-this-package:
-  en: c493c75904aea7c4
-  zh: 40e8e7b162270a48
+  en: dfbc7b6cef715c99
+  zh: 973a18c78cfa7dd6
 /deepseek-ai-dsh-cua-bundle/understand-the-implementation:
-  en: 504f9d26fa575e15
-  zh: 2b8b7af4767b52b0
+  en: 8cf76d5bc5ab785b
+  zh: 18d24f49fe8fa14f
 /deepseek-ai-dsh-cua-bundle/further-exploration:
   en: 9f15d56b5b16e1ca
   zh: 75eb08e8828c8877
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
index ccb06e3286..14b7a1921e 100644
--- a/packages/experimental/cua-bundle/README.md
+++ b/packages/experimental/cua-bundle/README.md
@@ -33,13 +33,13 @@ pnpm dsh web
 
 For the source Desktop launcher and its separate development profile, follow [Desktop development](../../../apps/desktop/README.md). Enable Computer Use in each profile that needs it.
 
-The switch saves bundle selection in the profile’s `package.json`. Enabling preserves PTC execution mode. The detail page’s **Use persistent mode** action saves `ptc-runtime.executionMode: persistent-in-memory` in the user’s `cordis.patch.yml`. Already-persistent runtimes show a disabled button. Computer Use is designed for PTC and installed only in PTC sessions. When system permissions need attention, activation guidance opens the plugin details. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. HMR maintains these settings and the provider’s session tool registrations. Native components prepare on activation and source startup; subsequent `pnpm run build` checks the selected Web profile’s incremental native build. First preparation requires local compiler tools, and failure preserves diagnostics without publishing a new executable.
+The switch saves bundle selection in the profile’s `package.json`. Enabling preserves Coding Tools preferences and PTC execution mode. The detail page’s **Use persistent mode** action saves `ptc-runtime.executionMode: persistent-in-memory` in the user’s `cordis.patch.yml`. Already-persistent runtimes show a disabled button. Computer Use is designed for PTC and installed only in PTC sessions. When system permissions need attention, activation guidance opens the plugin details. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. HMR maintains these settings and the provider’s session tool registrations. Native components prepare on activation and source startup; subsequent `pnpm run build` checks the selected Web profile’s incremental native build. First preparation requires local compiler tools, and failure preserves diagnostics without publishing a new executable.
 
 Disabling unloads the provider and withdraws CUA tools from its Agent scopes. It retains the selected default, runtime configuration and retained PTC variables. Enabling again does not recreate the runtime. Explicitly changing from per-call to persistent execution replaces the shared runtime through HMR and can interrupt an active PTC call.
 
 Computer Use is available only on a macOS DSH Host. Other Hosts refuse enablement before saving settings. An already selected bundle is skipped at startup with a diagnostic and remains available for deselection; saved user settings remain. A browser on another operating system can connect to a supported Mac Host.
 
-If preparation fails, the saved selection and PTC settings remain, while CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
+If preparation fails, the saved selection remains, while CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
 
 Explicit activation runs a read-only permission check, which may start a helper without opening a system dialog. Open the [permission page](../client-ui-cua/README.md) for system requests, settings navigation and automatic refresh. Tasks ask separately before accessing an application. Saved application decisions use the existing profile configuration; session decisions remain in memory across turns and connections until DSH restarts or Computer Use is disabled. Revoke access on the same page.
 
@@ -51,7 +51,7 @@ Explicit activation runs a read-only permission check, which may start a helper
 <details>
 <summary>Maintainer details</summary>
 
-The bundle patch mounts the shared native provider and permission UI with `agentPreset: ptc`. The provider registers tools through existing Agent scopes, so other presets receive no CUA tool or guidance. Preset documents remain unchanged. `configureOnEnable` persists `ui-settings.enabled: true` through [Plugin Manager](../../boot/plugin-manager/README.md). The detail-page action uses the existing settings form to save `agent-preset-registry.selectedDefault: ptc` only when clicked, preserving the deployment `default`. The provider defaults to PTC scope even when a saved grants override omits that field. [CUA](../cua/README.md) owns registration and disposal.
+The bundle patch mounts the shared native provider and permission UI with `agentPreset: ptc`. The provider registers tools through existing Agent scopes, so other presets receive no CUA tool or guidance. Preset documents remain unchanged. The detail-page action uses the existing settings form to save `agent-preset-registry.selectedDefault: ptc` only when clicked, preserving the deployment `default`. The provider defaults to PTC scope even when a saved grants override omits that field. [CUA](../cua/README.md) owns registration and disposal.
 
 </details>
 
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
index 05fb2d15ea..5a14ec38be 100644
--- a/packages/experimental/cua-bundle/README.zh.md
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -33,7 +33,7 @@ pnpm dsh web
 
 源码 Desktop 的启动方式和独立开发配置档见[桌面开发说明](../../../apps/desktop/README.zh.md)。需要使用 Computer Use 的配置档分别开启该功能。
 
-开关将组合包选择保存到 profile 的 `package.json`。开启时保留 PTC 执行方式。详情页的“设为持久化”按钮将 `ptc-runtime.executionMode: persistent-in-memory` 保存到用户的 `cordis.patch.yml`；已配置为持久化时禁用按钮。Computer Use 针对 PTC 模式设计，仅安装在 PTC 会话中。系统权限尚未就绪时，启用引导会进入插件详情页。详情页提供“设为 PTC”按钮来修改新会话默认模式；已有会话保留原 preset。HMR 维护这些设置和提供方的会话工具注册。本机组件在启用及源码启动时准备，后续 `pnpm run build` 检查已选中 Web profile 的本机增量构建。首次准备需要本机编译工具，失败保留诊断且不发布新的可执行文件。
+开关将组合包选择保存到 profile 的 `package.json`。开启时保留 Coding Tools 设置和 PTC 执行方式。详情页的“设为持久化”按钮将 `ptc-runtime.executionMode: persistent-in-memory` 保存到用户的 `cordis.patch.yml`；已配置为持久化时禁用按钮。Computer Use 针对 PTC 模式设计，仅安装在 PTC 会话中。系统权限尚未就绪时，启用引导会进入插件详情页。详情页提供“设为 PTC”按钮来修改新会话默认模式；已有会话保留原 preset。HMR 维护这些设置和提供方的会话工具注册。本机组件在启用及源码启动时准备，后续 `pnpm run build` 检查已选中 Web profile 的本机增量构建。首次准备需要本机编译工具，失败保留诊断且不发布新的可执行文件。
 
 关闭会卸载提供方，并从其 Agent 作用域中撤回 CUA 工具。用户选择的默认值、执行器配置和变量均保留。再次开启不会重建执行器。用户显式从 per-call 切换为持久化执行时，HMR 会重载共享执行器，可能中断正在执行的 PTC 调用。
 
@@ -51,7 +51,7 @@ Computer Use 仅支持 macOS DSH Host。其他 Host 会在保存设置前拒绝
 <details>
 <summary>维护者说明</summary>
 
-组合包 patch 通过 `agentPreset: ptc` 挂载共享原生提供方和权限界面。提供方在现有 Agent 作用域中注册工具，其他 preset 不获得 CUA 工具或指引，preset 文档保持不变。`configureOnEnable` 通过[插件管理器](../../boot/plugin-manager/README.zh.md)保存 `ui-settings.enabled: true`。详情页按钮复用现有设置表单，仅在用户点击后保存 `agent-preset-registry.selectedDefault: ptc`，保留部署级 `default`。即使旧授权配置没有声明作用域字段，提供方也默认只为 PTC 会话注册工具。[CUA](../cua/README.zh.md)负责注册和销毁。
+组合包 patch 通过 `agentPreset: ptc` 挂载共享原生提供方和权限界面。提供方在现有 Agent 作用域中注册工具，其他 preset 不获得 CUA 工具或指引，preset 文档保持不变。详情页按钮复用现有设置表单，仅在用户点击后保存 `agent-preset-registry.selectedDefault: ptc`，保留部署级 `default`。即使旧授权配置没有声明作用域字段，提供方也默认只为 PTC 会话注册工具。[CUA](../cua/README.zh.md)负责注册和销毁。
 
 </details>
 
diff --git a/packages/experimental/cua-bundle/package.json b/packages/experimental/cua-bundle/package.json
index 1772866546..63242b6704 100644
--- a/packages/experimental/cua-bundle/package.json
+++ b/packages/experimental/cua-bundle/package.json
@@ -36,11 +36,6 @@
     "bundle": {
       "patch": "./cordis.patch.yml",
       "experimental": true,
-      "configureOnEnable": {
-        "ui-settings": {
-          "enabled": true
-        }
-      },
       "platforms": [
         "darwin"
       ]
@@ -49,7 +44,6 @@
   "dependencies": {
     "@deepseek-ai/dsh-experimental-cua-macos": "workspace:*",
     "@deepseek-ai/dsh-computer-use": "workspace:*",
-    "@deepseek-ai/dsh-ptc-runtime-node": "workspace:*",
     "@deepseek-ai/dsh-client-ui-cua": "workspace:*"
   },
   "peerDependencies": {
diff --git a/packages/util/package-manifest/README.i18n.yaml b/packages/util/package-manifest/README.i18n.yaml
index 56cd1cdc13..0b38407403 100644
--- a/packages/util/package-manifest/README.i18n.yaml
+++ b/packages/util/package-manifest/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: d152484eb41ac6b4
   zh: 1db86285abf6c499
 /deepseek-ai-dsh-package-manifest/use-this-package:
-  en: c4bbd42bbe88fd5b
-  zh: f948c43f2eb44b18
+  en: ddfb5b63be499457
+  zh: 0ae1d9e727ae6a83
 /deepseek-ai-dsh-package-manifest/understand-the-implementation:
   en: 41ec449dee927f04
   zh: ec1b583bd9025d84
diff --git a/packages/util/package-manifest/README.md b/packages/util/package-manifest/README.md
index 9e60708836..aef45b0cee 100644
--- a/packages/util/package-manifest/README.md
+++ b/packages/util/package-manifest/README.md
@@ -52,7 +52,6 @@ The following metadata fields are optional. Omitting them leaves the format vers
 | `dsh.manifestVersion` | Manifest format identifier; the declared format is `1`, independent of the npm package version and Session format version. |
 | `dsh.bundle.platforms` | Optional nonempty list of Node Host platform names, such as `["darwin"]`; omission allows every operating system. The launcher and plugin manager enforce it before composing or selecting the bundle. |
 | `dsh.bundle.experimental` | Explicit experimental feature label in plugin management; independent of the package name and enabled state. |
-| `dsh.bundle.configureOnEnable` | Entry-id map of JSON config fields that Plugin Manager saves on explicit enablement. Settings use ordinary profile reconciliation and remain after disablement; see [Plugin Manager](../../boot/plugin-manager/README.md). |
 | `engines.dsh` | Author-declared compatible DSH versions as a SemVer range, including exact prerelease versions. This field sits beside `engines.node` and `engines.npm`; an engines object may omit `dsh`. |
 
 `LocalizedText` carries literal text or a language map with a required English fallback. `PluginLocalizedMeta` carries optional display title, description, an image data URL resolved from a package root's `package.json.icon` or an exported `<specifier>/icon`, and metadata diagnostics for installed plugins. [App boot](../../boot/app-boot/README.md) reads these values; this package only supplies their types.
diff --git a/packages/util/package-manifest/README.zh.md b/packages/util/package-manifest/README.zh.md
index d7cb9b6d3d..a7f07b25fe 100644
--- a/packages/util/package-manifest/README.zh.md
+++ b/packages/util/package-manifest/README.zh.md
@@ -52,7 +52,6 @@ const manifest: DshPackageManifest = {
 | `dsh.manifestVersion` | manifest（元数据清单）格式标识；声明的格式为 `1`，独立于 npm 包版本和 Session 格式版本。 |
 | `dsh.bundle.platforms` | 可选的非空 Node Host 平台名称列表，例如 `["darwin"]`；省略时允许所有操作系统。启动器和插件管理器在组合或选择该组合包前检查此字段。 |
 | `dsh.bundle.experimental` | 在插件页显示实验性标签，不改变包名或启用状态。 |
-| `dsh.bundle.configureOnEnable` | 以条目 id 为键的 JSON 配置字段映射，由插件管理器在显式启用时保存。通过正常 profile 重组生效，关闭保留；见[插件管理器](../../boot/plugin-manager/README.zh.md)。 |
 | `engines.dsh` | 作者声明的兼容 DSH 版本，使用 SemVer 范围，也可填写精确的预发布版本。此字段与 `engines.node`、`engines.npm` 并列；engines 对象可省略 `dsh`。 |
 
 `LocalizedText` 携带字面文本或带必需英文回退值的语言映射。`PluginLocalizedMeta` 携带已安装插件的可选展示标题、描述、从包根 `package.json.icon` 或导出的 `<标识>/icon` 解析的图片 data URL，以及元信息诊断。[App boot](../../boot/app-boot/README.zh.md) 读取这些值；本包只提供其类型。
diff --git a/packages/util/package-manifest/src/types.ts b/packages/util/package-manifest/src/types.ts
index c3a50bd224..6ca6cf3529 100644
--- a/packages/util/package-manifest/src/types.ts
+++ b/packages/util/package-manifest/src/types.ts
@@ -67,10 +67,6 @@ export interface DshEnginesManifest {
 
 /** The configuration layer exported by a bundle package. */
 export interface DshBundleManifest {
-  /** Top-level fields saved to existing profile entries on explicit enablement.
-   * Settings remain after disablement.
-   */
-  configureOnEnable?: Record<string, Record<string, unknown>>
   /** Supported Node Host platform names; omission allows every operating system. */
   platforms?: string[]
   /** Mark this optional feature as experimental in plugin management. */
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d716b0cc64..34239c9456 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8679,9 +8679,6 @@ importers:
       '@deepseek-ai/dsh-experimental-cua-macos':
         specifier: workspace:*
         version: link:../cua-macos
-      '@deepseek-ai/dsh-ptc-runtime-node':
-        specifier: workspace:*
-        version: link:../../ptc-runtime/ptc-runtime-node
     devDependencies:
       '@deepseek-ai/cordis':
         specifier: workspace:~

From 36a2b4fba45d2a9bae89cc0c6901c3bd152a9c9c Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:49:36 +0800
Subject: [PATCH 18/44] test(cua): preserve effective Coding Tools preferences

---
 apps/web/tests/cua-optin.e2e.ts | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index bc287862aa..08ad43393b 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -127,9 +127,6 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     expect(saved).toBe(beforeEnable)
     expect(scaffold.ctx.settings.describe().find(row => row.ns === 'ui-settings')?.value).toMatchObject({ enabled: codingTools })
     expect(saved).not.toContain('executionMode:')
-    expect(load(saved)).toEqual(expect.arrayContaining([
-      expect.objectContaining({ id: 'ui-settings', config: { enabled: codingTools } }),
-    ]))
     if (selectedDefault === undefined) {
       expect(load(saved)).not.toEqual(expect.arrayContaining([expect.objectContaining({ id: 'agent-preset-registry' })]))
     } else {

From 4b7df027699ed580cab62547df2cb2399a500f92 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 15:53:14 +0800
Subject: [PATCH 19/44] test(cua): separate Coding Tools and preset selection
 scenarios

---
 apps/web/tests/cua-optin.e2e.ts                   | 15 +++++++++++++--
 packages/experimental/cua-bundle/README.i18n.yaml |  4 ++--
 packages/experimental/cua-bundle/README.md        |  2 +-
 packages/experimental/cua-bundle/README.zh.md     |  2 +-
 4 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index 08ad43393b..7e157d8603 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -14,7 +14,11 @@ import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapsh
 import { connectFreshWorkspaceZh, writeComposerDraft, ZH_BROWSER_LOCALE } from './support.ts'
 
 // The shipped bundle admits only macOS Hosts; unsupported Hosts are exercised in bundle-platform.e2e.ts.
-it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('hot-reloads CUA while preserving Coding Tools and changes the default %s only from its detail page', async (selectedDefault) => {
+it.skipIf(process.platform !== 'darwin').each([
+  { selectedDefault: undefined, codingTools: false },
+  { selectedDefault: undefined, codingTools: true },
+  { selectedDefault: 'minimal', codingTools: true },
+] as const)('preserves Coding Tools=$codingTools and default=$selectedDefault across CUA toggles', async ({ selectedDefault, codingTools }) => {
   const directory = await mkdtemp(join(tmpdir(), 'cua-optin-web-'))
   let ownedScaffold: WebScaffold | undefined
   let browser: Browser | undefined
@@ -28,7 +32,6 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     ] })
     const initialDefault = selectedDefault ?? 'standard'
     if (selectedDefault !== undefined) await scaffold.ctx.settings.update('agent-preset-registry', { selectedDefault })
-    const codingTools = selectedDefault !== undefined
     await scaffold.ctx.settings.update('ui-settings', { enabled: codingTools })
     const settingsPath = join(harnessHome, 'profiles/scaffold/cordis.patch.yml')
     const beforeEnable = await readFile(settingsPath, 'utf8')
@@ -181,6 +184,14 @@ it.skipIf(process.platform !== 'darwin').each([undefined, 'minimal'] as const)('
     await setup.getByRole('button', { name: '前往设置', exact: true }).click()
     await setup.waitFor({ state: 'hidden' })
     await page.getByRole('region', { name: '给 Computer Use 授权', exact: true }).getByRole('alert').waitFor()
+    if (!codingTools) {
+      expect(await readFile(settingsPath, 'utf8')).toBe(saved)
+      expect(scaffold.ctx.settings.describe().find(row => row.ns === 'ui-settings')?.value).toMatchObject({ enabled: false })
+      expect(scaffold.ctx.agentPresets.defaultId).toBe(initialDefault)
+      expect((await runtime.run(runtime.resolve({ program, bindings: [], stateOwner: owner }))).value).toBe(3)
+      await runtime.release(owner)
+      return
+    }
     const defaultSetting = page.getByRole('group', { name: '新会话默认模式', exact: true })
     await expect.poll(() => defaultSetting.getByRole('button', { name: '设为 PTC', exact: true }).isEnabled()).toBe(true)
     await compareOrRefreshGolden(fileURLToPath(new URL('./expected/cua-permissions/default-mode.expected.md', import.meta.url)),
diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
index 452b3f522f..cc4a8a0810 100644
--- a/packages/experimental/cua-bundle/README.i18n.yaml
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -39,8 +39,8 @@
   en: 417c40acd93df532
   zh: 69cc5cf7140c75a9
 /deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work:
-  en: 8ddfd9245748b7c3
-  zh: 52015ab010abd0f8
+  en: 987e53e31c00358d
+  zh: 6a42836830b6d9ca
 /deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work/dev-note:
   en: 0a1253c6f7b5e8b9
   zh: ce96645b3e75874e
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
index 14b7a1921e..c76171d884 100644
--- a/packages/experimental/cua-bundle/README.md
+++ b/packages/experimental/cua-bundle/README.md
@@ -86,7 +86,7 @@ CUA activation and removal change the PTC SDK and system guidance; subsequent re
 <a id="known-limitations-and-deferred-work"></a>
 
 - Source Web and Desktop share permission controls on macOS. Packaged Desktop helper distribution, signing, and permission attribution are deferred.
-- PTC execution is shared by the profile. A Host without HMR applies saved changes at restart.
+- PTC execution is shared by the profile. A Host without HMR applies saved changes at restart. When Coding Tools is off, the existing preset UI restores the new-session default to `standard`; choosing persistent execution leaves Coding Tools off.
 
 <a id="dev-note"></a>
 ### Dev Note
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
index 5a14ec38be..f8ef2726e9 100644
--- a/packages/experimental/cua-bundle/README.zh.md
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -86,7 +86,7 @@ CUA 生效和卸载会改变 PTC SDK 与系统指引，后续请求使用更新
 <a id="known-limitations-and-deferred-work"></a>
 
 - 源码 Web 与 Desktop 共用 macOS 权限控件。桌面安装包的 helper 分发、签名和权限归属留待后续处理。
-- PTC 执行方式由 profile 共享。未启用 HMR 的 Host 在重启时应用已保存的变更。
+- PTC 执行方式由 profile 共享。未启用 HMR 的 Host 在重启时应用已保存的变更。Coding Tools 关闭时，现有预设界面会将新会话默认值恢复为 `standard`；设置持久化执行方式仍保留 Coding Tools 关闭状态。
 
 <a id="dev-note"></a>
 ### 开发备注

From 9199e1a795ed88c1315a2c41af54d9ed5ea3cc2e Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 18:47:55 +0800
Subject: [PATCH 20/44] feat(cua): persist profile and conversation consent in
 domain storage

---
 ...26-09-26-cua-application-consent.i18n.yaml |   8 +-
 .../2026-09-26-cua-application-consent.md     |   8 +-
 .../2026-09-26-cua-application-consent.zh.md  |   8 +-
 ...0-19-cua-profile-consent-storage.i18n.yaml |  19 ++
 .../2026-10-19-cua-profile-consent-storage.md |  31 +++
 ...26-10-19-cua-profile-consent-storage.zh.md |  31 +++
 apps/web/tests/cua-permissions.e2e.ts         |  10 +-
 .../application-approval.expected.md          |   2 +-
 docs/subsystems/boot.md                       |   6 +-
 docs/subsystems/boot.zh.md                    |   6 +-
 docs/subsystems/computer-use.md               |   2 +-
 docs/subsystems/computer-use.zh.md            |   2 +-
 docs/subsystems/settings.md                   |   3 +-
 docs/subsystems/settings.zh.md                |   3 +-
 .../cua-consent-storage/guide.i18n.yaml       |  16 ++
 .../v0.2.1-rc.2/cua-consent-storage/guide.md  |  22 ++
 .../cua-consent-storage/guide.zh.md           |  22 ++
 packages/boot/config-editor/README.i18n.yaml  |   4 +-
 packages/boot/config-editor/README.md         |   2 +-
 packages/boot/config-editor/README.zh.md      |   2 +-
 packages/boot/config-editor/src/index.ts      |   5 +-
 packages/boot/hmr/README.i18n.yaml            |   4 +-
 packages/boot/hmr/README.md                   |   2 +-
 packages/boot/hmr/README.zh.md                |   2 +-
 packages/boot/hmr/src/index.ts                |  13 +-
 packages/boot/hmr/tests/coordination.spec.ts  |  19 --
 .../client-ui-cua/README.i18n.yaml            |   8 +-
 packages/experimental/client-ui-cua/README.md |   4 +-
 .../experimental/client-ui-cua/README.zh.md   |   4 +-
 .../client-ui-cua/src/client/mount.ts         |   3 -
 .../tests/controller.client.spec.ts           |   2 +-
 .../client-ui-cua/tests/mount.client.spec.ts  |  27 +--
 .../client-ui-cua/tests/panel.client.spec.tsx |   2 +-
 .../experimental/cua-bundle/README.i18n.yaml  |   4 +-
 packages/experimental/cua-bundle/README.md    |   2 +-
 packages/experimental/cua-bundle/README.zh.md |   2 +-
 .../experimental/cua-macos/README.i18n.yaml   |   4 +-
 packages/experimental/cua-macos/README.md     |   4 +-
 packages/experimental/cua-macos/README.zh.md  |   4 +-
 packages/experimental/cua-macos/package.json  |   5 +-
 .../tests/provider-lifecycle.spec.ts          |  83 ++++---
 packages/experimental/cua/README.i18n.yaml    |  16 +-
 packages/experimental/cua/README.md           |  11 +-
 packages/experimental/cua/README.zh.md        |  11 +-
 packages/experimental/cua/package.json        |   9 +-
 packages/experimental/cua/src/access-types.ts |   2 -
 packages/experimental/cua/src/access.ts       |  16 +-
 .../cua/src/application-access.ts             | 204 +++++++++---------
 packages/experimental/cua/src/index.ts        |  26 +--
 .../experimental/cua/src/permission-store.ts  | 110 ++++++++++
 .../experimental/cua/tests/access.spec.ts     |  44 ++--
 .../cua/tests/application-access.spec.ts      |  51 ++---
 .../tests/fixtures/permission-store-worker.ts |  26 +++
 .../cua/tests/permission-fixture.ts           |  47 ++++
 .../cua/tests/permission-store.spec.ts        | 137 ++++++++++++
 packages/experimental/cua/tsconfig.json       |  12 +-
 .../extensions/tool-cordis/src/api-catalog.ts |  16 +-
 packages/settings/settings/README.i18n.yaml   |   4 +-
 packages/settings/settings/README.md          |   2 -
 packages/settings/settings/README.zh.md       |   2 -
 packages/settings/settings/src/index.ts       |   9 +-
 pnpm-lock.yaml                                |  19 +-
 62 files changed, 787 insertions(+), 397 deletions(-)
 create mode 100644 .agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
 create mode 100644 .agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
 create mode 100644 .agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
 create mode 100644 docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.i18n.yaml
 create mode 100644 docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md
 create mode 100644 docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.zh.md
 create mode 100644 packages/experimental/cua/src/permission-store.ts
 create mode 100644 packages/experimental/cua/tests/fixtures/permission-store-worker.ts
 create mode 100644 packages/experimental/cua/tests/permission-fixture.ts
 create mode 100644 packages/experimental/cua/tests/permission-store.spec.ts

diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
index 4f7d6bb80e..34c38fd4ec 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.i18n.yaml
@@ -9,11 +9,11 @@
   en: b32a7ce6483b9b48
   zh: ec0938ad032b99d8
 /agent-note-application-consent-for-native-computer-use/decision:
-  en: 554368de34086124
-  zh: 79ac64bcd4f7a26b
+  en: 5c0fec597962dbc4
+  zh: 184aad8bf516a245
 /agent-note-application-consent-for-native-computer-use/alternatives-considered:
-  en: 80cd5fd93a42d937
-  zh: 2a0e241b1b8c2e1d
+  en: 9f41ecc5e34efe17
+  zh: b30ba6dae25b20b2
 /agent-note-application-consent-for-native-computer-use/consequences:
   en: 4bda3366af65250a
   zh: 7c83561b4db07284
diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
index 3c13cdb5cc..c7616b48d7 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md
@@ -10,7 +10,7 @@ macOS privileges authorize an execution host, not a user's choice of target appl
 
 ## Decision
 
-The CUA executor owns application consent for every object-API and native-tool dispatch. It uses the existing User Questions service for human decisions and the provider's existing profile configuration for saved grants. Its fixed approval presentation reuses the tool-approval card without adopting the session's tool-approval policy. Native icons and names are presentation metadata, excluded from saved identities and model results. General tool approval and operating-system privileges remain separate requirements. Arbitrary persistent PTC code and separately authorized shell tools retain their own execution authority.
+The CUA executor owns application consent for every object-API and native-tool dispatch. It uses the existing User Questions service for human decisions and profile-scoped domain storage for saved grants. Its fixed approval presentation reuses the tool-approval card without adopting the session's tool-approval policy. Native icons and names are presentation metadata, excluded from saved identities and model results. General tool approval and operating-system privileges remain separate requirements. Arbitrary persistent PTC code and separately authorized shell tools retain their own execution authority.
 
 System-permission buttons call the native helper on the DSH host and remain available to remote browsers. The [usage documentation](../../../../packages/experimental/client-ui-cua/README.md#use-this-package) explains where to complete authorization; the page has no persistent remote-access notice.
 
@@ -18,9 +18,7 @@ A saved identity combines the canonical executable path with a verified designat
 
 Cold application selection prepares an executable identity and handle without launching. The same consent decision guards the private launch continuation, and the helper checks the executable again before launch and binds the resulting process afterward. Signed selections retain the normal designated-requirement identity; an unverifiable executable uses a content identity for this pending selection and cannot create a saved grant. Preparing metadata before asking avoids starting an application the user refuses.
 
-Session decisions are kept in memory by Session ID and application identity. Agent disposal and helper replacement release native handles without discarding these decisions; provider disposal or DSH restart clears them. This scope covers follow-up turns without relying on the model to decide when a user intent has ended.
-
-Selections of the same application within one session are serialized, so a pending question does not produce competing decisions. Saved-grant additions and revocations share one mutation queue and read the current grant list inside it. Provider shutdown cancels writes still waiting for HMR admission; admitted writes settle before disposal completes. Refusals prevent another prompt until the user permits asking again; a restored saved grant takes precedence in both dispatch and the permission-page projection.
+Conversation decisions survive provider disposal and DSH restart according to [profile consent storage](2026-10-19-cua-profile-consent-storage.md). That decision owns persistence, migration and cross-process revocation. The executor continues to serialize application selections within a conversation, refuse repeated prompts after denial, and give an explicit long-term grant precedence over conversation refusals.
 
 Revocation invalidates the Agent connections that retain the application's handles, then awaits native cleanup. Reauthorization uses a fresh connection, so old app and window snapshots cannot become valid again. The [native object decision](2026-09-17-experimental-cua-object-api.md) continues to own process identity, coordinate semantics, and separation from the evaluator.
 
@@ -30,7 +28,7 @@ Revocation invalidates the Agent connections that retain the application's handl
 
 **Persist application names or unsigned paths.** A replacement can reuse both. Durable grants require a verifiable signing identity; session access supports unsigned development applications without that promise.
 
-**Add an approval database or Session control stream.** Profile settings already own user configuration, and User Questions already owns interactive answers. The permission UI observes the provider and its owning settings namespace without another authorization store or event channel.
+**Add an approval database or Session control stream.** User Questions already owns interactive answers. The existing domain service provides durable state without introducing a dedicated database or Session control stream; storage tradeoffs are owned by the profile consent decision.
 
 **Disable permission buttons based on the browser address.** A user may operate the DSH host through screen sharing and complete authorization there. Port forwarding and proxies make the address an unreliable indication of whether the browser and DSH run on the same computer.
 
diff --git a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
index 42b667f485..a65282e66b 100644
--- a/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md
@@ -10,7 +10,7 @@ macOS 权限授权执行宿主，不能表达用户允许操作哪些目标应
 
 ## 决策
 
-CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。人工决定复用 User Questions 服务，长期许可保存在 provider 的现有 profile 配置中。通用工具审批和操作系统权限仍是独立要求。任意 persistent PTC 代码和另行授权的 shell 工具保留各自的执行权限。 固定审批呈现复用工具审批卡片，同时保留独立于会话工具审批策略的授权规则。本机图标和名称仅用于展示，不进入保存的身份信息或模型结果。
+CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。人工决定复用 User Questions 服务，长期许可保存在按 profile 隔离的存储域中。通用工具审批和操作系统权限仍是独立要求。任意 persistent PTC 代码和另行授权的 shell 工具保留各自的执行权限。 固定审批呈现复用工具审批卡片，同时保留独立于会话工具审批策略的授权规则。本机图标和名称仅用于展示，不进入保存的身份信息或模型结果。
 
 系统权限按钮调用运行 DSH 的电脑上的原生 helper，远程访问时仍可使用。授权地点写在[使用说明](../../../../packages/experimental/client-ui-cua/README.zh.md#use-this-package)中，页面不常驻远程访问提示。
 
@@ -18,9 +18,7 @@ CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。
 
 选择尚未运行的应用时，先准备可执行文件身份和句柄，不立即启动。同一授权决定保护内部启动续接，helper 在启动前再次核对可执行文件，并在启动后绑定实际进程。已签名应用沿用签名指定要求身份；签名不可验证的程序使用本次待启动选择的内容身份，不能生成长期许可。先准备元数据再询问，可以避免启动用户拒绝的应用。
 
-会话决定按 Session ID 和应用身份保存在内存中。Agent 销毁或 helper 重建会释放原生句柄，但保留授权决定；提供方卸载或 DSH 重启后清除。会话范围可以覆盖用户的后续指令，无须由模型判断一次用户意图何时结束。
-
-同一会话对同一应用的选择串行执行，避免未完成的问题产生相互冲突的决定。长期许可的新增和撤销共用写入队列，并在队列内读取当前许可列表。提供方关闭时取消尚在等待 HMR 调度的写入，已开始的写入会在销毁完成前结束。拒绝会阻止再次询问，直到用户允许重询；重新添加的长期许可在执行检查和权限页中均优先于旧拒绝记录。
+会话决定按[profile 授权存储](2026-10-19-cua-profile-consent-storage.zh.md)的规则，在提供方卸载和 DSH 重启后保留。该记录负责持久化、迁移和跨进程撤销。执行器继续将同一对话对同一应用的选择串行化，拒绝后不再次询问，显式长期许可优先于会话拒绝。
 
 撤销使保留目标应用句柄的 Agent 连接失效，并等待原生清理完成。重新授权使用新连接，因此旧应用对象和窗口快照不能重新生效。[原生对象决策](2026-09-17-experimental-cua-object-api.zh.md)继续负责进程身份、坐标语义和与执行器分离的设计。
 
@@ -30,7 +28,7 @@ CUA 执行器在每次对象 API 和原生工具调用时检查应用授权。
 
 **保存应用名称或未签名路径。** 替换程序可以复用二者。长期许可需要可验证的签名身份；会话授权支持未签名的开发应用，但不承诺跨进程复用。
 
-**新增审批数据库或 Session 控制流。** Profile settings 已负责用户配置，User Questions 已负责交互回答。权限界面查询 provider，并监听其配置 namespace，无须另一份授权存储或事件通道。
+**增加审批数据库或 Session 控制流。** User Questions 已经负责交互式回答。现有域服务提供持久状态，无须增加专用数据库或 Session 控制流；存储取舍由 profile 授权存储决策负责。
 
 **根据浏览器访问地址禁用权限按钮。** 用户可能通过屏幕共享操作运行 DSH 的电脑，并在该电脑上完成授权。端口转发和代理使访问地址无法可靠判断浏览器与 DSH 是否运行在同一台电脑上。
 
diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
new file mode 100644
index 0000000000..3a80ff1466
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
@@ -0,0 +1,19 @@
+# Bilingual-pair consistency record for 2026-10-19-cua-profile-consent-storage.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
+/agent-note-durable-computer-use-consent-within-one-profile:
+  en: b2aa270d586efd93
+  zh: 99606fa28dc4a752
+/agent-note-durable-computer-use-consent-within-one-profile/problem:
+  en: f2c70036a57ddb41
+  zh: 9bbbf3dd09d486f5
+/agent-note-durable-computer-use-consent-within-one-profile/decision:
+  en: 977254fd3af9e946
+  zh: 09a17fb5b9a56d07
+/agent-note-durable-computer-use-consent-within-one-profile/alternatives-considered:
+  en: 1c2cbc7630e0aa5c
+  zh: 444a58df3fa1c481
+/agent-note-durable-computer-use-consent-within-one-profile/consequences:
+  en: 66fe232589e46d64
+  zh: fc69831be76248d9
diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
new file mode 100644
index 0000000000..d8699909ab
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
@@ -0,0 +1,31 @@
+# Agent Note: Durable Computer Use consent within one profile
+
+Status: implemented
+
+English | [中文](2026-10-19-cua-profile-consent-storage.zh.md)
+
+## Problem
+
+Application grants stored as plugin configuration make each authorization change depend on configuration reconciliation. Process-local conversation decisions also disappear when the same conversation resumes after a restart. A shared in-memory storage handle cannot observe another process revoking permission.
+
+## Decision
+
+The CUA owner uses the existing domain storage service, with one domain per canonical profile directory. It stores long-term grants and conversation decisions by native application identity. Conversation IDs scope permission without turning it into permission for every conversation. The native identity policy remains owned by [application consent](2026-09-26-cua-application-consent.md); this note replaces only that note's storage and restart-lifetime choices.
+
+Every operation opens fresh domain state while holding the profile's existing file-lock primitive and closes the domain before releasing the lock. Authorized native dispatch holds the same lock until it settles. Revocation cancels this process's affected work first, then commits after other processes' already-admitted operations have finished. A completed revocation therefore leaves no operation using the old authority. App-wide revocation generations and per-conversation decision revisions prevent an old handle or delayed answer from restoring revoked access.
+
+The JSON backend remains the shipped default. The domain name contains the SHA-256 digest of the canonical profile directory, isolating profiles that share one storage root. Legacy `allowedApps` is imported once; a persisted migration marker prevents an old configuration from restoring a revoked grant. Users can remove that configuration after checking the migrated list. Corrupt or unavailable profile storage fails closed. A composition without a profile has only temporary conversation state.
+
+## Alternatives considered
+
+**Keep authorization in configuration.** It preserves existing storage but retains configuration-write and HMR coupling for runtime application decisions.
+
+**Keep one domain open and rely on change events.** Domain notifications are process-local. Another host could continue to use stale grants after revocation.
+
+**Add a new watcher, revision file or authorization broker.** The existing domain and file-lock primitives provide fresh reads and serialized operation admission without a new shared storage or IPC framework. This choice trades concurrent native operations within one profile for a clear revocation completion point.
+
+## Consequences
+
+File locks coordinate processes on one machine and PID namespace. A network-mounted profile shared across hosts is unsupported. Revocation may wait for another process's native call to settle. No timer establishes authorization validity.
+
+The permission page still omits conversation-only grants and reads current state on entry, focus, actions and reconnection. Storage changes do not emit configuration events. System permissions remain owned by macOS. Tests cover restart retention, profile isolation, another process's write, cancellation, corrupted data, legacy import and non-resurrection after revocation. Stored conversation records currently require explicit retention management rather than automatic eviction.
diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
new file mode 100644
index 0000000000..c68b9e5f3a
--- /dev/null
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
@@ -0,0 +1,31 @@
+# Agent Note: 同一 profile 内的持久 Computer Use 授权
+
+Status: implemented
+
+[English](2026-10-19-cua-profile-consent-storage.md) | 中文
+
+## 问题
+
+把应用许可保存为插件配置，会让每次授权变更依赖配置重组。只保存在进程内的会话决定，也会在重启后恢复同一对话时丢失。长期持有的内存存储句柄无法观察另一个进程的撤销操作。
+
+## 决策
+
+CUA 使用现有域存储服务，每个 profile 的真实目录对应独立存储域，按本机应用身份保存长期许可和会话决定。对话 ID 限定权限范围，不把本会话许可扩展为所有对话的许可。本机身份规则仍由[应用授权](2026-09-26-cua-application-consent.zh.md)负责，本记录仅替代其中的存储和重启后有效期选择。
+
+每个操作使用现有文件锁，在 profile 锁内打开并读取最新存储状态，关闭域后才释放锁。已授权的原生操作持锁直到结束。撤销先取消本进程中受影响的工作，再等待其他进程已获准执行的操作结束后提交。因此，撤销完成后不会留下仍使用旧授权的操作。应用级撤销代次和各对话的决定版本，阻止旧句柄或迟到回答恢复被撤销的访问权限。
+
+随附配置继续使用 JSON 后端。域名包含 profile 真实目录的 SHA-256 摘要，隔离共用存储根目录的不同 profile。旧 `allowedApps` 只导入一次，持久化迁移标记阻止旧配置恢复已撤销的许可。用户确认列表迁移完成后可删除旧配置。profile 存储损坏或不可用时拒绝访问。没有 profile 的组合只保留临时会话状态。
+
+## 考虑过的替代方案
+
+**继续将授权保存在配置中。** 可以复用旧存储，但运行时应用决定仍依赖配置写入和 HMR。
+
+**长期打开域并依赖变更事件。** 域事件只在进程内传播，另一个宿主可能在撤销后继续使用旧许可。
+
+**增加新的监听器、版本文件或授权代理。** 现有域存储和文件锁已经能提供最新状态与串行准入，无须增加通用存储或 IPC 框架。代价是同一 profile 内的原生操作串行执行，换取明确的撤销完成点。
+
+## 后果
+
+文件锁协调同一电脑及 PID 命名空间中的进程，不支持跨主机共用网络目录。撤销可能等待其他进程的原生调用结束。授权是否有效不由计时器决定。
+
+权限页仍不显示仅对单个会话生效的许可，在进入页面、返回窗口、完成操作和重连后读取最新状态。存储变更不发送配置事件，系统权限仍归 macOS 管理。测试覆盖重启恢复、profile 隔离、其他进程写入、取消、数据损坏、旧配置导入和撤销后不恢复。已保存的会话记录目前需要显式管理保留期限，不自动淘汰。
diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 1da9c5b9ca..4a064c1741 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -1,5 +1,5 @@
 /** Built permission UI talks to the real provider; the isolated helper substitutes only macOS privilege observations. */
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -42,8 +42,6 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
     profile: { packages: [{ dir: bundle, enabled: true }, { dir: fixtureBundle, enabled: true }] },
   })
   resources.scaffold = scaffold
-  await scaffold.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'],
-    value: [{ id: 'a'.repeat(64), name: 'Fixture', executablePath: '/Applications/Fixture.app' }] }])
   const browser = await chromium.launch()
   resources.browser = browser
   const page = await newEnglishPage(browser), tripwire = watchConsole(page)
@@ -53,7 +51,6 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   const agent = scaffold.ctx.agents.list()[0]!
   await scaffold.ctx.agentPresets.select(agent, 'ptc')
   scaffold.ctx.approval.setPolicy(agent, 'never')
-  await scaffold.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'], value: [] }])
   // Application consent remains independent of the session's tool-approval policy.
   const grant = scaffold.ctx.tools.execute({ agent, signal: new AbortController().signal,
     callId: ToolCallId('cua-app-approval'), name: 'run_code',
@@ -145,7 +142,10 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   await panel.getByRole('button', { name: 'Allow asking again', exact: true }).click()
   await panel.getByText('Fixture', { exact: true }).waitFor({ state: 'hidden' })
   const saved = await readFile(join(scaffold.harnessHome, 'profiles/scaffold/cordis.patch.yml'), 'utf8')
-  expect(saved).toContain('allowedApps: []')
+  expect(saved).not.toContain('allowedApps:')
+  const files = await readdir(join(scaffold.harnessHome, 'storages'))
+  expect(files.some(file => file.startsWith('cua_permissions_') && file.endsWith('.json'))).toBe(true)
+  expect((await scaffold.ctx.cuaAccess.applications()).allowedApps).toEqual([])
   const events = (await readFile(audit, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as { event: string; method: string; params: object })
     .filter(record => record.event === 'call').map(({ method, params }) => ({ method, params }))
   expect(events).toContainEqual({ method: 'requestPermission', params: { permission: 'accessibility' } })
diff --git a/apps/web/tests/expected/cua-permissions/application-approval.expected.md b/apps/web/tests/expected/cua-permissions/application-approval.expected.md
index 96f5eb74e3..e60029a4dd 100644
--- a/apps/web/tests/expected/cua-permissions/application-approval.expected.md
+++ b/apps/web/tests/expected/cua-permissions/application-approval.expected.md
@@ -2,7 +2,7 @@
 - group "Approval details":
   - strong: Fixture
   - text: Allow Computer Use to launch, read, capture and control this application?
-  - paragraph: Session access lasts until DSH restarts or Computer Use is disabled.
+  - paragraph: Session access applies only to this conversation.
 - button "Reject"
 - button "Allow for this session"
 - button "Always allow"
diff --git a/docs/subsystems/boot.md b/docs/subsystems/boot.md
index 3db48dc344..606ad59bcb 100644
--- a/docs/subsystems/boot.md
+++ b/docs/subsystems/boot.md
@@ -85,10 +85,9 @@ configuration(): Array<{ entry: Entry; inherited: Record<string, unknown>; overr
 /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
  * @param entry Current Loader entry, also used to detect replacement during the write.
  * @param change Derive a raw config from the current entry and its inherited layer.
- * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  * @returns Fulfillment after Loader reconciliation completes.
  */
-async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>
+async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>
 ```
 
 Source: [`packages/boot/config-editor/src/index.ts`](../../packages/boot/config-editor/src/index.ts)
@@ -110,10 +109,9 @@ Hot reload service with Cordis-compatible module configuration and events.
 ```ts cordis-catalog
 /** Serialize a caller-owned mutation with all automatic reload paths.
  * @param operation Work that must not overlap module or configuration replacement.
- * @param signal Cancel admission while queued; an operation already running must finish.
  * @returns The operation result after its asynchronous work completes.
  */
-runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>
+runExclusive<T>(operation: () => Promise<T>): Promise<T>
 
 /** Watch a configuration path through the same queue as module replacement.
  * @param filename Absolute path, which may not exist yet.
diff --git a/docs/subsystems/boot.zh.md b/docs/subsystems/boot.zh.md
index baf734acd5..c7f830fbb9 100644
--- a/docs/subsystems/boot.zh.md
+++ b/docs/subsystems/boot.zh.md
@@ -85,10 +85,9 @@ configuration(): Array<{ entry: Entry; inherited: Record<string, unknown>; overr
 /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
  * @param entry Current Loader entry, also used to detect replacement during the write.
  * @param change Derive a raw config from the current entry and its inherited layer.
- * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  * @returns Fulfillment after Loader reconciliation completes.
  */
-async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>
+async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>
 ```
 
 Source: [`packages/boot/config-editor/src/index.ts`](../../packages/boot/config-editor/src/index.ts)
@@ -110,10 +109,9 @@ Hot reload service with Cordis-compatible module configuration and events.
 ```ts cordis-catalog
 /** Serialize a caller-owned mutation with all automatic reload paths.
  * @param operation Work that must not overlap module or configuration replacement.
- * @param signal Cancel admission while queued; an operation already running must finish.
  * @returns The operation result after its asynchronous work completes.
  */
-runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>
+runExclusive<T>(operation: () => Promise<T>): Promise<T>
 
 /** Watch a configuration path through the same queue as module replacement.
  * @param filename Absolute path, which may not exist yet.
diff --git a/docs/subsystems/computer-use.md b/docs/subsystems/computer-use.md
index 34e011f039..55444c7c10 100644
--- a/docs/subsystems/computer-use.md
+++ b/docs/subsystems/computer-use.md
@@ -88,7 +88,7 @@ Browser controls for provider-owned native permission and application decisions.
  * Read application decisions without waiting for the native helper.
  * @returns Saved grants and refused applications with their persistence owner.
  */
-@Remote applications(): CuaApplicationState
+@Remote applications(): Promise<CuaApplicationState>
 
 /**
  * Inspect system privileges independently of application decisions and icons.
diff --git a/docs/subsystems/computer-use.zh.md b/docs/subsystems/computer-use.zh.md
index 4a2020d9c8..c88dc9e479 100644
--- a/docs/subsystems/computer-use.zh.md
+++ b/docs/subsystems/computer-use.zh.md
@@ -88,7 +88,7 @@ Browser controls for provider-owned native permission and application decisions.
  * Read application decisions without waiting for the native helper.
  * @returns Saved grants and refused applications with their persistence owner.
  */
-@Remote applications(): CuaApplicationState
+@Remote applications(): Promise<CuaApplicationState>
 
 /**
  * Inspect system privileges independently of application decisions and icons.
diff --git a/docs/subsystems/settings.md b/docs/subsystems/settings.md
index 35bfb04492..ff047b7414 100644
--- a/docs/subsystems/settings.md
+++ b/docs/subsystems/settings.md
@@ -66,9 +66,8 @@ async replace(ns: string, section: object, expectedRevision?: number): Promise<v
  * @param ns Profile entry id.
  * @param ops Ordered form edits.
  * @param expectedRevision Revision returned by describe.
- * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  */
-async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>
+async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>
 ```
 
 Source: [`packages/settings/settings/src/index.ts`](../../packages/settings/settings/src/index.ts)
diff --git a/docs/subsystems/settings.zh.md b/docs/subsystems/settings.zh.md
index 043002f98a..cb2fbeb694 100644
--- a/docs/subsystems/settings.zh.md
+++ b/docs/subsystems/settings.zh.md
@@ -66,9 +66,8 @@ async replace(ns: string, section: object, expectedRevision?: number): Promise<v
  * @param ns Profile entry id.
  * @param ops Ordered form edits.
  * @param expectedRevision Revision returned by describe.
- * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
  */
-async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>
+async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>
 ```
 
 Source: [`packages/settings/settings/src/index.ts`](../../packages/settings/settings/src/index.ts)
diff --git a/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.i18n.yaml b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.i18n.yaml
new file mode 100644
index 0000000000..385596d866
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.i18n.yaml
@@ -0,0 +1,16 @@
+# Bilingual-pair consistency record for guide.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md
+/:
+  en: 131777d89cb23df3
+  zh: 44e50f8c09b2c4b9
+/computer-use-consent-storage:
+  en: fb837293708860f5
+  zh: 8ee31126d1faf7c7
+/computer-use-consent-storage/change:
+  en: 88150a92531212bf
+  zh: a0103c4d035a4af7
+/computer-use-consent-storage/migration:
+  en: c7a4989a79f4fbca
+  zh: 630fc23128ee0520
diff --git a/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md
new file mode 100644
index 0000000000..05a0bd4011
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md
@@ -0,0 +1,22 @@
+---
+kind: upgrade-guide
+description: "Computer Use application consent moves from profile configuration to durable profile-scoped storage."
+---
+
+# Computer Use consent storage
+
+English | [中文](guide.zh.md)
+
+## Change
+
+Computer Use stores application consent through `storageDomain`. With the default JSON backend, each canonical profile directory has its own `$DSH_HOME/storages/cua_permissions_<sha256>.json`. “Allow for this session” now follows the conversation ID across DSH restart and Computer Use disablement. It does not authorize another conversation. Unverifiable applications still require a matching native process identity; restarting that application may require new consent.
+
+`allowedApps` is a legacy import source. The first store access imports it once. Subsequent configuration edits do not grant or revoke access, and a revoked grant is not restored by reloading the old configuration. The permission page remains the authoring interface for grants and refusals. macOS privileges are unchanged.
+
+## Migration
+
+1. Keep the profile's existing storage services mounted. Shipped profiles already include `storageDomain` and the JSON backend; custom profiles need the same services. A profile without domain storage refuses authorization operations.
+2. Enable Computer Use and open its details to initialize storage. Confirm that the always-allowed applications appear.
+3. Remove `allowedApps` from the CUA entry in the profile configuration and other overlays after confirmation. Keep the remaining CUA configuration.
+4. Use the permission page to revoke applications or allow asking again. Existing conversation-only grants held by an older running process cannot be recovered; grant those once after upgrading. Newly granted conversation access then survives restart.
+5. Keep the storage file with that profile's state. Moving the profile to a different real directory selects a different store. File locks coordinate processes on one machine, not different machines sharing a network filesystem.
diff --git a/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.zh.md b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.zh.md
new file mode 100644
index 0000000000..fb9e8f39f3
--- /dev/null
+++ b/docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.zh.md
@@ -0,0 +1,22 @@
+---
+kind: upgrade-guide
+description: "Computer Use 应用授权从 profile 配置迁移到按 profile 隔离的持久存储。"
+---
+
+# Computer Use 授权存储
+
+[English](guide.md) | 中文
+
+## 变更
+
+Computer Use 通过 `storageDomain` 保存应用授权。使用默认 JSON 后端时，每个 profile 的真实目录对应独立的 `$DSH_HOME/storages/cua_permissions_<sha256>.json`。“本会话允许”现在按对话 ID 跨 DSH 重启和 Computer Use 启停保留，不授权其他对话。无法验证签名的应用仍需匹配本机进程身份，应用重启后可能需要重新授权。
+
+`allowedApps` 作为旧数据来源，只在首次访问存储时导入一次。此后修改配置不会授予或撤销访问权限，重新加载旧配置也不会恢复已撤销的许可。权限页继续提供授权管理和清除拒绝的操作。macOS 系统权限保持原样。
+
+## 迁移
+
+1. 保留 profile 的现有存储服务。随附 profile 已包含 `storageDomain` 和 JSON 后端，自定义 profile 需要挂载相同服务。有 profile 但没有域存储时，授权操作会被拒绝。
+2. 启用 Computer Use 并打开详情页，初始化存储。确认始终允许的应用显示正确。
+3. 确认后，从 profile 配置及其他覆盖层的 CUA 条目中删除 `allowedApps`，保留其他 CUA 配置。
+4. 在权限页撤销应用授权或允许再次询问。旧进程内已有的会话许可无法恢复，升级后需要重新授予一次；新授予的会话许可随后可跨重启保留。
+5. 将存储文件作为该 profile 的状态保留。把 profile 移到另一个真实目录后会使用不同存储。文件锁协调同一电脑上的进程，不支持多台电脑共用网络文件系统。
diff --git a/packages/boot/config-editor/README.i18n.yaml b/packages/boot/config-editor/README.i18n.yaml
index a04b21d3e8..5727bdff08 100644
--- a/packages/boot/config-editor/README.i18n.yaml
+++ b/packages/boot/config-editor/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 23386452a66b2fbd
   zh: 70bba862b949b652
 /deepseek-ai-dsh-config-editor/use-this-package:
-  en: be26ec7aef6c7cb4
-  zh: 3ade4ba48cdf1fc1
+  en: 1eedaa5d72b48177
+  zh: 39abc1d927a692d2
 /deepseek-ai-dsh-config-editor/understand-the-implementation:
   en: baa887b5ecfa7001
   zh: d3e03c2b1d10c67e
diff --git a/packages/boot/config-editor/README.md b/packages/boot/config-editor/README.md
index 912413eebb..17da6551f9 100644
--- a/packages/boot/config-editor/README.md
+++ b/packages/boot/config-editor/README.md
@@ -30,7 +30,7 @@ Mount this service in a profile application with Loader and `profileContext`. It
   name: '@deepseek-ai/dsh-config-editor'
 ```
 
-Use [settings](../../settings/settings/README.md) for forms restricted to live fields. Callers that edit complete configuration can use `ctx.configEditor.edit()`; ordinary fields retain Loader’s normal lifecycle. The optional `signal` cancels a write waiting for HMR admission without changing the file; an admitted write finishes normally.
+Use [settings](../../settings/settings/README.md) for forms restricted to live fields. Callers that edit complete configuration can use `ctx.configEditor.edit()`; ordinary fields retain Loader’s normal lifecycle.
 
 <a id="understand-the-implementation"></a>
 ## Understand the implementation
diff --git a/packages/boot/config-editor/README.zh.md b/packages/boot/config-editor/README.zh.md
index cc66180ff6..d1ff18344f 100644
--- a/packages/boot/config-editor/README.zh.md
+++ b/packages/boot/config-editor/README.zh.md
@@ -30,7 +30,7 @@ kind: "package-reference"
   name: '@deepseek-ai/dsh-config-editor'
 ```
 
-使用 [settings](../../settings/settings/README.zh.md) 提供只编辑即时字段的表单。编辑完整配置的调用方可使用 `ctx.configEditor.edit()`；普通字段保留 Loader 的正常生命周期。可选 `signal` 可取消等待 HMR 调度的写入，文件保持不变；已经开始的写入仍会完成。
+使用 [settings](../../settings/settings/README.zh.md) 提供只编辑即时字段的表单。编辑完整配置的调用方可使用 `ctx.configEditor.edit()`；普通字段保留 Loader 的正常生命周期。
 
 <a id="understand-the-implementation"></a>
 ## 理解实现
diff --git a/packages/boot/config-editor/src/index.ts b/packages/boot/config-editor/src/index.ts
index fefc0503c1..ffec879f40 100644
--- a/packages/boot/config-editor/src/index.ts
+++ b/packages/boot/config-editor/src/index.ts
@@ -82,16 +82,13 @@ export class ConfigEditor extends Service {
   /** Validate, persist, and reconcile a plugin's next config; ordinary fields keep normal lifecycle rules.
    * @param entry Current Loader entry, also used to detect replacement during the write.
    * @param change Derive a raw config from the current entry and its inherited layer.
-   * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
    * @returns Fulfillment after Loader reconciliation completes.
    */
   async edit(
     entry: Entry,
     change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>,
-    signal?: AbortSignal,
   ): Promise<void> {
     const run = async (): Promise<void> => {
-      signal?.throwIfAborted()
       const path = this.documentPath
       await withFileLock(join(this.ownerContext.profileContext.dir, 'package.json'), async () => {
         if (!this.entries().includes(entry) || entry.fiber === undefined) throw new Error('Configuration entry is no longer available')
@@ -153,7 +150,7 @@ export class ConfigEditor extends Service {
       })
     }
     const hmr = this.ownerContext.get('hmr')
-    await (hmr === undefined ? run() : hmr.runExclusive(run, signal))
+    await (hmr === undefined ? run() : hmr.runExclusive(run))
   }
 }
 
diff --git a/packages/boot/hmr/README.i18n.yaml b/packages/boot/hmr/README.i18n.yaml
index 7480a8b3f7..776c0d0fe7 100644
--- a/packages/boot/hmr/README.i18n.yaml
+++ b/packages/boot/hmr/README.i18n.yaml
@@ -21,8 +21,8 @@
   en: 11ef18c6d08f39f3
   zh: 2911cdd03ff3747d
 /deepseek-ai-dsh-hmr/understand-the-implementation:
-  en: 5ca2a7d68d7c189d
-  zh: 773ffb08d7cbfd0f
+  en: bd608f418630317f
+  zh: 053fa77a3fa571a9
 /deepseek-ai-dsh-hmr/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90
diff --git a/packages/boot/hmr/README.md b/packages/boot/hmr/README.md
index 9a2d9ccdc9..8d2270b4a1 100644
--- a/packages/boot/hmr/README.md
+++ b/packages/boot/hmr/README.md
@@ -56,7 +56,7 @@ Profile recompositions run by HMR's profile watches and by Plugin Manager also r
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-`watchConfig()` registers an awaited configuration handler and watches only its target path and required parent directories; sibling files, including temporary writer locks, are excluded before native watcher creation. `runExclusive()` serializes configuration changes and Loader updates with automatic reloads and rejects nested transactions. Its optional `signal` cancels a queued operation before admission; an admitted operation still completes before the queue advances. Package installation and removal run outside this queue. HMR does not acquire the package writer lock; manifest notifications reload only when the ordered `dsh.profile.bundles` list changes. Profile and home patch changes also trigger recomposition. File events received during a configuration transaction are processed afterward. Include refreshes and profile reconciliation reach plugins through ordinary Loader entry updates; Loader commits volatile-only changes in place.
+`watchConfig()` registers an awaited configuration handler and watches only its target path and required parent directories; sibling files, including temporary writer locks, are excluded before native watcher creation. `runExclusive()` serializes configuration changes and Loader updates with automatic reloads and rejects nested transactions. Package installation and removal run outside this queue. HMR does not acquire the package writer lock; manifest notifications reload only when the ordered `dsh.profile.bundles` list changes. Profile and home patch changes also trigger recomposition. File events received during a configuration transaction are processed afterward. Include refreshes and profile reconciliation reach plugins through ordinary Loader entry updates; Loader commits volatile-only changes in place.
 
 App-boot owns profile parsing and patch precedence. HMR reads the launcher’s data-only `profileContext`, registers the profile manifest and both user patch watches during initialization, and waits for application readiness before processing changes. Its disposal closes the watchers and cancels reloads waiting for startup. Configuration watchers start outside the active transaction context so later notifications can enter the queue.
 
diff --git a/packages/boot/hmr/README.zh.md b/packages/boot/hmr/README.zh.md
index 9fb05b544e..21044fe7d1 100644
--- a/packages/boot/hmr/README.zh.md
+++ b/packages/boot/hmr/README.zh.md
@@ -56,7 +56,7 @@ HMR 的 profile 监听和 Plugin Manager 执行的 profile 重新组合，还会
 <details>
 <summary>实现细节——点击展开</summary>
 
-`watchConfig()` 注册会被等待的配置处理器，仅监听目标路径及必要的父目录；同级文件（包括临时写锁）在创建原生 watcher 前即被排除。`runExclusive()` 将配置变更、Loader 更新与自动重载串行化，并拒绝嵌套事务。可选 `signal` 只取消尚未开始的排队操作；已经开始的操作仍会执行完毕，队列才继续。包安装和删除在该队列之外执行。HMR 不获取包操作写锁；manifest 通知仅在有序的 `dsh.profile.bundles` 列表变化时触发重载。profile 与 home patch 变化也会触发重新组合。配置事务期间收到的文件事件在事务结束后处理。 Include 刷新和 profile 重载都通过普通的 Loader 条目更新到达插件；仅 volatile 变化由 Loader 就地提交。
+`watchConfig()` 注册会被等待的配置处理器，仅监听目标路径及必要的父目录；同级文件（包括临时写锁）在创建原生 watcher 前即被排除。`runExclusive()` 将配置变更、Loader 更新与自动重载串行化，并拒绝嵌套事务。包安装和删除在该队列之外执行。HMR 不获取包操作写锁；manifest 通知仅在有序的 `dsh.profile.bundles` 列表变化时触发重载。profile 与 home patch 变化也会触发重新组合。配置事务期间收到的文件事件在事务结束后处理。 Include 刷新和 profile 重载都通过普通的 Loader 条目更新到达插件；仅 volatile 变化由 Loader 就地提交。
 
 App-boot 负责 profile 解析和 patch 优先级规则。HMR 读取启动器提供的纯数据 `profileContext`，在初始化时注册 profile manifest 和两份用户 patch 的监听，并等待应用就绪后处理更改。销毁 HMR 时会关闭监听器并取消等待启动的重载。配置监听器在当前事务上下文之外启动，使后续通知可以进入队列。
 
diff --git a/packages/boot/hmr/src/index.ts b/packages/boot/hmr/src/index.ts
index 961bf34e1a..e5c113db7b 100644
--- a/packages/boot/hmr/src/index.ts
+++ b/packages/boot/hmr/src/index.ts
@@ -263,25 +263,16 @@ class Hmr extends Service {
 
   /** Serialize a caller-owned mutation with all automatic reload paths.
    * @param operation Work that must not overlap module or configuration replacement.
-   * @param signal Cancel admission while queued; an operation already running must finish.
    * @returns The operation result after its asynchronous work completes.
    */
-  runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T> {
+  runExclusive<T>(operation: () => Promise<T>): Promise<T> {
     if (this.executing.getStore()) return Promise.reject(new Error('HMR transactions cannot be nested'))
-    // oxlint-disable-next-line typescript/prefer-promise-reject-errors -- Preserve the caller's arbitrary AbortSignal reason.
-    if (signal?.aborted) return Promise.reject(signal.reason)
-    const result = Promise.withResolvers<T>()
-    const cancel = () => { result.reject(signal?.reason) }
-    signal?.addEventListener('abort', cancel, { once: true })
     const task = this.operations.then(async () => {
-      signal?.removeEventListener('abort', cancel)
-      signal?.throwIfAborted()
       if (this.closing) throw new Error('HMR is disposed')
       return this.executing.run(true, operation)
     })
     this.operations = task.catch(() => {})
-    void task.then(result.resolve, result.reject)
-    return result.promise
+    return task
   }
 
   private runReload(operation: () => Promise<void>): Promise<void> {
diff --git a/packages/boot/hmr/tests/coordination.spec.ts b/packages/boot/hmr/tests/coordination.spec.ts
index a3ade63286..b3660828e9 100644
--- a/packages/boot/hmr/tests/coordination.spec.ts
+++ b/packages/boot/hmr/tests/coordination.spec.ts
@@ -59,25 +59,6 @@ it('serializes mutations, rejects nesting and keeps the queue usable after failu
   expect(order).toEqual([1, 2])
 })
 
-it('cancels queued mutations without cancelling an admitted transaction', async () => {
-  const { hmr } = await fixture()
-  const release = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
-  onTestFinished(() => { release.resolve(undefined) })
-  const running = new AbortController(), waiting = new AbortController()
-  const first = hmr.runExclusive(async () => { entered.resolve(undefined); await release.promise; return 'committed' }, running.signal)
-  await entered.promise
-  const operation = vi.fn(async () => 'unwanted')
-  const cancelled = hmr.runExclusive(operation, waiting.signal)
-  waiting.abort(new Error('owner unloaded'))
-  running.abort(new Error('too late to cancel admission'))
-  await expect(cancelled).rejects.toThrow('owner unloaded')
-  await expect(hmr.runExclusive(operation, waiting.signal)).rejects.toThrow('owner unloaded')
-  release.resolve(undefined)
-  await expect(first).resolves.toBe('committed')
-  await hmr.runExclusive(async () => {})
-  expect(operation).not.toHaveBeenCalled()
-})
-
 it('holds configuration handlers behind configuration mutations', async () => {
   const { hmr, dir } = await fixture()
   const filename = join(dir, 'package.json')
diff --git a/packages/experimental/client-ui-cua/README.i18n.yaml b/packages/experimental/client-ui-cua/README.i18n.yaml
index caf834fb6a..ec4c14b523 100644
--- a/packages/experimental/client-ui-cua/README.i18n.yaml
+++ b/packages/experimental/client-ui-cua/README.i18n.yaml
@@ -12,14 +12,14 @@
   en: 4e62e511b5d14986
   zh: 1fce04dbad7515f7
 /deepseek-ai-dsh-client-ui-cua/table-of-contents:
-  en: 1a1d0bf8154bf602
-  zh: c6d8b33e1bac3206
+  en: 3ea778e9b27756c4
+  zh: 30546f132a77d94d
 /deepseek-ai-dsh-client-ui-cua/use-this-package:
   en: 7bf328334f27968f
   zh: 4d68b54f049497d4
 /deepseek-ai-dsh-client-ui-cua/understand-the-implementation:
-  en: d6cf7f20c568ba15
-  zh: 6cfc962d8f787086
+  en: 43b9245a9d9b2262
+  zh: ae25ea17010d99b3
 /deepseek-ai-dsh-client-ui-cua/further-exploration:
   en: f0fde9f736ade61a
   zh: 43a534a21bcc1c13
diff --git a/packages/experimental/client-ui-cua/README.md b/packages/experimental/client-ui-cua/README.md
index 9007e5fe0a..3c5620687c 100644
--- a/packages/experimental/client-ui-cua/README.md
+++ b/packages/experimental/client-ui-cua/README.md
@@ -20,7 +20,7 @@ Open Computer Use in Plugins to check Accessibility and Screen Recording, reques
 - [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
 - [Dev Note](#dev-note)
 
-Application permission prompts and permission-page lists show native icons and application names. Paths remain available on hover. Icons are presentation metadata and are never saved with grants. This plugin registers the application-approval presentation in the existing composer chain and reuses the shared approval card. The pending question still owns waiting, cancellation and answers. The prompt offers session access, refusal and, for verifiable applications with writable settings, persistent access.
+Application permission prompts and permission-page lists show native icons and application names. Paths remain available on hover. Icons are presentation metadata and are never saved with grants. This plugin registers the application-approval presentation in the existing composer chain and reuses the shared approval card. The pending question still owns waiting, cancellation and answers. The prompt offers session access, refusal and, for verifiable applications with durable profile storage, persistent access.
 
 -----
 
@@ -45,7 +45,7 @@ This plugin has no configurable fields.
 <details>
 <summary>Implementation internals</summary>
 
-The optional browser contribution mounts the native provider's permission Remote and reuses the Plugins activation and configuration slots. The four setup rows remain visible while unknown fields use placeholders. The default-mode form, runtime configuration, system checks, application decisions, and application icons fill in as each query completes. Application names and actions do not wait for icons; icon positions retain their space. User actions run in order without waiting for pending observation queries. Disposal waits for both actions and queries to settle before releasing the separately owned Remote mount. Query errors stay with the affected section, and activation guidance depends only on system checks. Plugin Manager’s pending state pauses observation during bundle changes and resumes it afterward; late results from the previous activation are discarded. One controller projects queries into the page and setup dialog; reconnects and updates to the Host-reported settings namespace refresh it. Operation notices live in the shell overlay, so closing the page does not remove them. The provider owns permission checks, persisted decisions, and cancellation; the browser owns no authorization state.
+The optional browser contribution mounts the native provider's permission Remote and reuses the Plugins activation and configuration slots. The four setup rows remain visible while unknown fields use placeholders. The default-mode form, runtime configuration, system checks, application decisions, and application icons fill in as each query completes. Application names and actions do not wait for icons; icon positions retain their space. User actions run in order without waiting for pending observation queries. Disposal waits for both actions and queries to settle before releasing the separately owned Remote mount. Query errors stay with the affected section, and activation guidance depends only on system checks. Plugin Manager’s pending state pauses observation during bundle changes and resumes it afterward; late results from the previous activation are discarded. One controller projects queries into the page and setup dialog; reconnects refresh it. Page entry, focus and completed actions read the current permission store. Operation notices live in the shell overlay, so closing the page does not remove them. The provider owns permission checks, persisted decisions, and cancellation; the browser owns no authorization state.
 
 The detail page reads the effective default (`selectedDefault ?? default`) from the existing `configForms` service. The default button writes only `selectedDefault` through the form's revision-checked settings path. The execution-mode row uses CUA's `ptcConfiguration()` and `enablePersistentPtc()` controls: the Host edits only `ptc-runtime.executionMode` through the existing configuration editor, preserving its ordinary Loader reload lifecycle. Permission checks and runtime state settle independently. Loading, read-only and unavailable settings cannot submit a change; a failed write remains beside the setting for retry.
 
diff --git a/packages/experimental/client-ui-cua/README.zh.md b/packages/experimental/client-ui-cua/README.zh.md
index 168c2f206e..b35c7a49d4 100644
--- a/packages/experimental/client-ui-cua/README.zh.md
+++ b/packages/experimental/client-ui-cua/README.zh.md
@@ -20,7 +20,7 @@ kind: "package-reference"
 - [已知限制与后续工作](#known-limitations-and-deferred-work)
 - [开发备注](#dev-note)
 
-应用授权提示和权限页列表显示本机图标与应用名称，悬停可查看列表中的路径。图标仅用于展示，不随授权保存。本插件通过现有 composer 注册应用审批呈现，复用共用审批卡片，等待、取消和回答仍由原待答问题负责。提示提供本会话允许和拒绝；应用签名可验证且配置可写时，还提供始终允许。
+应用授权提示和权限页列表显示本机图标与应用名称，悬停可查看列表中的路径。图标仅用于展示，不随授权保存。本插件通过现有 composer 注册应用审批呈现，复用共用审批卡片，等待、取消和回答仍由原待答问题负责。提示提供本会话允许和拒绝；应用签名可验证且 profile 持久存储可用时，还提供始终允许。
 
 -----
 
@@ -45,7 +45,7 @@ kind: "package-reference"
 <details>
 <summary>实现细节</summary>
 
-可选浏览器插件挂载原生 provider 的权限 Remote，复用插件页的启用引导和配置插槽。四排使用条件始终可见，未加载的字段保留占位。默认模式、执行方式、系统权限、应用列表和应用图标分别查询，结果返回后各自显示。应用名称和操作按钮不等待图标，图标位置保留空位。用户操作按顺序执行，不等待尚未完成的查询；卸载时等待操作和查询全部结束，再释放独立持有的 Remote 挂载。查询错误只显示在对应部分，启用引导只等待系统权限结果。面板复用插件管理器的忙碌状态，在启停期间暂停查询，完成后再刷新；上一次启用期间的迟到结果会被丢弃。一个控制器把查询结果投影到页面和设置弹窗；重新连接或 Host 返回的配置 namespace 更新时刷新状态。操作提示挂载到 shell overlay，关闭页面后仍可显示。provider 负责权限检查、持久授权和取消；浏览器不保存授权决定。
+可选浏览器插件挂载原生 provider 的权限 Remote，复用插件页的启用引导和配置插槽。四排使用条件始终可见，未加载的字段保留占位。默认模式、执行方式、系统权限、应用列表和应用图标分别查询，结果返回后各自显示。应用名称和操作按钮不等待图标，图标位置保留空位。用户操作按顺序执行，不等待尚未完成的查询；卸载时等待操作和查询全部结束，再释放独立持有的 Remote 挂载。查询错误只显示在对应部分，启用引导只等待系统权限结果。面板复用插件管理器的忙碌状态，在启停期间暂停查询，完成后再刷新；上一次启用期间的迟到结果会被丢弃。一个控制器把查询结果投影到页面和设置弹窗；重新连接时刷新状态。进入页面、返回窗口和完成操作后都会读取当前授权记录。操作提示挂载到 shell overlay，关闭页面后仍可显示。provider 负责权限检查、持久授权和取消；浏览器不保存授权决定。
 
 详情页通过现有 `configForms` 服务读取实际默认值（`selectedDefault ?? default`）。默认模式按钮仅写入 `selectedDefault`，沿用表单带版本检查的设置写入流程。执行方式一行调用 CUA 的 `ptcConfiguration()` 和 `enablePersistentPtc()`：Host 通过现有配置编辑器仅修改 `ptc-runtime.executionMode`，保留普通 Loader 重载规则。权限检查和执行方式状态独立返回。设置仍在加载、只读或不可用时不能提交；写入失败时在设置旁显示错误，供用户重试。
 
diff --git a/packages/experimental/client-ui-cua/src/client/mount.ts b/packages/experimental/client-ui-cua/src/client/mount.ts
index 634040e82d..0cd17df577 100644
--- a/packages/experimental/client-ui-cua/src/client/mount.ts
+++ b/packages/experimental/client-ui-cua/src/client/mount.ts
@@ -75,9 +75,6 @@ export async function mountCuaPermissions(ctx: Context, contribution: TypertRemo
     }
     ctx.effect(() => () => controller.dispose())
     ctx.on('connection/reset', face.refresh)
-    ctx.effect(() => ctx.remote.$on('settings/document-updated', (namespace) => {
-      if (namespace === controller.state.getSnapshot().applications.value?.settingsNamespace) face.refresh()
-    }))
     ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
       name: 'plugins.bundle.config', key: '@deepseek-ai/dsh-cua-bundle', locale: NS, inject: () => settings,
     }, PermissionPanel))
diff --git a/packages/experimental/client-ui-cua/tests/controller.client.spec.ts b/packages/experimental/client-ui-cua/tests/controller.client.spec.ts
index e9a07594e3..78c2ffb0cd 100644
--- a/packages/experimental/client-ui-cua/tests/controller.client.spec.ts
+++ b/packages/experimental/client-ui-cua/tests/controller.client.spec.ts
@@ -6,7 +6,7 @@ import { PermissionController } from '../src/client/controller.ts'
 
 const value: CuaSystemPermissionState = { accessibility: true, screenRecording: false, helper: { pid: 9 }, parent: { pid: 8 } }
 const applications: CuaApplicationState = {
-  allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+  allowedApps: [], blockedApps: [], persistentAvailable: true }
 function fixture() {
   const actions = {
     readRuntime: vi.fn(async () => ({ persistent: false, writable: true })),
diff --git a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
index 77ed4d1c10..947807077c 100644
--- a/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
+++ b/packages/experimental/client-ui-cua/tests/mount.client.spec.ts
@@ -16,7 +16,7 @@ import type { ApplicationApprovalProps } from '../src/client/ApplicationApproval
 const contribution: TypertRemoteContribution = { package: '@deepseek-ai/dsh-cua', descriptors: [] }
 const value: CuaApplicationState & { system: CuaSystemPermissionState } = {
   system: { accessibility: false, screenRecording: false, helper: { pid: 2 }, parent: { pid: 1 } },
-  allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+  allowedApps: [], blockedApps: [], persistentAvailable: true }
 
 function actionsOf(value: Record<string, unknown>): asserts value is Record<string, unknown> & PermissionFace {
   assert(typeof value.setActive === 'function')
@@ -27,8 +27,7 @@ function actionsOf(value: Record<string, unknown>): asserts value is Record<stri
 }
 
 async function fixture(fail = false) {
-  const ctx = new Context(), unmount = vi.fn(async () => {}), unsubscribe = vi.fn()
-  let settingsListener: ((namespace: string, revision: number) => void) | undefined
+  const ctx = new Context(), unmount = vi.fn(async () => {})
   class Remote extends Service {
     constructor() { super(ctx, 'remote') }
     async $mount(received: TypertRemoteContribution) {
@@ -36,7 +35,6 @@ async function fixture(fail = false) {
       const owned = this.ctx.effect(() => unmount)
       return () => owned()
     }
-    $on(_event: string, listener: (namespace: string, revision: number) => void) { settingsListener = listener; return unsubscribe }
   }
   new Remote()
   const setDefault = vi.fn(async () => true)
@@ -68,9 +66,8 @@ async function fixture(fail = false) {
     'conversation.composer': { kind: 'chain', scope: 'session' },
   } } as never, () => null)
   if (fail) vi.spyOn(ctx.slots, 'inject').mockImplementationOnce(() => { throw new Error('slot unavailable') })
-  return { ctx, unmount, unsubscribe, status, systemStatus, applicationIcons,
+  return { ctx, unmount, status, systemStatus, applicationIcons,
     requestPermission, openSettings, revoke, retryApproval, setDefault, setPersistent, runtimeConfiguration,
-    updateSettings(namespace: string) { settingsListener!(namespace, 1) },
   }
 }
 
@@ -141,7 +138,6 @@ it('withdraws the permission Remote and all controls with the optional plugin',
     expect(f.ctx.slots.entries('conversation.composer')).toHaveLength(0)
     expect(f.ctx.slots.entries('plugins.bundle.config')).toHaveLength(0)
     expect(f.ctx.slots.entries('shell.overlay')).toHaveLength(0)
-    expect(f.unsubscribe).toHaveBeenCalledOnce()
     expect(f.unmount).toHaveBeenCalledOnce()
   } finally { await f.ctx.fiber.dispose() }
 })
@@ -181,22 +177,11 @@ it.each(['plugin', 'root'])('keeps the Remote mounted until an accepted revoke c
   }
 })
 
-it('refreshes only the settings namespace reported by the permission owner', async () => {
+it('refreshes application storage on reconnect', async () => {
   const f = await fixture()
-  f.status.mockResolvedValue({ ok: true, value: { ...value, settingsNamespace: 'custom-cua-entry' } })
   try {
     await f.ctx.plugin({ inject: [...inject], apply: ctx => mountCuaPermissions(ctx, contribution) })
-    const actions = f.ctx.slots.entries('plugins.bundle.config')[0]!.inject!()
-    actionsOf(actions)
-    f.updateSettings('locale')
-    expect(f.status).not.toHaveBeenCalled()
-    actions.refresh()
-    await vi.waitFor(() => { expect(actions.hooks.cuaPermissions.getSnapshot().busy).toBe(false) })
-    expect(f.status).toHaveBeenCalledOnce()
-    f.updateSettings('cua')
-    f.updateSettings('locale')
-    expect(f.status).toHaveBeenCalledOnce()
-    f.updateSettings('custom-cua-entry')
-    await vi.waitFor(() => { expect(f.status).toHaveBeenCalledTimes(2) })
+    f.ctx.emit('connection/reset')
+    await vi.waitFor(() => { expect(f.status).toHaveBeenCalledOnce() })
   } finally { await f.ctx.fiber.dispose() }
 })
diff --git a/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
index 86ce6d8b75..0b17aa0676 100644
--- a/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
+++ b/packages/experimental/client-ui-cua/tests/panel.client.spec.tsx
@@ -13,7 +13,7 @@ import { en, zh } from '../src/client/locales.ts'
 afterEach(() => { cleanup(); vi.useRealTimers() })
 const value: CuaApplicationState & { system: CuaSystemPermissionState } = { system: { accessibility: false, screenRecording: true,
   helper: { pid: 9, path: '/native/helper' }, parent: { pid: 8, path: '/host/node' } },
-allowedApps: [], blockedApps: [], settingsNamespace: 'cua', persistentAvailable: true }
+allowedApps: [], blockedApps: [], persistentAvailable: true }
 
 function observe(value: CuaApplicationState & { system: CuaSystemPermissionState }) {
   return { system: { value: value.system, busy: false, error: null },
diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
index cc4a8a0810..a16c0b9afb 100644
--- a/packages/experimental/cua-bundle/README.i18n.yaml
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: b563e4ec4727d0de
   zh: d0228da978238e05
 /deepseek-ai-dsh-cua-bundle/use-this-package:
-  en: dfbc7b6cef715c99
-  zh: 973a18c78cfa7dd6
+  en: 0e0d77615d168483
+  zh: 29ddf3d328670699
 /deepseek-ai-dsh-cua-bundle/understand-the-implementation:
   en: 8cf76d5bc5ab785b
   zh: 18d24f49fe8fa14f
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
index c76171d884..a4b00691ee 100644
--- a/packages/experimental/cua-bundle/README.md
+++ b/packages/experimental/cua-bundle/README.md
@@ -41,7 +41,7 @@ Computer Use is available only on a macOS DSH Host. Other Hosts refuse enablemen
 
 If preparation fails, the saved selection remains, while CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
 
-Explicit activation runs a read-only permission check, which may start a helper without opening a system dialog. Open the [permission page](../client-ui-cua/README.md) for system requests, settings navigation and automatic refresh. Tasks ask separately before accessing an application. Saved application decisions use the existing profile configuration; session decisions remain in memory across turns and connections until DSH restarts or Computer Use is disabled. Revoke access on the same page.
+Explicit activation runs a read-only permission check, which may start a helper without opening a system dialog. Open the [permission page](../client-ui-cua/README.md) for system requests, settings navigation and automatic refresh. Tasks ask separately before accessing an application. Saved application decisions use profile-scoped domain storage. Conversation decisions survive turns, connections, DSH restarts and Computer Use disablement without applying to another conversation. Revoke access on the same page.
 
 -----
 
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
index f8ef2726e9..d8a91195a9 100644
--- a/packages/experimental/cua-bundle/README.zh.md
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -41,7 +41,7 @@ Computer Use 仅支持 macOS DSH Host。其他 Host 会在保存设置前拒绝
 
 准备失败时，已保存的选择和 PTC 设置保留，CUA 操作暂不可用。刷新或重新打开插件页查看组件诊断，修复后重启 DSH。
 
-显式启用会进行只读权限检查，可能启动 helper，但不会打开系统授权弹窗。[权限页面](../client-ui-cua/README.zh.md) 提供系统申请入口、设置跳转和自动检测。任务访问应用前会单独询问用户。长期应用授权保存在现有 profile 配置中，会话授权保存在内存中，跨 turn 和连接复用，重启 DSH 或关闭 Computer Use 后失效。可以在同一页面撤销授权。
+显式启用会进行只读权限检查，可能启动 helper，但不会打开系统授权弹窗。[权限页面](../client-ui-cua/README.zh.md) 提供系统申请入口、设置跳转和自动检测。任务访问应用前会单独询问用户。应用授权保存在按 profile 隔离的存储域中。会话授权跨 turn、连接、DSH 重启和 Computer Use 启停保留，只在原对话中生效。可以在同一页面撤销授权。
 
 -----
 
diff --git a/packages/experimental/cua-macos/README.i18n.yaml b/packages/experimental/cua-macos/README.i18n.yaml
index 2515976f52..fd95598dbc 100644
--- a/packages/experimental/cua-macos/README.i18n.yaml
+++ b/packages/experimental/cua-macos/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 867d9ec544719acf
   zh: 92348599582dc33a
 /deepseek-ai-dsh-experimental-cua-macos/use-this-package:
-  en: 107cc4d4e72e248d
-  zh: 1aec124d4018d2a4
+  en: 260410d37cd84ee4
+  zh: f1cc8a665f33e658
 /deepseek-ai-dsh-experimental-cua-macos/use-this-package/connect-an-external-execution-environment:
   en: e7909c9b43e44fbc
   zh: 98949877d4ea3a86
diff --git a/packages/experimental/cua-macos/README.md b/packages/experimental/cua-macos/README.md
index 02ccc35e71..2ee4c3418a 100644
--- a/packages/experimental/cua-macos/README.md
+++ b/packages/experimental/cua-macos/README.md
@@ -43,7 +43,7 @@ The dump command checks profile composition without a model request. For a real
 | Field | Default | Meaning |
 | --- | --- | --- |
 | `agentPreset` | `ptc` | Register tools and guidance only for Agents bound to this preset; `false` registers globally. |
-| `allowedApps` | `[]` | Live profile-local application consent, keyed by executable path and verified signing requirement. |
+| `allowedApps` | `[]` | Legacy signed grants, imported once into profile-scoped storage. |
 | `helperPath` | package-owned executable | Optional absolute native executable override. |
 | `buildTimeoutMs` | `300000` | Maximum native preparation time. |
 | `timeoutMs` | `30000` | Per-operation deadline; cancellation can leave partial input. |
@@ -65,7 +65,7 @@ Keypad names (`KP_0` through `KP_9`, `KP_Enter`, and keypad operators) retain th
 
 Agent disposal and plugin unload cancel and await the complete tool call, including image admission and attachment storage. An image write already in progress must settle before disposal returns; a canceled call cannot return a successful screenshot.
 
-Application consent is enforced before AX reads, window-title reads, screenshots, activation, and input through the CUA tool. The first selection asks the human for session access, denial, or saved access when the application has a verifiable signature. Session access is kept in memory by session and application identity, survives agent and helper replacement, and expires when DSH restarts or Computer Use is disabled. Signed application identities combine the canonical executable path and designated code-signing requirement; unverifiable applications remain bound to their process instance. Denial prevents repeated prompts in that session. Revocation reads and removes saved access in the same queue as grant creation, invalidates each affected Agent connection, and awaits its native cleanup without replaying input. Every app handle on those Agent connections becomes unusable; other applications need fresh selection, but their session and saved grants remain reusable. See the [application consent decision](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md). These checks govern CUA calls; persistent PTC and separately authorized shell tools are not an operating-system sandbox.
+Application consent is enforced before AX reads, window-title reads, screenshots, activation, and input through the CUA tool. The first selection asks the human for session access, denial, or saved access when the application has a verifiable signature. Session access is stored by conversation and application identity and survives DSH restart and Computer Use disablement. Other conversations require their own consent. Signed application identities combine the canonical executable path and designated code-signing requirement; unverifiable applications remain bound to their process instance. Denial prevents repeated prompts in that session. Revocation reads and removes saved access in the same queue as grant creation, invalidates each affected Agent connection, and awaits its native cleanup without replaying input. Every app handle on those Agent connections becomes unusable; other applications need fresh selection, but their session and saved grants remain reusable. See the [application consent decision](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.md). These checks govern CUA calls; persistent PTC and separately authorized shell tools are not an operating-system sandbox.
 
 Raw `getState` exposes validated state fields and the complete text for the requested disclosure options. The native helper also returns structured element diagnostics for native checks; the tool projection omits that duplicate array from model text and structured tool values.
 
diff --git a/packages/experimental/cua-macos/README.zh.md b/packages/experimental/cua-macos/README.zh.md
index eb996f3616..09b150c7cc 100644
--- a/packages/experimental/cua-macos/README.zh.md
+++ b/packages/experimental/cua-macos/README.zh.md
@@ -43,7 +43,7 @@ pnpm dsh headless --patch packages/experimental/cua-macos/examples/macos.cordis.
 | 字段 | 默认值 | 含义 |
 | --- | --- | --- |
 | `agentPreset` | `ptc` | 仅为绑定该 preset 的 Agent 注册工具和指引；`false` 表示全局注册。 |
-| `allowedApps` | `[]` | 当前配置档的动态应用授权，绑定可执行文件路径和已验证的代码签名要求。 |
+| `allowedApps` | `[]` | 旧的已签名应用许可，只导入 profile 存储一次。 |
 | `helperPath` | 包内可执行文件 | 可选的原生可执行文件绝对路径覆盖。 |
 | `buildTimeoutMs` | `300000` | 原生组件准备的最长时间。 |
 | `timeoutMs` | `30000` | 单次操作截止时间，取消后可能已发生部分输入。 |
@@ -65,7 +65,7 @@ pnpm dsh headless --patch packages/experimental/cua-macos/examples/macos.cordis.
 
 Agent 销毁和插件卸载会取消并等待完整工具调用，包括图像接入检查和附件存储。已经开始的图像写入必须结束后，销毁才会返回；已取消的调用不会返回成功截图。
 
-CUA 工具在读取 AX、窗口标题、截图、激活和输入前检查应用授权。首次选择应用时询问用户，可选择本会话允许、拒绝；签名可验证的应用还可保存长期授权。会话许可按会话和应用身份保存在内存中，Agent 或 helper 重建后仍可复用，重启 DSH 或关闭 Computer Use 后失效。已签名应用的身份由规范化可执行文件路径和代码签名指定要求组成；签名不可验证的应用仍绑定进程实例。拒绝后，同一会话不会反复询问。撤销与长期许可的保存共用队列，在队列内读取并移除许可，然后使相关 Agent 连接失效并等待原生清理完成，不自动重放输入。同一 Agent 连接中的其他应用也需要重新选择，其他应用的会话许可和长期许可仍可复用。设计理由见[应用授权决策](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md)。这些检查的范围是 CUA 调用。persistent PTC 与已授权的 shell 仍按各自执行权限运行。
+CUA 工具在读取 AX、窗口标题、截图、激活和输入前检查应用授权。首次选择应用时询问用户，可选择本会话允许、拒绝；签名可验证的应用还可保存长期授权。会话许可按对话和应用身份持久化，重启 DSH 或关闭 Computer Use 后仍可复用，其他对话需要单独授权。已签名应用的身份由规范化可执行文件路径和代码签名指定要求组成；签名不可验证的应用仍绑定进程实例。拒绝后，同一会话不会反复询问。撤销与长期许可的保存共用队列，在队列内读取并移除许可，然后使相关 Agent 连接失效并等待原生清理完成，不自动重放输入。同一 Agent 连接中的其他应用也需要重新选择，其他应用的会话许可和长期许可仍可复用。设计理由见[应用授权决策](../../../.agents/notes/implemented/architecture/2026-09-26-cua-application-consent.zh.md)。这些检查的范围是 CUA 调用。persistent PTC 与已授权的 shell 仍按各自执行权限运行。
 
 原始 `getState` 操作返回经过校验的状态字段，以及按本次披露选项生成的完整文本。原生 helper 还返回供原生检查使用的结构化元素诊断数组；工具投影会从模型文本和结构化工具值中移除这份重复数组。
 
diff --git a/packages/experimental/cua-macos/package.json b/packages/experimental/cua-macos/package.json
index 03d3f568e2..31f7c1bf10 100644
--- a/packages/experimental/cua-macos/package.json
+++ b/packages/experimental/cua-macos/package.json
@@ -80,7 +80,10 @@
     "@deepseek-ai/dsh-app-boot": "workspace:*",
     "@deepseek-ai/dsh-config-editor": "workspace:*",
     "@deepseek-ai/dsh-hmr": "workspace:*",
-    "@deepseek-ai/cordis-plugin-timer": "workspace:~"
+    "@deepseek-ai/cordis-plugin-timer": "workspace:~",
+    "@deepseek-ai/dsh-storage": "workspace:*",
+    "@deepseek-ai/dsh-storage-json": "workspace:*",
+    "@deepseek-ai/dsh-storage-domain": "workspace:*"
   },
   "scripts": {
     "build:native": "swift build --package-path native --configuration release"
diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index b1628ed917..dfdef7bfde 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -1,5 +1,5 @@
 /** Native helper replacement is synchronized with Agent and provider disposal. */
-import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
@@ -10,6 +10,9 @@ import Timer from '@deepseek-ai/cordis-plugin-timer'
 import { initProfile, mountRootInclude, readProfilePatches, type ProfileContext } from '@deepseek-ai/dsh-app-boot'
 import ConfigEditor from '@deepseek-ai/dsh-config-editor'
 import Settings from '@deepseek-ai/dsh-settings'
+import Storage from '@deepseek-ai/dsh-storage'
+import * as StorageJson from '@deepseek-ai/dsh-storage-json'
+import * as StorageDomain from '@deepseek-ai/dsh-storage-domain'
 import Hmr from '@deepseek-ai/dsh-hmr'
 import { mountAgentLoopTestDependencies, mountAgentLoopTestHarness } from '@deepseek-ai/dsh-agent-loop-testkit'
 import ComputerUseRegistry from '@deepseek-ai/dsh-computer-use'
@@ -109,7 +112,7 @@ async function selectApplication(f: Awaited<ReturnType<typeof setup>>) {
 it('rejects a relative helper path before publishing computer-use operations', async () => {
   const ctx = new Context()
   onTestFinished(() => ctx.fiber.dispose())
-  await expect(NativeProvider.apply(ctx, { ...config, allowedApps: { get: () => [] }, helperPath: 'relative-helper' })).rejects.toThrow('helperPath must be absolute')
+  await expect(NativeProvider.apply(ctx, { ...config, allowedApps: [], helperPath: 'relative-helper' })).rejects.toThrow('helperPath must be absolute')
 })
 
 it.each(['Allow for this session', 'Deny'])('obtains %s before a stopped application can launch', async (choice) => {
@@ -576,7 +579,7 @@ it('prepares the selected native component before registering CUA and creates no
   const f = await setup()
   await f.provider.dispose()
   native.prepare.mockReset().mockResolvedValue(resolve('prepared-helper'))
-  await NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: { get: () => [] } })
+  await NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: [] })
   expect(native.prepare).toHaveBeenCalledTimes(1)
   expect(native.instances).toHaveLength(0)
   await f.execute()
@@ -625,7 +628,7 @@ it('waits for canceled preparation and never publishes its late success', async
   const ready = Promise.withResolvers<string>()
   onTestFinished(() => { ready.resolve(resolve('late-helper')) })
   native.prepare.mockReset().mockReturnValue(ready.promise)
-  const starting = Promise.resolve(NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: { get: () => [] } }))
+  const starting = Promise.resolve(NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: [] }))
   const failed = expect(starting).rejects.toThrow()
   const signal = native.prepare.mock.calls[0]![0].signal
   const aborted = new Promise<void>((resolve) => {
@@ -648,12 +651,12 @@ it('rejects an unsupported native host before starting preparation', async () =>
   await f.provider.dispose()
   native.architecture.mockImplementationOnce(() => { throw new Error('unsupported host') })
   native.prepare.mockReset()
-  await expect(NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: { get: () => [] } })).rejects.toThrow('unsupported host')
+  await expect(NativeProvider.apply(f.ctx, { ...automaticConfig, allowedApps: [] })).rejects.toThrow('unsupported host')
   expect(native.prepare).not.toHaveBeenCalled()
 })
 
 
-async function permissionProfile() {
+async function permissionProfile(allowedApps: Array<{ id: string; name: string; executablePath: string }> = []) {
   const f = await setup()
   await f.provider.dispose()
   const home = await mkdtemp(join(tmpdir(), 'cua-grant-profile-')), dir = join(home, 'profile')
@@ -664,7 +667,7 @@ async function permissionProfile() {
   await writeFile(join(home, 'package.json'), '{"name":"test-installation"}\n')
   await writeFile(join(bundle, 'package.json'), JSON.stringify({ name: 'permission-fixture-bundle', version: '1.0.0',
     dsh: { bundle: { patch: 'cordis.patch.yml' } } }))
-  await writeFile(join(bundle, 'cordis.patch.yml'), JSON.stringify([{ insert: [{ id: 'cua', name: 'cordis:cua', config }] }]))
+  await writeFile(join(bundle, 'cordis.patch.yml'), JSON.stringify([{ insert: [{ id: 'cua', name: 'cordis:cua', config: { ...config, allowedApps } }] }]))
   await writeFile(join(dir, 'cordis.yml'), '[]\n')
   const profile: ProfileContext = { name: 'test', startedBundles: ['permission-fixture-bundle'], dir,
     patchPath: join(dir, 'cordis.patch.yml'), installAnchor: join(home, 'package.json'), cwd: home, home,
@@ -675,11 +678,14 @@ async function permissionProfile() {
   await f.ctx.plugin(Loader)
   f.ctx.loader.builtins.cua = NativeProvider
   await f.ctx.plugin(ConfigEditor)
+  await f.ctx.plugin(Storage)
+  await f.ctx.plugin(StorageJson, { root: join(home, 'storages') })
+  await f.ctx.plugin(StorageDomain, { backend: 'json' })
   await mountRootInclude(f.ctx, join(dir, 'cordis.yml'), readProfilePatches('test', profile))
   await f.ctx.loader.await()
   native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
     : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
-  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
+  expect((await f.ctx.cuaAccess.applications()).persistentAvailable).toBe(true)
   await f.ctx.plugin(Settings)
   await f.ctx.plugin(Timer)
   await f.ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 })
@@ -687,62 +693,45 @@ async function permissionProfile() {
   return { ...f, profile }
 }
 
-it('cancels a queued grant write when the current HMR transaction unloads CUA', async () => {
-  const f = await permissionProfile()
+it('stores revocation without entering the HMR configuration queue', async () => {
   const grant = { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app' }
-  await f.ctx.settings.mutate('cua', [{ op: 'set', path: ['allowedApps'], value: [grant] }])
+  const f = await permissionProfile([grant])
   const before = await readFile(f.profile.patchPath, 'utf8')
-  const acquired = Promise.withResolvers<undefined>(), unload = Promise.withResolvers<undefined>()
-  const queued = Promise.withResolvers<undefined>()
-  onTestFinished(() => { unload.resolve(undefined) })
-  const mutate = f.ctx.settings.mutate.bind(f.ctx.settings)
-  const observe = vi.spyOn(f.ctx.settings, 'mutate').mockImplementation((...args) => {
-    const pending = mutate(...args)
-    queued.resolve(undefined)
-    return pending
-  })
-  onTestFinished(() => { observe.mockRestore() })
-  const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
-  const disabling = f.ctx.hmr.runExclusive(async () => {
-    acquired.resolve(undefined)
-    await unload.promise
-    await entry.update({ disabled: true })
-  })
+  const acquired = Promise.withResolvers<undefined>(), release = Promise.withResolvers<undefined>()
+  onTestFinished(() => { release.resolve(undefined) })
+  const blocked = f.ctx.hmr.runExclusive(async () => { acquired.resolve(undefined); await release.promise })
   await acquired.promise
-  const revoked = f.ctx.cuaAccess.revoke(grant.id as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
-  const rejected = expect(revoked).rejects.toThrow()
-  await queued.promise
-  unload.resolve(undefined)
-  await Promise.all([disabling, rejected])
-  await f.ctx.hmr.runExclusive(async () => {})
-  expect(entry.disabled).toBe(true)
+  await f.ctx.cuaAccess.revoke(grant.id as import('@deepseek-ai/dsh-cua/types').CuaApplicationId)
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
   expect(await readFile(f.profile.patchPath, 'utf8')).toBe(before)
+  release.resolve(undefined)
+  await blocked
+  const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
+  await entry.update({ disabled: true })
+  await entry.update({ disabled: false })
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
 })
 
-it('stores signed application consent in the current profile and refuses unavailable settings', async () => {
+it('stores signed application consent separately from configuration', async () => {
   const f = await permissionProfile(), { profile } = f
-  expect(f.ctx.settings.describe().find(row => row.ns === 'cua')?.autoGenerate).toBe(false)
+  expect(f.ctx.settings.describe().find(row => row.ns === 'cua')).toBeUndefined()
   await f.ctx.plugin(UserQuestions)
   f.ctx.on('user-questions/request', async () => ({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] }))
   const authorization = { id: 'a'.repeat(64), name: 'Fixture', executablePath: '/fixture/app', persistable: true }
   native.request.mockResolvedValue({ appHandle: 'signed-app', pid: 17, name: 'Fixture', authorization })
   expect((await f.execute('getApp', { selector: 'Fixture' })).isError).toBe(false)
-  expect(await readFile(profile.patchPath, 'utf8')).toContain(authorization.id)
+  expect(await readFile(profile.patchPath, 'utf8')).not.toContain(authorization.id)
+  const files = await readdir(join(profile.home, 'storages'))
+  const stored = files.find(file => file.startsWith('cua_permissions_'))!
+  expect(await readFile(join(profile.home, 'storages', stored), 'utf8')).toContain(authorization.id)
   native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
     : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
-  const permission = f.ctx.cuaAccess.applications()
+  const permission = await f.ctx.cuaAccess.applications()
   expect(permission.allowedApps).toHaveLength(1)
   await f.ctx.cuaAccess.revoke(permission.allowedApps[0]!.id)
-  expect(await readFile(profile.patchPath, 'utf8')).toContain('allowedApps: []')
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
   await f.ctx.cuaAccess.retryApproval(permission.allowedApps[0]!.id)
-  vi.spyOn(f.ctx.settings, 'describe').mockReturnValue([])
-  native.request.mockResolvedValue({ appHandle: 'signed-app', pid: 17, name: 'Fixture', authorization })
-  const unavailable = await f.execute('getApp', { selector: 'Fixture' })
-  expect(unavailable.isError).toBe(true)
-  expect(JSON.stringify(unavailable.content)).toContain('APP_ACCESS_DENIED')
-  native.request.mockImplementation(async (method: string) => method === 'applicationIcons' ? {}
-    : { accessibility: true, screenRecording: true, helper: { pid: 2 }, parent: { pid: 1 } })
-  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
+
 })
 
 it('rejects an application handle before any helper or consent has been acquired', async () => {
diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index 2595aa1a70..2140e30b24 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -15,14 +15,14 @@
   en: 400de8528e57cf00
   zh: 1eb88c23eb4b511f
 /deepseek-ai-dsh-cua/use-this-package:
-  en: 577e1b18dd220c73
-  zh: bde0692c6695d749
+  en: 33e2ce6748f23743
+  zh: 4c2f53e92231859f
 /deepseek-ai-dsh-cua/understand-the-implementation:
-  en: 727a4ec9b5cd1789
-  zh: 000a6a34b29e1008
+  en: c31e18d5f70c08f2
+  zh: 2a2925201bb924a9
 /deepseek-ai-dsh-cua/further-exploration:
-  en: b8b0aece886fadaa
-  zh: ecd8c88d601f2179
+  en: 166e3c1f9a67f753
+  zh: 698c5136c5350052
 /deepseek-ai-dsh-cua/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90
@@ -39,8 +39,8 @@
   en: 2d5df52dafa1d940
   zh: 06e815759b9150c3
 /deepseek-ai-dsh-cua/known-limitations-and-deferred-work:
-  en: ae98f1b2718b3b94
-  zh: e6bf4e96ae08e669
+  en: a4b9d44dec85b0d1
+  zh: 3a393e508397ecc2
 /deepseek-ai-dsh-cua/known-limitations-and-deferred-work/dev-note:
   en: 0a1253c6f7b5e8b9
   zh: 9f56528562c7c914
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index db6074eaad..ae9ece5c8a 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -35,7 +35,7 @@ Observation methods emit and return their result. Use `void await app.getAXState
 
 `tools.cua` returns operation values directly. Screenshot values retain the encoded image Base64 and add a durable `attachment` reference for the tool renderer; model content contains coordinate metadata and one image, without the encoded bytes. Before capture, the tool requires an attachment store and a resolved model route declaring image input. Admission and storage failures reject the call. The object bridge preserves the screenshot bytes and validated metadata without uploading or emitting the same image again.
 
-Application consent precedes launch, observation, capture, and input. Session access is kept in memory by session and application identity, survives agent and helper replacement, and expires when DSH restarts or Computer Use is disabled. Saved grants require platform-verified executable identity. Refusal and revocation close affected Agent connections, so their old objects require fresh selection. No input is replayed after cancellation, timeout, or reconnect.
+Application consent precedes launch, observation, capture, and input. Session access is stored by conversation and application identity and survives DSH restart and Computer Use disablement. Other conversations require their own consent. Saved grants require platform-verified executable identity. Refusal and revocation close affected Agent connections, so their old objects require fresh selection. No input is replayed after cancellation, timeout, or reconnect.
 
 Actions return `dispatched:true, verified:false`; read fresh state to verify the result. Coordinate actions default to pixels in the latest returned screenshot; `relative: true` accepts integers from 0 to 1000 after a successful window observation. The Host resolves attachment normalization and the selected model route’s image projection before returning the screenshot, then converts input to native window points. Resizing invalidates the screenshot mapping; `SCREENSHOT_REQUIRED` requires a new screenshot for absolute coordinates. Resizing rejects old coordinates with `WINDOW_CHANGED`; movement alone preserves window-local coordinates.
 
@@ -49,13 +49,17 @@ Actions return `dispatched:true, verified:false`; read fresh state to verify the
 <details>
 <summary>Shared execution and platform ownership</summary>
 
+The [permission store](src/permission-store.ts) uses `storageDomain` with the configured backend. The default JSON backend writes `$DSH_HOME/storages/cua_permissions_<sha256>.json`, where the digest identifies the canonical profile directory. Each authorized native operation opens fresh state under the profile's file lock and closes its domain afterward. Revocation waits for operations already admitted by another process; after it completes, every process rejects old handles. Files on different machines or PID namespaces must not share this lock.
+
+Legacy `allowedApps` are imported on first store access and never reapplied after migration. The old configuration can be removed after checking the permission page. Grants, denials and the option to ask again are durable; the page still omits conversation-only grants. Standalone compositions without a profile retain only process-local decisions; a profile without domain storage refuses authorization operations.
+
 The permission Remote also exposes `ptcConfiguration()` and `enablePersistentPtc()` for the detail-page runtime setting. Reads inspect the existing runtime and editable profile entry. Explicit writes use `configEditor.edit()` to preserve other fields and apply normal Loader reload; an already-persistent runtime is left intact. This setting is separate from system and application authorization.
 
 The provider calls [installCua](src/index.ts) with its prepared helper, connection factory, and guidance. [NativeClient](src/native-client.ts) owns request correlation, byte limits, cancellation acknowledgement, and failure settlement. The platform connector owns startup and connection cleanup. The shared executor retains one connection per Agent and joins in-flight image writes during disposal.
 
 `agentPreset` defaults to `ptc`, restricting tools and guidance to Agents bound to that preset. The provider uses the existing `agent/created` and `agent-preset/selected` events and Agent-owned scopes, including Agents already present when it loads. Provider unload and Agent disposal release those registrations. Preset definitions may register after the provider; a preset name filters bound Agents and supplies no tools until a matching Agent exists. Set `agentPreset: false` for global registration in standalone compositions without presets. The Host continues to own permissions, native connections and cancellation; preset definitions remain unchanged.
 
-[The operation schema](src/protocol.ts) is the authority for model parameters and separately declared Host-only fields. Native implementations enforce target identity, window geometry, resource limits, and operating-system access at execution. No invariant companion is published because this library has no separately projected registry or durable state.
+[The operation schema](src/protocol.ts) is the authority for model parameters and separately declared Host-only fields. Native implementations enforce target identity, window geometry, resource limits, and operating-system access at execution. The permission store owns durable consent separately from the native protocol.
 
 </details>
 
@@ -66,6 +70,7 @@ The provider calls [installCua](src/index.ts) with its prepared helper, connecti
 
 - [macOS provider](../cua-macos/README.md)
 - [Object interfaces](src/types.ts)
+- [Consent storage migration](../../../docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.md)
 
 -----
 
@@ -90,7 +95,7 @@ Results append to history. Retaining objects does not rewrite previous messages;
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- In-memory session decisions have no capacity limit or eviction. They remain until the provider unloads, so a long-running Host retains entries for every session/application pair that requested access.
+- Conversation decisions have no automatic retention limit or deletion when a conversation is removed. Revocation removes permission, while its generation remains to reject older handles and pending approvals.
 - Native execution currently uses the macOS provider. Windows support is planned as a separate provider package with a C# helper, retaining the shared app/window API, authorization, snapshot validity, and action-result semantics. Its implementation must document system-specific limitations and distinguish cross-compilation evidence from Windows desktop validation.
 - Persistent variables do not reserve an application across a sequence of operations. Other Agents and the user can change its state. Hover and observations do not restore the previous pointer position; [continuous interaction](../../../.agents/notes/implemented/architecture/2026-10-13-cua-continuous-hover.md) uses no cross-call ownership.
 - The package stays in `experimental` until Windows support and platform validation permit promotion to the `computer-use` group.
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index cf70a56d95..6cb6d5ddcc 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -35,7 +35,7 @@ kind: "package-library"
 
 `tools.cua` 直接返回操作结果。截图结果保留图片 Base64，并增加供工具渲染使用的持久 `attachment` 引用；模型内容只包含坐标元数据和一张图片，不包含编码字节。截图前要求附件服务可用，并确认当前模型支持图片输入。图片接入或保存失败会拒绝调用。对象桥接保留截图字节和已校验的元数据，不重复上传或输出同一张图片。
 
-应用授权发生在启动、观察、截图和输入之前。会话许可按会话和应用身份保存在内存中，Agent 或 helper 重建后仍可复用，重启 DSH 或关闭 Computer Use 后失效。长期许可要求平台验证可执行文件身份。拒绝或撤销会关闭受影响的 Agent 连接，因此旧对象必须重新选择目标。取消、超时或重新连接后均不重放输入。
+应用授权发生在启动、观察、截图和输入之前。会话许可按对话和应用身份持久化，重启 DSH 或关闭 Computer Use 后仍可复用，其他对话需要单独授权。长期许可要求平台验证可执行文件身份。拒绝或撤销会关闭受影响的 Agent 连接，因此旧对象必须重新选择目标。取消、超时或重新连接后均不重放输入。
 
 动作返回 `dispatched:true, verified:false`；请读取新状态以验证结果。坐标操作默认使用最近返回截图中的像素；成功观察窗口后，传入 `relative: true` 可使用 0～1000 的整数比例。Host 在返回截图前解析附件归一化和当前模型的图片缩放规则，再将输入换算为原生窗口 point。窗口尺寸变化会使截图映射失效，绝对坐标遇到 `SCREENSHOT_REQUIRED` 时需要重新截图。窗口缩放后以 `WINDOW_CHANGED` 拒绝旧坐标；单纯移动窗口不改变窗口内坐标。
 
@@ -49,13 +49,17 @@ kind: "package-library"
 <details>
 <summary>共享执行与平台职责</summary>
 
+[授权存储](src/permission-store.ts)复用 `storageDomain` 和配置的后端。默认 JSON 后端写入 `$DSH_HOME/storages/cua_permissions_<sha256>.json`，摘要对应 profile 的真实目录。每次原生操作在该 profile 的文件锁内打开并读取最新状态，结束后关闭存储域。撤销会等待其他进程已获准执行的操作结束；撤销完成后，各进程都拒绝旧句柄。不同电脑或 PID 命名空间不能共享这把锁。
+
+旧 `allowedApps` 只在首次访问存储时导入，迁移后不再应用。确认权限页显示正确后，可以删除旧配置。授权、拒绝和允许再次询问均持久化，页面仍不显示仅对某个会话生效的许可。没有 profile 的独立组合只保留进程内决定；有 profile 但缺少域存储的组合会拒绝授权操作。
+
 权限 Remote 还通过 `ptcConfiguration()` 和 `enablePersistentPtc()` 支持详情页的执行方式设置。查询读取现有执行器和可编辑的 profile 条目。显式写入使用 `configEditor.edit()` 保留其他字段并按正常 Loader 规则重载；已是持久化模式的执行器保持不变。此设置独立于系统权限和应用授权。
 
 提供方将准备好的 helper、连接工厂和指引传给 [installCua](src/index.ts)。[NativeClient](src/native-client.ts) 负责请求关联、字节上限、取消确认和失败处理。平台连接器负责启动和连接清理。共享执行器为每个 Agent 保留一个连接，并在销毁时等待进行中的图像写入。
 
 `agentPreset` 默认为 `ptc`，将工具和指引限制到绑定该 preset 的 Agent。提供方使用现有 `agent/created`、`agent-preset/selected` 事件及 Agent 拥有的作用域，也处理启用前已存在的 Agent。提供方卸载和 Agent 销毁都会释放这些注册。preset 定义可以晚于提供方注册；名称用于筛选已绑定的 Agent，在匹配的 Agent 出现前不提供工具。不使用 preset 的独立组合可设置 `agentPreset: false` 来全局注册。Host 仍拥有权限、本机连接和取消操作，preset 定义保持不变。
 
-[操作 schema](src/protocol.ts) 定义模型参数，并单独声明 Host 专用字段。原生实现在执行时检查目标身份、窗口几何、资源上限和操作系统访问条件。本库没有独立投影的注册表或持久状态，因此不发布 invariant 模块。
+[操作 schema](src/protocol.ts) 定义模型参数，并单独声明 Host 专用字段。原生实现在执行时检查目标身份、窗口几何、资源上限和操作系统访问条件。授权存储独立于原生协议保存持久许可。
 
 </details>
 
@@ -66,6 +70,7 @@ kind: "package-library"
 
 - [macOS 提供方](../cua-macos/README.zh.md)
 - [对象接口](src/types.ts)
+- [授权存储迁移](../../../docs/upgrade-guide/v0.2.1-rc.2/cua-consent-storage/guide.zh.md)
 
 -----
 
@@ -90,7 +95,7 @@ kind: "package-library"
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- 会话授权决策保存在内存中，没有容量上限或淘汰机制，直到提供方卸载才清空。长期运行的 Host 会保留每个曾请求访问的会话与应用组合。
+- 会话决定没有自动保留期限，也不会随对话删除而自动清理。撤销会移除许可，但保留撤销代次，用于拒绝旧句柄和先前尚未完成的审批。
 - 当前原生执行使用 macOS 提供方。Windows 支持计划使用独立的提供方包和 C# helper，保留共享应用与窗口 API、授权、快照有效性和动作结果语义。实现须说明系统特有的限制，并区分交叉编译证据和 Windows 桌面验证。
 - 持久变量不会在一组连续操作期间独占应用。其他 Agent 和用户可能改变其状态。 悬停和观察不恢复先前的鼠标位置；[连续交互](../../../.agents/notes/implemented/architecture/2026-10-13-cua-continuous-hover.zh.md)不分配跨调用所有权。
 - 本包保留在 `experimental`，Windows 支持和平台验证完成后可迁至 `computer-use` 组。
diff --git a/packages/experimental/cua/package.json b/packages/experimental/cua/package.json
index a28b368b46..203d8eebc6 100644
--- a/packages/experimental/cua/package.json
+++ b/packages/experimental/cua/package.json
@@ -74,7 +74,8 @@
     "@deepseek-ai/dsh-attachment": "workspace:*",
     "@deepseek-ai/dsh-llm": "workspace:*",
     "@deepseek-ai/dsh-scope": "workspace:*",
-    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*"
+    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*",
+    "@deepseek-ai/dsh-storage-domain": "workspace:*"
   },
   "dependencies": {
     "@deepseek-ai/dsh-util-values": "workspace:*",
@@ -109,13 +110,15 @@
     "@deepseek-ai/dsh-sandbox-policy": "workspace:*",
     "sharp": "^0.35.3",
     "@deepseek-ai/dsh-ptc-runtime": "workspace:*",
-    "@deepseek-ai/dsh-settings": "workspace:*",
     "@deepseek-ai/dsh-user-questions": "workspace:*",
     "@deepseek-ai/dsh-app-boot": "workspace:*",
     "@deepseek-ai/dsh-config-editor": "workspace:*",
     "@deepseek-ai/dsh-hmr": "workspace:*",
     "@deepseek-ai/cordis-plugin-timer": "workspace:~",
     "@deepseek-ai/dsh-scope": "workspace:*",
-    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*"
+    "@deepseek-ai/dsh-agent-preset-registry": "workspace:*",
+    "@deepseek-ai/dsh-storage-domain": "workspace:*",
+    "@deepseek-ai/dsh-storage": "workspace:*",
+    "@deepseek-ai/dsh-storage-json": "workspace:*"
   }
 }
diff --git a/packages/experimental/cua/src/access-types.ts b/packages/experimental/cua/src/access-types.ts
index 1124ff5023..eabda165aa 100644
--- a/packages/experimental/cua/src/access-types.ts
+++ b/packages/experimental/cua/src/access-types.ts
@@ -21,8 +21,6 @@ export interface CuaSystemPermissionState {
 }
 /** Saved grants and refused applications, independent of native permission checks and icons. */
 export interface CuaApplicationState {
-  /** Owning configuration entry for permission updates; null when this composition has no Loader entry. */
-  settingsNamespace: string | null
   allowedApps: readonly CuaApplicationGrant[]
   /** Refusals from any session, excluding saved grants; other sessions may still hold session access. */
   blockedApps: readonly CuaApplicationGrant[]
diff --git a/packages/experimental/cua/src/access.ts b/packages/experimental/cua/src/access.ts
index 15e1a33b83..b28ec6fc68 100644
--- a/packages/experimental/cua/src/access.ts
+++ b/packages/experimental/cua/src/access.ts
@@ -15,7 +15,6 @@ export type * from './access-types.ts'
 interface ControlOptions extends AccessOptions {
   native: NativeClientConfig
   createChannel: NativeChannelFactory
-  settingsNamespace: string | null
 }
 type Control = (method: string, params: Record<string, JsonValue>) => Promise<JsonValue>
 const permissionProcess = z.object({ pid: z.number().int().positive(), path: z.string().optional(), name: z.string().optional() })
@@ -36,11 +35,10 @@ export class CuaAccess extends TypertRemoteService {
   /**
    * @param ctx Provider context.
    * @param policy Application decision owner.
-   * @param settingsNamespace Owning configuration entry.
    * @param control Serialized native permission dispatch.
    */
   constructor(ctx: Context, private readonly policy: ApplicationAccess,
-    private readonly settingsNamespace: string | null, private readonly control: Control) { super(ctx, 'cuaAccess') }
+    private readonly control: Control) { super(ctx, 'cuaAccess') }
 
   /** Read PTC execution state separately from native permission checks.
    * @returns Whether the shared runtime retains memory and has an editable profile entry.
@@ -70,9 +68,7 @@ export class CuaAccess extends TypertRemoteService {
    * @returns Saved grants and refused applications with their persistence owner.
    */
   @Remote
-  applications(): CuaApplicationState {
-    return { settingsNamespace: this.settingsNamespace, ...this.policy.status() }
-  }
+  applications(): Promise<CuaApplicationState> { return this.policy.status() }
 
   /**
    * Inspect system privileges independently of application decisions and icons.
@@ -89,7 +85,7 @@ export class CuaAccess extends TypertRemoteService {
    */
   @Remote
   async applicationIcons(): Promise<Record<string, string>> {
-    const state = this.policy.status()
+    const state = await this.policy.status()
     const paths = [...new Set([...state.allowedApps, ...state.blockedApps].map(app => app.executablePath))]
     return paths.length === 0 ? {} : z.record(z.string(), ApplicationIcon).parse(await this.control('applicationIcons', { paths }))
   }
@@ -127,10 +123,8 @@ export class CuaAccess extends TypertRemoteService {
    * @param id Refused or revoked application displayed on the permission page.
    * @returns Completion after clearing refusals; no permission is granted and no action is replayed.
    */
-  /* oxlint-disable typescript/require-await -- Remote callers receive policy failures as rejected promises. */
   @Remote
-  async retryApproval(id: CuaApplicationId): Promise<void> { this.policy.retryApproval(id) }
-  /* oxlint-enable typescript/require-await */
+  async retryApproval(id: CuaApplicationId): Promise<void> { await this.policy.retryApproval(id) }
 }
 
 /**
@@ -162,6 +156,6 @@ export function installCuaAccess(ctx: Context, options: ControlOptions): Pick<Ap
     await Promise.allSettled([policy.dispose(), tail])
     await client?.dispose()
   }, 'cua-access.dispose')
-  new CuaAccess(ctx, policy, options.settingsNamespace, control)
+  new CuaAccess(ctx, policy, control)
   return { select: policy.select.bind(policy), run: policy.run.bind(policy), forget: policy.forget.bind(policy), dispose }
 }
diff --git a/packages/experimental/cua/src/application-access.ts b/packages/experimental/cua/src/application-access.ts
index df75ceabd1..26832c3e6c 100644
--- a/packages/experimental/cua/src/application-access.ts
+++ b/packages/experimental/cua/src/application-access.ts
@@ -7,21 +7,21 @@ import { NativeError, type NativeClient } from './native-client.ts'
 import type { CuaAppHandle } from './types.ts'
 import type { CuaApplicationGrant, CuaApplicationId } from './application-types.ts'
 import type { CuaApplicationState } from './access-types.ts'
+import { CuaPermissionStore, type ApplicationPermission, type PermissionTransaction } from './permission-store.ts'
 
 /** Native identity admission occurs before any application observation or input. */
 export const ApplicationAuthorizationResult = z.object({
   id: z.string().regex(/^[a-f0-9]{64}$/).transform(value => value as CuaApplicationId),
   name: z.string(), executablePath: z.string().min(1), persistable: z.boolean(),
 })
-/** Current saved grants and their optional profile writer. */
-export interface AccessOptions {
-  grants: () => readonly CuaApplicationGrant[]
-  /** Cancel queued persistence on provider shutdown; admitted writes must settle before returning. */
-  save?: ((grants: readonly CuaApplicationGrant[], signal: AbortSignal) => Promise<void>) | undefined
-}
+/** Application consent uses one profile store, including conversation-scoped decisions. */
+export interface AccessOptions { store: CuaPermissionStore }
 interface Selection {
   identity: CuaApplicationGrant
   scope: 'session' | 'persistent'
+  sessionId: Agent['id']
+  revoked: number
+  revision: number
   lifetime: AbortController
 }
 interface ClientSelections {
@@ -39,16 +39,13 @@ interface ActiveOperation {
 /** Owns application consent and cancels operations when saved access is removed. */
 export class ApplicationAccess {
   private readonly clients = new Map<NativeClient, ClientSelections>()
-  private readonly decisions = new Map<Agent['id'], Map<CuaApplicationId, { identity: CuaApplicationGrant; allowed: boolean }>>()
   private readonly active = new Set<ActiveOperation>()
   private readonly selections = new Map<Agent['id'], Map<CuaApplicationId, Promise<void>>>()
   private readonly lifetime = new AbortController()
-  private mutationTail: Promise<unknown> = Promise.resolve()
   private disposal: Promise<void> | undefined
 
   /** @param ctx Host context owning this provider. @param options Live saved grants and profile persistence. */
   constructor(private readonly ctx: Context, private readonly options: AccessOptions) {
-    ctx.on('loader/volatile-update', () => { this.reconcile() })
     ctx.effect(() => () => this.dispose(), 'cua-application-access.dispose')
   }
 
@@ -59,9 +56,8 @@ export class ApplicationAccess {
   dispose(): Promise<void> {
     return this.disposal ??= (async () => {
       this.lifetime.abort()
-      await Promise.allSettled([this.mutationTail, ...[...this.active].map(operation => operation.done.promise)])
+      await Promise.allSettled([this.options.store.drain(), ...[...this.active].map(operation => operation.done.promise)])
       this.clients.clear()
-      this.decisions.clear()
     })()
   }
 
@@ -69,33 +65,35 @@ export class ApplicationAccess {
    * Project application decisions without requesting native permissions.
    * @returns Current saved grants and refused applications for the permission page.
    */
-  status(): Omit<CuaApplicationState, 'settingsNamespace'> {
-    const allowedApps = [...this.options.grants()]
-    const blockedApps = new Map<CuaApplicationId, CuaApplicationGrant>()
-    for (const decisions of this.decisions.values()) for (const [id, decision] of decisions) {
-      if (decision.allowed || allowedApps.some(grant => grant.id === id)) continue
-      blockedApps.set(id, decision.identity)
-    }
-    return { allowedApps,
-      blockedApps: [...blockedApps.values()], persistentAvailable: this.options.save !== undefined }
+  async status(): Promise<CuaApplicationState> {
+    return this.options.store.withState(this.lifetime.signal, ({ state }) => {
+      const allowedApps: CuaApplicationGrant[] = [], blockedApps: CuaApplicationGrant[] = []
+      for (const app of Object.values(state.applications)) {
+        if (app.always) allowedApps.push(app.always)
+        else {
+          const denied = Object.values(app.sessions).find(session => session.decision === 'deny')
+          if (denied) blockedApps.push(denied.identity)
+        }
+      }
+      return { allowedApps, blockedApps, persistentAvailable: this.options.store.persistent }
+    })
   }
 
   /**
-   * Remove saved and session consent and cancel affected native operations.
+   * Remove saved and session consent and join affected native operations.
    * @param id Application identity shown in the permission page.
-   * @returns Completion after persistence and affected operations settle; already dispatched input cannot be undone.
+   * @returns Completion after persistence and cancellation, including other processes' admitted operations.
    */
   async revoke(id: CuaApplicationId): Promise<void> {
     this.lifetime.signal.throwIfAborted()
-    let clients: readonly NativeClient[] = []
-    await this.mutate(async () => {
-      const grants = this.options.grants()
-      if (grants.some(grant => grant.id === id)) {
-        const save = this.options.save
-        if (!save) throw new Error('Application permissions cannot be saved in this composition')
-        await save(grants.filter(grant => grant.id !== id), this.lifetime.signal)
-      }
-      clients = this.invalidate(id)
+    const clients = this.invalidate(id)
+    const before = await this.read(id)
+    if (before.always && !this.options.store.persistent) throw new Error('Application permissions cannot be saved in this composition')
+    await this.options.store.withState(this.lifetime.signal, async (transaction) => {
+      const app = transaction.state.applications[id] ?? this.empty()
+      await this.save(transaction, id, { revoked: app.revoked + 1, sessions: Object.fromEntries(
+        Object.entries(app.sessions).map(([sessionId, session]) => [sessionId, { ...session, decision: 'deny' as const, revision: session.revision + 1 }]),
+      ) })
     })
     const results = await Promise.allSettled([
       ...clients.map(client => client.dispose()),
@@ -106,16 +104,18 @@ export class ApplicationAccess {
     if (errors.length) throw new AggregateError(errors, 'Application access was revoked, but helper cleanup failed')
   }
 
-  /**
-   * Clear explicit refusal; the next getApp still requires a new user decision.
-   * @param id Application identity selected by the human.
+  /** Clear refusals without granting access or restoring old handles.
+   * @param id Application selected by the human.
+   * @returns Completion after the new asking policy is durable.
    */
-  retryApproval(id: CuaApplicationId): void {
-    this.lifetime.signal.throwIfAborted()
-    for (const decisions of this.decisions.values()) if (decisions.get(id)?.allowed === false) decisions.delete(id)
-    for (const state of this.clients.values()) for (const [handle, selected] of state.handles) {
-      if (selected.identity.id === id && selected.lifetime.signal.aborted) state.handles.delete(handle)
-    }
+  async retryApproval(id: CuaApplicationId): Promise<void> {
+    await this.options.store.withState(this.lifetime.signal, async (transaction) => {
+      const app = transaction.state.applications[id]
+      if (!app || !Object.values(app.sessions).some(session => session.decision === 'deny')) return
+      await this.save(transaction, id, { ...app, sessions: Object.fromEntries(Object.entries(app.sessions).map(([sessionId, session]) => [
+        sessionId, session.decision === 'deny' ? { ...session, decision: 'ask' as const, revision: session.revision + 1 } : session,
+      ])) })
+    })
   }
 
   /**
@@ -132,38 +132,40 @@ export class ApplicationAccess {
     identity: CuaApplicationGrant & { persistable: boolean }, signal: AbortSignal, icon?: string): Promise<void> {
     await this.withOperation(agent, client, identity, signal, signal => this.selectInOrder(agent, identity.id, async () => {
       signal.throwIfAborted()
+      const observed = await this.read(identity.id, signal)
       const existing = this.clients.get(client)?.handles.get(handle)
-      if (!client.disposed && existing && this.permitted(existing)) return
-      const saved = identity.persistable && this.options.grants().some(grant => grant.id === identity.id)
-      const decision = this.decisions.get(agent.id)?.get(identity.id)
+      if (!client.disposed && existing && this.permitted(existing, observed)) return
+      const saved = identity.persistable && observed.always !== undefined
+      const decision = observed.sessions[agent.id]
       let scope: Selection['scope'] = saved ? 'persistent' : 'session'
-      if (!saved && decision?.allowed === false) throw this.denied(identity)
+      if (!saved && decision?.decision === 'deny') throw this.denied(identity)
       if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
-      if (!saved && !decision?.allowed) {
+      if (!saved && decision?.decision !== 'allow') {
         const questions = this.ctx.get('userQuestions')
         if (!questions) throw new NativeError('APP_APPROVAL_UNAVAILABLE', 'No human answerer is available for application access')
         const options = [{ label: 'Allow for this session' }, { label: 'Deny' }]
-        if (identity.persistable && this.options.save) options.push({ label: 'Always allow' })
+        if (identity.persistable && this.options.store.persistent) options.push({ label: 'Always allow' })
         let result: AskUserQuestionAnswer
         try {
           result = await questions.ask({ agent, signal, questions: [{ id: 'cua-app-access',
             question: `Allow Computer Use to launch if needed, read, capture, and control ${identity.name}?`,
-            detail: 'Session access lasts until DSH restarts or Computer Use is disabled.',
+            detail: 'Session access applies only to this conversation.',
             options, intent: {
               kind: 'approval', approve: 'Allow for this session', reject: 'Deny',
-              ...(identity.persistable && this.options.save ? { always: 'Always allow' } : {}),
+              ...(identity.persistable && this.options.store.persistent ? { always: 'Always allow' } : {}),
               subject: { name: identity.name, ...(icon === undefined ? {} : { icon }) },
               display: {
                 question: { en: 'Allow Computer Use to launch, read, capture and control this application?',
                   zh: '允许 Computer Use 启动、读取、截图和控制此应用吗？' },
-                detail: { en: 'Session access lasts until DSH restarts or Computer Use is disabled.',
-                  zh: '会话授权在重启 DSH 或关闭 Computer Use 后失效。' },
+                detail: { en: 'Session access applies only to this conversation.',
+                  zh: '会话授权仅在当前对话中生效。' },
                 approve: { en: 'Allow for this session', zh: '本会话允许' },
               },
             } }] })
         } catch (error) {
           if (error instanceof UserQuestionError && error.code === 'ASK_CANCELLED') {
             this.invalidate(identity.id, agent)
+            if (!this.lifetime.signal.aborted) await this.decide(agent.id, identity, 'deny')
             throw this.denied(identity)
           }
           if (error instanceof UserQuestionError && error.code === 'DELEGATED_CALLER') {
@@ -175,21 +177,37 @@ export class ApplicationAccess {
         const answer = result.answers.find(answer => answer.id === 'cua-app-access')
         const chosen = answer && !answer.custom?.trim() && answer.selected.length === 1 ? answer.selected[0] : undefined
         if (chosen === 'Allow for this session') scope = 'session'
-        else if (chosen === 'Always allow' && identity.persistable && this.options.save) {
-          scope = 'persistent'
-          const { persistable: _persistable, ...grant } = identity
-          await this.persist((grants) => {
-            signal.throwIfAborted()
-            return [...grants.filter(item => item.id !== identity.id), grant]
-          })
-        } else {
+        else if (chosen === 'Always allow' && identity.persistable && this.options.store.persistent) scope = 'persistent'
+        else {
+          await this.decide(agent.id, identity, 'deny')
           this.invalidate(identity.id, agent)
           throw this.denied(identity)
         }
       }
+      const authorized = await this.options.store.withState(signal, async (transaction) => {
+        signal.throwIfAborted()
+        const app = transaction.state.applications[identity.id] ?? this.empty()
+        if (app.revoked !== observed.revoked
+          || app.sessions[agent.id]?.revision !== observed.sessions[agent.id]?.revision) {
+          throw new NativeError('APP_ACCESS_REVOKED', 'Application consent changed while awaiting approval; select the application again')
+        }
+        if (scope === 'persistent' && !saved && !this.options.store.persistent) throw this.denied(identity)
+        const { persistable: _persistable, ...grant } = identity
+        const previous = app.sessions[agent.id]
+        if (previous?.decision === 'allow' && (scope === 'session' || app.always)) {
+          return { revoked: app.revoked, revision: previous.revision }
+        }
+        const revision = (previous?.revision ?? 0) + 1
+        const next = { ...app,
+          ...(scope === 'persistent' ? { always: grant } : {}),
+          sessions: { ...app.sessions, [agent.id]: { identity: grant, decision: 'allow' as const,
+            revision } },
+        }
+        await this.save(transaction, identity.id, next)
+        return { revoked: next.revoked, revision }
+      })
       signal.throwIfAborted()
       // The awaited user decision can outlive the helper, so re-read its live getter.
-      // oxlint-disable-next-line typescript/no-unnecessary-condition
       if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
       const state = this.clients.get(client) ?? { agent, handles: new Map<CuaAppHandle, Selection>() }
       const { persistable: _persistable, ...grant } = identity
@@ -197,10 +215,9 @@ export class ApplicationAccess {
         for (const selected of previousState.handles.values()) selected.lifetime.abort()
         this.clients.delete(previous)
       }
-      state.handles.set(handle, { identity: grant, scope, lifetime: new AbortController() })
+      state.handles.set(handle, { identity: grant, scope, sessionId: agent.id, revoked: authorized.revoked,
+        revision: authorized.revision, lifetime: new AbortController() })
       this.clients.set(client, state)
-      if (scope === 'session') this.decide(agent.id, grant, true)
-      else this.decisions.get(agent.id)?.delete(identity.id)
     }))
   }
 
@@ -217,12 +234,16 @@ export class ApplicationAccess {
     const state = this.clients.get(client)
     const selected = state?.handles.get(handle)
     if (!state || !selected) throw new NativeError('APP_ACCESS_REQUIRED', 'Select the application with getApp and obtain user consent before reading or controlling it')
-    if (!this.permitted(selected)) {
-      if (!selected.lifetime.signal.aborted) this.invalidate(selected.identity.id, state.agent)
-      throw new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application')
-    }
-    if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
-    return this.withOperation(state.agent, client, selected.identity, AbortSignal.any([signal, selected.lifetime.signal]), dispatch)
+    if (selected.lifetime.signal.aborted) throw new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application')
+    const lifetime = AbortSignal.any([signal, this.lifetime.signal, selected.lifetime.signal])
+    return this.options.store.withState(lifetime, async ({ state: permissions }) => {
+      if (!this.permitted(selected, permissions.applications[selected.identity.id] ?? this.empty())) {
+        this.invalidate(selected.identity.id, state.agent)
+        throw new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application')
+      }
+      if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
+      return this.withOperation(state.agent, client, selected.identity, lifetime, dispatch)
+    })
   }
 
   private async selectInOrder(agent: Agent, id: CuaApplicationId, select: () => Promise<void>): Promise<void> {
@@ -263,54 +284,43 @@ export class ApplicationAccess {
     for (const [client, state] of this.clients) if (state.agent === agent) this.clients.delete(client)
   }
 
-  private permitted(selection: Selection): boolean {
-    return !selection.lifetime.signal.aborted
-      && (selection.scope === 'session' || this.options.grants().some(grant => grant.id === selection.identity.id))
+  private permitted(selection: Selection, app: ApplicationPermission): boolean {
+    const session = app.sessions[selection.sessionId]
+    return !selection.lifetime.signal.aborted && app.revoked === selection.revoked
+      && (selection.scope === 'persistent' ? app.always !== undefined
+        : session?.decision === 'allow' && session.revision === selection.revision)
   }
   private denied(identity: CuaApplicationGrant): NativeError {
     return new NativeError('APP_ACCESS_DENIED', `The user denied access to ${identity.name}. Do not retry or use another tool to bypass this decision.`)
   }
-  private decide(sessionId: Agent['id'], identity: CuaApplicationGrant, allowed: boolean): void {
-    const decisions = this.decisions.get(sessionId) ?? new Map<CuaApplicationId, { identity: CuaApplicationGrant; allowed: boolean }>()
-    decisions.set(identity.id, { identity: { id: identity.id, name: identity.name, executablePath: identity.executablePath }, allowed })
-    this.decisions.set(sessionId, decisions)
+  private async decide(sessionId: Agent['id'], identity: CuaApplicationGrant, decision: 'allow' | 'deny'): Promise<void> {
+    await this.options.store.withState(this.lifetime.signal, async (transaction) => {
+      const app = transaction.state.applications[identity.id] ?? this.empty()
+      await this.save(transaction, identity.id, { ...app, sessions: { ...app.sessions,
+        [sessionId]: { identity: { id: identity.id, name: identity.name, executablePath: identity.executablePath }, decision,
+          revision: (app.sessions[sessionId]?.revision ?? 0) + 1 },
+      } })
+    })
   }
   private invalidate(id: CuaApplicationId, agent?: Agent): NativeClient[] {
     const clients = new Set<NativeClient>()
-    for (const [sessionId, decisions] of this.decisions) {
-      const decision = decisions.get(id)
-      if (decision && (agent === undefined || sessionId === agent.id)) this.decide(sessionId, decision.identity, false)
-    }
     for (const [client, state] of this.clients) for (const selection of state.handles.values()) if (selection.identity.id === id
       && (agent === undefined || state.agent.id === agent.id)) {
       selection.lifetime.abort(new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application'))
-      this.decide(state.agent.id, selection.identity, false)
       clients.add(client)
     }
     for (const operation of this.active) if (operation.identity.id === id && (agent === undefined || operation.agent.id === agent.id)) {
-      this.decide(operation.agent.id, operation.identity, false)
       operation.controller.abort(this.denied(operation.identity))
       clients.add(operation.client)
     }
     for (const client of clients) client.invalidate()
     return [...clients]
   }
-  private reconcile(): void {
-    for (const state of this.clients.values()) for (const selection of state.handles.values()) {
-      if (!selection.lifetime.signal.aborted && !this.permitted(selection)) this.invalidate(selection.identity.id)
-    }
+  private empty(): ApplicationPermission { return { revoked: 0, sessions: {} } }
+  private read(id: CuaApplicationId, signal = this.lifetime.signal): Promise<ApplicationPermission> {
+    return this.options.store.withState(signal, ({ state }) => state.applications[id] ?? this.empty())
   }
-  private persist(update: (grants: readonly CuaApplicationGrant[]) => readonly CuaApplicationGrant[]): Promise<void> {
-    return this.mutate(async () => {
-      const save = this.options.save
-      if (!save) throw new Error('Application permissions cannot be saved in this composition')
-      await save(update(this.options.grants()), this.lifetime.signal)
-    })
-  }
-  private mutate(mutate: () => Promise<void>): Promise<void> {
-    const perform = async () => { this.lifetime.signal.throwIfAborted(); await mutate() }
-    const operation = this.mutationTail.then(perform, perform)
-    this.mutationTail = operation
-    return operation
+  private save(transaction: PermissionTransaction, id: CuaApplicationId, app: ApplicationPermission): Promise<void> {
+    return transaction.save({ ...transaction.state, applications: { ...transaction.state.applications, [id]: app } })
   }
 }
diff --git a/packages/experimental/cua/src/index.ts b/packages/experimental/cua/src/index.ts
index 67050906e0..3d694bf349 100644
--- a/packages/experimental/cua/src/index.ts
+++ b/packages/experimental/cua/src/index.ts
@@ -3,7 +3,7 @@ import { join } from 'node:path'
 import { Buffer } from 'node:buffer'
 import { tmpdir } from 'node:os'
 import { withFileLock } from '@deepseek-ai/dsh-atomic-write'
-import type { Context, Volatile } from '@deepseek-ai/cordis'
+import type { Context } from '@deepseek-ai/cordis'
 import Schema from '@deepseek-ai/schemastery'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import { ComputerUseProviderName } from '@deepseek-ai/dsh-computer-use/brand'
@@ -13,6 +13,7 @@ import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { JsonValue } from '@deepseek-ai/dsh-util-values'
 import { z } from 'zod'
 import { NativeClient, NativeError, type NativeClientConfig, type NativeChannelFactory } from './native-client.ts'
+import { CuaPermissionStore } from './permission-store.ts'
 import { ApplicationAuthorizationResult, installCuaAccess } from './access.ts'
 import type { CuaApplicationGrant, CuaApplicationId } from './access-types.ts'
 import type { CuaAppHandle, CuaOperation } from './types.ts'
@@ -25,7 +26,6 @@ import type { ToolDefinition, ToolExecution } from '@deepseek-ai/dsh-tools'
 import type {} from '@deepseek-ai/dsh-subprocess'
 import type {} from '@deepseek-ai/dsh-computer-use'
 import type {} from '@deepseek-ai/dsh-ptc-runtime'
-import type {} from '@deepseek-ai/dsh-settings'
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 
 export { CuaAccess } from './access.ts'
@@ -35,11 +35,11 @@ export type * from './access-types.ts'
 export interface CuaConfig {
   /** Register tools for Agents using this preset; defaults to ptc. False enables global registration. */
   agentPreset: string | false
-  /** Signed applications explicitly approved for future tasks in this profile. */
-  allowedApps: Volatile<Array<Omit<CuaApplicationGrant, 'id'> & {
+  /** Legacy grants imported once into profile-scoped storage; later edits are ignored. */
+  allowedApps: Array<Omit<CuaApplicationGrant, 'id'> & {
     /** Unbranded digest at the profile configuration boundary; admitted by the Config schema. */
     id: string
-  }>>
+  }>
   /** Absolute native helper override; omission prepares the package-owned executable. */
   helperPath?: string
   /** Maximum time in milliseconds for native component preparation. */
@@ -84,7 +84,7 @@ export const CuaConfig = Schema.object({
   allowedApps: Schema.array(Schema.object({
     id: Schema.string().pattern(/^[a-f0-9]{64}$/).required(),
     name: Schema.string().required(), executablePath: Schema.string().min(1).required(),
-  })).default([]).volatile(),
+  })).default([]),
   helperPath: Schema.string(),
   buildTimeoutMs: Schema.number().step(1).min(1).max(2 ** 31 - 1).default(300_000),
   timeoutMs: Schema.number().step(1).min(1).max(2 ** 31 - 1).default(30_000),
@@ -166,21 +166,9 @@ export function installCua(ctx: Context, config: CuaConfig, backend: CuaBackend)
     maxRequestBytes: config.maxRequestBytes, maxResponseBytes: config.maxResponseBytes, graceMs: config.graceMs,
     textEventIntervalMs: config.textEventIntervalMs, maxClickHoldMs: config.maxClickHoldMs,
   }
-  const entryId = ctx.fiber.entry?.options.id
-  ctx.inject(['settings'], scope => scope.effect(() => scope.settings.configure({ auto: false }, ctx.fiber)))
   const access = installCuaAccess(ctx, {
-    settingsNamespace: entryId ?? null,
     native, createChannel: backend.createChannel,
-    grants: () => config.allowedApps.get().map(grant => ({ ...grant, id: grant.id as CuaApplicationId })),
-    get save() {
-      const settings = ctx.get('settings')
-      if (entryId === undefined || settings === undefined) return undefined
-      const descriptor = settings.describe().find(entry => entry.ns === entryId)
-      if (!descriptor) return undefined
-      return async (grants: readonly CuaApplicationGrant[], signal: AbortSignal) => {
-        await settings.mutate(entryId, [{ op: 'set', path: ['allowedApps'], value: grants }], descriptor.revision, signal)
-      }
-    },
+    store: new CuaPermissionStore(ctx, config.allowedApps.map(grant => ({ ...grant, id: grant.id as CuaApplicationId })), config.timeoutMs),
   })
   const clients = new Map<Agent, NativeClient>()
   const lifetime = new AbortController()
diff --git a/packages/experimental/cua/src/permission-store.ts b/packages/experimental/cua/src/permission-store.ts
new file mode 100644
index 0000000000..bf50b25bee
--- /dev/null
+++ b/packages/experimental/cua/src/permission-store.ts
@@ -0,0 +1,110 @@
+/** Profile-scoped application consent over the existing domain storage service. */
+import { createHash } from 'node:crypto'
+import { realpath } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { Context } from '@deepseek-ai/cordis'
+import { defineDomain } from '@deepseek-ai/dsh-storage-domain'
+import { withFileLock } from '@deepseek-ai/dsh-atomic-write'
+import type {} from '@deepseek-ai/dsh-app-boot'
+import { z } from 'zod'
+import type { CuaApplicationGrant, CuaApplicationId } from './application-types.ts'
+
+const identity = z.object({
+  id: z.string().regex(/^[a-f0-9]{64}$/).transform(value => value as CuaApplicationId),
+  name: z.string(), executablePath: z.string().min(1),
+})
+const sessionDecision = z.object({
+  identity, decision: z.enum(['allow', 'deny', 'ask']), revision: z.number().int().nonnegative(),
+})
+const application = z.object({
+  revoked: z.number().int().nonnegative(), always: identity.optional(),
+  sessions: z.record(z.string(), sessionDecision),
+})
+const state = z.object({
+  migrated: z.boolean(), applications: z.record(z.string().regex(/^[a-f0-9]{64}$/), application),
+}).superRefine((value, context) => {
+  for (const [id, app] of Object.entries(value.applications)) {
+    if ((app.always !== undefined && app.always.id !== id)
+      || Object.values(app.sessions).some(session => session.identity.id !== id)) {
+      context.addIssue({ code: 'custom', message: 'Application identity does not match its stored key' })
+    }
+  }
+})
+/** One application's grants and revocation generations. */
+export type ApplicationPermission = z.infer<typeof application>
+/** Validated authoritative state; an empty migrated store never reimports legacy grants. */
+export type PermissionState = z.infer<typeof state>
+/** One locked storage operation, with writes resolving only after durability. */
+export interface PermissionTransaction {
+  state: PermissionState
+  save: (next: PermissionState) => Promise<void>
+}
+
+/**
+ * Open fresh domain state under a profile lock for every decision and native operation.
+ * Without a profile, only process-local session decisions are writable. A profile requires domain storage.
+ */
+export class CuaPermissionStore {
+  private readonly directory: string | undefined
+  private memory: PermissionState
+  private readonly pending = new Set<Promise<unknown>>()
+  private tail: Promise<void> = Promise.resolve()
+  /**
+   * @param ctx Provider context with optional profile and domain storage services.
+   * @param legacy Grants imported on the first access to this profile's store.
+   * @param waitMs Existing operation budget, also bounding profile-lock contention.
+   */
+  constructor(private readonly ctx: Context, private readonly legacy: readonly CuaApplicationGrant[], private readonly waitMs: number) {
+    this.directory = ctx.get('profileContext')?.dir
+    this.memory = this.importLegacy()
+  }
+  /** Whether this composition can retain application and session grants across restarts. */
+  get persistent(): boolean { return this.directory !== undefined && this.ctx.get('storageDomain') !== undefined }
+
+  /**
+   * Serialize a read, write, or authorized dispatch against all other users of this profile.
+   * @param signal Cancellation while waiting; admitted operations own their cancellation.
+   * @param operation Work using fresh state. Native dispatch keeps the lock until it settles.
+   * @returns The operation's result after its domain handle has closed.
+   */
+  withState<T>(signal: AbortSignal, operation: (transaction: PermissionTransaction) => T | Promise<T>): Promise<T> {
+    const pending = this.operate(signal, operation)
+    this.pending.add(pending)
+    void pending.finally(() => { this.pending.delete(pending) }).catch(() => {})
+    return pending
+  }
+  /** Join accepted operations before withdrawing this provider. */
+  async drain(): Promise<void> { await Promise.allSettled(this.pending) }
+
+  private async operate<T>(signal: AbortSignal, operation: (transaction: PermissionTransaction) => T | Promise<T>): Promise<T> {
+    if (this.directory === undefined) {
+      const run = async (): Promise<T> => {
+        signal.throwIfAborted()
+        return operation({ state: this.memory, save: (next) => { this.memory = next; return Promise.resolve() } })
+      }
+      const pending = this.tail.then(run, run)
+      this.tail = pending.then(() => {}, () => {})
+      return pending
+    }
+    const storage = this.ctx.get('storageDomain')
+    if (storage === undefined) throw new Error('Profile application permissions require storageDomain')
+    const directory = await realpath(this.directory)
+    const name = `cua_permissions_${createHash('sha256').update(directory).digest('hex')}`
+    const spec = defineDomain({ name, version: 1, tables: {}, global: {
+      schema: state, initial: { migrated: false, applications: {} },
+    } })
+    return withFileLock(join(directory, 'cua-permissions'), async () => {
+      const domain = await storage.open(spec)
+      try {
+        if (!domain.global.get().migrated) await domain.global.set(this.importLegacy())
+        return await operation({ state: domain.global.get(), save: next => domain.global.set(next) })
+      } finally { await domain.close() }
+    }, { signal, waitMs: this.waitMs })
+  }
+
+  private importLegacy(): PermissionState {
+    return { migrated: true, applications: Object.fromEntries(this.legacy.map(grant => [grant.id, {
+      revoked: 0, always: grant, sessions: {},
+    }])) }
+  }
+}
diff --git a/packages/experimental/cua/tests/access.spec.ts b/packages/experimental/cua/tests/access.spec.ts
index 21b47b1a71..605aefcecb 100644
--- a/packages/experimental/cua/tests/access.spec.ts
+++ b/packages/experimental/cua/tests/access.spec.ts
@@ -9,6 +9,7 @@ import { ApplicationAuthorizationResult, installCuaAccess } from '../src/access.
 import type { CuaApplicationGrant } from '../src/access-types.ts'
 import type { CuaAppHandle } from '../src/types.ts'
 import { NativeClient } from '../src/native-client.ts'
+import { permissionFixture } from './permission-fixture.ts'
 
 const native = vi.hoisted(() => ({ instances: [] as Array<{
   disposed: boolean
@@ -46,22 +47,18 @@ async function setup(choice = 'Allow for this session', options: { writable?: bo
   const owner = await ctx.agents.create({ sessionId: SessionId('cua-access-test') })
   const answer = vi.fn<() => Promise<AskUserQuestionAnswer>>(async () => ({ answers: [{ id: 'cua-app-access', selected: [choice] }] }))
   ctx.on('user-questions/request', answer)
-  let grants: readonly CuaApplicationGrant[] = options.initial ?? []
-  const save = vi.fn(async (next: readonly CuaApplicationGrant[]) => { grants = next })
-  let writable = options.writable !== false
-  const access = installCuaAccess(ctx, { native: nativeConfig, createChannel: unusedConnector, settingsNamespace: 'cua', grants: () => grants, get save() { return writable ? save : undefined } })
+  const permissions = permissionFixture(ctx, options.initial, options.writable)
+  const access = installCuaAccess(ctx, { native: nativeConfig, createChannel: unusedConnector, store: permissions.store })
   const client = new NativeClient(ctx, nativeConfig, unusedConnector)
-  return { ctx, owner, agent: owner.agent, answer, save, access, client, grants: () => grants,
-    setWritable(value: boolean) { writable = value },
-  }
+  return { ctx, owner, agent: owner.agent, answer, access, client, ...permissions }
 }
 
 it('requires another user decision after the permission page permits asking again', async () => {
   const f = await setup('Deny')
   await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
-  expect(f.ctx.cuaAccess.applications().blockedApps).toHaveLength(1)
+  expect((await f.ctx.cuaAccess.applications()).blockedApps).toHaveLength(1)
   await f.ctx.cuaAccess.retryApproval(identity.id)
-  expect(f.ctx.cuaAccess.applications().blockedApps).toEqual([])
+  expect((await f.ctx.cuaAccess.applications()).blockedApps).toEqual([])
   await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
   f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
   const retryClient = new NativeClient(f.ctx, nativeConfig, unusedConnector)
@@ -136,15 +133,14 @@ it('fails closed without a human answerer and never offers persistence without i
   await f.ctx.plugin(UserQuestions)
   await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
   expect(f.save).not.toHaveBeenCalled()
-  expect(f.ctx.cuaAccess.applications().persistentAvailable).toBe(false)
+  expect((await f.ctx.cuaAccess.applications()).persistentAvailable).toBe(false)
 })
 
 it('projects task decisions, observes live config removal, and forgets a disposed task', async () => {
   const f = await setup('Always allow')
   await f.access.select(f.agent, f.client, handle, identity, signal)
-  expect(f.ctx.cuaAccess.applications().allowedApps).toHaveLength(1)
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toHaveLength(1)
   await f.save([])
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
   await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REVOKED')
   await f.owner.dispose()
   f.access.forget(f.agent)
@@ -160,8 +156,8 @@ it('refuses to promise revocation of a saved decision without persistence', asyn
 it('checks native permissions without converting an OS request into a grant', async () => {
   const f = await setup()
   await f.access.select(f.agent, f.client, handle, identity, signal)
-  const before = f.ctx.cuaAccess.applications()
-  expect(before).toEqual({ settingsNamespace: 'cua', allowedApps: [], blockedApps: [], persistentAvailable: true })
+  const before = (await f.ctx.cuaAccess.applications())
+  expect(before).toEqual({ allowedApps: [], blockedApps: [], persistentAvailable: true })
   expect(await f.ctx.cuaAccess.systemStatus()).toMatchObject({ accessibility: false, screenRecording: false })
   expect(await f.ctx.cuaAccess.requestPermission('accessibility')).toMatchObject({ accessibility: false })
   await f.ctx.cuaAccess.openSettings('screenRecording')
@@ -205,7 +201,6 @@ it('isolates other tasks and applications while revoking and forgetting one deci
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await f.access.select(f.agent, f.client, otherHandle, other, signal)
   await f.access.select(owner.agent, otherClient, otherHandle, other, signal)
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
   await f.ctx.cuaAccess.retryApproval(identity.id)
   const started: PromiseWithResolvers<void> = Promise.withResolvers()
   const release: PromiseWithResolvers<void> = Promise.withResolvers()
@@ -233,7 +228,7 @@ it('removes a grant whose save is already pending when another task revokes the
   const release: PromiseWithResolvers<void> = Promise.withResolvers()
   onTestFinished(() => { release.resolve() })
   const save = f.save.getMockImplementation()!
-  f.save.mockImplementationOnce(async (grants) => { entered.resolve(); await release.promise; await save(grants) })
+  f.save.mockImplementationOnce(async (...args) => { entered.resolve(); await release.promise; await save(...args) })
   f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] })
   const selection = f.access.select(owner.agent, client, handle, identity, signal)
   const settledSelection = Promise.allSettled([selection])
@@ -271,10 +266,10 @@ it('projects restored persistent grants without showing the same application as
   await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
   const { persistable: _persistable, ...grant } = identity
   await f.save([grant])
-  expect(f.ctx.cuaAccess.applications().blockedApps).toEqual([])
+  expect((await f.ctx.cuaAccess.applications()).blockedApps).toEqual([])
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await f.access.select(f.agent, replacement, handle, identity, signal)
-  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual([grant])
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([grant])
   expect(f.answer).toHaveBeenCalledOnce()
 })
 
@@ -315,7 +310,7 @@ it('keeps other session grants after revocation while requiring fresh native han
   await f.access.select(f.agent, f.client, otherHandle, other, signal)
   await f.ctx.cuaAccess.revoke(identity.id)
   await expect(f.access.run(f.client, otherHandle, signal, async () => 'old handle')).rejects.toThrow('NATIVE_CLOSED')
-  const state = f.ctx.cuaAccess.applications()
+  const state = (await f.ctx.cuaAccess.applications())
   expect(state.blockedApps.map(app => app.id)).toEqual([identity.id])
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await f.access.select(f.agent, replacement, otherHandle, other, signal)
@@ -333,7 +328,6 @@ it('does not let a stale revoked task invalidate another task after a saved gran
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await f.access.select(owner.agent, replacement, handle, identity, signal)
   await expect(f.access.run(f.client, handle, signal, async () => 'stale')).rejects.toThrow('APP_ACCESS_REVOKED')
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
   expect(replacement.disposed).toBe(false)
   await expect(f.access.run(replacement, handle, signal, async () => 'restored')).resolves.toBe('restored')
 })
@@ -353,7 +347,7 @@ it('offers fixed approval actions with native metadata while keeping icons out o
 it('reads application decisions without native work and retrieves icons separately', async () => {
   const f = await setup('Always allow')
   await f.access.select(f.agent, f.client, handle, identity, signal)
-  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual(f.grants())
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual(f.grants())
   expect(native.instances).toHaveLength(1)
   await f.ctx.cuaAccess.systemStatus()
   const control = native.instances.at(-1)!
@@ -361,7 +355,7 @@ it('reads application decisions without native work and retrieves icons separate
   onTestFinished(() => { pending.resolve({}) })
   control.request.mockReturnValueOnce(pending.promise)
   const icons = f.ctx.cuaAccess.applicationIcons()
-  expect(f.ctx.cuaAccess.applications().allowedApps).toEqual(f.grants())
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual(f.grants())
   pending.resolve({ [identity.executablePath]: 'data:image/png;base64,aWNvbg==' })
   expect(await icons).toEqual({ [identity.executablePath]: 'data:image/png;base64,aWNvbg==' })
   expect(f.grants()[0]).not.toHaveProperty('icon')
@@ -378,7 +372,7 @@ it('skips native icon work for an empty application list and propagates icon fai
   await f.ctx.cuaAccess.systemStatus()
   native.instances.at(-1)!.request.mockRejectedValueOnce(new Error('icons unavailable'))
   await expect(f.ctx.cuaAccess.applicationIcons()).rejects.toThrow('icons unavailable')
-  expect(f.ctx.cuaAccess.applications().allowedApps).toHaveLength(1)
+  expect((await f.ctx.cuaAccess.applications()).allowedApps).toHaveLength(1)
   expect((await f.ctx.cuaAccess.systemStatus()).accessibility).toBe(false)
 })
 
@@ -398,12 +392,12 @@ it('omits session-only grants from the permission page and retains their access
   await f.access.select(f.agent, f.client, handle, identity, signal)
   const other = { ...identity, id: 'b'.repeat(64) as typeof identity.id, name: 'Another application', executablePath: '/Applications/Other.app' }
   await f.access.select(f.agent, f.client, 'other-application' as CuaAppHandle, other, signal)
-  expect(f.ctx.cuaAccess.applications()).toEqual({ settingsNamespace: 'cua', allowedApps: [], blockedApps: [], persistentAvailable: true })
+  expect((await f.ctx.cuaAccess.applications())).toEqual({ allowedApps: [], blockedApps: [], persistentAvailable: true })
   const owner = await f.ctx.agents.create({ sessionId: SessionId('cua-always-allow') })
   const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] })
   await f.access.select(owner.agent, client, handle, identity, signal)
-  const state = f.ctx.cuaAccess.applications()
+  const state = (await f.ctx.cuaAccess.applications())
   expect(state.allowedApps.map(app => app.id)).toEqual([identity.id])
   expect(state.blockedApps).toEqual([])
   await expect(f.access.run(f.client, handle, signal, async () => 'still allowed')).resolves.toBe('still allowed')
diff --git a/packages/experimental/cua/tests/application-access.spec.ts b/packages/experimental/cua/tests/application-access.spec.ts
index 74d2ddefbf..ed78a0cbfe 100644
--- a/packages/experimental/cua/tests/application-access.spec.ts
+++ b/packages/experimental/cua/tests/application-access.spec.ts
@@ -1,5 +1,4 @@
 /** Application decisions are checked at dispatch and revocation cancels owned work. */
-import { setImmediate } from 'node:timers/promises'
 import { Context } from '@deepseek-ai/cordis'
 import { mountAgentLoopTestDependencies, mountAgentLoopTestHarness } from '@deepseek-ai/dsh-agent-loop-testkit'
 import { SessionId } from '@deepseek-ai/dsh-session'
@@ -9,6 +8,7 @@ import { ApplicationAuthorizationResult, ApplicationAccess } from '../src/applic
 import type { CuaApplicationGrant } from '../src/application-types.ts'
 import type { CuaAppHandle } from '../src/types.ts'
 import { NativeClient } from '../src/native-client.ts'
+import { permissionFixture } from './permission-fixture.ts'
 
 const native = vi.hoisted(() => ({ instances: [] as Array<{
   disposed: boolean
@@ -46,14 +46,10 @@ async function setup(choice = 'Allow for this session', options: { writable?: bo
   const owner = await ctx.agents.create({ sessionId: SessionId('cua-access-test') })
   const answer = vi.fn<() => Promise<AskUserQuestionAnswer>>(async () => ({ answers: [{ id: 'cua-app-access', selected: [choice] }] }))
   ctx.on('user-questions/request', answer)
-  let grants: readonly CuaApplicationGrant[] = options.initial ?? []
-  const save = vi.fn(async (next: readonly CuaApplicationGrant[]) => { grants = next })
-  let writable = options.writable !== false
-  const access = new ApplicationAccess(ctx, { grants: () => grants, get save() { return writable ? save : undefined } })
+  const permissions = permissionFixture(ctx, options.initial, options.writable)
+  const access = new ApplicationAccess(ctx, { store: permissions.store })
   const client = new NativeClient(ctx, nativeConfig, unusedConnector)
-  return { ctx, owner, agent: owner.agent, answer, save, access, client, grants: () => grants,
-    setWritable(value: boolean) { writable = value },
-  }
+  return { ctx, owner, agent: owner.agent, answer, access, client, ...permissions }
 }
 
 it('refuses raw handle dispatch until getApp obtains consent', async () => {
@@ -63,7 +59,7 @@ it('refuses raw handle dispatch until getApp obtains consent', async () => {
   expect(dispatch).not.toHaveBeenCalled()
 })
 
-it('reuses session consent across application handles and connections without saving it', async () => {
+it('reuses session consent across application handles and connections without granting global access', async () => {
   const f = await setup()
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await expect(f.access.run(f.client, handle, signal, async () => 'read')).resolves.toBe('read')
@@ -157,24 +153,14 @@ it('merges a concurrently saved decision using the latest grant list', async ()
   expect(f.grants()).toEqual([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
 })
 
-it('refuses queued persistence when the profile writer disappears', async () => {
+it('rejects a long-term choice when storage becomes unavailable during the question', async () => {
   const f = await setup('Always allow')
-  const saving: PromiseWithResolvers<void> = Promise.withResolvers()
-  const release: PromiseWithResolvers<void> = Promise.withResolvers()
-  onTestFinished(() => { release.resolve() })
-  f.save.mockImplementationOnce(async () => { saving.resolve(); await release.promise })
-  const first = f.access.select(f.agent, f.client, handle, identity, signal)
-  await saving.promise
-  const other = { ...identity, id: 'b'.repeat(64) as typeof identity.id }
-  const second = f.access.select(f.agent, f.client, 'second' as CuaAppHandle, other, signal)
-  const refused = expect(second).rejects.toThrow('cannot be saved')
-  await vi.waitFor(() => { expect(f.answer).toHaveBeenCalledTimes(2) })
-  await setImmediate()
-  f.setWritable(false)
-  release.resolve()
-  await first
-  await refused
-  expect(f.save).toHaveBeenCalledOnce()
+  f.answer.mockImplementationOnce(async () => {
+    f.setWritable(false)
+    return { answers: [{ id: 'cua-app-access', selected: ['Always allow'] }] }
+  })
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  expect(f.save).not.toHaveBeenCalled()
 })
 
 it('serializes duplicate application questions and rejects every waiting selection after denial', async () => {
@@ -239,7 +225,7 @@ it('enforces a removed saved grant before its configuration notification arrives
   expect(f.client.disposed).toBe(true)
 })
 
-it('cancels native work when saved consent is removed from configuration', async () => {
+it('cancels native work when saved consent is revoked', async () => {
   const f = await setup('Always allow')
   await f.access.select(f.agent, f.client, handle, identity, signal)
   const entered = Promise.withResolvers<undefined>()
@@ -251,9 +237,7 @@ it('cancels native work when saved consent is removed from configuration', async
   })
   const rejected = expect(pending).rejects.toThrow('APP_ACCESS_DENIED')
   await entered.promise
-  await f.save([])
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
+  await f.access.revoke(identity.id)
   await rejected
   expect(f.client.disposed).toBe(true)
   await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REVOKED')
@@ -294,7 +278,6 @@ it('refuses closed helpers and forgets one task without removing another task',
   const owner = await f.ctx.agents.create({ sessionId: SessionId('other-consented-task') })
   const other = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await f.access.select(owner.agent, other, handle, identity, signal)
-  f.ctx.emit('loader/volatile-update', [['allowedApps']])
   f.access.forget(f.agent)
   await expect(f.access.run(other, handle, signal, async () => 'kept')).resolves.toBe('kept')
   other.invalidate()
@@ -367,12 +350,12 @@ it('revokes session consent even after its agent and connection are released', a
   expect(f.answer).toHaveBeenCalledTimes(2)
 })
 
-it('clears session consent when the provider is disabled and recreated', async () => {
+it('retains conversation consent when the provider is recreated over the same store', async () => {
   const f = await setup()
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await f.access.dispose()
-  const access = new ApplicationAccess(f.ctx, { grants: f.grants, save: f.save })
+  const access = new ApplicationAccess(f.ctx, { store: f.store })
   const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await access.select(f.agent, client, handle, identity, signal)
-  expect(f.answer).toHaveBeenCalledTimes(2)
+  expect(f.answer).toHaveBeenCalledOnce()
 })
diff --git a/packages/experimental/cua/tests/fixtures/permission-store-worker.ts b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
new file mode 100644
index 0000000000..a1b5f6d5ff
--- /dev/null
+++ b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
@@ -0,0 +1,26 @@
+/** Independent process used to verify fresh authorization reads over the production JSON backend. */
+import { Context } from '@deepseek-ai/cordis'
+import Storage from '@deepseek-ai/dsh-storage'
+import * as JsonStorage from '@deepseek-ai/dsh-storage-json'
+import * as Domains from '@deepseek-ai/dsh-storage-domain'
+import { CuaPermissionStore } from '../../src/permission-store.ts'
+import type { CuaApplicationId } from '../../src/application-types.ts'
+
+const [root, directory, id] = process.argv.slice(2)
+if (!root || !directory || !id) throw new Error('Expected storage root, profile directory and application id')
+const ctx = new Context()
+try {
+  ctx.provide('profileContext', { dir: directory })
+  await ctx.plugin(Storage)
+  await ctx.plugin(JsonStorage, { root })
+  await ctx.plugin(Domains, { backend: 'json' })
+  const store = new CuaPermissionStore(ctx, [], 30_000)
+  await store.withState(new AbortController().signal, async (transaction) => {
+    const existing = transaction.state.applications[id]
+    await transaction.save({ ...transaction.state, applications: { ...transaction.state.applications,
+      [id]: { revoked: (existing?.revoked ?? 0) + 1, sessions: {},
+        always: { id: id as CuaApplicationId, name: 'Other process', executablePath: '/other' } },
+    } })
+  })
+  process.stdout.write('saved\n')
+} finally { await ctx.fiber.dispose() }
diff --git a/packages/experimental/cua/tests/permission-fixture.ts b/packages/experimental/cua/tests/permission-fixture.ts
new file mode 100644
index 0000000000..17a1aa4642
--- /dev/null
+++ b/packages/experimental/cua/tests/permission-fixture.ts
@@ -0,0 +1,47 @@
+/** Policy tests use the real store's in-memory composition and injectable durable-write failures. */
+import type { Context } from '@deepseek-ai/cordis'
+import { isDeepStrictEqual } from 'node:util'
+import { vi } from 'vitest'
+import { CuaPermissionStore, type PermissionState } from '../src/permission-store.ts'
+import type { CuaApplicationGrant } from '../src/application-types.ts'
+
+/**
+ * @param ctx Test context.
+ * @param initial Existing long-term grants.
+ * @param writable Whether long-term decisions can be saved.
+ * @returns Store and external writer controls.
+ */
+export function permissionFixture(ctx: Context, initial: readonly CuaApplicationGrant[] = [], writable = true) {
+  const store = new CuaPermissionStore(ctx, initial, 1000)
+  const capability = vi.spyOn(store, 'persistent', 'get').mockImplementation(() => writable)
+  const original = store.withState.bind(store)
+  const grantsOf = (state: PermissionState) => Object.values(state.applications).flatMap(app => app.always ? [app.always] : [])
+  let observed = [...initial]
+  const save = vi.fn(async (grants: readonly CuaApplicationGrant[], commit?: () => Promise<void>) => {
+    if (commit) { await commit(); return }
+    await original(new AbortController().signal, async (transaction) => {
+      const applications = { ...transaction.state.applications }
+      for (const [id, app] of Object.entries(applications)) if (app.always) {
+        const { always: _always, ...rest } = app
+        applications[id] = { ...rest, revoked: app.revoked + 1 }
+      }
+      for (const grant of grants) applications[grant.id] = {
+        ...(applications[grant.id] ?? { revoked: 0, sessions: {} }), always: grant,
+      }
+      await transaction.save({ ...transaction.state, applications })
+      observed = [...grants]
+    })
+  })
+  vi.spyOn(store, 'withState').mockImplementation((signal, operation) => original(signal, async (transaction) => {
+    observed = grantsOf(transaction.state)
+    return operation({ ...transaction, save: async (next) => {
+      const nextGrants = grantsOf(next)
+      const commit = async () => { await transaction.save(next); observed = nextGrants }
+      if (isDeepStrictEqual(observed, nextGrants)) await commit()
+      else await save(nextGrants, commit)
+    } })
+  }))
+  return { store, save, grants: () => observed,
+    setWritable(value: boolean) { writable = value; capability.mockImplementation(() => writable) },
+  }
+}
diff --git a/packages/experimental/cua/tests/permission-store.spec.ts b/packages/experimental/cua/tests/permission-store.spec.ts
new file mode 100644
index 0000000000..ab10c29ddf
--- /dev/null
+++ b/packages/experimental/cua/tests/permission-store.spec.ts
@@ -0,0 +1,137 @@
+/** Durable profile and conversation decisions use the production storage composition. */
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile, symlink } from 'node:fs/promises'
+import { execFile } from 'node:child_process'
+import { promisify } from 'node:util'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { Context } from '@deepseek-ai/cordis'
+import Storage from '@deepseek-ai/dsh-storage'
+import * as JsonStorage from '@deepseek-ai/dsh-storage-json'
+import * as Domains from '@deepseek-ai/dsh-storage-domain'
+import { expect, it, onTestFinished } from 'vitest'
+import { CuaPermissionStore } from '../src/permission-store.ts'
+import type { CuaApplicationGrant, CuaApplicationId } from '../src/application-types.ts'
+
+const signal = new AbortController().signal
+const grant = { id: 'a'.repeat(64) as CuaApplicationId, name: 'Fixture', executablePath: '/fixture/app' }
+
+async function setup() {
+  const root = await mkdtemp(join(tmpdir(), 'cua-permission-store-'))
+  const storageRoot = join(root, 'storages'), directory = join(root, 'profile')
+  await mkdir(directory)
+  const contexts: Context[] = []
+  onTestFinished(async () => { for (const ctx of contexts) await ctx.fiber.dispose(); await rm(root, { recursive: true, force: true }) })
+  const open = async (profile = directory, legacy: readonly CuaApplicationGrant[] = []) => {
+    const ctx = new Context(); contexts.push(ctx)
+    ctx.provide('profileContext', { dir: profile })
+    await ctx.plugin(Storage)
+    await ctx.plugin(JsonStorage, { root: storageRoot })
+    const domain = await ctx.plugin(Domains, { backend: 'json' })
+    return { ctx, domain, store: new CuaPermissionStore(ctx, legacy, 30_000) }
+  }
+  return { root, storageRoot, directory, open }
+}
+
+it('imports legacy grants once, retains conversation choices, and never restores a revoked legacy grant', async () => {
+  const f = await setup(), first = await f.open(f.directory, [grant])
+  await first.store.withState(signal, async (transaction) => {
+    expect(transaction.state.applications[grant.id]?.always).toEqual(grant)
+    await transaction.save({ migrated: true, applications: { [grant.id]: { revoked: 1, sessions: {
+      conversation: { identity: grant, decision: 'allow', revision: 1 },
+      refused: { identity: grant, decision: 'deny', revision: 2 },
+    } } } })
+  })
+  await first.ctx.fiber.dispose()
+  const resumed = await f.open(f.directory, [grant])
+  const stored = await resumed.store.withState(signal, transaction => transaction.state)
+  expect(stored.applications[grant.id]?.always).toBeUndefined()
+  expect(stored.applications[grant.id]?.sessions.conversation?.decision).toBe('allow')
+  expect(stored.applications[grant.id]?.sessions.refused?.decision).toBe('deny')
+  expect(stored.applications[grant.id]?.sessions.another).toBeUndefined()
+  const files = await readdir(f.storageRoot)
+  expect(files).toHaveLength(1)
+  expect(files[0]).toMatch(/^cua_permissions_[a-f0-9]{64}\.json$/)
+  expect(await readFile(join(f.storageRoot, files[0]!), 'utf8')).toContain('conversation')
+})
+
+it('isolates different profiles that use the same storage root', async () => {
+  const f = await setup(), a = await f.open(f.directory, [grant])
+  await a.store.withState(signal, transaction => transaction.state)
+  const other = join(f.root, 'other'); await mkdir(other)
+  const b = await f.open(other)
+  expect(await b.store.withState(signal, transaction => transaction.state.applications)).toEqual({})
+  expect(await readdir(f.storageRoot)).toHaveLength(2)
+})
+
+it.skipIf(process.platform === 'win32')('uses the same profile identity through a directory symlink', async () => {
+  const f = await setup(), a = await f.open(f.directory, [grant])
+  await a.store.withState(signal, transaction => transaction.state)
+  const alias = join(f.root, 'alias'); await symlink(f.directory, alias)
+  const b = await f.open(alias)
+  expect(await b.store.withState(signal, transaction => transaction.state.applications[grant.id]?.always)).toEqual(grant)
+  expect(await readdir(f.storageRoot)).toHaveLength(1)
+})
+
+it('reloads another process’s writes instead of reusing an in-memory authorization snapshot', async () => {
+  const f = await setup(), a = await f.open(f.directory, [grant])
+  await a.store.withState(signal, transaction => transaction.state)
+  const controller = new AbortController()
+  const running = promisify(execFile)(process.execPath, ['--import', 'tsx/esm',
+    fileURLToPath(new URL('./fixtures/permission-store-worker.ts', import.meta.url)), f.storageRoot, f.directory, grant.id,
+  ], { cwd: process.cwd(), env: { PATH: process.env.PATH }, signal: controller.signal })
+  onTestFinished(async () => { controller.abort(); await running.catch(() => {}) })
+  expect((await running).stdout).toBe('saved\n')
+  const latest = await a.store.withState(signal, transaction => transaction.state.applications[grant.id])
+  expect(latest).toMatchObject({ revoked: 1, always: { name: 'Other process' } })
+})
+
+it('serializes independent domain owners, cancels a waiting operation, and closes after a failure', async () => {
+  const f = await setup(), a = await f.open(), b = await f.open()
+  const entered = Promise.withResolvers<undefined>(), release = Promise.withResolvers<undefined>()
+  onTestFinished(() => { release.resolve(undefined) })
+  const holding = a.store.withState(signal, async (transaction) => {
+    entered.resolve(undefined)
+    await release.promise
+    return transaction.state
+  })
+  await entered.promise
+  const controller = new AbortController(); controller.abort(new Error('cancelled'))
+  await expect(b.store.withState(controller.signal, () => { throw new Error('must not enter') })).rejects.toThrow('cancelled')
+  const next = b.store.withState(signal, async (transaction) => {
+    await transaction.save({ migrated: true, applications: {} })
+    throw new Error('operation failed after commit')
+  })
+  const failed = expect(next).rejects.toThrow('operation failed after commit')
+  release.resolve(undefined); await holding; await failed
+  expect(await a.store.withState(signal, transaction => transaction.state.migrated)).toBe(true)
+  await Promise.all([a.store.drain(), b.store.drain()])
+})
+
+it('rejects malformed or identity-mismatched data without replacing it with legacy grants', async () => {
+  const f = await setup(), a = await f.open(f.directory, [grant])
+  await a.store.withState(signal, transaction => transaction.state)
+  const file = join(f.storageRoot, (await readdir(f.storageRoot))[0]!)
+  const valid = await readFile(file, 'utf8')
+  await writeFile(file, '{broken')
+  await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toThrow()
+  expect(await readFile(file, 'utf8')).toBe('{broken')
+  const altered: { global: { applications: Record<string, { always: CuaApplicationGrant }> } } = JSON.parse(valid)
+  altered.global.applications[grant.id]!.always.id = 'b'.repeat(64) as CuaApplicationId
+  const mismatch = JSON.stringify(altered); await writeFile(file, mismatch)
+  await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toMatchObject({ code: 'invalid-record' })
+  expect(await readFile(file, 'utf8')).toBe(mismatch)
+})
+
+it('uses temporary decisions only without a profile and fails when profile storage disappears', async () => {
+  const ctx = new Context(); onTestFinished(() => ctx.fiber.dispose())
+  const temporary = new CuaPermissionStore(ctx, [], 1000)
+  expect(temporary.persistent).toBe(false)
+  await temporary.withState(signal, transaction => transaction.save({ migrated: true, applications: {
+    [grant.id]: { revoked: 0, sessions: { conversation: { identity: grant, decision: 'allow', revision: 1 } } },
+  } }))
+  expect(await temporary.withState(signal, transaction => transaction.state.applications[grant.id]?.sessions.conversation?.decision)).toBe('allow')
+  const f = await setup(), a = await f.open()
+  await a.domain.dispose()
+  await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toThrow('require storageDomain')
+})
diff --git a/packages/experimental/cua/tsconfig.json b/packages/experimental/cua/tsconfig.json
index cb086d3e6f..5b1f8eef25 100644
--- a/packages/experimental/cua/tsconfig.json
+++ b/packages/experimental/cua/tsconfig.json
@@ -44,9 +44,6 @@
     {
       "path": "../../typert/protocol"
     },
-    {
-      "path": "../../settings/settings"
-    },
     {
       "path": "../../interaction/user-questions"
     },
@@ -64,6 +61,15 @@
     },
     {
       "path": "../../preset/agent-preset-registry"
+    },
+    {
+      "path": "../../storage/storage-domain"
+    },
+    {
+      "path": "../../boot/app-boot"
+    },
+    {
+      "path": "../../boot/config-editor"
     }
   ]
 }
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index 0155166178..a71dc8a28e 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -731,9 +731,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         returns: 'Detached layer values alongside their Loader entries.',
       },
       {
-        signature: 'async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, signal?: AbortSignal, ): Promise<void>',
+        signature: 'async edit( entry: Entry, change: (current: Record<string, unknown>, inherited: Record<string, unknown>) => Record<string, unknown>, ): Promise<void>',
         description: 'Validate, persist, and reconcile a plugin\'s next config; ordinary fields keep normal lifecycle rules.',
-        parameters: [{ name: 'entry', description: 'Current Loader entry, also used to detect replacement during the write.' }, { name: 'change', description: 'Derive a raw config from the current entry and its inherited layer.' }, { name: 'signal', description: 'Cancel while waiting for HMR admission; admitted writes finish normally.' }],
+        parameters: [{ name: 'entry', description: 'Current Loader entry, also used to detect replacement during the write.' }, { name: 'change', description: 'Derive a raw config from the current entry and its inherited layer.' }],
         returns: 'Fulfillment after Loader reconciliation completes.',
       },
     ],
@@ -928,7 +928,7 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         returns: 'Completion after the shared runtime reload; already-persistent runtimes are left intact.',
       },
       {
-        signature: '@Remote applications(): CuaApplicationState',
+        signature: '@Remote applications(): Promise<CuaApplicationState>',
         description: 'Read application decisions without waiting for the native helper.',
         parameters: [],
         returns: 'Saved grants and refused applications with their persistence owner.',
@@ -1382,9 +1382,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         parameters: [],
       },
       {
-        signature: 'runExclusive<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>',
+        signature: 'runExclusive<T>(operation: () => Promise<T>): Promise<T>',
         description: 'Serialize a caller-owned mutation with all automatic reload paths.',
-        parameters: [{ name: 'operation', description: 'Work that must not overlap module or configuration replacement.' }, { name: 'signal', description: 'Cancel admission while queued; an operation already running must finish.' }],
+        parameters: [{ name: 'operation', description: 'Work that must not overlap module or configuration replacement.' }],
         returns: 'The operation result after its asynchronous work completes.',
       },
       {
@@ -2785,9 +2785,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
         parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'section', description: 'Complete form values.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }],
       },
       {
-        signature: 'async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void>',
+        signature: 'async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>',
         description: 'Apply field edits without restating redacted secrets; unsetting an array index removes its element.',
-        parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'ops', description: 'Ordered form edits.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }, { name: 'signal', description: 'Cancel while waiting for HMR admission; admitted writes finish normally.' }],
+        parameters: [{ name: 'ns', description: 'Profile entry id.' }, { name: 'ops', description: 'Ordered form edits.' }, { name: 'expectedRevision', description: 'Revision returned by describe.' }],
       },
     ],
   },
@@ -5417,7 +5417,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'CuaApplicationState',
-    declaration: 'export interface CuaApplicationState {\n    settingsNamespace: string | null;\n    allowedApps: readonly CuaApplicationGrant[];\n    blockedApps: readonly CuaApplicationGrant[];\n    persistentAvailable: boolean;\n}',
+    declaration: 'export interface CuaApplicationState {\n    allowedApps: readonly CuaApplicationGrant[];\n    blockedApps: readonly CuaApplicationGrant[];\n    persistentAvailable: boolean;\n}',
   },
   {
     name: 'CuaPermissionProcess',
diff --git a/packages/settings/settings/README.i18n.yaml b/packages/settings/settings/README.i18n.yaml
index 190c34df59..46348fd8da 100644
--- a/packages/settings/settings/README.i18n.yaml
+++ b/packages/settings/settings/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 23386452a66b2fbd
   zh: 70bba862b949b652
 /deepseek-ai-dsh-settings/use-this-package:
-  en: ae4733d0b646cc71
-  zh: 86a1fa8d8d1fa077
+  en: e0f5e49cf8137839
+  zh: bdd8aff9b7773e5a
 /deepseek-ai-dsh-settings/understand-the-implementation:
   en: d8eae17e891ff44e
   zh: 05189989b2786002
diff --git a/packages/settings/settings/README.md b/packages/settings/settings/README.md
index 70e855128f..740996e34b 100644
--- a/packages/settings/settings/README.md
+++ b/packages/settings/settings/README.md
@@ -30,8 +30,6 @@ Mount this plugin with Loader and [config-editor](../../boot/config-editor/READM
   name: '@deepseek-ai/dsh-settings'
 ```
 
-`mutate()` accepts an optional `signal` to cancel a write waiting for HMR admission. Admitted writes finish normally.
-
 This plugin has no configuration fields. Forms expose only volatile fields from active, uniquely addressed profile entries. Ordinary configuration remains editable through Cordis configuration files.
 
 Once the Loader has settled every entry after Settings starts, a `settings.yaml` left in the harness home by earlier releases is imported once: each section is written into the entry of the same id (`ui-developer-tools` → `ui-settings`, `ui-onboarding` → `ui-settings-general`, `shell` → the platform's shell executor entry), the file is renamed to `settings.yaml.imported` before the first write, and a section the running composition rejects is logged and stays only in the renamed file.
diff --git a/packages/settings/settings/README.zh.md b/packages/settings/settings/README.zh.md
index ab1d6f73b1..c8fae11993 100644
--- a/packages/settings/settings/README.zh.md
+++ b/packages/settings/settings/README.zh.md
@@ -30,8 +30,6 @@ kind: "package-reference"
   name: '@deepseek-ai/dsh-settings'
 ```
 
-`mutate()` 接受可选 `signal`，用于取消等待 HMR 调度的写入。已经开始的写入仍会完成。
-
 此插件没有配置字段。表单只展示活动且可唯一定位的 profile 条目中的 volatile 字段。普通配置仍通过 Cordis 配置文件编辑。
 
 Settings 启动后、Loader 完成所有条目的加载时，早期版本留在 harness home 中的 `settings.yaml` 会被导入一次：每个 section 写入同名条目（`ui-developer-tools` → `ui-settings`、`ui-onboarding` → `ui-settings-general`、`shell` → 当前平台的 shell 执行器条目），文件在第一次写入前改名为 `settings.yaml.imported`，被当前组合拒绝的 section 会记录日志并只保留在改名后的文件中。
diff --git a/packages/settings/settings/src/index.ts b/packages/settings/settings/src/index.ts
index 9dc30c54b6..e0586ecb24 100644
--- a/packages/settings/settings/src/index.ts
+++ b/packages/settings/settings/src/index.ts
@@ -363,22 +363,21 @@ export class SettingsForms extends Service {
    * @param ns Profile entry id.
    * @param ops Ordered form edits.
    * @param expectedRevision Revision returned by describe.
-   * @param signal Cancel while waiting for HMR admission; admitted writes finish normally.
    */
-  async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number, signal?: AbortSignal): Promise<void> {
+  async mutate(ns: string, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void> {
     await this.write(ns, (current, base, schema) => ops.reduce((value, op) => {
       if (op.op === 'set') return applyPathOp(value, op, schema)
       const parent = op.path.slice(0, -1).reduce<unknown>((node, key) => member(node, key), value)
       if (Array.isArray(parent)) return applyPathOp(value, op, schema)
       const inherited = op.path.reduce<unknown>((node, key) => member(node, key, true), base)
       return applyPathOp(value, inherited === undefined ? op : { op: 'set', path: op.path, value: inherited }, schema)
-    }, current), expectedRevision, ops.map(op => op.path), signal)
+    }, current), expectedRevision, ops.map(op => op.path))
   }
 
   private async write(
     ns: string,
     change: (current: Record<string, unknown>, base: Record<string, unknown>, schema: z) => Record<string, unknown>,
-    expected?: number, paths: readonly (readonly string[])[] = [], signal?: AbortSignal,
+    expected?: number, paths: readonly (readonly string[])[] = [],
   ): Promise<void> {
     const entry = this.ownerContext.configEditor.entries().find(row => row.options.id === ns)
     const schema = entry === undefined ? undefined : this.schema(entry)
@@ -419,7 +418,7 @@ export class SettingsForms extends Service {
         return result
       }
       return mergeLayers(strip(raw, form), next) as Record<string, unknown>
-    }, signal)
+    })
     this.describe()
   }
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 34239c9456..57ebf491b2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -8643,9 +8643,15 @@ importers:
       '@deepseek-ai/dsh-session-projection':
         specifier: workspace:*
         version: link:../../session/session-projection
-      '@deepseek-ai/dsh-settings':
+      '@deepseek-ai/dsh-storage':
         specifier: workspace:*
-        version: link:../../settings/settings
+        version: link:../../storage/storage
+      '@deepseek-ai/dsh-storage-domain':
+        specifier: workspace:*
+        version: link:../../storage/storage-domain
+      '@deepseek-ai/dsh-storage-json':
+        specifier: workspace:*
+        version: link:../../storage/storage-json
       '@deepseek-ai/dsh-subprocess':
         specifier: workspace:*
         version: link:../../subprocess/subprocess
@@ -8771,6 +8777,15 @@ importers:
       '@deepseek-ai/dsh-settings':
         specifier: workspace:*
         version: link:../../settings/settings
+      '@deepseek-ai/dsh-storage':
+        specifier: workspace:*
+        version: link:../../storage/storage
+      '@deepseek-ai/dsh-storage-domain':
+        specifier: workspace:*
+        version: link:../../storage/storage-domain
+      '@deepseek-ai/dsh-storage-json':
+        specifier: workspace:*
+        version: link:../../storage/storage-json
       '@deepseek-ai/dsh-subprocess':
         specifier: workspace:*
         version: link:../../subprocess/subprocess

From b788fd3add669cbc98564605524c1c788339ebc1 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 18:58:55 +0800
Subject: [PATCH 21/44] fix(cua): isolate application leases from permission
 storage reads

---
 ...0-19-cua-profile-consent-storage.i18n.yaml |  8 ++---
 .../2026-10-19-cua-profile-consent-storage.md |  4 +--
 ...26-10-19-cua-profile-consent-storage.zh.md |  4 +--
 docs/subsystems/computer-use.md               |  4 +--
 docs/subsystems/computer-use.zh.md            |  4 +--
 .../tests/provider-lifecycle.spec.ts          |  1 +
 packages/experimental/cua/README.i18n.yaml    |  4 +--
 packages/experimental/cua/README.md           |  2 +-
 packages/experimental/cua/README.zh.md        |  2 +-
 packages/experimental/cua/src/access.ts       |  4 +--
 .../cua/src/application-access.ts             | 32 ++++++++++++-------
 .../experimental/cua/src/permission-store.ts  | 21 +++++++++++-
 .../experimental/cua/tests/access.spec.ts     | 21 ++++++++++++
 .../cua/tests/permission-store.spec.ts        | 18 +++++++++++
 .../extensions/tool-cordis/src/api-catalog.ts |  4 +--
 15 files changed, 101 insertions(+), 32 deletions(-)

diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
index 3a80ff1466..8b9d673b1e 100644
--- a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.i18n.yaml
@@ -9,11 +9,11 @@
   en: f2c70036a57ddb41
   zh: 9bbbf3dd09d486f5
 /agent-note-durable-computer-use-consent-within-one-profile/decision:
-  en: 977254fd3af9e946
-  zh: 09a17fb5b9a56d07
+  en: 1df102f3d0440a6a
+  zh: 3456af8e552729a3
 /agent-note-durable-computer-use-consent-within-one-profile/alternatives-considered:
-  en: 1c2cbc7630e0aa5c
-  zh: 444a58df3fa1c481
+  en: 2af74afa3ecaf3b9
+  zh: 96f7f43c5d1150df
 /agent-note-durable-computer-use-consent-within-one-profile/consequences:
   en: 66fe232589e46d64
   zh: fc69831be76248d9
diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
index d8699909ab..a7134629c7 100644
--- a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.md
@@ -12,7 +12,7 @@ Application grants stored as plugin configuration make each authorization change
 
 The CUA owner uses the existing domain storage service, with one domain per canonical profile directory. It stores long-term grants and conversation decisions by native application identity. Conversation IDs scope permission without turning it into permission for every conversation. The native identity policy remains owned by [application consent](2026-09-26-cua-application-consent.md); this note replaces only that note's storage and restart-lifetime choices.
 
-Every operation opens fresh domain state while holding the profile's existing file-lock primitive and closes the domain before releasing the lock. Authorized native dispatch holds the same lock until it settles. Revocation cancels this process's affected work first, then commits after other processes' already-admitted operations have finished. A completed revocation therefore leaves no operation using the old authority. App-wide revocation generations and per-conversation decision revisions prevent an old handle or delayed answer from restoring revoked access.
+Every operation opens fresh domain state while holding the profile's existing file-lock primitive and closes the domain before releasing the lock. Native dispatch and revocation use a separate lock for the selected application. Storage reads and unrelated applications remain available during a native call. Revocation cancels this process's affected work first, then commits after other processes' already-admitted operations have finished. A completed revocation therefore leaves no operation using the old authority. App-wide revocation generations and per-conversation decision revisions prevent an old handle or delayed answer from restoring revoked access.
 
 The JSON backend remains the shipped default. The domain name contains the SHA-256 digest of the canonical profile directory, isolating profiles that share one storage root. Legacy `allowedApps` is imported once; a persisted migration marker prevents an old configuration from restoring a revoked grant. Users can remove that configuration after checking the migrated list. Corrupt or unavailable profile storage fails closed. A composition without a profile has only temporary conversation state.
 
@@ -22,7 +22,7 @@ The JSON backend remains the shipped default. The domain name contains the SHA-2
 
 **Keep one domain open and rely on change events.** Domain notifications are process-local. Another host could continue to use stale grants after revocation.
 
-**Add a new watcher, revision file or authorization broker.** The existing domain and file-lock primitives provide fresh reads and serialized operation admission without a new shared storage or IPC framework. This choice trades concurrent native operations within one profile for a clear revocation completion point.
+**Add a new watcher, revision file or authorization broker.** The existing domain and file-lock primitives provide fresh reads and serialized operation admission without a new shared storage or IPC framework. Operations on the same application are serialized across processes; other applications and their conversation decisions remain independent.
 
 ## Consequences
 
diff --git a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
index c68b9e5f3a..6f6eccbc56 100644
--- a/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
+++ b/.agents/notes/implemented/architecture/2026-10-19-cua-profile-consent-storage.zh.md
@@ -12,7 +12,7 @@ Status: implemented
 
 CUA 使用现有域存储服务，每个 profile 的真实目录对应独立存储域，按本机应用身份保存长期许可和会话决定。对话 ID 限定权限范围，不把本会话许可扩展为所有对话的许可。本机身份规则仍由[应用授权](2026-09-26-cua-application-consent.zh.md)负责，本记录仅替代其中的存储和重启后有效期选择。
 
-每个操作使用现有文件锁，在 profile 锁内打开并读取最新存储状态，关闭域后才释放锁。已授权的原生操作持锁直到结束。撤销先取消本进程中受影响的工作，再等待其他进程已获准执行的操作结束后提交。因此，撤销完成后不会留下仍使用旧授权的操作。应用级撤销代次和各对话的决定版本，阻止旧句柄或迟到回答恢复被撤销的访问权限。
+每个操作使用现有文件锁，在 profile 锁内打开并读取最新存储状态，关闭域后才释放锁。原生操作和撤销使用单独的目标应用锁；原生调用期间仍可读取存储或访问其他应用。撤销先取消本进程中受影响的工作，再等待其他进程已获准执行的操作结束后提交。因此，撤销完成后不会留下仍使用旧授权的操作。应用级撤销代次和各对话的决定版本，阻止旧句柄或迟到回答恢复被撤销的访问权限。
 
 随附配置继续使用 JSON 后端。域名包含 profile 真实目录的 SHA-256 摘要，隔离共用存储根目录的不同 profile。旧 `allowedApps` 只导入一次，持久化迁移标记阻止旧配置恢复已撤销的许可。用户确认列表迁移完成后可删除旧配置。profile 存储损坏或不可用时拒绝访问。没有 profile 的组合只保留临时会话状态。
 
@@ -22,7 +22,7 @@ CUA 使用现有域存储服务，每个 profile 的真实目录对应独立存
 
 **长期打开域并依赖变更事件。** 域事件只在进程内传播，另一个宿主可能在撤销后继续使用旧许可。
 
-**增加新的监听器、版本文件或授权代理。** 现有域存储和文件锁已经能提供最新状态与串行准入，无须增加通用存储或 IPC 框架。代价是同一 profile 内的原生操作串行执行，换取明确的撤销完成点。
+**增加新的监听器、版本文件或授权代理。** 现有域存储和文件锁已经能提供最新状态与串行准入，无须增加通用存储或 IPC 框架。不同进程对同一应用的操作串行执行，其他应用及其会话决定保持独立。
 
 ## 后果
 
diff --git a/docs/subsystems/computer-use.md b/docs/subsystems/computer-use.md
index 55444c7c10..3ca3c0f996 100644
--- a/docs/subsystems/computer-use.md
+++ b/docs/subsystems/computer-use.md
@@ -85,8 +85,8 @@ Browser controls for provider-owned native permission and application decisions.
 @Remote async enablePersistentPtc(): Promise<void>
 
 /**
- * Read application decisions without waiting for the native helper.
- * @returns Saved grants and refused applications with their persistence owner.
+ * Read fresh stored application decisions without issuing a native request.
+ * @returns Saved grants, refused applications and durable-storage availability.
  */
 @Remote applications(): Promise<CuaApplicationState>
 
diff --git a/docs/subsystems/computer-use.zh.md b/docs/subsystems/computer-use.zh.md
index c88dc9e479..8f92700783 100644
--- a/docs/subsystems/computer-use.zh.md
+++ b/docs/subsystems/computer-use.zh.md
@@ -85,8 +85,8 @@ Browser controls for provider-owned native permission and application decisions.
 @Remote async enablePersistentPtc(): Promise<void>
 
 /**
- * Read application decisions without waiting for the native helper.
- * @returns Saved grants and refused applications with their persistence owner.
+ * Read fresh stored application decisions without issuing a native request.
+ * @returns Saved grants, refused applications and durable-storage availability.
  */
 @Remote applications(): Promise<CuaApplicationState>
 
diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index dfdef7bfde..9665dfdced 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -709,6 +709,7 @@ it('stores revocation without entering the HMR configuration queue', async () =>
   const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
   await entry.update({ disabled: true })
   await entry.update({ disabled: false })
+  await f.ctx.loader.await()
   expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
 })
 
diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index 2140e30b24..734eecdddc 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: 33e2ce6748f23743
   zh: 4c2f53e92231859f
 /deepseek-ai-dsh-cua/understand-the-implementation:
-  en: c31e18d5f70c08f2
-  zh: 2a2925201bb924a9
+  en: 82a91b10bc505310
+  zh: 5c3ad0152c14d5fb
 /deepseek-ai-dsh-cua/further-exploration:
   en: 166e3c1f9a67f753
   zh: 698c5136c5350052
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index ae9ece5c8a..9ad59ec4a7 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -49,7 +49,7 @@ Actions return `dispatched:true, verified:false`; read fresh state to verify the
 <details>
 <summary>Shared execution and platform ownership</summary>
 
-The [permission store](src/permission-store.ts) uses `storageDomain` with the configured backend. The default JSON backend writes `$DSH_HOME/storages/cua_permissions_<sha256>.json`, where the digest identifies the canonical profile directory. Each authorized native operation opens fresh state under the profile's file lock and closes its domain afterward. Revocation waits for operations already admitted by another process; after it completes, every process rejects old handles. Files on different machines or PID namespaces must not share this lock.
+The [permission store](src/permission-store.ts) uses `storageDomain` with the configured backend. The default JSON backend writes `$DSH_HOME/storages/cua_permissions_<sha256>.json`, where the digest identifies the canonical profile directory. Each authorization check opens fresh state under the profile's file lock and closes its domain afterward; native dispatch uses a separate application lock. Revocation waits for operations already admitted by another process; after it completes, every process rejects old handles. Files on different machines or PID namespaces must not share this lock.
 
 Legacy `allowedApps` are imported on first store access and never reapplied after migration. The old configuration can be removed after checking the permission page. Grants, denials and the option to ask again are durable; the page still omits conversation-only grants. Standalone compositions without a profile retain only process-local decisions; a profile without domain storage refuses authorization operations.
 
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index 6cb6d5ddcc..7f07e70793 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -49,7 +49,7 @@ kind: "package-library"
 <details>
 <summary>共享执行与平台职责</summary>
 
-[授权存储](src/permission-store.ts)复用 `storageDomain` 和配置的后端。默认 JSON 后端写入 `$DSH_HOME/storages/cua_permissions_<sha256>.json`，摘要对应 profile 的真实目录。每次原生操作在该 profile 的文件锁内打开并读取最新状态，结束后关闭存储域。撤销会等待其他进程已获准执行的操作结束；撤销完成后，各进程都拒绝旧句柄。不同电脑或 PID 命名空间不能共享这把锁。
+[授权存储](src/permission-store.ts)复用 `storageDomain` 和配置的后端。默认 JSON 后端写入 `$DSH_HOME/storages/cua_permissions_<sha256>.json`，摘要对应 profile 的真实目录。每次授权检查在 profile 文件锁内打开并读取最新状态，随后关闭存储域；原生操作使用单独的应用锁。撤销会等待其他进程已获准执行的操作结束；撤销完成后，各进程都拒绝旧句柄。不同电脑或 PID 命名空间不能共享这把锁。
 
 旧 `allowedApps` 只在首次访问存储时导入，迁移后不再应用。确认权限页显示正确后，可以删除旧配置。授权、拒绝和允许再次询问均持久化，页面仍不显示仅对某个会话生效的许可。没有 profile 的独立组合只保留进程内决定；有 profile 但缺少域存储的组合会拒绝授权操作。
 
diff --git a/packages/experimental/cua/src/access.ts b/packages/experimental/cua/src/access.ts
index b28ec6fc68..1fc9dbb72c 100644
--- a/packages/experimental/cua/src/access.ts
+++ b/packages/experimental/cua/src/access.ts
@@ -64,8 +64,8 @@ export class CuaAccess extends TypertRemoteService {
   }
 
   /**
-   * Read application decisions without waiting for the native helper.
-   * @returns Saved grants and refused applications with their persistence owner.
+   * Read fresh stored application decisions without issuing a native request.
+   * @returns Saved grants, refused applications and durable-storage availability.
    */
   @Remote
   applications(): Promise<CuaApplicationState> { return this.policy.status() }
diff --git a/packages/experimental/cua/src/application-access.ts b/packages/experimental/cua/src/application-access.ts
index 26832c3e6c..8f81baaea1 100644
--- a/packages/experimental/cua/src/application-access.ts
+++ b/packages/experimental/cua/src/application-access.ts
@@ -86,15 +86,17 @@ export class ApplicationAccess {
    */
   async revoke(id: CuaApplicationId): Promise<void> {
     this.lifetime.signal.throwIfAborted()
+    id = ApplicationAuthorizationResult.shape.id.parse(id)
     const clients = this.invalidate(id)
-    const before = await this.read(id)
-    if (before.always && !this.options.store.persistent) throw new Error('Application permissions cannot be saved in this composition')
-    await this.options.store.withState(this.lifetime.signal, async (transaction) => {
-      const app = transaction.state.applications[id] ?? this.empty()
-      await this.save(transaction, id, { revoked: app.revoked + 1, sessions: Object.fromEntries(
-        Object.entries(app.sessions).map(([sessionId, session]) => [sessionId, { ...session, decision: 'deny' as const, revision: session.revision + 1 }]),
-      ) })
-    })
+    await this.options.store.withApplication(id, this.lifetime.signal, () =>
+      this.options.store.withState(this.lifetime.signal, async (transaction) => {
+        const app = transaction.state.applications[id] ?? this.empty()
+        if (app.always && !this.options.store.persistent) throw new Error('Application permissions cannot be saved in this composition')
+        await this.save(transaction, id, { revoked: app.revoked + 1, sessions: Object.fromEntries(
+          Object.entries(app.sessions).map(([sessionId, session]) => [sessionId, { ...session, decision: 'deny' as const, revision: session.revision + 1 }]),
+        ) })
+      }),
+    )
     const results = await Promise.allSettled([
       ...clients.map(client => client.dispose()),
       ...[...this.active].filter(operation => operation.identity.id === id).map(operation => operation.done.promise),
@@ -109,6 +111,7 @@ export class ApplicationAccess {
    * @returns Completion after the new asking policy is durable.
    */
   async retryApproval(id: CuaApplicationId): Promise<void> {
+    id = ApplicationAuthorizationResult.shape.id.parse(id)
     await this.options.store.withState(this.lifetime.signal, async (transaction) => {
       const app = transaction.state.applications[id]
       if (!app || !Object.values(app.sessions).some(session => session.decision === 'deny')) return
@@ -134,7 +137,11 @@ export class ApplicationAccess {
       signal.throwIfAborted()
       const observed = await this.read(identity.id, signal)
       const existing = this.clients.get(client)?.handles.get(handle)
-      if (!client.disposed && existing && this.permitted(existing, observed)) return
+      if (!client.disposed && existing) {
+        if (this.permitted(existing, observed)) return
+        this.invalidate(identity.id, agent)
+        throw new NativeError('APP_ACCESS_REVOKED', 'Application access changed; acquire a fresh application handle after consent')
+      }
       const saved = identity.persistable && observed.always !== undefined
       const decision = observed.sessions[agent.id]
       let scope: Selection['scope'] = saved ? 'persistent' : 'session'
@@ -184,6 +191,7 @@ export class ApplicationAccess {
           throw this.denied(identity)
         }
       }
+      if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
       const authorized = await this.options.store.withState(signal, async (transaction) => {
         signal.throwIfAborted()
         const app = transaction.state.applications[identity.id] ?? this.empty()
@@ -236,8 +244,10 @@ export class ApplicationAccess {
     if (!state || !selected) throw new NativeError('APP_ACCESS_REQUIRED', 'Select the application with getApp and obtain user consent before reading or controlling it')
     if (selected.lifetime.signal.aborted) throw new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application')
     const lifetime = AbortSignal.any([signal, this.lifetime.signal, selected.lifetime.signal])
-    return this.options.store.withState(lifetime, async ({ state: permissions }) => {
-      if (!this.permitted(selected, permissions.applications[selected.identity.id] ?? this.empty())) {
+    return this.options.store.withApplication(selected.identity.id, lifetime, async () => {
+      const permitted = await this.options.store.withState(lifetime, ({ state: permissions }) =>
+        this.permitted(selected, permissions.applications[selected.identity.id] ?? this.empty()))
+      if (!permitted) {
         this.invalidate(selected.identity.id, state.agent)
         throw new NativeError('APP_ACCESS_REVOKED', 'Application access was revoked; stop using this application')
       }
diff --git a/packages/experimental/cua/src/permission-store.ts b/packages/experimental/cua/src/permission-store.ts
index bf50b25bee..8d1d5bbfc3 100644
--- a/packages/experimental/cua/src/permission-store.ts
+++ b/packages/experimental/cua/src/permission-store.ts
@@ -64,7 +64,7 @@ export class CuaPermissionStore {
   /**
    * Serialize a read, write, or authorized dispatch against all other users of this profile.
    * @param signal Cancellation while waiting; admitted operations own their cancellation.
-   * @param operation Work using fresh state. Native dispatch keeps the lock until it settles.
+   * @param operation Work using fresh state. Native dispatch uses its separate application lease.
    * @returns The operation's result after its domain handle has closed.
    */
   withState<T>(signal: AbortSignal, operation: (transaction: PermissionTransaction) => T | Promise<T>): Promise<T> {
@@ -73,6 +73,25 @@ export class CuaPermissionStore {
     void pending.finally(() => { this.pending.delete(pending) }).catch(() => {})
     return pending
   }
+  /**
+   * Coordinate native dispatch and whole-application revocation without blocking other applications.
+   * @param id Validated native application identity.
+   * @param signal Cancellation while waiting for admission.
+   * @param operation Authorized dispatch or revocation, after checking fresh state separately.
+   * @returns Result after releasing the application lease.
+   */
+  withApplication<T>(id: CuaApplicationId, signal: AbortSignal, operation: () => Promise<T>): Promise<T> {
+    const pending = (async () => {
+      signal.throwIfAborted()
+      if (this.directory === undefined) return operation()
+      const directory = await realpath(this.directory)
+      return withFileLock(join(directory, `cua-application-${id}`), operation, { signal, waitMs: this.waitMs })
+    })()
+    this.pending.add(pending)
+    void pending.finally(() => { this.pending.delete(pending) }).catch(() => {})
+    return pending
+  }
+
   /** Join accepted operations before withdrawing this provider. */
   async drain(): Promise<void> { await Promise.allSettled(this.pending) }
 
diff --git a/packages/experimental/cua/tests/access.spec.ts b/packages/experimental/cua/tests/access.spec.ts
index 605aefcecb..3faf63eea2 100644
--- a/packages/experimental/cua/tests/access.spec.ts
+++ b/packages/experimental/cua/tests/access.spec.ts
@@ -423,3 +423,24 @@ it('configures persistent PTC through the existing profile editor only on explic
   await f.ctx.cuaAccess.enablePersistentPtc()
   expect(edit).toHaveBeenCalledOnce()
 })
+
+it('rejects invalid application identities before a permission file or native handle can be touched', async () => {
+  const f = await setup()
+  const invalid = '../another-profile' as import('../src/application-types.ts').CuaApplicationId
+  await expect(f.ctx.cuaAccess.revoke(invalid)).rejects.toThrow()
+  await expect(f.ctx.cuaAccess.retryApproval(invalid)).rejects.toThrow()
+  expect(f.save).not.toHaveBeenCalled()
+  expect(f.client.disposed).toBe(false)
+})
+
+it('does not reactivate old handles when stored permission was revoked and later restored', async () => {
+  const f = await setup('Always allow')
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.save([])
+  await f.save([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_REVOKED')
+  expect(f.client.disposed).toBe(true)
+  const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  await f.access.select(f.agent, replacement, handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledOnce()
+})
diff --git a/packages/experimental/cua/tests/permission-store.spec.ts b/packages/experimental/cua/tests/permission-store.spec.ts
index ab10c29ddf..9f0e176259 100644
--- a/packages/experimental/cua/tests/permission-store.spec.ts
+++ b/packages/experimental/cua/tests/permission-store.spec.ts
@@ -135,3 +135,21 @@ it('uses temporary decisions only without a profile and fails when profile stora
   await a.domain.dispose()
   await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toThrow('require storageDomain')
 })
+
+it('keeps storage reads and other applications available while one native operation holds its lease', async () => {
+  const f = await setup(), a = await f.open(), b = await f.open()
+  const entered = Promise.withResolvers<undefined>(), release = Promise.withResolvers<undefined>()
+  onTestFinished(() => { release.resolve(undefined) })
+  const active = a.store.withApplication(grant.id, signal, async () => { entered.resolve(undefined); await release.promise })
+  await entered.promise
+  expect(await b.store.withState(signal, transaction => transaction.state.migrated)).toBe(true)
+  expect(await b.store.withApplication('b'.repeat(64) as CuaApplicationId, signal, async () => 'independent')).toBe('independent')
+  const waiting = new AbortController()
+  const blocked = b.store.withApplication(grant.id, waiting.signal, async () => 'must not run')
+  const rejected = expect(blocked).rejects.toThrow('cancelled')
+  waiting.abort(new Error('cancelled'))
+  await rejected
+  release.resolve(undefined); await active
+  await expect(b.store.withApplication(grant.id, signal, async () => { throw new Error('dispatch failed') })).rejects.toThrow('dispatch failed')
+  expect(await a.store.withApplication(grant.id, signal, async () => 'released')).toBe('released')
+})
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index a71dc8a28e..1aca345241 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -929,9 +929,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
       },
       {
         signature: '@Remote applications(): Promise<CuaApplicationState>',
-        description: 'Read application decisions without waiting for the native helper.',
+        description: 'Read fresh stored application decisions without issuing a native request.',
         parameters: [],
-        returns: 'Saved grants and refused applications with their persistence owner.',
+        returns: 'Saved grants, refused applications and durable-storage availability.',
       },
       {
         signature: '@Remote async systemStatus(): Promise<CuaSystemPermissionState>',

From 39347a3f244cc8a3d81cb5a8a839374bd59f06d3 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:03:36 +0800
Subject: [PATCH 22/44] test(cua): await provider disposal before restoring
 permission state

---
 docs/event-producer-consumer.md                                 | 2 +-
 docs/event-producer-consumer.zh.md                              | 2 +-
 .../experimental/cua-macos/tests/provider-lifecycle.spec.ts     | 2 ++
 packages/experimental/cua/src/permission-store.ts               | 2 +-
 packages/experimental/cua/tests/access.spec.ts                  | 2 +-
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md
index a4989de8ce..3ce41e4fba 100644
--- a/docs/event-producer-consumer.md
+++ b/docs/event-producer-consumer.md
@@ -103,7 +103,7 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `internal/service` | - | `gateway` |
 | `internal/status` | - | [`agent`](../packages/core/agent), `inspector`, `translator`, [`web`](../packages/web/web) |
 | `internal/update` | - | [`app-boot`](../packages/boot/app-boot) |
-| `loader/volatile-update` | - | [`cua`](../packages/experimental/cua), [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`plugin-market`](../packages/boot/plugin-market), `product-analytics`, `speech-to-text` |
+| `loader/volatile-update` | - | [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`plugin-market`](../packages/boot/plugin-market), `product-analytics`, `speech-to-text` |
 | `slots/changed` | `ui-renderer` (`emit`) | - |
 <!-- END GENERATED event-producer-consumer:undeclared -->
 
diff --git a/docs/event-producer-consumer.zh.md b/docs/event-producer-consumer.zh.md
index 1b30db518a..0398a6eb73 100644
--- a/docs/event-producer-consumer.zh.md
+++ b/docs/event-producer-consumer.zh.md
@@ -105,7 +105,7 @@
 | `internal/service` | - | `gateway` |
 | `internal/status` | - | [`agent`](../packages/core/agent), `inspector`, `translator`, [`web`](../packages/web/web) |
 | `internal/update` | - | [`app-boot`](../packages/boot/app-boot) |
-| `loader/volatile-update` | - | [`cua`](../packages/experimental/cua), [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`plugin-market`](../packages/boot/plugin-market), `product-analytics`, `speech-to-text` |
+| `loader/volatile-update` | - | [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai), [`plugin-market`](../packages/boot/plugin-market), `product-analytics`, `speech-to-text` |
 | `slots/changed` | `ui-renderer` (`emit`) | - |
 <!-- END GENERATED event-producer-consumer:undeclared -->
 
diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index 9665dfdced..950cd98d8f 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -707,7 +707,9 @@ it('stores revocation without entering the HMR configuration queue', async () =>
   release.resolve(undefined)
   await blocked
   const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
+  const stopping = entry.fiber!
   await entry.update({ disabled: true })
+  await stopping.dispose()
   await entry.update({ disabled: false })
   await f.ctx.loader.await()
   expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
diff --git a/packages/experimental/cua/src/permission-store.ts b/packages/experimental/cua/src/permission-store.ts
index 8d1d5bbfc3..d4d3bc752a 100644
--- a/packages/experimental/cua/src/permission-store.ts
+++ b/packages/experimental/cua/src/permission-store.ts
@@ -101,7 +101,7 @@ export class CuaPermissionStore {
         signal.throwIfAborted()
         return operation({ state: this.memory, save: (next) => { this.memory = next; return Promise.resolve() } })
       }
-      const pending = this.tail.then(run, run)
+      const pending = this.tail.then(run)
       this.tail = pending.then(() => {}, () => {})
       return pending
     }
diff --git a/packages/experimental/cua/tests/access.spec.ts b/packages/experimental/cua/tests/access.spec.ts
index 3faf63eea2..fe395ea805 100644
--- a/packages/experimental/cua/tests/access.spec.ts
+++ b/packages/experimental/cua/tests/access.spec.ts
@@ -438,7 +438,7 @@ it('does not reactivate old handles when stored permission was revoked and later
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await f.save([])
   await f.save([{ id: identity.id, name: identity.name, executablePath: identity.executablePath }])
-  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_REVOKED')
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
   expect(f.client.disposed).toBe(true)
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await f.access.select(f.agent, replacement, handle, identity, signal)

From 5b4f3e3cfac6d22ecdf7e7567ed3a275cfd82d1f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:10:36 +0800
Subject: [PATCH 23/44] test(cua): keep external permission writer source
 independent

---
 .../tests/fixtures/permission-store-worker.ts | 40 +++++++------------
 .../cua/tests/permission-store.spec.ts        |  5 ++-
 2 files changed, 18 insertions(+), 27 deletions(-)

diff --git a/packages/experimental/cua/tests/fixtures/permission-store-worker.ts b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
index a1b5f6d5ff..5a30c72de6 100644
--- a/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
+++ b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
@@ -1,26 +1,16 @@
-/** Independent process used to verify fresh authorization reads over the production JSON backend. */
-import { Context } from '@deepseek-ai/cordis'
-import Storage from '@deepseek-ai/dsh-storage'
-import * as JsonStorage from '@deepseek-ai/dsh-storage-json'
-import * as Domains from '@deepseek-ai/dsh-storage-domain'
-import { CuaPermissionStore } from '../../src/permission-store.ts'
-import type { CuaApplicationId } from '../../src/application-types.ts'
+/** External file writer used to verify that an open provider reloads durable authorization. */
+import { readFile, rename, writeFile } from 'node:fs/promises'
 
-const [root, directory, id] = process.argv.slice(2)
-if (!root || !directory || !id) throw new Error('Expected storage root, profile directory and application id')
-const ctx = new Context()
-try {
-  ctx.provide('profileContext', { dir: directory })
-  await ctx.plugin(Storage)
-  await ctx.plugin(JsonStorage, { root })
-  await ctx.plugin(Domains, { backend: 'json' })
-  const store = new CuaPermissionStore(ctx, [], 30_000)
-  await store.withState(new AbortController().signal, async (transaction) => {
-    const existing = transaction.state.applications[id]
-    await transaction.save({ ...transaction.state, applications: { ...transaction.state.applications,
-      [id]: { revoked: (existing?.revoked ?? 0) + 1, sessions: {},
-        always: { id: id as CuaApplicationId, name: 'Other process', executablePath: '/other' } },
-    } })
-  })
-  process.stdout.write('saved\n')
-} finally { await ctx.fiber.dispose() }
+const [file, id] = process.argv.slice(2)
+if (!file || !id) throw new Error('Expected storage file and application id')
+const record = JSON.parse(await readFile(file, 'utf8'))
+const existing = record.global.applications[id]
+record.global.applications[id] = {
+  revoked: (existing?.revoked ?? 0) + 1,
+  sessions: {},
+  always: { id, name: 'Other process', executablePath: '/other' },
+}
+const temporary = `${file}.writer-${process.pid}`
+await writeFile(temporary, JSON.stringify(record))
+await rename(temporary, file)
+process.stdout.write('saved\n')
diff --git a/packages/experimental/cua/tests/permission-store.spec.ts b/packages/experimental/cua/tests/permission-store.spec.ts
index 9f0e176259..4d8c8418d3 100644
--- a/packages/experimental/cua/tests/permission-store.spec.ts
+++ b/packages/experimental/cua/tests/permission-store.spec.ts
@@ -77,8 +77,9 @@ it('reloads another process’s writes instead of reusing an in-memory authoriza
   const f = await setup(), a = await f.open(f.directory, [grant])
   await a.store.withState(signal, transaction => transaction.state)
   const controller = new AbortController()
-  const running = promisify(execFile)(process.execPath, ['--import', 'tsx/esm',
-    fileURLToPath(new URL('./fixtures/permission-store-worker.ts', import.meta.url)), f.storageRoot, f.directory, grant.id,
+  const file = join(f.storageRoot, (await readdir(f.storageRoot))[0]!)
+  const running = promisify(execFile)(process.execPath, [
+    fileURLToPath(new URL('./fixtures/permission-store-worker.ts', import.meta.url)), file, grant.id,
   ], { cwd: process.cwd(), env: { PATH: process.env.PATH }, signal: controller.signal })
   onTestFinished(async () => { controller.abort(); await running.catch(() => {}) })
   expect((await running).stdout).toBe('saved\n')

From fc76fb2ada8277897433b2f156e0217daa696363 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:12:37 +0800
Subject: [PATCH 24/44] test(cua): verify durable consent across complete
 provider restarts

---
 .../tests/provider-lifecycle.spec.ts          |  5 ++-
 .../cua/tests/application-access.spec.ts      | 41 +++++++++++++++++++
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index 950cd98d8f..8f3ffce7d8 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -708,9 +708,10 @@ it('stores revocation without entering the HMR configuration queue', async () =>
   await blocked
   const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
   const stopping = entry.fiber!
-  await entry.update({ disabled: true })
+  const options = { ...entry.options }
+  entry.parent.remove(entry.options.id)
   await stopping.dispose()
-  await entry.update({ disabled: false })
+  await entry.parent.create({ ...options, disabled: false })
   await f.ctx.loader.await()
   expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
 })
diff --git a/packages/experimental/cua/tests/application-access.spec.ts b/packages/experimental/cua/tests/application-access.spec.ts
index ed78a0cbfe..8bbb54c2f4 100644
--- a/packages/experimental/cua/tests/application-access.spec.ts
+++ b/packages/experimental/cua/tests/application-access.spec.ts
@@ -1,5 +1,11 @@
 /** Application decisions are checked at dispatch and revocation cancels owned work. */
 import { Context } from '@deepseek-ai/cordis'
+import { mkdir, mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import Storage from '@deepseek-ai/dsh-storage'
+import * as JsonStorage from '@deepseek-ai/dsh-storage-json'
+import * as Domains from '@deepseek-ai/dsh-storage-domain'
 import { mountAgentLoopTestDependencies, mountAgentLoopTestHarness } from '@deepseek-ai/dsh-agent-loop-testkit'
 import { SessionId } from '@deepseek-ai/dsh-session'
 import UserQuestions, { UserQuestionError, type AskUserQuestionAnswer } from '@deepseek-ai/dsh-user-questions'
@@ -9,6 +15,7 @@ import type { CuaApplicationGrant } from '../src/application-types.ts'
 import type { CuaAppHandle } from '../src/types.ts'
 import { NativeClient } from '../src/native-client.ts'
 import { permissionFixture } from './permission-fixture.ts'
+import { CuaPermissionStore } from '../src/permission-store.ts'
 
 const native = vi.hoisted(() => ({ instances: [] as Array<{
   disposed: boolean
@@ -359,3 +366,37 @@ it('retains conversation consent when the provider is recreated over the same st
   await access.select(f.agent, client, handle, identity, signal)
   expect(f.answer).toHaveBeenCalledOnce()
 })
+
+it('restores consent after a complete context restart only for the original conversation', async () => {
+  const root = await mkdtemp(join(tmpdir(), 'cua-conversation-consent-'))
+  const directory = join(root, 'profile')
+  await mkdir(directory)
+  const contexts: Context[] = []
+  onTestFinished(async () => {
+    for (const ctx of contexts) await ctx.fiber.dispose()
+    await rm(root, { recursive: true, force: true })
+  })
+  const open = async () => {
+    const f = await setup()
+    contexts.push(f.ctx)
+    f.ctx.provide('profileContext', { dir: directory })
+    await f.ctx.plugin(Storage)
+    await f.ctx.plugin(JsonStorage, { root: join(root, 'storages') })
+    await f.ctx.plugin(Domains, { backend: 'json' })
+    const access = new ApplicationAccess(f.ctx, { store: new CuaPermissionStore(f.ctx, [], 1000) })
+    return { ...f, access }
+  }
+  const first = await open()
+  await first.access.select(first.agent, first.client, handle, identity, signal)
+  expect(first.answer).toHaveBeenCalledOnce()
+  await first.ctx.fiber.dispose()
+  const restored = await open()
+  await restored.access.select(restored.agent, restored.client, handle, identity, signal)
+  expect(restored.answer).not.toHaveBeenCalled()
+  await expect(restored.access.run(restored.client, handle, signal, async () => 'read')).resolves.toBe('read')
+  const other = await restored.ctx.agents.create({ sessionId: SessionId('another-conversation') })
+  const client = new NativeClient(restored.ctx, nativeConfig, unusedConnector)
+  await restored.access.select(other.agent, client, handle, identity, signal)
+  expect(restored.answer).toHaveBeenCalledOnce()
+  expect((await restored.access.status()).allowedApps).toEqual([])
+})

From a780875c95577780aa61a9674ce1ee4cd90ef316 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:13:31 +0800
Subject: [PATCH 25/44] test(cua): isolate HMR queue regression from provider
 restart coverage

---
 .../cua-macos/tests/provider-lifecycle.spec.ts            | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
index 8f3ffce7d8..c4947232e4 100644
--- a/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
+++ b/packages/experimental/cua-macos/tests/provider-lifecycle.spec.ts
@@ -706,14 +706,6 @@ it('stores revocation without entering the HMR configuration queue', async () =>
   expect(await readFile(f.profile.patchPath, 'utf8')).toBe(before)
   release.resolve(undefined)
   await blocked
-  const entry = [...f.ctx.loader.entries()].find(entry => entry.options.id === 'cua')!
-  const stopping = entry.fiber!
-  const options = { ...entry.options }
-  entry.parent.remove(entry.options.id)
-  await stopping.dispose()
-  await entry.parent.create({ ...options, disabled: false })
-  await f.ctx.loader.await()
-  expect((await f.ctx.cuaAccess.applications()).allowedApps).toEqual([])
 })
 
 it('stores signed application consent separately from configuration', async () => {

From 435c7c16a6549ed964ee9f1425978bbff48d7d4f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:15:23 +0800
Subject: [PATCH 26/44] test(cua): cover stale permission answers and durable
 write races

---
 apps/web/tests/cua-permissions.e2e.ts         |  2 +-
 .../cua/tests/application-access.spec.ts      | 85 ++++++++++++++++++-
 2 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 4a064c1741..ee5664e059 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -143,7 +143,7 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   await panel.getByText('Fixture', { exact: true }).waitFor({ state: 'hidden' })
   const saved = await readFile(join(scaffold.harnessHome, 'profiles/scaffold/cordis.patch.yml'), 'utf8')
   expect(saved).not.toContain('allowedApps:')
-  const files = await readdir(join(scaffold.harnessHome, 'storages'))
+  const files = await readdir(join(scaffold.workspaceCwd, '.dsh-storages'))
   expect(files.some(file => file.startsWith('cua_permissions_') && file.endsWith('.json'))).toBe(true)
   expect((await scaffold.ctx.cuaAccess.applications()).allowedApps).toEqual([])
   const events = (await readFile(audit, 'utf8')).trim().split('\n').map(line => JSON.parse(line) as { event: string; method: string; params: object })
diff --git a/packages/experimental/cua/tests/application-access.spec.ts b/packages/experimental/cua/tests/application-access.spec.ts
index 8bbb54c2f4..e71b61e955 100644
--- a/packages/experimental/cua/tests/application-access.spec.ts
+++ b/packages/experimental/cua/tests/application-access.spec.ts
@@ -222,7 +222,7 @@ it('keeps another task allowed when the same application is denied in a new task
   await expect(f.access.run(f.client, handle, signal, async () => 'still allowed')).resolves.toBe('still allowed')
 })
 
-it('enforces a removed saved grant before its configuration notification arrives', async () => {
+it('enforces a removed saved grant from fresh storage before dispatch', async () => {
   const f = await setup('Always allow')
   await f.access.select(f.agent, f.client, handle, identity, signal)
   await f.save([])
@@ -352,7 +352,7 @@ it('revokes session consent even after its agent and connection are released', a
   const replacement = new NativeClient(f.ctx, nativeConfig, unusedConnector)
   await expect(f.access.select(f.agent, replacement, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
   expect(f.answer).toHaveBeenCalledOnce()
-  f.access.retryApproval(identity.id)
+  await f.access.retryApproval(identity.id)
   await f.access.select(f.agent, replacement, handle, identity, signal)
   expect(f.answer).toHaveBeenCalledTimes(2)
 })
@@ -400,3 +400,84 @@ it('restores consent after a complete context restart only for the original conv
   expect(restored.answer).toHaveBeenCalledOnce()
   expect((await restored.access.status()).allowedApps).toEqual([])
 })
+
+
+it('revokes an unselected application and clears only refused conversations', async () => {
+  const f = await setup()
+  await f.access.revoke(identity.id)
+  await f.access.retryApproval(identity.id)
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  const owner = await f.ctx.agents.create({ sessionId: SessionId('refused-conversation') })
+  const client = new NativeClient(f.ctx, nativeConfig, unusedConnector)
+  f.answer.mockResolvedValueOnce({ answers: [{ id: 'cua-app-access', selected: ['Deny'] }] })
+  await expect(f.access.select(owner.agent, client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  await f.access.retryApproval(identity.id)
+  await expect(f.access.run(f.client, handle, signal, async () => 'still allowed')).resolves.toBe('still allowed')
+  await f.access.select(owner.agent, new NativeClient(f.ctx, nativeConfig, unusedConnector), handle, identity, signal)
+  expect(f.answer).toHaveBeenCalledTimes(3)
+})
+
+it.each(['revoked', 'session revision'])('rejects a delayed answer after another store writer changes %s', async (change) => {
+  const f = await setup()
+  const answer = Promise.withResolvers<AskUserQuestionAnswer>()
+  const entered: PromiseWithResolvers<void> = Promise.withResolvers()
+  onTestFinished(() => { answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Deny'] }] }) })
+  f.answer.mockImplementationOnce(() => { entered.resolve(); return answer.promise })
+  const pending = f.access.select(f.agent, f.client, handle, identity, signal)
+  const rejected = expect(pending).rejects.toThrow('APP_ACCESS_REVOKED')
+  await entered.promise
+  const { persistable: _persistable, ...grant } = identity
+  await f.store.withState(signal, transaction => transaction.save({ migrated: true, applications: {
+    [identity.id]: { revoked: change === 'revoked' ? 1 : 0, sessions: change === 'session revision' ? {
+      [f.agent.id]: { identity: grant, decision: 'deny', revision: 1 },
+    } : {} },
+  } }))
+  answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Allow for this session'] }] })
+  await rejected
+  const dispatch = vi.fn(async () => null)
+  await expect(f.access.run(f.client, handle, signal, dispatch)).rejects.toThrow('APP_ACCESS_REQUIRED')
+  expect(dispatch).not.toHaveBeenCalled()
+})
+
+it('does not store a cancellation decision after provider disposal starts', async () => {
+  const f = await setup()
+  const answer = Promise.withResolvers<AskUserQuestionAnswer>()
+  const entered: PromiseWithResolvers<void> = Promise.withResolvers()
+  onTestFinished(() => { answer.resolve({ answers: [{ id: 'cua-app-access', selected: ['Deny'] }] }) })
+  f.answer.mockImplementationOnce(() => { entered.resolve(); return answer.promise })
+  const pending = f.access.select(f.agent, f.client, handle, identity, signal)
+  const rejected = expect(pending).rejects.toThrow()
+  await entered.promise
+  const closing = f.access.dispose()
+  answer.reject(new UserQuestionError('provider stopped', 'ASK_CANCELLED'))
+  await rejected; await closing
+  expect(await f.store.withState(signal, transaction => transaction.state.applications)).toEqual({})
+})
+
+it('rejects persistent consent when storage capability disappears before the commit', async () => {
+  const f = await setup('Always allow')
+  const original = vi.mocked(f.store.withState).getMockImplementation()!
+  vi.mocked(f.store.withState).mockImplementationOnce(original).mockImplementationOnce((signal, operation) => {
+    f.setWritable(false)
+    return original(signal, operation)
+  })
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('APP_ACCESS_DENIED')
+  expect(f.grants()).toEqual([])
+})
+
+it('does not attach a native handle that closes while its durable grant is committing', async () => {
+  const f = await setup('Always allow')
+  const save = f.save.getMockImplementation()!
+  f.save.mockImplementationOnce(async (...args) => { await save(...args); f.client.invalidate() })
+  await expect(f.access.select(f.agent, f.client, handle, identity, signal)).rejects.toThrow('NATIVE_CLOSED')
+  await expect(f.access.run(f.client, handle, signal, async () => null)).rejects.toThrow('APP_ACCESS_REQUIRED')
+})
+
+it('denies existing handles when the stored application record is removed', async () => {
+  const f = await setup()
+  await f.access.select(f.agent, f.client, handle, identity, signal)
+  await f.store.withState(signal, transaction => transaction.save({ migrated: true, applications: {} }))
+  const dispatch = vi.fn(async () => null)
+  await expect(f.access.run(f.client, handle, signal, dispatch)).rejects.toThrow('APP_ACCESS_REVOKED')
+  expect(dispatch).not.toHaveBeenCalled()
+})

From 2cad88bb22cbe276cbd53ce2aa0e6e32b4b35896 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:19:48 +0800
Subject: [PATCH 27/44] test(cua): report provider state when re-enabling
 stalls

---
 apps/web/tests/cua-permissions.e2e.ts | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index ee5664e059..364e528c5e 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -166,12 +166,24 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   })
   try {
     const toggle = page.locator('[data-plugin-panel]').getByRole('switch', { name: 'Enable Computer Use', exact: true })
+    const policy = Reflect.get(scaffold.ctx.cuaAccess, 'policy')
     for (let cycle = 0; cycle < 3; cycle++) {
       await toggle.click()
       await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('false')
       await expect.poll(() => toggle.isEnabled()).toBe(true)
       await toggle.click()
-      await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+      try {
+        await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
+      } catch (error) {
+        console.error('CUA enable diagnostics', {
+          cycle, active: policy.active.size, clients: policy.clients.size, pending: policy.options.store.pending.size,
+          entries: [...scaffold.ctx.loader.entries()].filter(entry => /cua|hmr/.test(entry.options.name)).map(entry => ({
+            id: entry.id, disabled: entry.disabled, state: entry.fiber?.state, pending: entry.fiber?.inertia !== undefined,
+          })),
+          page: await panel.textContent(),
+        })
+        throw error
+      }
       const setup = page.getByRole('dialog', { name: 'Set up Computer Use before use', exact: true })
       await setup.getByRole('button', { name: 'Later', exact: true }).click()
       await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')

From 0e6e6e199878db8f7104807245d1295c580a9287 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:21:17 +0800
Subject: [PATCH 28/44] test(cua): avoid waiting for an unmounted panel in
 failure diagnostics

---
 apps/web/tests/cua-permissions.e2e.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 364e528c5e..076399f49b 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -180,7 +180,6 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
           entries: [...scaffold.ctx.loader.entries()].filter(entry => /cua|hmr/.test(entry.options.name)).map(entry => ({
             id: entry.id, disabled: entry.disabled, state: entry.fiber?.state, pending: entry.fiber?.inertia !== undefined,
           })),
-          page: await panel.textContent(),
         })
         throw error
       }

From 5acc123d16bd3557106c1a30849ac3b74badd741 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 19:23:28 +0800
Subject: [PATCH 29/44] test(cua): keep native fixture override above plugin
 bundle ordering

---
 apps/web/tests/cua-permissions.e2e.ts | 24 ++++++------------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 076399f49b..74b7f14a5f 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -33,13 +33,12 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
     icon: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAADElEQVQImWNgZGIGAAAOAAeCcsnOAAAAAElFTkSuQmCC' }
   await writeFile(state, JSON.stringify({ accessibility: false, screenRecording: false, launchApplication }))
   await writeFile(join(root, 'observe-helper'), '')
-  const fixtureBundle = join(root, 'fixture-bundle')
-  await mkdir(fixtureBundle)
-  await writeFile(join(fixtureBundle, 'package.json'), JSON.stringify({ name: 'cua-permission-fixture', version: '1.0.0',
-    dsh: { bundle: { patch: 'cordis.patch.yml' } } }))
-  await writeFile(join(fixtureBundle, 'cordis.patch.yml'), `- id: cua\n  config: ${JSON.stringify({ helperPath: helper })}\n`)
+  const fixturePatch = join(root, 'native-fixture.yml')
+  // Keep the external helper override above bundle order changes when CUA is re-enabled.
+  await writeFile(fixturePatch, JSON.stringify([{ id: 'cua', config: { helperPath: helper } }]))
   const scaffold = await launchWebScaffold({
-    profile: { packages: [{ dir: bundle, enabled: true }, { dir: fixtureBundle, enabled: true }] },
+    profile: { packages: [{ dir: bundle, enabled: true }] },
+    extraOverlayPath: fixturePatch,
   })
   resources.scaffold = scaffold
   const browser = await chromium.launch()
@@ -166,23 +165,12 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   })
   try {
     const toggle = page.locator('[data-plugin-panel]').getByRole('switch', { name: 'Enable Computer Use', exact: true })
-    const policy = Reflect.get(scaffold.ctx.cuaAccess, 'policy')
     for (let cycle = 0; cycle < 3; cycle++) {
       await toggle.click()
       await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('false')
       await expect.poll(() => toggle.isEnabled()).toBe(true)
       await toggle.click()
-      try {
-        await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
-      } catch (error) {
-        console.error('CUA enable diagnostics', {
-          cycle, active: policy.active.size, clients: policy.clients.size, pending: policy.options.store.pending.size,
-          entries: [...scaffold.ctx.loader.entries()].filter(entry => /cua|hmr/.test(entry.options.name)).map(entry => ({
-            id: entry.id, disabled: entry.disabled, state: entry.fiber?.state, pending: entry.fiber?.inertia !== undefined,
-          })),
-        })
-        throw error
-      }
+      await expect.poll(() => toggle.getAttribute('aria-checked')).toBe('true')
       const setup = page.getByRole('dialog', { name: 'Set up Computer Use before use', exact: true })
       await setup.getByRole('button', { name: 'Later', exact: true }).click()
       await expect.poll(() => panel.getAttribute('aria-busy')).toBe('false')

From e8b7565454c8012c7cd126e028553f8ab2453b28 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 23:41:04 +0800
Subject: [PATCH 30/44] test(cua): type consent storage fixtures for lint

---
 packages/experimental/cua/tests/application-access.spec.ts  | 4 ++--
 .../cua/tests/fixtures/permission-store-worker.ts           | 6 ++++--
 packages/experimental/cua/tests/permission-fixture.ts       | 4 ++--
 packages/experimental/cua/tests/permission-store.spec.ts    | 2 +-
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/packages/experimental/cua/tests/application-access.spec.ts b/packages/experimental/cua/tests/application-access.spec.ts
index e71b61e955..cce1acac22 100644
--- a/packages/experimental/cua/tests/application-access.spec.ts
+++ b/packages/experimental/cua/tests/application-access.spec.ts
@@ -456,8 +456,8 @@ it('does not store a cancellation decision after provider disposal starts', asyn
 
 it('rejects persistent consent when storage capability disappears before the commit', async () => {
   const f = await setup('Always allow')
-  const original = vi.mocked(f.store.withState).getMockImplementation()!
-  vi.mocked(f.store.withState).mockImplementationOnce(original).mockImplementationOnce((signal, operation) => {
+  const original = f.withState.getMockImplementation()!
+  f.withState.mockImplementationOnce(original).mockImplementationOnce((signal, operation) => {
     f.setWritable(false)
     return original(signal, operation)
   })
diff --git a/packages/experimental/cua/tests/fixtures/permission-store-worker.ts b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
index 5a30c72de6..dbaf9a9245 100644
--- a/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
+++ b/packages/experimental/cua/tests/fixtures/permission-store-worker.ts
@@ -1,14 +1,16 @@
 /** External file writer used to verify that an open provider reloads durable authorization. */
 import { readFile, rename, writeFile } from 'node:fs/promises'
+import type { PermissionState } from '../../src/permission-store.ts'
+import type { CuaApplicationId } from '../../src/application-types.ts'
 
 const [file, id] = process.argv.slice(2)
 if (!file || !id) throw new Error('Expected storage file and application id')
-const record = JSON.parse(await readFile(file, 'utf8'))
+const record = JSON.parse(await readFile(file, 'utf8')) as { global: PermissionState }
 const existing = record.global.applications[id]
 record.global.applications[id] = {
   revoked: (existing?.revoked ?? 0) + 1,
   sessions: {},
-  always: { id, name: 'Other process', executablePath: '/other' },
+  always: { id: id as CuaApplicationId, name: 'Other process', executablePath: '/other' },
 }
 const temporary = `${file}.writer-${process.pid}`
 await writeFile(temporary, JSON.stringify(record))
diff --git a/packages/experimental/cua/tests/permission-fixture.ts b/packages/experimental/cua/tests/permission-fixture.ts
index 17a1aa4642..0802d34152 100644
--- a/packages/experimental/cua/tests/permission-fixture.ts
+++ b/packages/experimental/cua/tests/permission-fixture.ts
@@ -32,7 +32,7 @@ export function permissionFixture(ctx: Context, initial: readonly CuaApplication
       observed = [...grants]
     })
   })
-  vi.spyOn(store, 'withState').mockImplementation((signal, operation) => original(signal, async (transaction) => {
+  const withState = vi.spyOn(store, 'withState').mockImplementation((signal, operation) => original(signal, async (transaction) => {
     observed = grantsOf(transaction.state)
     return operation({ ...transaction, save: async (next) => {
       const nextGrants = grantsOf(next)
@@ -41,7 +41,7 @@ export function permissionFixture(ctx: Context, initial: readonly CuaApplication
       else await save(nextGrants, commit)
     } })
   }))
-  return { store, save, grants: () => observed,
+  return { store, save, withState, grants: () => observed,
     setWritable(value: boolean) { writable = value; capability.mockImplementation(() => writable) },
   }
 }
diff --git a/packages/experimental/cua/tests/permission-store.spec.ts b/packages/experimental/cua/tests/permission-store.spec.ts
index 4d8c8418d3..40c6fbe07a 100644
--- a/packages/experimental/cua/tests/permission-store.spec.ts
+++ b/packages/experimental/cua/tests/permission-store.spec.ts
@@ -117,7 +117,7 @@ it('rejects malformed or identity-mismatched data without replacing it with lega
   await writeFile(file, '{broken')
   await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toThrow()
   expect(await readFile(file, 'utf8')).toBe('{broken')
-  const altered: { global: { applications: Record<string, { always: CuaApplicationGrant }> } } = JSON.parse(valid)
+  const altered = JSON.parse(valid) as { global: { applications: Record<string, { always: CuaApplicationGrant }> } }
   altered.global.applications[grant.id]!.always.id = 'b'.repeat(64) as CuaApplicationId
   const mismatch = JSON.stringify(altered); await writeFile(file, mismatch)
   await expect(a.store.withState(signal, transaction => transaction.state)).rejects.toMatchObject({ code: 'invalid-record' })

From 2c7847a8970ab7ba3dbea1ee74a14fcfed83fb71 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Mon, 19 Oct 2026 23:43:52 +0800
Subject: [PATCH 31/44] fix(cua): retain client closure checks across awaited
 consent

---
 packages/experimental/cua/src/application-access.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/experimental/cua/src/application-access.ts b/packages/experimental/cua/src/application-access.ts
index 8f81baaea1..09d72073ad 100644
--- a/packages/experimental/cua/src/application-access.ts
+++ b/packages/experimental/cua/src/application-access.ts
@@ -191,6 +191,7 @@ export class ApplicationAccess {
           throw this.denied(identity)
         }
       }
+      // oxlint-disable-next-line typescript/no-unnecessary-condition -- Awaiting approval can close the native client.
       if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
       const authorized = await this.options.store.withState(signal, async (transaction) => {
         signal.throwIfAborted()
@@ -215,7 +216,7 @@ export class ApplicationAccess {
         return { revoked: next.revoked, revision }
       })
       signal.throwIfAborted()
-      // The awaited user decision can outlive the helper, so re-read its live getter.
+      // oxlint-disable-next-line typescript/no-unnecessary-condition -- Persisting consent can close the native client.
       if (client.disposed) throw new NativeError('NATIVE_CLOSED', 'Helper is closed; acquire fresh application handles')
       const state = this.clients.get(client) ?? { agent, handles: new Map<CuaAppHandle, Selection>() }
       const { persistable: _persistable, ...grant } = identity

From 5fe3e753d5e572953a8f124adce07031aa858c0f Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 20 Oct 2026 13:16:45 +0800
Subject: [PATCH 32/44] test(cua): follow the experimental plugin page after
 sync

---
 packages/client/ui-plugin-manager/README.i18n.yaml           | 4 ++--
 packages/client/ui-plugin-manager/README.md                  | 2 +-
 packages/client/ui-plugin-manager/README.zh.md               | 2 +-
 .../ui-plugin-manager/tests/components.client.spec.tsx       | 5 +++--
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index 1a14d5cbd2..1f65263358 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: 9312d8b1b381378f
   zh: 8d0ae7ad26ada2ac
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-a-bundle:
-  en: 997455148b3f60e2
-  zh: 37c2be69e6dc7c13
+  en: c6414317764acbc1
+  zh: 17ed961cbdbf285e
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-one-row-of-a-bundle:
   en: d3627d4dba5e6cc2
   zh: e0d0eada4c20331f
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index 7094db10c1..9089a30268 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -74,7 +74,7 @@ After the checks, the list toolbar says how many plugins can be updated, that al
 
 ### Switching a bundle
 
-A bundle can declare `dsh.bundle.experimental: true` to display the experimental tag independently of its directory or package name; existing experimental package names retain that tag.
+A bundle can declare `dsh.bundle.experimental: true` to display the experimental tag independently of its directory or package name; the built-in experimental bundle list also supplies that tag.
 
 A bundle's page shows its full package name under the title. Its **Source** section, after the rows, names the spec that installs it elsewhere, as `pnpm add` accepts it, or **Built in** for an official bundle the installation ships, then its current version. A bundle's switch changes its layer selection. While the Host applies the change, the switch stays disabled and a spinner appears beside it; the reserved space keeps the controls from shifting. A profile with HMR recomposes before the operation completes; one without HMR, and a bundle a higher layer overrides, say so in a toast. A bundle the Host cannot read carries a problem tag and its reason on its page and cannot be switched on; one that provides the management components stays locked. The Host answers with error codes, which the page's dictionary words; pnpm's and the Loader's own diagnostics are shown as they are. The page excludes built-in profile bundles from cards even when the profile holds them as dependencies or the Host reports an error. The Host inventory remains complete; the Settings Plugins section's Plugin list tab inspects their plugins.
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 336db803ac..9402c5d3ab 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -74,7 +74,7 @@ Host 将网络失败或超时归因于 GitHub 地址，且提供 npmmirror 时
 
 ### 切换一个组合包
 
-组合包可通过 `dsh.bundle.experimental: true` 显示实验性标签，代码目录和包名不必包含 experimental；已有实验性包名也保留标签。
+组合包可通过 `dsh.bundle.experimental: true` 显示实验性标签，代码目录和包名不必包含 experimental；内置实验性组合包列表也提供该标签。
 
 组合包页面在标题下方显示完整包名。组件列表之后的「来源信息」给出在别处安装它所需的 spec（`pnpm add` 接受的形式），安装随附的官方组合包显示「内置」，随后是当前版本。组合包开关改变其层选择。Host 应用更改期间，开关保持禁用，旁边显示加载动画；动画位置预留空间，避免控件移动。启用了 HMR 的 profile 在操作完成前重组；没有 HMR 的 profile，以及被更高层覆盖的组合包，会以 toast 说明。Host 读不了的组合包带异常标签，其页面给出原因，且不能打开；提供管理组件的组合包保持锁定。Host 以错误码作答，由页面字典措辞；pnpm 与 Loader 自己的诊断原样显示。页面从卡片中排除内置 profile 组合包，即使 profile 将它们列为依赖或 Host 报告了异常。Host 清单仍保留完整数据；设置中「插件」分区的「插件列表」标签页负责查看它们的插件。
 
diff --git a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
index 4bf125ad38..1137fdf577 100644
--- a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
+++ b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
@@ -788,12 +788,13 @@ describe('PluginManagerPage', () => {
     expect(screen.getByText(`${en.reasonLabel}: native preparation unavailable`)).toBeTruthy()
   })
 
-  it('marks a normally named Computer Use bundle experimental and explains persistent PTC before enabling', () => {
-    const description = 'Enabling switches this profile to persistent PTC.'
+  it('shows Computer Use permission guidance on the experimental plugins page', () => {
+    const description = 'Review application access before use.'
     const { actions } = renderTab({ packages: [pkg({
       name: '@deepseek-ai/dsh-cua-bundle', experimental: true, enabled: false, optional: true, installed: false,
       meta: { title: 'Computer Use', description },
     })] })
+    fireEvent.click(screen.getByRole('button', { name: en.moreAction }))
     expect(screen.getByText(en.statusBeta)).toBeTruthy()
     expect(screen.getByText(description)).toBeTruthy()
     fireEvent.click(screen.getByRole('switch', { name: en.enableToggle.replace('{name}', 'Computer Use') }))

From 97a571556e6446f8df357081c4eebe2fe83acfe3 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 20 Oct 2026 15:31:28 +0800
Subject: [PATCH 33/44] refactor(cua): remove redundant bundle metadata and
 build prewarm

---
 ...capabilities-as-optional-bundles.i18n.yaml |  4 +-
 ...mental-capabilities-as-optional-bundles.md |  4 +-
 ...tal-capabilities-as-optional-bundles.zh.md |  4 +-
 apps/web/tests/bundle-platform.e2e.ts         |  2 +-
 apps/web/tests/cua-optin.e2e.ts               |  4 +-
 package.json                                  |  3 +-
 packages/boot/plugin-manager/src/index.ts     |  5 +-
 packages/boot/plugin-manager/src/types.ts     |  2 -
 .../boot/plugin-manager/tests/manager.spec.ts | 19 +------
 .../client/ui-plugin-manager/README.i18n.yaml |  4 +-
 packages/client/ui-plugin-manager/README.md   |  2 -
 .../client/ui-plugin-manager/README.zh.md     |  2 -
 .../src/client/PluginManagerPage.module.css   |  1 -
 .../src/client/manager-store.ts               |  3 -
 .../src/client/presentation.ts                |  4 +-
 .../tests/components.client.spec.tsx          |  2 +-
 .../tests/manager-store.client.spec.ts        |  3 -
 .../experimental/cua-bundle/README.i18n.yaml  |  4 +-
 packages/experimental/cua-bundle/README.md    |  2 +-
 packages/experimental/cua-bundle/README.zh.md |  2 +-
 packages/experimental/cua-bundle/package.json |  1 -
 packages/experimental/cua/src/client/mount.ts |  2 +-
 .../cua/tests/controller.client.spec.ts       | 19 +++++++
 .../extensions/tool-cordis/src/api-catalog.ts |  2 +-
 .../util/package-manifest/README.i18n.yaml    |  4 +-
 packages/util/package-manifest/README.md      |  1 -
 packages/util/package-manifest/README.zh.md   |  1 -
 packages/util/package-manifest/src/types.ts   |  2 -
 scripts/build-cua.spec.ts                     | 31 ----------
 scripts/build-cua.ts                          | 57 -------------------
 scripts/build.spec.ts                         |  3 +-
 scripts/build.ts                              |  6 +-
 .../verify-default-product-isolation.spec.ts  | 11 ++--
 scripts/verify-default-product-isolation.ts   |  3 +-
 34 files changed, 51 insertions(+), 168 deletions(-)
 delete mode 100644 scripts/build-cua.spec.ts
 delete mode 100644 scripts/build-cua.ts

diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
index 3cd08b31a7..eae6a82b4d 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
@@ -9,8 +9,8 @@
   en: 2ba6c43b20a3d347
   zh: 5647179ddaa38ad9
 /agent-note-ship-experimental-capabilities-as-optional-bundles/decision:
-  en: e28694eaf87ec685
-  zh: b14c6e817a6186a9
+  en: d6328ba2b218f2ac
+  zh: 3731561313b1ad5e
 /agent-note-ship-experimental-capabilities-as-optional-bundles/alternatives-considered:
   en: d6f40bf02df37ab7
   zh: e5b85ce9d41e8754
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
index 3801ca88e0..e9bcbc1933 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
@@ -18,9 +18,7 @@ Bundles insert ordinary Host rows; optional model tools register in the global t
 
 Claude Code and Codex install on demand through the separate `ON_DEMAND_BUNDLES` catalog; the [on-demand native-bundle decision](2026-10-05-official-on-demand-bundles.md) owns the cost, version, and offline-discovery trade-offs.
 
-Computer Use is a shipped optional bundle in the experimental group. Its repository-owned native component is prepared only for enabled profiles, without an external Cua Driver runtime. It declares `dsh.bundle.experimental: true` for the experimental card label; existing experimental package names retain their labels.
-
-The CUA bundle uses the explicit naming exception `@deepseek-ai/dsh-cua-bundle`, alongside `@deepseek-ai/dsh-cua`. These names preserve profile references when the capability moves package groups; the experimental classification still controls isolation and promotion.
+Computer Use is a shipped optional bundle in the experimental group. Its bundle uses the explicit naming exception `@deepseek-ai/dsh-cua-bundle`, alongside `@deepseek-ai/dsh-cua`. These names preserve profile references when the capability moves package groups; the experimental classification still controls isolation and promotion. Its repository-owned native component is prepared when the provider loads, without an external Cua Driver runtime.
 
 ## Alternatives considered
 
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
index 21cc11295f..27dbe3aaad 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
@@ -18,9 +18,7 @@ Bundle 插入普通 Host 行；可选模型工具注册到全局工具层，因
 
 Claude Code 与 Codex 通过独立的 `ON_DEMAND_BUNDLES` 目录按需安装，其成本、版本与离线发现取舍由[按需原生 bundle 决策](2026-10-05-official-on-demand-bundles.zh.md)管理。
 
-Computer Use 是 experimental 包组内随安装提供的可选组合包。其仓库自有原生组件只为已启用的配置档准备，不引入外部 Cua Driver 运行时。它通过 `dsh.bundle.experimental: true` 显示实验性卡片标签；已有实验包名保留对应标签。
-
-CUA 组合包与 `@deepseek-ai/dsh-cua` 一起采用显式命名例外 `@deepseek-ai/dsh-cua-bundle`，在能力移动分组时保留配置引用。依赖隔离和晋升仍由实验性分类约束。
+Computer Use 是 experimental 包组内随安装提供的可选组合包。组合包与 `@deepseek-ai/dsh-cua` 一起采用显式命名例外 `@deepseek-ai/dsh-cua-bundle`，在能力移动分组时保留配置引用。依赖隔离和晋升仍由实验性分类约束。提供方加载时准备仓库自有的本机组件，无需外部 Cua Driver 运行时。
 
 ## 考虑过的替代方案
 
diff --git a/apps/web/tests/bundle-platform.e2e.ts b/apps/web/tests/bundle-platform.e2e.ts
index c592af5497..1b23da431a 100644
--- a/apps/web/tests/bundle-platform.e2e.ts
+++ b/apps/web/tests/bundle-platform.e2e.ts
@@ -19,7 +19,7 @@ it('disables unsupported bundles, shows the Host restriction, and refuses direct
   })
   const name = 'host-platform-only'
   await writeFile(join(root, 'package.json'), JSON.stringify({ name, version: '1.0.0', dsh: { bundle: {
-    patch: './cordis.patch.yml', experimental: true, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'],
+    patch: './cordis.patch.yml', platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'],
   } } }))
   await writeFile(join(root, 'cordis.patch.yml'), '- id: ptc-runtime\n  config:\n    executionMode: persistent-in-memory\n')
   const scaffold = owned.scaffold = await launchWebScaffold({ profile: { packages: [{ dir: root }] } })
diff --git a/apps/web/tests/cua-optin.e2e.ts b/apps/web/tests/cua-optin.e2e.ts
index d8a5003d68..77fc5eb351 100644
--- a/apps/web/tests/cua-optin.e2e.ts
+++ b/apps/web/tests/cua-optin.e2e.ts
@@ -11,7 +11,7 @@ import type {} from '@deepseek-ai/dsh-agent-preset-registry'
 import { load } from 'js-yaml'
 import { expect, it, vi } from 'vitest'
 import { captureStableAria, compareOrRefreshGolden, launchWebScaffold, webSnapshotMode, type WebScaffold } from './scaffold.ts'
-import { connectFreshWorkspaceZh, writeComposerDraft, ZH_BROWSER_LOCALE } from './support.ts'
+import { connectFreshWorkspaceZh, ZH_BROWSER_LOCALE } from './support.ts'
 
 // The shipped bundle admits only macOS Hosts; unsupported Hosts are exercised in bundle-platform.e2e.ts.
 it.skipIf(process.platform !== 'darwin').each([
@@ -39,8 +39,6 @@ it.skipIf(process.platform !== 'darwin').each([
     const page = await browser.newPage({ viewport: { width: 1680, height: 1000 }, locale: ZH_BROWSER_LOCALE })
     await page.goto(scaffold.authenticatedUrl, { waitUntil: 'load' })
     await connectFreshWorkspaceZh(page, scaffold.workspaceCwd)
-    const input = page.locator('[data-composer-input]')
-    await writeComposerDraft(page, input, 'Retained draft')
     await page.getByRole('navigation', { name: '全局面板' }).getByRole('button', { name: '插件', exact: true }).click()
     const plugins = page.locator('[data-plugin-panel]')
     await plugins.getByRole('button', { name: '更多', exact: true }).waitFor()
diff --git a/package.json b/package.json
index b5882ca018..fd29dfb45f 100644
--- a/package.json
+++ b/package.json
@@ -216,8 +216,7 @@
     "verify-official-bundle-catalog": "tsx scripts/gen-official-bundle-catalog.ts --check",
     "gen-provider-data": "tsx packages/llm/llm-pi-ai/scripts/gen-provider-data.ts",
     "verify-provider-data": "tsx packages/llm/llm-pi-ai/scripts/gen-provider-data.ts --check",
-    "verify-product-use": "tsx scripts/verify-product-use.ts",
-    "build:cua": "tsx scripts/build-cua.ts"
+    "verify-product-use": "tsx scripts/verify-product-use.ts"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-hooks-claude-code": "workspace:*",
diff --git a/packages/boot/plugin-manager/src/index.ts b/packages/boot/plugin-manager/src/index.ts
index 4d0dbb4e1b..fa1912babf 100644
--- a/packages/boot/plugin-manager/src/index.ts
+++ b/packages/boot/plugin-manager/src/index.ts
@@ -520,8 +520,6 @@ export class PluginManager extends TypertRemoteService {
             ...(readOnlyReason === undefined ? {} : { readOnlyReason }), error: targetError ?? { code: 'not-bundle' }, rows: [], overrides: [] })
           continue
         }
-        const experimental = info.dsh?.bundle?.experimental
-        if (experimental !== undefined && typeof experimental !== 'boolean') throw new Error('bundle experimental must be a boolean')
         version = info.version
         const compatibility = evaluatePluginCompatibility(info, exemptions)
         if (compatibility !== undefined && !compatibility.exempted) throw new ManagementFailure('incompatible-version', [incompatiblePlugin(compatibility)])
@@ -531,8 +529,7 @@ export class PluginManager extends TypertRemoteService {
         try { assertBundlePlatform(info.dsh?.bundle?.platforms, process.platform) }
         catch (error) { platformError = managementError(error) }
         const error = targetError ?? platformError
-        bundles.push({ name, official, availability, ...target, ...experimental === undefined ? {} : { experimental },
-          ...(version === undefined ? {} : { version }),
+        bundles.push({ name, official, availability, ...target, ...(version === undefined ? {} : { version }),
           ...(info.description === undefined || info.description === '' ? {} : { description: info.description }),
           ...meta === undefined ? {} : { meta },
           ...sourceOf(info.name), enabled, installed, optional, removable: removable && readOnlyReason === undefined,
diff --git a/packages/boot/plugin-manager/src/types.ts b/packages/boot/plugin-manager/src/types.ts
index ff9e3582f9..6f3c96176c 100644
--- a/packages/boot/plugin-manager/src/types.ts
+++ b/packages/boot/plugin-manager/src/types.ts
@@ -72,8 +72,6 @@ export interface BundleRowInfo {
 /** One shipped, profile-installed, or discoverable on-demand bundle. */
 export interface BundleInfo {
   name: string
-  /** Explicit experimental feature status declared by the bundle. */
-  experimental?: boolean
   /** Project-maintained shipped optional bundle or on-demand catalog entry, independent of installation and selection. */
   official: boolean
   /** Readable package location; on-demand catalog entries exclude undeclared transitive copies, and declared files may be missing. */
diff --git a/packages/boot/plugin-manager/tests/manager.spec.ts b/packages/boot/plugin-manager/tests/manager.spec.ts
index 97d6dfdc23..b363e69ae1 100644
--- a/packages/boot/plugin-manager/tests/manager.spec.ts
+++ b/packages/boot/plugin-manager/tests/manager.spec.ts
@@ -93,7 +93,7 @@ it.each(['live', 'startup'] as const)('refuses an unsupported bundle before savi
   const { manager, dir, ctx } = await fixture(reload, false, undefined, {}, undefined, (dir) => {
     const path = join(dir, 'node_modules/extra/package.json')
     writeFileSync(path, JSON.stringify({ name: 'extra', version: '1.0.0', description: 'Platform-limited bundle',
-      dsh: { bundle: { patch: './cordis.patch.yml', experimental: true, platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
+      dsh: { bundle: { patch: './cordis.patch.yml', platforms: [process.platform === 'darwin' ? 'win32' : 'darwin'] } } }))
     const manifest = readProfileManifest('test', dir)
     manifest.dsh = { profile: { bundles: ['core'] } }
     writeFileSync(join(dir, 'package.json'), JSON.stringify(manifest))
@@ -101,7 +101,7 @@ it.each(['live', 'startup'] as const)('refuses an unsupported bundle before savi
   const before = readFileSync(join(dir, 'package.json'), 'utf8')
   const patchBefore = readFileSync(join(dir, 'cordis.patch.yml'), 'utf8')
   expect((await manager.listBundles()).find(row => row.name === 'extra')).toMatchObject({
-    enabled: false, experimental: true, description: 'Platform-limited bundle', error: { code: 'unsupported-platform' },
+    enabled: false, description: 'Platform-limited bundle', error: { code: 'unsupported-platform' },
   })
   expect(await manager.setBundleEnabled('extra', true)).toMatchObject({ changed: false, application: 'failed', error: { code: 'unsupported-platform' } })
   expect(readFileSync(join(dir, 'package.json'), 'utf8')).toBe(before)
@@ -1549,21 +1549,6 @@ it.each([false, true])('rechecks installed bundle peers before accepting a disab
   expect(readProfileManifest('test', dir).dsh?.profile?.bundles).toEqual(['core', 'extra'])
 })
 
-it.each([true, false])('projects the explicit experimental flag %s independently of package naming', async (experimental) => {
-  const { manager, dir } = await fixture()
-  const path = join(dir, 'node_modules/extra/package.json')
-  const manifest = JSON.parse(readFileSync(path, 'utf8')) as { dsh: { bundle: { experimental?: boolean | string } } }
-  manifest.dsh.bundle.experimental = experimental
-  writeFileSync(path, JSON.stringify(manifest))
-  expect((await manager.listBundles()).find(row => row.name === 'extra')).toMatchObject({ experimental })
-  manifest.dsh.bundle.experimental = 'yes'
-  writeFileSync(path, JSON.stringify(manifest))
-  const error = (await manager.listBundles()).find(row => row.name === 'extra')?.error
-  expect(error?.code).toBe('operation-error')
-  expect(error?.diagnostic).toContain('must be a boolean')
-})
-
-
 it('lists absent Official entries offline without resolving their packages or consulting registries', async () => {
   const { manager } = await fixture()
   const resolve = vi.spyOn(operations, 'bundleManifest')
diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index 1f65263358..a4970bdd22 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: 9312d8b1b381378f
   zh: 8d0ae7ad26ada2ac
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-a-bundle:
-  en: c6414317764acbc1
-  zh: 17ed961cbdbf285e
+  en: 84f8052ae35afcc0
+  zh: c3a058db6d3a8da4
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/switching-one-row-of-a-bundle:
   en: d3627d4dba5e6cc2
   zh: e0d0eada4c20331f
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index 9089a30268..3230575344 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -74,8 +74,6 @@ After the checks, the list toolbar says how many plugins can be updated, that al
 
 ### Switching a bundle
 
-A bundle can declare `dsh.bundle.experimental: true` to display the experimental tag independently of its directory or package name; the built-in experimental bundle list also supplies that tag.
-
 A bundle's page shows its full package name under the title. Its **Source** section, after the rows, names the spec that installs it elsewhere, as `pnpm add` accepts it, or **Built in** for an official bundle the installation ships, then its current version. A bundle's switch changes its layer selection. While the Host applies the change, the switch stays disabled and a spinner appears beside it; the reserved space keeps the controls from shifting. A profile with HMR recomposes before the operation completes; one without HMR, and a bundle a higher layer overrides, say so in a toast. A bundle the Host cannot read carries a problem tag and its reason on its page and cannot be switched on; one that provides the management components stays locked. The Host answers with error codes, which the page's dictionary words; pnpm's and the Loader's own diagnostics are shown as they are. The page excludes built-in profile bundles from cards even when the profile holds them as dependencies or the Host reports an error. The Host inventory remains complete; the Settings Plugins section's Plugin list tab inspects their plugins.
 
 ### Switching one row of a bundle
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 9402c5d3ab..a4eae196eb 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -74,8 +74,6 @@ Host 将网络失败或超时归因于 GitHub 地址，且提供 npmmirror 时
 
 ### 切换一个组合包
 
-组合包可通过 `dsh.bundle.experimental: true` 显示实验性标签，代码目录和包名不必包含 experimental；内置实验性组合包列表也提供该标签。
-
 组合包页面在标题下方显示完整包名。组件列表之后的「来源信息」给出在别处安装它所需的 spec（`pnpm add` 接受的形式），安装随附的官方组合包显示「内置」，随后是当前版本。组合包开关改变其层选择。Host 应用更改期间，开关保持禁用，旁边显示加载动画；动画位置预留空间，避免控件移动。启用了 HMR 的 profile 在操作完成前重组；没有 HMR 的 profile，以及被更高层覆盖的组合包，会以 toast 说明。Host 读不了的组合包带异常标签，其页面给出原因，且不能打开；提供管理组件的组合包保持锁定。Host 以错误码作答，由页面字典措辞；pnpm 与 Loader 自己的诊断原样显示。页面从卡片中排除内置 profile 组合包，即使 profile 将它们列为依赖或 Host 报告了异常。Host 清单仍保留完整数据；设置中「插件」分区的「插件列表」标签页负责查看它们的插件。
 
 ### 切换组合包里的一行
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index 9cdfe3aa36..f90aa4f086 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -285,7 +285,6 @@
   gap: 4px;
 }
 
-
 .titleRow {
   display: flex;
   align-items: center;
diff --git a/packages/client/ui-plugin-manager/src/client/manager-store.ts b/packages/client/ui-plugin-manager/src/client/manager-store.ts
index 4b69178a79..236c2d4599 100644
--- a/packages/client/ui-plugin-manager/src/client/manager-store.ts
+++ b/packages/client/ui-plugin-manager/src/client/manager-store.ts
@@ -91,8 +91,6 @@ export interface PackageRow {
 /** One bundle as the page shows it: the Host's bundle joined with the entries its rows run as. */
 export interface PackageView {
   readonly name: string
-  /** Experimental feature marker supplied by the bundle manifest. */
-  readonly experimental?: boolean
   /** Official catalog identity is independent of installation and selection. */
   readonly official: boolean
   /** Readable package location, separately from the profile dependency declaration. */
@@ -548,7 +546,6 @@ export function packageView(bundle: BundleInfo, plugins: readonly PluginInfo[]):
     ...bundle.installTarget === undefined ? {} : { installTarget: bundle.installTarget },
     installed: bundle.installed,
     optional: bundle.optional,
-    ...bundle.experimental === undefined ? {} : { experimental: bundle.experimental },
     removable: bundle.removable,
     updatable: bundle.updatable,
     enabled: bundle.enabled,
diff --git a/packages/client/ui-plugin-manager/src/client/presentation.ts b/packages/client/ui-plugin-manager/src/client/presentation.ts
index 9bc06387bb..098e6cc6ec 100644
--- a/packages/client/ui-plugin-manager/src/client/presentation.ts
+++ b/packages/client/ui-plugin-manager/src/client/presentation.ts
@@ -133,12 +133,12 @@ const EXPERIMENTAL_BUNDLES: readonly string[] = [
  * @returns localized copy with a technical-name fallback and the independent beta status.
  */
 export function packageText(
-  pkg: Pick<PackageView, 'name' | 'meta' | 'experimental'>, resolveText: PluginManagerFace['resolveText'],
+  pkg: Pick<PackageView, 'name' | 'meta'>, resolveText: PluginManagerFace['resolveText'],
 ): { title: string; description: string | undefined; beta: boolean } {
   return {
     title: pkg.meta?.title === undefined ? pkg.name : resolveText(pkg.meta.title),
     description: pkg.meta?.description === undefined ? undefined : resolveText(pkg.meta.description) || undefined,
-    beta: pkg.experimental === true || EXPERIMENTAL_BUNDLES.includes(pkg.name),
+    beta: EXPERIMENTAL_BUNDLES.includes(pkg.name),
   }
 }
 
diff --git a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
index 1137fdf577..58865d59af 100644
--- a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
+++ b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
@@ -791,7 +791,7 @@ describe('PluginManagerPage', () => {
   it('shows Computer Use permission guidance on the experimental plugins page', () => {
     const description = 'Review application access before use.'
     const { actions } = renderTab({ packages: [pkg({
-      name: '@deepseek-ai/dsh-cua-bundle', experimental: true, enabled: false, optional: true, installed: false,
+      name: '@deepseek-ai/dsh-cua-bundle', enabled: false, optional: true, installed: false,
       meta: { title: 'Computer Use', description },
     })] })
     fireEvent.click(screen.getByRole('button', { name: en.moreAction }))
diff --git a/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts b/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
index 8004e66247..7eb6506453 100644
--- a/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
+++ b/packages/client/ui-plugin-manager/tests/manager-store.client.spec.ts
@@ -1738,9 +1738,6 @@ it('recognizes the official registry without a trailing slash and with uppercase
   await vi.waitFor(() => { expect(state().install.registry).toEqual({ kind: 'offered', registry: MIRROR }) })
 })
 
-it('retains the bundle experimental marker in its client projection', () => {
-  expect(packageView({ ...BUNDLE, experimental: true }, PLUGINS)).toMatchObject({ experimental: true })
-})
 
 describe('desktop analytics outcomes', () => {
   it('redacts authenticated installer URLs from click and failed-result events', async () => {
diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
index c6ab74441f..ed2a2b42a4 100644
--- a/packages/experimental/cua-bundle/README.i18n.yaml
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: b563e4ec4727d0de
   zh: d0228da978238e05
 /deepseek-ai-dsh-cua-bundle/use-this-package:
-  en: 5c29711c8c4e1815
-  zh: ed34830a3669ef71
+  en: b6d91daced0484ae
+  zh: bbb66c14f0ba2738
 /deepseek-ai-dsh-cua-bundle/understand-the-implementation:
   en: 8cf76d5bc5ab785b
   zh: 18d24f49fe8fa14f
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
index fa158ec76a..d47f2f9744 100644
--- a/packages/experimental/cua-bundle/README.md
+++ b/packages/experimental/cua-bundle/README.md
@@ -33,7 +33,7 @@ pnpm dsh web
 
 For the source Desktop launcher and its separate development profile, follow [Desktop development](../../../apps/desktop/README.md). Enable Computer Use in each profile that needs it.
 
-The switch saves bundle selection in the profile’s `package.json`. Enabling preserves Coding Tools preferences and PTC execution mode. The detail page’s **Use persistent mode** action saves `ptc-runtime.executionMode: persistent-in-memory` in the user’s `cordis.patch.yml`. Already-persistent runtimes show a disabled button. Computer Use is designed for PTC and installed only in PTC sessions. When system permissions need attention, activation guidance opens the plugin details. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. HMR maintains these settings and the provider’s session tool registrations. Native components prepare on activation and source startup; subsequent `pnpm run build` checks the selected Web profile’s incremental native build. First preparation requires local compiler tools, and failure preserves diagnostics without publishing a new executable.
+The switch saves bundle selection in the profile’s `package.json`. Enabling preserves Coding Tools preferences and PTC execution mode. The detail page’s **Use persistent mode** action saves `ptc-runtime.executionMode: persistent-in-memory` in the user’s `cordis.patch.yml`. Already-persistent runtimes show a disabled button. Computer Use is designed for PTC and installed only in PTC sessions. When system permissions need attention, activation guidance opens the plugin details. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. HMR maintains these settings and the provider’s session tool registrations. Native components prepare when the provider loads and reuse the source-hashed executable when available. First preparation requires local compiler tools, and failure preserves diagnostics without publishing a new executable.
 
 Disabling unloads the provider and withdraws CUA tools from its Agent scopes. It retains the selected default, runtime configuration and retained PTC variables. Enabling again does not recreate the runtime. Explicitly changing from per-call to persistent execution replaces the shared runtime through HMR and can interrupt an active PTC call.
 
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
index 8e4f0f8de3..4bdcdbcf9d 100644
--- a/packages/experimental/cua-bundle/README.zh.md
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -33,7 +33,7 @@ pnpm dsh web
 
 源码 Desktop 的启动方式和独立开发配置档见[桌面开发说明](../../../apps/desktop/README.zh.md)。需要使用 Computer Use 的配置档分别开启该功能。
 
-开关将组合包选择保存到 profile 的 `package.json`。开启时保留 Coding Tools 设置和 PTC 执行方式。详情页的“设为持久化”按钮将 `ptc-runtime.executionMode: persistent-in-memory` 保存到用户的 `cordis.patch.yml`；已配置为持久化时禁用按钮。Computer Use 针对 PTC 模式设计，仅安装在 PTC 会话中。系统权限尚未就绪时，启用引导会进入插件详情页。详情页提供“设为 PTC”按钮来修改新会话默认模式；已有会话保留原 preset。HMR 维护这些设置和提供方的会话工具注册。本机组件在启用及源码启动时准备，后续 `pnpm run build` 检查已选中 Web profile 的本机增量构建。首次准备需要本机编译工具，失败保留诊断且不发布新的可执行文件。
+开关将组合包选择保存到 profile 的 `package.json`。开启时保留 Coding Tools 设置和 PTC 执行方式。详情页的“设为持久化”按钮将 `ptc-runtime.executionMode: persistent-in-memory` 保存到用户的 `cordis.patch.yml`；已配置为持久化时禁用按钮。Computer Use 针对 PTC 模式设计，仅安装在 PTC 会话中。系统权限尚未就绪时，启用引导会进入插件详情页。详情页提供“设为 PTC”按钮来修改新会话默认模式；已有会话保留原 preset。HMR 维护这些设置和提供方的会话工具注册。提供方加载时准备本机组件，已有与源码摘要匹配的可执行文件时直接复用。首次准备需要本机编译工具，失败保留诊断且不发布新的可执行文件。
 
 关闭会卸载提供方，并从其 Agent 作用域中撤回 CUA 工具。用户选择的默认值、执行器配置和变量均保留。再次开启不会重建执行器。用户显式从 per-call 切换为持久化执行时，HMR 会重载共享执行器，可能中断正在执行的 PTC 调用。
 
diff --git a/packages/experimental/cua-bundle/package.json b/packages/experimental/cua-bundle/package.json
index 6892f762bb..794c666300 100644
--- a/packages/experimental/cua-bundle/package.json
+++ b/packages/experimental/cua-bundle/package.json
@@ -35,7 +35,6 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml",
-      "experimental": true,
       "platforms": [
         "darwin"
       ]
diff --git a/packages/experimental/cua/src/client/mount.ts b/packages/experimental/cua/src/client/mount.ts
index 264228ec64..373459eb90 100644
--- a/packages/experimental/cua/src/client/mount.ts
+++ b/packages/experimental/cua/src/client/mount.ts
@@ -9,8 +9,8 @@ import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
 import type { ComposerChainProps } from '@deepseek-ai/dsh-client-ui-conversation/client'
-import { PermissionController } from './controller.ts'
 import { ApplicationApproval, selectApplicationApproval } from './ApplicationApproval.tsx'
+import { PermissionController } from './controller.ts'
 import { PermissionPanel, PermissionSetup, PermissionToast } from './PermissionPanel.tsx'
 import { en, NS, zh, type CuaPermissionLocaleKey } from './locales.ts'
 
diff --git a/packages/experimental/cua/tests/controller.client.spec.ts b/packages/experimental/cua/tests/controller.client.spec.ts
index 50d545aa82..a91f0164b0 100644
--- a/packages/experimental/cua/tests/controller.client.spec.ts
+++ b/packages/experimental/cua/tests/controller.client.spec.ts
@@ -125,9 +125,28 @@ it('ignores stale toast completion after the permission UI is disposed', async (
   const before = f.controller.state.getSnapshot()
   f.face.dismissToast()
   f.face.setActive(true)
+  f.face.refresh()
   expect(f.controller.state.getSnapshot()).toBe(before)
 })
 
+it.each(['success', 'failure'])('settles an in-flight action %s after disposal without publishing', async (outcome) => {
+  const f = fixture(), pending = Promise.withResolvers<undefined>(), entered = Promise.withResolvers<undefined>()
+  onTestFinished(async () => { pending.resolve(undefined); await f.controller.dispose() })
+  f.actions.requestPermission.mockImplementationOnce(async () => {
+    entered.resolve(undefined)
+    await pending.promise
+    return { ok: true, value }
+  })
+  f.face.request('accessibility')
+  await entered.promise
+  const before = f.controller.state.getSnapshot(), closed = f.controller.dispose()
+  if (outcome === 'failure') pending.reject(new Error('permission request ended after withdrawal'))
+  else pending.resolve(undefined)
+  await closed
+  expect(f.controller.state.getSnapshot()).toBe(before)
+  expect(f.actions.systemStatus).not.toHaveBeenCalled()
+})
+
 it('contains a late read rejection and supports errors without an Error instance', async () => {
   const f = fixture()
   f.actions.systemStatus.mockRejectedValueOnce('offline')
diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts
index 2aa7b4fe5b..f493598795 100644
--- a/packages/extensions/tool-cordis/src/api-catalog.ts
+++ b/packages/extensions/tool-cordis/src/api-catalog.ts
@@ -5166,7 +5166,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
   },
   {
     name: 'BundleInfo',
-    declaration: 'export interface BundleInfo {\n    name: string;\n    experimental?: boolean;\n    official: boolean;\n    availability: \'installation\' | \'profile\' | \'missing\';\n    installTarget?: {\n        spec: string;\n        version: string;\n    };\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    updatable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}',
+    declaration: 'export interface BundleInfo {\n    name: string;\n    official: boolean;\n    availability: \'installation\' | \'profile\' | \'missing\';\n    installTarget?: {\n        spec: string;\n        version: string;\n    };\n    version?: string;\n    meta?: PluginLocalizedMeta;\n    description?: string;\n    enabled: boolean;\n    installed: boolean;\n    source?: string;\n    optional: boolean;\n    removable: boolean;\n    updatable: boolean;\n    readOnlyReason?: ReadOnlyReason;\n    error?: ManagementError;\n    rows: BundleRowInfo[];\n    overrides: string[];\n}',
   },
   {
     name: 'BundleRowInfo',
diff --git a/packages/util/package-manifest/README.i18n.yaml b/packages/util/package-manifest/README.i18n.yaml
index f603633485..4edf1572bf 100644
--- a/packages/util/package-manifest/README.i18n.yaml
+++ b/packages/util/package-manifest/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: d152484eb41ac6b4
   zh: 1db86285abf6c499
 /deepseek-ai-dsh-package-manifest/use-this-package:
-  en: c387a2ba85ad5f5c
-  zh: b1d7465c61e8dcb2
+  en: 2b4a2b115906bad1
+  zh: df5642f9ed0741ff
 /deepseek-ai-dsh-package-manifest/understand-the-implementation:
   en: 41ec449dee927f04
   zh: ec1b583bd9025d84
diff --git a/packages/util/package-manifest/README.md b/packages/util/package-manifest/README.md
index aaa62cfeb5..a6d23c311a 100644
--- a/packages/util/package-manifest/README.md
+++ b/packages/util/package-manifest/README.md
@@ -51,7 +51,6 @@ The following metadata fields are optional. Omitting them leaves the format vers
 |---|---|
 | `dsh.manifestVersion` | Manifest format identifier; the declared format is `1`, independent of the npm package version and Session format version. |
 | `dsh.bundle.platforms` | Optional nonempty list of Node Host platform names, such as `["darwin"]`; omission allows every operating system. The launcher and plugin manager enforce it before composing or selecting the bundle. |
-| `dsh.bundle.experimental` | Explicit experimental feature label in plugin management; independent of the package name and enabled state. |
 | `engines.dsh` | Author-declared compatible DSH versions as a SemVer range, including exact prerelease versions. This field sits beside `engines.node` and `engines.npm`; an engines object may omit `dsh`. |
 
 `LocalizedText` carries literal text or a language map with a required English fallback. `PluginLocalizedMeta` carries optional display title, description, an image data URL resolved from a package root's `package.json.icon` or an exported `<specifier>/icon`, and metadata diagnostics for installed plugins. [App boot](../../boot/app-boot/README.md) reads these values; this package only supplies their types.
diff --git a/packages/util/package-manifest/README.zh.md b/packages/util/package-manifest/README.zh.md
index 9cbbf4de48..9d7392e0ec 100644
--- a/packages/util/package-manifest/README.zh.md
+++ b/packages/util/package-manifest/README.zh.md
@@ -51,7 +51,6 @@ const manifest: DshPackageManifest = {
 |---|---|
 | `dsh.manifestVersion` | manifest（元数据清单）格式标识；声明的格式为 `1`，独立于 npm 包版本和 Session 格式版本。 |
 | `dsh.bundle.platforms` | 可选的非空 Node Host 平台名称列表，例如 `["darwin"]`；省略时允许所有操作系统。启动器和插件管理器在组合或选择该组合包前检查此字段。 |
-| `dsh.bundle.experimental` | 在插件页显示实验性标签，不改变包名或启用状态。 |
 | `engines.dsh` | 作者声明的兼容 DSH 版本，使用 SemVer 范围，也可填写精确的预发布版本。此字段与 `engines.node`、`engines.npm` 并列；engines 对象可省略 `dsh`。 |
 
 `LocalizedText` 携带字面文本或带必需英文回退值的语言映射。`PluginLocalizedMeta` 携带已安装插件的可选展示标题、描述、从包根 `package.json.icon` 或导出的 `<标识>/icon` 解析的图片 data URL，以及元信息诊断。[App boot](../../boot/app-boot/README.zh.md) 读取这些值；本包只提供其类型。
diff --git a/packages/util/package-manifest/src/types.ts b/packages/util/package-manifest/src/types.ts
index b186a04b55..3a9915ab5d 100644
--- a/packages/util/package-manifest/src/types.ts
+++ b/packages/util/package-manifest/src/types.ts
@@ -71,8 +71,6 @@ export interface DshEnginesManifest {
 export interface DshBundleManifest {
   /** Supported Node Host platform names; omission allows every operating system. */
   platforms?: string[]
-  /** Mark this optional feature as experimental in plugin management. */
-  experimental?: boolean
   /** One patch file path, or an ordered list applied in sequence, each relative to the declaring package root. */
   patch: string | string[]
 }
diff --git a/scripts/build-cua.spec.ts b/scripts/build-cua.spec.ts
deleted file mode 100644
index 42e385c813..0000000000
--- a/scripts/build-cua.spec.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-/** Native preparation follows the same persisted bundle selection as the Web switch. */
-import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { expect, it, onTestFinished } from 'vitest'
-import { computerUseSelected } from './build-cua.ts'
-
-it('does not create or select a profile when Computer Use has not been enabled', async () => {
-  const home = await mkdtemp(join(tmpdir(), 'cua-selection-'))
-  onTestFinished(() => rm(home, { recursive: true, force: true }))
-  expect(computerUseSelected(home, 'web')).toBe(false)
-  const directory = join(home, 'profiles/web')
-  await mkdir(directory, { recursive: true })
-  await writeFile(join(directory, 'package.json'), '{}')
-  expect(computerUseSelected(home, 'web')).toBe(false)
-})
-
-it('reads enable and disable changes from the existing profile manifest', async () => {
-  const home = await mkdtemp(join(tmpdir(), 'cua-selection-'))
-  onTestFinished(() => rm(home, { recursive: true, force: true }))
-  const directory = join(home, 'profiles/web')
-  await mkdir(directory, { recursive: true })
-  for (const enabled of [false, true, false]) {
-    const bundles = ['@deepseek-ai/dsh-base', ...(enabled ? ['@deepseek-ai/dsh-cua-bundle'] : [])]
-    await writeFile(join(directory, 'package.json'), JSON.stringify({ dsh: { profile: { bundles } } }))
-    expect(computerUseSelected(home, 'web')).toBe(enabled)
-    expect(computerUseSelected(home, 'another-profile')).toBe(false)
-  }
-  await writeFile(join(directory, 'package.json'), JSON.stringify({ dsh: { profile: { bundles: 'cua' } } }))
-  expect(() => computerUseSelected(home, 'web')).toThrow('string array')
-})
diff --git a/scripts/build-cua.ts b/scripts/build-cua.ts
deleted file mode 100644
index 66670f320d..0000000000
--- a/scripts/build-cua.ts
+++ /dev/null
@@ -1,57 +0,0 @@
-/** Prepare native components only when selected by the existing Web profile. */
-import { existsSync } from 'node:fs'
-import { join, resolve } from 'node:path'
-import { parseArgs } from 'node:util'
-import { Context } from '@deepseek-ai/cordis'
-import { readProfileManifest } from '@deepseek-ai/dsh-app-boot'
-import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
-import Subprocess from '@deepseek-ai/dsh-subprocess-local'
-import { buildNativeExecutable } from '../packages/experimental/cua-macos/src/native-build.ts'
-
-/**
- * Read the existing plugin selection without creating or mutating a profile.
- * @param home - Harness home used by the application launch.
- * @param profile - Profile whose optional bundle selection controls preparation.
- * @returns Whether Computer Use is selected in that profile.
- */
-export function computerUseSelected(home: string, profile: string): boolean {
-  const directory = join(home, 'profiles', profile)
-  if (!existsSync(join(directory, 'package.json'))) return false
-  const manifest = readProfileManifest('build:cua', directory)
-  const bundles = manifest.dsh?.profile?.bundles
-  if (bundles === undefined) return false
-  if (!Array.isArray(bundles) || !bundles.every(name => typeof name === 'string')) throw new Error('build:cua: profile bundles must be a string array')
-  return bundles.includes('@deepseek-ai/dsh-cua-bundle')
-}
-
-async function main(): Promise<void> {
-  const { values } = parseArgs({ options: {
-    force: { type: 'boolean', default: false }, profile: { type: 'string', default: 'web' },
-    arch: { type: 'string' },
-  }, allowPositionals: false })
-  const selected = values.force || computerUseSelected(resolveDshHome(), values.profile)
-  if (!selected || process.platform !== 'darwin') return
-  const architecture = values.arch ?? process.arch
-  if (architecture !== 'arm64' && architecture !== 'x64') throw new Error(`build:cua: unsupported architecture ${architecture}`)
-  const ctx = new Context()
-  const controller = new AbortController()
-  const stop = () => { controller.abort() }
-  process.on('SIGINT', stop)
-  process.on('SIGTERM', stop)
-  try {
-    await ctx.plugin(Subprocess)
-    const helper = await buildNativeExecutable({
-      packageRoot: resolve(import.meta.dirname, '../packages/experimental/cua-macos'),
-      architecture, subprocess: ctx.subprocess, signal: controller.signal,
-      timeoutMs: 600_000, graceMs: 3000,
-    })
-    console.log(`build:cua: ready ${helper}`)
-  } finally {
-    try { await ctx.fiber.dispose() } finally {
-      process.removeListener('SIGINT', stop)
-      process.removeListener('SIGTERM', stop)
-    }
-  }
-}
-
-if (import.meta.main) await main()
diff --git a/scripts/build.spec.ts b/scripts/build.spec.ts
index 506bbcb1ed..157edf8b46 100644
--- a/scripts/build.spec.ts
+++ b/scripts/build.spec.ts
@@ -13,8 +13,7 @@ const artifactGraph = {
   'desktop-bundle': ['host-bundle'],
   'client-src': ['desktop-bundle'],
   'client-bundle': ['client-src'],
-  'cua': ['client-bundle'],
-  'web': ['cua'],
+  'web': ['client-bundle'],
 }
 
 function graph(gates: ReturnType<typeof buildGates>): Record<string, string[] | undefined> {
diff --git a/scripts/build.ts b/scripts/build.ts
index 71f6808288..6dcd73590b 100644
--- a/scripts/build.ts
+++ b/scripts/build.ts
@@ -69,8 +69,7 @@ export function parseBuildArguments(args: readonly string[]): BuildArguments {
 /**
  * Construct the build steps of one scope as a gate dependency graph.
  * Artifact steps generate Typert from source before Host compilation, then bundle Host,
- * Desktop, and Client artifacts, prepare the configured CUA helper, then build Web.
- * Native output also precedes Host compilation.
+ * Desktop, and Client artifacts before Web. Native output also precedes Host compilation.
  * The typecheck scope generates Typert before compiling Host and Client packages; it writes no
  * bundle. In complete and typecheck scopes each aggregate check waits only for its own face's
  * package compilation; alone, the
@@ -95,8 +94,7 @@ export function buildGates(
     for (const step of libraryBuildSteps(root, 'all')) {
       gates.push(libraryGate(step, step.id === 'host-src' ? ['native', ...step.needs] : step.needs, env))
     }
-    gates.push(pnpmGate('cua', 'configured CUA helper', ['run', 'build:cua'], ['client-bundle'], env))
-    gates.push(pnpmGate('web', 'Web build', ['run', 'build:web'], ['cua'], env))
+    gates.push(pnpmGate('web', 'Web build', ['run', 'build:web'], ['client-bundle'], env))
   }
   if (scope === 'typecheck') {
     for (const step of contractSteps(root, 'all')) gates.push(libraryGate(step, step.needs, env))
diff --git a/scripts/verify-default-product-isolation.spec.ts b/scripts/verify-default-product-isolation.spec.ts
index 9cd21e12d4..1c7f0a9229 100644
--- a/scripts/verify-default-product-isolation.spec.ts
+++ b/scripts/verify-default-product-isolation.spec.ts
@@ -113,16 +113,15 @@ describe('default product isolation', () => {
     expect(verifyDefaultProductIsolation(root).failures).toEqual([])
   })
 
-  it.each([[true, false], [false, false], [true, true], [false, true]])('ships an optional bundle switched off with legacy icon=%s and metadata=%s', (legacy, declared) => {
+  it.each([true, false])('ships an optional bundle switched off with legacy icon=%s', (legacy) => {
     const root = fixture()
-    const layer = declared ? '@deepseek-ai/dsh-prototype-layer' : '@deepseek-ai/dsh-experimental-layer'
-    const directory = declared ? 'packages/bundle/prototype-layer' : 'packages/experimental/layer'
-    write(root, `${directory}/package.json`, {
+    const layer = '@deepseek-ai/dsh-experimental-layer'
+    write(root, 'packages/experimental/layer/package.json', {
       name: layer, ...legacy ? { icon: './icon.svg' } : {},
       exports: { ...legacy ? {} : { './icon': './icon.svg' }, './locale/*.json': './locale/*.json' },
-      dependencies: { [experimental]: 'workspace:^' }, dsh: { bundle: { patch: './cordis.patch.yml', ...declared ? { experimental: true } : {} } },
+      dependencies: { [experimental]: 'workspace:^' }, dsh: { bundle: { patch: './cordis.patch.yml' } },
     })
-    write(root, `${directory}/cordis.patch.yml`, [{ insert: [{ name: experimental }] }])
+    write(root, 'packages/experimental/layer/cordis.patch.yml', [{ insert: [{ name: experimental }] }])
     manifest(root, 'apps/cli/package.json', { dependencies: { [core]: 'workspace:^', [layer]: 'workspace:^' } })
     write(root, profile, `export const PROFILE_TEMPLATES = { web: { bundles: ['${base}'] } }\n`
       + `export const DEFAULT_PROFILE_BUNDLES = ['${base}']\n`
diff --git a/scripts/verify-default-product-isolation.ts b/scripts/verify-default-product-isolation.ts
index 66e6c369d4..0120368412 100644
--- a/scripts/verify-default-product-isolation.ts
+++ b/scripts/verify-default-product-isolation.ts
@@ -107,8 +107,7 @@ export function verifyDefaultProductIsolation(root: string): ProductIsolationRes
   const sources = new Set<string>()
   const configs = new Set<string>()
   let webPluginCount = 0
-  const isExperimental = (pkg: Package): boolean => pkg.manifest.dsh?.bundle?.experimental === true
-    || isExperimentalPackageName(pkg.manifest.name)
+  const isExperimental = (pkg: Package): boolean => isExperimentalPackageName(pkg.manifest.name)
     || display(pkg.directory).startsWith('packages/experimental/')
   const add = (pkg: Package, origin: string): void => {
     if (isExperimental(pkg)) {

From 7bfe8263999d57d6006db2125230f00653702732 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 20 Oct 2026 15:37:24 +0800
Subject: [PATCH 34/44] docs(cua): refresh event references after import
 cleanup

---
 docs/event-producer-consumer.md    | 8 ++++----
 docs/event-producer-consumer.zh.md | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md
index 0857f12fca..9f34a2c838 100644
--- a/docs/event-producer-consumer.md
+++ b/docs/event-producer-consumer.md
@@ -57,10 +57,10 @@ This matrix shows which packages dispatch each harness-owned event and which pac
 | `llm/adapters-updated` | `emit` | [`packages/llm/llm/src/types.ts:23`](../packages/llm/llm/src/types.ts) | [`llm`](../packages/llm/llm) (`events.dispatch`) | [`acp`](../packages/acp/acp), `remotes` |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:75`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`llm-replay`](../packages/test-support/llm-replay), [`session-checkpoint-policy`](../packages/session/session-checkpoint-policy), [`session-title`](../packages/session/session-title) |
 | `permission-presets/catalog-changed` | `emit` | [`packages/interaction/permission-presets/src/types.ts:48`](../packages/interaction/permission-presets/src/types.ts) | [`permission-presets`](../packages/interaction/permission-presets) (`events.dispatch`) | `remotes` |
-| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:394`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:400`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:407`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/update-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:414`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:392`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:398`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:405`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/update-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:412`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
 | `plugin-market/changed` | `emit` | [`packages/boot/plugin-market/src/types.ts:168`](../packages/boot/plugin-market/src/types.ts) | [`plugin-market`](../packages/boot/plugin-market) (`emit`) | `remotes` |
 | `schedule/changed` | `emit` | [`packages/schedule/schedule/src/types.ts:478`](../packages/schedule/schedule/src/types.ts) | [`schedule`](../packages/schedule/schedule) (`emit`) | `remotes` |
 | `schedule/resolve-agent` | `waterfall` | [`packages/schedule/schedule/src/index.ts:74`](../packages/schedule/schedule/src/index.ts) | [`schedule`](../packages/schedule/schedule) (`waterfall`) | `server` |
diff --git a/docs/event-producer-consumer.zh.md b/docs/event-producer-consumer.zh.md
index 9eb7deb527..cfb872b5b7 100644
--- a/docs/event-producer-consumer.zh.md
+++ b/docs/event-producer-consumer.zh.md
@@ -59,10 +59,10 @@
 | `llm/adapters-updated` | `emit` | [`packages/llm/llm/src/types.ts:23`](../packages/llm/llm/src/types.ts) | [`llm`](../packages/llm/llm) (`events.dispatch`) | [`acp`](../packages/acp/acp), `remotes` |
 | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:75`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`llm-replay`](../packages/test-support/llm-replay), [`session-checkpoint-policy`](../packages/session/session-checkpoint-policy), [`session-title`](../packages/session/session-title) |
 | `permission-presets/catalog-changed` | `emit` | [`packages/interaction/permission-presets/src/types.ts:48`](../packages/interaction/permission-presets/src/types.ts) | [`permission-presets`](../packages/interaction/permission-presets) (`events.dispatch`) | `remotes` |
-| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:394`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:400`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:407`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
-| `plugin-manager/update-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:414`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/changed` | `emit` | [`packages/boot/plugin-manager/src/types.ts:392`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-log` | `emit` | [`packages/boot/plugin-manager/src/types.ts:398`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/install-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:405`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
+| `plugin-manager/update-state` | `emit` | [`packages/boot/plugin-manager/src/types.ts:412`](../packages/boot/plugin-manager/src/types.ts) | [`plugin-manager`](../packages/boot/plugin-manager) (`emit`) | `remotes` |
 | `plugin-market/changed` | `emit` | [`packages/boot/plugin-market/src/types.ts:168`](../packages/boot/plugin-market/src/types.ts) | [`plugin-market`](../packages/boot/plugin-market) (`emit`) | `remotes` |
 | `schedule/changed` | `emit` | [`packages/schedule/schedule/src/types.ts:478`](../packages/schedule/schedule/src/types.ts) | [`schedule`](../packages/schedule/schedule) (`emit`) | `remotes` |
 | `schedule/resolve-agent` | `waterfall` | [`packages/schedule/schedule/src/index.ts:74`](../packages/schedule/schedule/src/index.ts) | [`schedule`](../packages/schedule/schedule) (`waterfall`) | `server` |

From 66f0ee1fbbca33a471113821ea3919d7e2ebf88d Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Tue, 20 Oct 2026 16:03:07 +0800
Subject: [PATCH 35/44] test(cua): align mount assertions with query ownership

---
 packages/experimental/cua/tests/mount.client.spec.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/experimental/cua/tests/mount.client.spec.ts b/packages/experimental/cua/tests/mount.client.spec.ts
index 23e06c017e..78d6381378 100644
--- a/packages/experimental/cua/tests/mount.client.spec.ts
+++ b/packages/experimental/cua/tests/mount.client.spec.ts
@@ -18,7 +18,6 @@ const value: CuaApplicationState & { system: CuaSystemPermissionState } = {
   allowedApps: [], blockedApps: [], persistentAvailable: true }
 
 function actionsOf(value: Record<string, unknown>): asserts value is Record<string, unknown> & PermissionFace {
-  assert(typeof value.setActive === 'function')
   assert(typeof value.refresh === 'function' && typeof value.request === 'function' && typeof value.openSettings === 'function')
   assert(typeof value.revoke === 'function' && typeof value.dismissToast === 'function')
   assert(typeof value.retryApproval === 'function')

From 3edd1935b9535a94def34ec7ec124ce68c3bdde5 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Fri, 23 Oct 2026 13:25:39 +0800
Subject: [PATCH 36/44] test(cua): match sentence case setup dialog title

---
 apps/web/tests/cua-permissions.e2e.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 58193a4876..4277e37d50 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -199,7 +199,7 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
         await expect.poll(() => toggle.isEnabled(), { timeout: PLUGIN_TOGGLE_SETTLE_MS }).toBe(true)
         await toggle.click()
         await expect.poll(() => toggle.getAttribute('aria-checked'), { timeout: PLUGIN_TOGGLE_SETTLE_MS }).toBe('true')
-        const setup = page.getByRole('dialog', { name: 'Set up Computer Use before use', exact: true })
+        const setup = page.getByRole('dialog', { name: 'Set up computer use before use', exact: true })
         await setup.getByRole('button', { name: 'Later', exact: true }).click()
         await expect.poll(() => panel.getAttribute('aria-busy'), { timeout: PLUGIN_TOGGLE_SETTLE_MS }).toBe('false')
         expect(await trace.evaluate(value => value.errors)).toEqual([])

From 4f400578212ab9d24c454fb4778a487fe32e886b Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Fri, 23 Oct 2026 13:28:16 +0800
Subject: [PATCH 37/44] test(cua): locate the localized native provider switch

---
 apps/web/tests/cua-permissions.e2e.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 4277e37d50..4432bc0783 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -222,7 +222,7 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   await diagnostic.waitFor()
   const diagnosticText = await diagnostic.innerText()
   const height = await panel.evaluate(element => element.getBoundingClientRect().height)
-  const rowToggle = plugins.getByRole('switch', { name: 'Enable component @deepseek-ai/dsh-experimental-cua-macos', exact: true })
+  const rowToggle = plugins.getByRole('switch', { name: 'Enable component macOS Computer Use provider', exact: true })
   const release = Promise.withResolvers<undefined>()
   const changeRow = scaffold.ctx.pluginManager.setPluginEnabled.bind(scaffold.ctx.pluginManager)
   let changing: ReturnType<typeof changeRow> | undefined

From a87b643d87f426ceaba8cd9d45007e475eaeb630 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 15:37:00 +0800
Subject: [PATCH 38/44] style(cua): align permission separators and section
 spacing

---
 packages/client/ui-plugin-manager/README.i18n.yaml          | 4 ++--
 packages/client/ui-plugin-manager/README.md                 | 2 +-
 packages/client/ui-plugin-manager/README.zh.md              | 2 +-
 .../src/client/PluginManagerPage.module.css                 | 4 ++--
 packages/experimental/cua/README.i18n.yaml                  | 4 ++--
 packages/experimental/cua/README.md                         | 2 ++
 packages/experimental/cua/README.zh.md                      | 2 ++
 .../experimental/cua/src/client/PermissionPanel.module.css  | 6 +++---
 8 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index 59210c7cf4..6df591a84c 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -33,8 +33,8 @@
   en: e9da90f03691101b
   zh: 902cda935a4ce3c8
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/detail-page-extension-points:
-  en: c7cd3de96e538815
-  zh: ca603c132c0885fb
+  en: 651eb33f2e1c5c42
+  zh: ba679af009805c3e
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/page-tabs:
   en: fc469bab4fbd6028
   zh: 8f5a04e1b9a46471
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index a17f8baf53..6f900ca168 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -110,7 +110,7 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 A row's page exists only while a `plugins.row.config` entry names the row, so a contribution meant for a row renders on the page that configuration opens.
 
-Component lists and detail pages show current startup diagnostics from the Host inventory. The diagnostic remains visible after reopening the page and disappears when the component recovers.
+Component lists and detail pages show current startup diagnostics from the Host inventory. The diagnostic remains visible after reopening the page and disappears when the component recovers. Component and source rows use the shared l3 separator color.
 
 ### Page tabs
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 23b36bb372..5f269f064c 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -110,7 +110,7 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 行页只在某个 `plugins.row.config` 条目点名这一行时存在，因此给行的贡献渲染在该配置打开的页面上。
 
-组件列表和详情页显示 Host 清单中的当前启动诊断。重新打开页面后仍能看到原因，组件恢复后诊断消失。
+组件列表和详情页显示 Host 清单中的当前启动诊断。重新打开页面后仍能看到原因，组件恢复后诊断消失。 组件列表与来源信息使用共享 l3 分割线颜色。
 
 ### 页面标签页
 
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index 6e779d10df..1c6d1213f2 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -1525,7 +1525,7 @@ label.registryOption {
   gap: 16px;
   min-height: 44px;
   padding: 8px 2px;
-  border-bottom: 0.5px solid var(--dsw-alias-border-l2);
+  border-bottom: 0.5px solid var(--dsw-alias-border-l3);
 }
 
 .facts dt {
@@ -1570,7 +1570,7 @@ label.registryOption {
 
 .row {
   padding: 12px 2px;
-  border-bottom: 0.5px solid var(--dsw-alias-border-l2);
+  border-bottom: 0.5px solid var(--dsw-alias-border-l3);
 }
 
 .row:last-child {
diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index 063f5b0005..762d055260 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: db09ea66bf04180c
   zh: 9b3a573e83443482
 /deepseek-ai-dsh-cua/use-this-package/permission-controls:
-  en: d09b38ae381f92b0
-  zh: f169fbfb4828a842
+  en: 6b4b3ae85c92d3df
+  zh: 501807b4e7c7a434
 /deepseek-ai-dsh-cua/understand-the-implementation:
   en: be463bdd095cc2a9
   zh: 23248be7a2f0b1db
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index 16449b82cc..f5d2bd73b3 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -43,6 +43,8 @@ Actions return `dispatched:true, verified:false`; read fresh state to verify the
 
 ### Permission controls
 
+Permission groups use the shared l3 border color and 32px section spacing, matching the plugin page’s component and source sections.
+
 The [Computer Use bundle](../cua-bundle/README.md) mounts this page with its native provider. **Authorize computer use** groups the new-session default, PTC execution mode, Accessibility, and Screen Recording inside one border, with dividers between the rows. Each system-permission row shows the system-reported responsible application’s `.app` bundle filename and icon together in a bordered label. **Manage applications computer use can access** places the application lists inside a separate bordered group. Choose **Request permission**, find that application in the macOS permission list, and enable its switch; if macOS names another application, follow that prompt. With no detected source, the page directs the user to the application named by macOS. Each system-permission row has one control: **Request permission** when access is missing, or an outlined **Allowed** button with a settings icon after authorization. Clicking it opens the corresponding privacy pane, where the user can revoke access; hovering shows **Open System Settings**. Unknown status uses the same button with an **Unknown** label; pending initial observations retain a single placeholder. The page refreshes on entry, when the window regains focus, and after permission actions. A failed query offers **Retry**. Follow any macOS quit-and-reopen prompt and restart DSH as needed.
 
 System-permission operations affect the computer running DSH. When accessing DSH remotely, complete authorization on that computer.
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index 02eb936c0c..079000c5e5 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -43,6 +43,8 @@ kind: "package-reference"
 
 ### 权限控件
 
+权限分组使用共享 l3 边框色，区块间距与插件页的组件和来源信息区块统一为 32px。
+
 [Computer Use 组合](../cua-bundle/README.zh.md)将本页与原生 provider 一起挂载。“给 Computer Use 授权”把新会话默认模式、PTC 执行方式、辅助功能和屏幕录制放在同一个边框内，四排之间使用分隔线。两条系统权限要求在能识别责任应用时，把该应用的 `.app` 包名称和图标放在同一个标签中。“管理 Computer Use 可访问的应用”使用独立边框包住应用列表。点击“申请权限”，在 macOS 权限列表中找到该应用并开启对应开关；若 macOS 显示其他名称，以系统提示为准。来源无法识别时，页面引导用户查找系统提示的应用。每条系统权限要求只显示一个控件：未授权时为“申请权限”，已授权时为带设置图标的“已允许”描边按钮，点击直接进入对应隐私设置页，由用户撤销权限，悬停提示“打开系统设置”。无法确认状态时使用同样的按钮，文字为“未确认”。首次查询期间保留一个占位。进入详情页、返回窗口或完成授权操作后会自动刷新；查询失败时可点击“重试”。若系统要求退出并重新打开应用，请按提示操作并重新启动 DSH。
 
 系统权限操作作用于运行 DSH 的电脑。远程访问时，请在该电脑上完成授权。
diff --git a/packages/experimental/cua/src/client/PermissionPanel.module.css b/packages/experimental/cua/src/client/PermissionPanel.module.css
index 2db3d674d2..3b96fd18a8 100644
--- a/packages/experimental/cua/src/client/PermissionPanel.module.css
+++ b/packages/experimental/cua/src/client/PermissionPanel.module.css
@@ -1,7 +1,7 @@
-.panels { display: grid; gap: 24px; margin: 18px 0; font-size: 13px; }
+.panels { display: grid; gap: 32px; margin: 0; font-size: 13px; }
 .panel { display: grid; gap: 12px; min-width: 0; }
-.card { min-width: 0; border: 0.5px solid var(--dsw-alias-border-l1); border-radius: var(--dsw-radius-md); }
-.card > * + * { border-top: 0.5px solid var(--dsw-alias-border-l1); }
+.card { min-width: 0; border: 0.5px solid var(--dsw-alias-border-l3); border-radius: var(--dsw-radius-md); }
+.card > * + * { border-top: 0.5px solid var(--dsw-alias-border-l3); }
 .panel p { margin: 0; color: var(--dsw-alias-label-secondary); line-height: 1.6; }
 .panel h3 { margin: 0; font-size: 14px; font-weight: 500; }
 .panel h4 { margin: 0; font-size: 13px; font-weight: 500; color: var(--dsw-alias-label-secondary); }

From 57f2832347322e89ac6dbbb7d447adfc4285fec7 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 16:01:24 +0800
Subject: [PATCH 39/44] revert(plugins): defer navigation scroll behavior

---
 apps/web/tests/cua-permissions.e2e.ts           |  2 --
 .../client/ui-plugin-manager/README.i18n.yaml   |  4 ++--
 packages/client/ui-plugin-manager/README.md     |  2 +-
 packages/client/ui-plugin-manager/README.zh.md  |  2 +-
 .../src/client/PluginManagerPage.tsx            |  9 ++-------
 .../tests/components.client.spec.tsx            | 17 -----------------
 6 files changed, 6 insertions(+), 30 deletions(-)

diff --git a/apps/web/tests/cua-permissions.e2e.ts b/apps/web/tests/cua-permissions.e2e.ts
index 720768bb34..4835557ce8 100644
--- a/apps/web/tests/cua-permissions.e2e.ts
+++ b/apps/web/tests/cua-permissions.e2e.ts
@@ -82,11 +82,9 @@ it.skipIf(process.platform !== 'darwin')('keeps system requests pending until fr
   await openDetails.scrollIntoViewIfNeeded()
   expect(await plugins.locator('[data-plugin-body]').evaluate(element => element.scrollTop)).toBeGreaterThan(0)
   await openDetails.click()
-  await expect.poll(() => plugins.locator('[data-plugin-body]').evaluate(element => element.scrollTop)).toBe(0)
   const panel = page.locator('[data-cua-settings]')
   const accessibility = panel.getByRole('group', { name: 'Accessibility', exact: true })
   await accessibility.getByRole('button', { name: 'Request permission', exact: true }).waitFor()
-  expect(await plugins.locator('[data-plugin-body]').evaluate(element => element.scrollTop)).toBe(0)
   expect(await panel.getByRole('region', { name: 'Authorize computer use', exact: true }).getByRole('group').count()).toBe(4)
   expect(await panel.getByRole('region', { name: 'Manage applications computer use can access', exact: true }).count()).toBe(1)
   await expect.poll(() => panel.locator('li img').evaluate((image: HTMLImageElement) => image.naturalWidth)).toBe(1)
diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index 6df591a84c..3ba2f77690 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: d152484eb41ac6b4
   zh: 09388d293f9be9cb
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package:
-  en: d0ed769a71eb56ef
-  zh: 444370058b7129c8
+  en: 535d6322bcfb329b
+  zh: fbf05155ccbb3e0e
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/installing-a-bundle:
   en: fcb2e69c8b028c0a
   zh: d505a075679974eb
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index 6f900ca168..9f0e3d1fe6 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -29,7 +29,7 @@ Use the **Plugins** entry in the Web sidebar to manage the profile's installed b
 
 [Ralph loops](../../experimental/ralph-bundle/README.md) and [Session search](../../experimental/session-search/README.md) remain bundled but are hidden from both plugin lists unless the profile enables or separately installs them. Existing selections remain manageable; switching off an installation-carried copy hides it again. Enter either exact package name in **Add plugin**, then choose **Enable now** to use the shipped copy without downloading it again. Sidebar session search is independent.
 
-Select **Plugins** in the sidebar. The information button uses an 11px caption-colored icon in a 20px square hover area, with a 4px gap after the subtitle. It explains that this page configures official plugins and installs or manages other plugins, while **Settings → Built-in plugins** shows the built-in inventory and runtime status. Hover or focus shows the shared tooltip; clicking keeps it open until another click, Escape, Tab, or an outside click. The page reads the inventory and the bundles through `api-remotes` when first opened; a Host without a managed profile shows the page as unavailable. **Built-in plugin settings** lists official configuration pages by their configured order: Subagent, web search, agent loop, then shell. **Experimental plugins** shows the primary optional bundles, with **More** beside its heading opening a separate page of the same title. That page lists the official bundles eligible for display, including those on the main list, with Codex and Claude Code subagents last. Its back button returns to the main list, where **Installed plugins** remains below Experimental plugins. Bundle details return to the list they were opened from. Switching pages or tabs starts at the top; refreshing the current page preserves its scroll position. Catalog entries keep their position after installation or removal. **Installed plugins** lists other profile bundles. Installation-carried optional bundles have no uninstall action. Experimental packages retain the **Experimental** marker on both lists. Switching on a bundle that page holds back adds it to the main list in the position that page shows it, and switching it off leaves it on that page alone unless its manifest hides unselected bundles; other bundles keep their place on both. A dependency without a bundle patch is not a plugin and is not listed unless the profile selects it, in which case it carries a problem tag. Global configuration remains in the Settings **Built-in plugins** section.
+Select **Plugins** in the sidebar. The information button uses an 11px caption-colored icon in a 20px square hover area, with a 4px gap after the subtitle. It explains that this page configures official plugins and installs or manages other plugins, while **Settings → Built-in plugins** shows the built-in inventory and runtime status. Hover or focus shows the shared tooltip; clicking keeps it open until another click, Escape, Tab, or an outside click. The page reads the inventory and the bundles through `api-remotes` when first opened; a Host without a managed profile shows the page as unavailable. **Built-in plugin settings** lists official configuration pages by their configured order: Subagent, web search, agent loop, then shell. **Experimental plugins** shows the primary optional bundles, with **More** beside its heading opening a separate page of the same title. That page lists the official bundles eligible for display, including those on the main list, with Codex and Claude Code subagents last. Its back button returns to the main list, where **Installed plugins** remains below Experimental plugins. Bundle details return to the list they were opened from. Catalog entries keep their position after installation or removal. **Installed plugins** lists other profile bundles. Installation-carried optional bundles have no uninstall action. Experimental packages retain the **Experimental** marker on both lists. Switching on a bundle that page holds back adds it to the main list in the position that page shows it, and switching it off leaves it on that page alone unless its manifest hides unselected bundles; other bundles keep their place on both. A dependency without a bundle patch is not a plugin and is not listed unless the profile selects it, in which case it carries a problem tag. Global configuration remains in the Settings **Built-in plugins** section.
 
 As available header width decreases, Refresh and Add plugin first become icon-only controls with accessible names and tooltips; the tabs then shrink from their usual minimum width to fit their labels, and the action group wraps only when necessary. The information button follows the subtitle text. The main page header and list share one scroll container. Header controls move with the scroll position until they reach their compact positions; scrolling back follows the same coordinates. The header retains its resting layout height, so moving its controls does not change the list's scroll range. A barely scrolling list can stop before the header is fully compact. The More list's back-and-title row stays fixed, and detail pages scroll their head row with the content. The Installed/Discover tabs use the compact 34px control with a 2px inset around the selection indicator. The subtitle scrolls out of view; with tabs present, the title also scrolls out, and the tabs settle beside Refresh and Add plugin where space permits. On narrow pages, the tabs and icon actions share a row beneath the heading where they fit; otherwise the tabs stay above the actions. Their relative order stays the same throughout scrolling. The resting and compact layouts retain their 28px and 16px page-top insets respectively, with 16px below the compact controls. macOS adds the frame's titlebar clearance while resting; its compact bar keeps 16px above and below with the sidebar expanded, and with the sidebar collapsed it also clears the frame's top strip so the controls stay below the native window controls. Only on macOS, when the sidebar is collapsed, the compact controls keep 8px rather than 16px above them in addition to the unchanged frame clearance, at every width. The resting layout and compact bottom spacing stay unchanged. Windows relies on the frame's caption offset without adding it again. The divider spans the page at the bottom of the compact header; the list's initial top spacing scrolls with its content. Hover styling applies only where the pointer can hover, so a tap leaves no card, row, or menu option in its hover state; cards and icon actions answer a touch-down with the pressed fill instead. The install, registry, and filter fields take a 16px face under a coarse pointer, which keeps iOS Safari from zooming a focused field.
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 5f269f064c..40f5855ed0 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -29,7 +29,7 @@ kind: "package-reference"
 
 [Ralph 循环](../../experimental/ralph-bundle/README.zh.md)和[会话搜索](../../experimental/session-search/README.zh.md)仍随包提供，但默认不在两个插件列表中展示，只有 profile 启用或另行安装后才显示。已有的启用状态仍可管理；关闭随安装提供的版本后，它会再次隐藏。在**添加插件**中输入准确包名，再选择**立即启用**，即可使用随包提供的版本，无需再次下载。侧栏会话搜索独立于此功能。
 
-在侧栏选择**插件**。信息按钮使用 11px 的 caption 色图标和 20px 方形悬停区域，与副标题间隔 4px。它说明当前页用于配置官方插件、安装和管理其他插件，**设置 → 内置插件**则展示内置插件列表及运行状态。悬停或聚焦显示共享 tooltip；点击后保持展开，直至再次点击、Escape、Tab 或外部点击。页面首次打开时通过 `api-remotes` 读取清单与组合包；没有受管 profile 的 Host 上页面显示为不可用。**内置插件配置**按配置的顺序列出官方配置页：子智能体、网页搜索、Agent 循环、终端。**实验性插件**展示主要的可选组合包，标题旁的**更多**打开同名的独立页面。该页列出符合展示条件的官方组合包，也包含主列表已有的条目，Codex 和 Claude Code 子智能体排在最后。返回按钮回到主列表，**已安装插件**保持在实验性插件下方。组合包详情返回打开它的列表。目录条目在安装或移除后保持原位置。**已安装插件**列出其他 profile 组合包。安装随附的可选组合包没有卸载操作。实验性包在两个列表中均保留**实验性**标签。开启仅在该页列出的组合包会按该页中的位置把它加入主列表，关闭后它只留在该页，但 manifest 声明默认隐藏的组合包会从该页消失；其他组合包在两个列表中均保持原位。没有组合包 patch 的依赖不是插件，除非 profile 选中了它才会带异常标签列出。全局配置仍在设置的**内置插件**分区中编辑。 切换页面或标签时从顶部开始，同一页面刷新数据时保留滚动位置。
+在侧栏选择**插件**。信息按钮使用 11px 的 caption 色图标和 20px 方形悬停区域，与副标题间隔 4px。它说明当前页用于配置官方插件、安装和管理其他插件，**设置 → 内置插件**则展示内置插件列表及运行状态。悬停或聚焦显示共享 tooltip；点击后保持展开，直至再次点击、Escape、Tab 或外部点击。页面首次打开时通过 `api-remotes` 读取清单与组合包；没有受管 profile 的 Host 上页面显示为不可用。**内置插件配置**按配置的顺序列出官方配置页：子智能体、网页搜索、Agent 循环、终端。**实验性插件**展示主要的可选组合包，标题旁的**更多**打开同名的独立页面。该页列出符合展示条件的官方组合包，也包含主列表已有的条目，Codex 和 Claude Code 子智能体排在最后。返回按钮回到主列表，**已安装插件**保持在实验性插件下方。组合包详情返回打开它的列表。目录条目在安装或移除后保持原位置。**已安装插件**列出其他 profile 组合包。安装随附的可选组合包没有卸载操作。实验性包在两个列表中均保留**实验性**标签。开启仅在该页列出的组合包会按该页中的位置把它加入主列表，关闭后它只留在该页，但 manifest 声明默认隐藏的组合包会从该页消失；其他组合包在两个列表中均保持原位。没有组合包 patch 的依赖不是插件，除非 profile 选中了它才会带异常标签列出。全局配置仍在设置的**内置插件**分区中编辑。
 
 页头可用宽度缩小时，“刷新”和“添加插件”先变为保留可访问名称与 tooltip 的图标按钮；标签再从常规最小宽度收紧为文案所需宽度，仍不足时操作组才换行。信息按钮紧随副标题文字。主页面的页头和列表共用一个滚动容器。页头控件随滚动位置移动，到达紧凑态位置后停住；反向滚动沿同样的坐标返回。页头保留静止态的布局高度，因此控件移动不会改变列表的滚动范围。只能滚动少量距离的列表可能在页头完全收拢前到达底部。“更多”列表的返回与标题行固定，详情页的页头随内容滚动。“已安装/发现”标签使用总高 34px 的紧凑控件，选中指示块与外框之间留 2px。副标题随滚动离开视口；有标签时标题也随之滚出，标签在空间足够时停靠到“刷新”“添加插件”旁边。窄页面中，标签与图标操作优先在标题下方共用一行；放不下时，标签始终在操作组上方。滚动过程中两组控件的相对顺序保持不变。静止态与紧凑态分别保留 28px 和 16px 的页面顶部留白，紧凑态控件下方保留 16px。macOS 静止态保留框架的标题栏安全区；折叠态在侧栏展开时上下各留 16px，侧栏收起时再避让框架顶部安全区，使控件位于原生窗口控件下方。仅在 macOS 侧栏收起时，紧凑态控件在原有框架安全区之外的顶部留白统一由 16px 减为 8px，不受窗口宽度影响；静止态布局与紧凑态底部留白均不变。Windows 使用框架已有的标题栏偏移，不重复叠加。分隔线在紧凑页头底部横跨页面，列表初始的顶部留白随内容滚动。悬停样式只在可悬停的指针下生效，点按不会让卡片、行或菜单项停留在悬停态；卡片与图标操作改以按下填充回馈触摸。安装、注册表与筛选输入框在粗指针下使用 16px 字号，iOS Safari 不会因聚焦而放大页面。
 
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
index e49d36f61e..6acfce2d20 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx
@@ -8,7 +8,7 @@
  * the page declares.
  */
 
-import { useEffect, useId, useLayoutEffect, useRef, useState, type ReactNode } from 'react'
+import { useEffect, useId, useRef, useState, type ReactNode } from 'react'
 import { createPortal } from 'react-dom'
 import type { PluginInstallFailureKind, Registry } from '@deepseek-ai/dsh-api-remotes/client'
 import {
@@ -1527,11 +1527,6 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
   const selectedTab = props.useStore(state => state.tab)
   // A contributed tab that left the ledger falls back to Installed, and stays there when it returns.
   const tab = tabs.some(item => item.id === selectedTab) ? selectedTab : INSTALLED_TAB
-  const pageRef = useRef<HTMLDivElement>(null)
-  useLayoutEffect(() => {
-    /* v8 ignore else -- The unconditional body attaches its ref before this layout effect. */
-    if (pageRef.current !== null) pageRef.current.scrollTop = 0
-  }, [view, tab])
   useEffect(() => { if (tab !== selectedTab) setTab(tab) }, [tab, selectedTab, setTab])
   const tabsId = useId()
   const [activation, setActivation] = useState<string | null>(null)
@@ -1642,7 +1637,7 @@ export function PluginManagerPage(props: PluginManagerPageProps): ReactNode {
           <h1 className={css.pageTitle}>{t('moreTitle')}</h1>
         </header>
       ) : null}
-      <div ref={pageRef} className={css.pageBody} data-plugin-body>
+      <div className={css.pageBody} data-plugin-body>
         {showsMainList
           ? (
             <div
diff --git a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
index fefec8bd7d..041d5d2a39 100644
--- a/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
+++ b/packages/client/ui-plugin-manager/tests/components.client.spec.tsx
@@ -226,23 +226,6 @@ function renderTab(
 }
 
 describe('PluginManagerPage', () => {
-  it('starts each page at the top and keeps scroll position during a refresh', () => {
-    const { set } = renderTab({ packages: [pkg()] })
-    const open = screen.getByRole('button', { name: 'View dsh-better-sidebar' })
-    const panel = open.closest<HTMLElement>('[data-plugin-body]')!
-    panel.scrollTop = 350
-    fireEvent.click(open)
-    expect(panel.scrollTop).toBe(0)
-    panel.scrollTop = 120
-    set({ refreshStatus: 'refreshing' })
-    expect(panel.scrollTop).toBe(120)
-    set({ refreshStatus: 'idle', packages: [pkg({ version: '0.17.0' })] })
-    expect(panel.scrollTop).toBe(120)
-    fireEvent.click(screen.getByRole('button', { name: en.backToList }))
-    expect(panel.scrollTop).toBe(0)
-    expect(screen.getByRole('heading', { name: en.title, level: 1 })).toBeTruthy()
-  })
-
   it('shows no tabs without contributions, and switches between Installed and a contributed tab', () => {
     const { actions, navigation, setTabs } = renderTab({ packages: [pkg()] }, {}, {
       'plugins.tab:discover': (_view, owner) => {

From 31044bf469bd59ad217aa0ff9deff393690b5fba Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 16:07:14 +0800
Subject: [PATCH 40/44] revert(cua): remove unrelated Session presence recovery

---
 .../api/session-controller/README.i18n.yaml   |  4 +-
 packages/api/session-controller/README.md     |  2 +-
 packages/api/session-controller/README.zh.md  |  2 +-
 .../src/client/sessions/manager.ts            |  4 +-
 .../src/client/sessions/session.ts            | 10 ++---
 .../tests/session.client.spec.ts              |  9 +----
 .../tests/sessions-service.client.spec.ts     | 37 -------------------
 7 files changed, 9 insertions(+), 59 deletions(-)

diff --git a/packages/api/session-controller/README.i18n.yaml b/packages/api/session-controller/README.i18n.yaml
index 3abe900803..cf1badb15b 100644
--- a/packages/api/session-controller/README.i18n.yaml
+++ b/packages/api/session-controller/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: 1fdf707322fb6996
   zh: 0204f7e9d4aa3cce
 /session-controller/use-this-package:
-  en: ae5b60a56f67dcf0
-  zh: 04f64e8891cba464
+  en: 0c8945a47f87b5f7
+  zh: b099d66521dca175
 /session-controller/client-references:
   en: 41bdda1ac32df558
   zh: aa5d0e325924066b
diff --git a/packages/api/session-controller/README.md b/packages/api/session-controller/README.md
index 471e2824f0..ae7cff7cb7 100644
--- a/packages/api/session-controller/README.md
+++ b/packages/api/session-controller/README.md
@@ -45,7 +45,7 @@ Client list rows and resident Sessions use the current `sessionListMetadata` pro
 
 `session.create` returns a Session for a new conversation, and its response names the Session actually used. A named `sessionId` is reused while it is blank (no turn has started), belongs to the requested directory, is an unarchived member of the requested Workspace, and is not written by another owner; a live Session is reused in place, and a persisted one is resumed while retaining its writer lock. The reused Session runs the requested `agentPreset`, or the configured default when the request names none: its recorded preset is not resolved, and a change is logged as `agent-preset/selected` before the Agent is published. A named Session that has started, fails the Workspace placement, or is written by another owner stays unchanged, and a new Session is created instead. A `sessionId` with no stored Session becomes the new Session's identity. A named Session in another directory fails with `session/conflict`, and one owned by subagent routing with `session/agent-busy`; both checks precede preset resolution. Creations naming one identity run in arrival order, including their preset resolution, and each response reports the preset its own request left the Session running. `session.list` includes persisted blanks using cached metadata, without opening cold log bodies.
 
-Client list refreshes retain unchanged row objects and reuse the items array when order and values match. Each row's `retainedBy` contains positive local reference-source counts; Host metadata refreshes cannot overwrite them. Cache membership checks use a per-refresh ID set, so reconciliation grows linearly with the current list and retained cache sizes. Host summary updates replace running and Agent availability; local create/fork responses only fill missing metadata on existing rows. Removed ordinary Sessions retain projection stores only when their catalogs contain children. A current Host addition or reconciled list restores a retained Session after plugin reload, preserving its draft and clearing the removed state; a removal received during a list request takes precedence over that response.
+Client list refreshes retain unchanged row objects and reuse the items array when order and values match. Each row's `retainedBy` contains positive local reference-source counts; Host metadata refreshes cannot overwrite them. Cache membership checks use a per-refresh ID set, so reconciliation grows linearly with the current list and retained cache sizes. Host summary updates replace running and Agent availability; local create/fork responses only fill missing metadata on existing rows. Removed ordinary Sessions retain projection stores only when their catalogs contain children.
 
 Background-job rows and observation streams belong to [`dsh-api-job-controller`](../job-controller/README.md); the control stream carries projections only.
 
diff --git a/packages/api/session-controller/README.zh.md b/packages/api/session-controller/README.zh.md
index 62a1dca4db..0bbbd6ddaf 100644
--- a/packages/api/session-controller/README.zh.md
+++ b/packages/api/session-controller/README.zh.md
@@ -45,7 +45,7 @@ Client 列表行和驻留 Session 使用当前 `sessionListMetadata` 投影纠
 
 `session.create` 返回一个用于新对话的 Session，响应指明实际使用的 Session。请求指明的 `sessionId` 在满足以下条件时被复用：仍为空白（尚未开始任何轮次）、属于请求的目录、是请求的工作区中未归档的成员，且未被其他写者占用；活动 Session 原地复用，持久化 Session 被恢复并持续持有其写锁。被复用的 Session 运行请求的 `agentPreset`，请求未指明时运行配置的默认 preset：不解析它记录的 preset，变更在 Agent 发布前记录为 `agent-preset/selected`。指明的 Session 若已开始、不满足工作区归属，或被其他写者占用，则保持不变，改为新建 Session。没有对应已存储 Session 的 `sessionId` 成为新 Session 的标识。指明其他目录中的 Session 返回 `session/conflict`，指明由 subagent 路由拥有的 Session 返回 `session/agent-busy`；这两项检查先于 preset 解析。指明同一标识的创建请求按到达顺序执行，preset 解析也包含在内，每个响应报告其自身请求完成时该 Session 运行的 preset。`session.list` 根据缓存元数据列出持久化空白会话，不打开冷日志正文。
 
-Client 列表刷新保留未变化的行对象，并在顺序和值均相同时复用条目数组。每行的 `retainedBy` 包含正数的本地引用来源计数，Host 元数据刷新不能覆盖它们。缓存成员检查使用每次刷新构建的 ID 集合，因此对账成本随当前列表和保留缓存的规模线性增长。 Host 摘要更新会替换运行状态与 Agent 可用性；本地 create/fork 响应只补充已有行缺失的元数据。普通 Session 被移除后，仅在目录仍有子项时保留其投影 store。 当前 Host 新增事件或对账后的列表会恢复插件重载前保留的 Session，清除移除状态并保留草稿；列表请求期间收到的移除事件优先于该次响应。
+Client 列表刷新保留未变化的行对象，并在顺序和值均相同时复用条目数组。每行的 `retainedBy` 包含正数的本地引用来源计数，Host 元数据刷新不能覆盖它们。缓存成员检查使用每次刷新构建的 ID 集合，因此对账成本随当前列表和保留缓存的规模线性增长。 Host 摘要更新会替换运行状态与 Agent 可用性；本地 create/fork 响应只补充已有行缺失的元数据。普通 Session 被移除后，仅在目录仍有子项时保留其投影 store。
 
 后台 job 的名册行与观测流属于 [`dsh-api-job-controller`](../job-controller/README.zh.md)；控制流只承载投影。
 
diff --git a/packages/api/session-controller/src/client/sessions/manager.ts b/packages/api/session-controller/src/client/sessions/manager.ts
index 6f52d2096c..105930d1ef 100644
--- a/packages/api/session-controller/src/client/sessions/manager.ts
+++ b/packages/api/session-controller/src/client/sessions/manager.ts
@@ -451,7 +451,6 @@ export class SessionManager {
           for (const s of this.summaries) {
             const session = this.sessions.get(s.sessionId)
             if (session === undefined) continue
-            session.handlePresence(true)
             session.handleBlank(this.effectiveBlank(s))
             session.handleRunning(s.running)
           }
@@ -672,7 +671,6 @@ export class SessionManager {
   handleSessionAdded(summary: SessionSummary): void {
     this.mergeSummary(summary)
     if (!this.disposed && summary.running) this.engagedSessions.add(summary.sessionId)
-    this.sessions.get(summary.sessionId)?.handlePresence(true)
     this.sessions.get(summary.sessionId)?.handleBlank(this.effectiveBlank(summary))
     if (summary.projections !== undefined) this.applyListBlock(summary.sessionId, summary.projections)
   }
@@ -712,7 +710,7 @@ export class SessionManager {
       ? { kind: 'status', sessionId, running: false, agentAvailable: false }
       : { kind: 'remove', sessionId })
     if (durableSubagent) this.sessions.get(sessionId)?.handleRunning(false)
-    else this.sessions.get(sessionId)?.handlePresence(false)
+    else this.sessions.get(sessionId)?.handleRemoved()
     const catalog = this.projectionStores.get(sessionId)?.values().subagentCatalog
     if (!durableSubagent && (catalog === undefined || catalog.length === 0)) {
       this.projectionStores.delete(sessionId)
diff --git a/packages/api/session-controller/src/client/sessions/session.ts b/packages/api/session-controller/src/client/sessions/session.ts
index 7fd67057cc..09494e01ab 100644
--- a/packages/api/session-controller/src/client/sessions/session.ts
+++ b/packages/api/session-controller/src/client/sessions/session.ts
@@ -577,13 +577,9 @@ export class Session implements SessionFace {
     this.notifier.markDirty()
   }
 
-  /**
-   * Update Host membership while retaining the resident instance and its draft.
-   * @param present - Whether a current Host event or reconciled list contains this Session.
-   */
-  handlePresence(present: boolean): void {
-    if (present === !this.removed) return
-    this.removed = !present
+  /** `api-session/removed` relay: flag the snapshot while retaining the resident instance. */
+  handleRemoved(): void {
+    this.removed = true
     this.notifier.markDirty()
   }
 
diff --git a/packages/api/session-controller/tests/session.client.spec.ts b/packages/api/session-controller/tests/session.client.spec.ts
index 69846236d3..8d1838e40f 100644
--- a/packages/api/session-controller/tests/session.client.spec.ts
+++ b/packages/api/session-controller/tests/session.client.spec.ts
@@ -840,17 +840,10 @@ describe('remaining branches', () => {
   it('deduplicates repeated running flips and records removal', async ({ mock, start }) => {
     const session = await sessionBench(mock, start, SID)
     const before = session.getSnapshot()
-    session.handlePresence(true)
-    expect(session.getSnapshot()).toBe(before)
     session.handleRunning(false) // already false: dedup branch
     expect(session.getSnapshot()).toBe(before)
-    session.handlePresence(false)
+    session.handleRemoved()
     expect(session.getSnapshot().removed).toBe(true)
-    const removed = session.getSnapshot()
-    session.handlePresence(false)
-    expect(session.getSnapshot()).toBe(removed)
-    session.handlePresence(true)
-    expect(session.getSnapshot().removed).toBe(false)
   })
 
   it('drops live events while cold/error (no window upkeep)', async ({ mock, start }) => {
diff --git a/packages/api/session-controller/tests/sessions-service.client.spec.ts b/packages/api/session-controller/tests/sessions-service.client.spec.ts
index bfa92bea95..f43e32e64e 100644
--- a/packages/api/session-controller/tests/sessions-service.client.spec.ts
+++ b/packages/api/session-controller/tests/sessions-service.client.spec.ts
@@ -1072,43 +1072,6 @@ describe('catalog arrival', () => {
   })
 })
 
-describe('Host membership recovery', () => {
-  it.for(['event', 'list'] as const)('restores a retained Session through a current %s after plugin reload', async (source, { bench }) => {
-    const b = bench()
-    await feedList(b, [{ id: 's1' }])
-    using reference = b.svc.retain(sid('s1'), { source: 'controllerOperation' })
-    await reference.ready
-    const session = reference.binding.session
-    b.svc.handleSessionRemoved(sid('s1'))
-    expect(session.getSnapshot().removed).toBe(true)
-    if (source === 'event') {
-      b.svc.handleSessionAdded({ agentAvailable: true, sessionId: sid('s1'), updatedAt: 2, running: false, blank: false })
-    } else {
-      await feedList(b, [{ id: 's1' }])
-    }
-    expect(b.svc.binding(sid('s1'))).toBe(reference.binding)
-    expect(session.getSnapshot().removed).toBe(false)
-  })
-
-  it('keeps a removal newer than an in-flight list response', async ({ bench }) => {
-    const b = bench()
-    await feedList(b, [{ id: 's1' }])
-    using reference = b.svc.retain(sid('s1'), { source: 'controllerOperation' })
-    await reference.ready
-    const gate: PromiseWithResolvers<void> = Promise.withResolvers()
-    b.unblock.push(() => { gate.resolve() })
-    b.mock.remote.session.list.mockImplementation(async () => {
-      await gate.promise
-      return ok({ items: [{ agentAvailable: true, sessionId: sid('s1'), updatedAt: 1, running: false, blank: false }] })
-    })
-    const refresh = b.svc.refresh()
-    b.svc.handleSessionRemoved(sid('s1'))
-    gate.resolve()
-    await refresh
-    expect(reference.binding.session.getSnapshot().removed).toBe(true)
-  })
-})
-
 describe('blank mirror', () => {
   it('flips blank=false from the running:true status frame (cross-client conversion)', async ({ bench }) => {
     const b = bench()

From 8860e050459ac70f410425d7ea1ce24b102685be Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 16:23:53 +0800
Subject: [PATCH 41/44] docs(cua): keep documentation changes focused on
 consent

---
 ...capabilities-as-optional-bundles.i18n.yaml |  4 +--
 ...mental-capabilities-as-optional-bundles.md |  2 +-
 ...tal-capabilities-as-optional-bundles.zh.md |  2 +-
 docs/subsystems/computer-use.i18n.yaml        |  4 +--
 docs/subsystems/computer-use.md               |  2 +-
 docs/subsystems/computer-use.zh.md            |  2 +-
 packages/experimental/README.i18n.yaml        |  4 +--
 packages/experimental/README.md               |  2 +-
 packages/experimental/README.zh.md            |  2 +-
 .../experimental/cua-bundle/README.i18n.yaml  | 32 +++++++++----------
 packages/experimental/cua-bundle/README.md    | 14 ++++----
 packages/experimental/cua-bundle/README.zh.md | 14 ++++----
 packages/experimental/cua/README.i18n.yaml    |  4 +--
 packages/experimental/cua/README.md           |  2 +-
 packages/experimental/cua/README.zh.md        |  2 +-
 15 files changed, 46 insertions(+), 46 deletions(-)

diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
index 621975c54b..4a705f767e 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.i18n.yaml
@@ -15,5 +15,5 @@
   en: d6f40bf02df37ab7
   zh: e5b85ce9d41e8754
 /agent-note-ship-experimental-capabilities-as-optional-bundles/consequences:
-  en: 651a70607e44928d
-  zh: d26bb5c1a61e05c9
+  en: 3064da835e892958
+  zh: bfcf967b6acc6f85
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
index c380bc3634..2c5e6a73b5 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.md
@@ -34,4 +34,4 @@ Computer Use is a shipped optional bundle in the experimental group. Its bundle
 
 Official discovery does not imply experimental status or a different plugin lifecycle. Switching a bundle off keeps its installed files; failed activation retains the existing saved-selection behavior. Bundle rows are ordinary Host rows with their usual switches. Individual and combined composition tests cover the Host rows and every preset's tool catalog; live switching and recorded Sessions cover activation and model-visible behavior.
 
-Computer Use keeps its permission service and native provider on the Host and registers tools in Agent scopes whose bound preset is `ptc`. Existing Agent events and `createScope()` maintain current, new and resumed Agents. Preset declarations remain unchanged. The detail page has separate actions for the new-session default and persistent PTC execution, both using the existing settings forms. The activation switch preserves those settings; disablement retains the selected execution mode and its in-memory state. Web regressions cover both default choices, live opt-in, blank-session preset changes, inherited children and disposal, plus retained PTC state across repeated toggles.
+Computer Use keeps its permission service and native provider on the Host and registers tools in Agent scopes whose bound preset is `ptc`. Existing Agent events and `createScope()` maintain current, new and resumed Agents. Preset declarations remain unchanged. Only the explicit detail-page action changes the new-session default through the existing settings form; the activation switch does not configure PTC execution.
diff --git a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
index ca1e9d6b6c..31afdf2f3f 100644
--- a/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
+++ b/.agents/notes/implemented/architecture/2026-09-21-experimental-capabilities-as-optional-bundles.zh.md
@@ -34,4 +34,4 @@ Computer Use 是 experimental 包组内随安装提供的可选组合包。组
 
 官方发现不表示实验性状态，也不引入不同的插件生命周期。关闭 bundle 保留已安装文件；激活失败保留现有的已保存选择行为。Bundle 行是普通 Host 行，使用常规开关。独立与组合测试覆盖 Host 行及每个预设的工具目录；实时切换与已记录 Session 覆盖激活和模型可见行为。
 
-Computer Use 将权限服务和原生提供方保留在 Host，在已绑定 `ptc` preset 的 Agent 作用域中注册工具。现有 Agent 事件和 `createScope()` 维护当前、新建和恢复的 Agent，preset 声明保持不变。详情页通过独立按钮分别设置新会话默认模式和持久化 PTC 执行方式，两者复用现有设置表单。启用开关保留这些设置，关闭保留已选执行方式和内存状态。Web 回归覆盖两种默认选择、运行时启停、空会话切换 preset、子会话继承与销毁，以及反复启停后 PTC 状态保留。
+Computer Use 将权限服务和原生提供方保留在 Host，在已绑定 `ptc` preset 的 Agent 作用域中注册工具。现有 Agent 事件和 `createScope()` 维护当前、新建和恢复的 Agent，preset 声明保持不变。只有详情页的显式操作通过现有设置表单修改新会话默认模式，启用开关不配置 PTC 执行方式。
diff --git a/docs/subsystems/computer-use.i18n.yaml b/docs/subsystems/computer-use.i18n.yaml
index 7a2d337439..fc82ebf720 100644
--- a/docs/subsystems/computer-use.i18n.yaml
+++ b/docs/subsystems/computer-use.i18n.yaml
@@ -3,8 +3,8 @@
 # After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/computer-use.md
 /computer-use:
-  en: d3496899650b7131
-  zh: 74d4f51b1a0db1f4
+  en: aff84e3ac8c41594
+  zh: bee7fc09854bfa8b
 /computer-use/choose-a-provider:
   en: fa2e0d7b41c0450b
   zh: af9a799711f901e6
diff --git a/docs/subsystems/computer-use.md b/docs/subsystems/computer-use.md
index a31960d6dc..9a9400e124 100644
--- a/docs/subsystems/computer-use.md
+++ b/docs/subsystems/computer-use.md
@@ -4,7 +4,7 @@ English | [中文](computer-use.zh.md)
 
 Computer use lets a model observe and operate the local desktop through a configured provider. The shared DSH capability is called **computer use**; **Cua Driver** names the upstream implementation.
 
-[Computer Use](../../packages/experimental/cua-bundle/README.md) provides an optional experimental switch for macOS CUA and persistent PTC.
+[Computer Use](../../packages/experimental/cua-bundle/README.md) provides an optional experimental switch for macOS CUA permission setup.
 
 The [`macOS CUA provider`](../../packages/experimental/cua-macos/README.md) uses the [shared CUA objects and executor](../../packages/experimental/cua/README.md), which enforce application consent through User Questions and profile configuration.
 
diff --git a/docs/subsystems/computer-use.zh.md b/docs/subsystems/computer-use.zh.md
index 124231e289..e43718f0ed 100644
--- a/docs/subsystems/computer-use.zh.md
+++ b/docs/subsystems/computer-use.zh.md
@@ -4,7 +4,7 @@
 
 计算机操作让模型通过配置的提供方观察并操作本地桌面。DSH 的共享能力称为 **computer use（计算机操作）**；**Cua Driver** 是上游实现的名称。
 
-[Computer Use](../../packages/experimental/cua-bundle/README.zh.md) 提供 macOS CUA 和 persistent PTC 的可选实验性开关。
+[Computer Use](../../packages/experimental/cua-bundle/README.zh.md) 提供 macOS CUA 及权限设置 的可选实验性开关。
 
 [macOS CUA 提供方](../../packages/experimental/cua-macos/README.zh.md)使用[共享 CUA 对象与执行器](../../packages/experimental/cua/README.zh.md)，通过 User Questions 和配置档设置执行应用授权。
 
diff --git a/packages/experimental/README.i18n.yaml b/packages/experimental/README.i18n.yaml
index 9636d6df2f..21f50eee7a 100644
--- a/packages/experimental/README.i18n.yaml
+++ b/packages/experimental/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: b55aeb927737b90d
   zh: 0b215fcb5c2c7908
 /packages-experimental/packages:
-  en: bf15543c38ac5c3d
-  zh: c6b5eaa133902470
+  en: 036d034ac12d686c
+  zh: c748a9230fefee86
 /packages-experimental/related-documentation:
   en: 1cb9d3448d44e48d
   zh: cd326d70a746b896
diff --git a/packages/experimental/README.md b/packages/experimental/README.md
index fbad880861..4d89dd0faf 100644
--- a/packages/experimental/README.md
+++ b/packages/experimental/README.md
@@ -79,7 +79,7 @@ Promotion requires a named product role, documented public behavior and limitati
 | [`ptc-runtime-python`](ptc-runtime-python/README.md) | CPython subprocess backend for the PTC execution seam | `ctx.ptcRuntime` |
 | [CUA](cua/README.md) | Application/window objects, authorized execution, and permission controls. | `ctx.cuaAccess` |
 | [macOS CUA](cua-macos/README.md) | Swift native execution and platform preparation. | `ctx.computerUse` |
-| [`cua-bundle`](cua-bundle/README.md) | Optional Computer Use switch with persistent PTC | — |
+| [`cua-bundle`](cua-bundle/README.md) | Optional Computer Use switch for PTC sessions | — |
 | [`computer-use-cua-driver-mcp`](computer-use-cua-driver-mcp/README.md) | Use an installed Cua Driver through MCP | `ctx.computerUse` |
 | [`computer-use-cua-driver-native`](computer-use-cua-driver-native/README.md) | Embed the Cua Driver native npm runtime | `ctx.computerUse` |
 | [`browser-use-playwright-mcp`](browser-use-playwright-mcp/README.md) | Playwright browser tools over MCP | `ctx.browserUse` |
diff --git a/packages/experimental/README.zh.md b/packages/experimental/README.zh.md
index a56055bf5c..d979466bd1 100644
--- a/packages/experimental/README.zh.md
+++ b/packages/experimental/README.zh.md
@@ -79,7 +79,7 @@ kind: "package-group"
 | [`ptc-runtime-python`](ptc-runtime-python/README.zh.md) | PTC 执行 seam 的 CPython 子进程后端 | `ctx.ptcRuntime` |
 | [CUA](cua/README.zh.md) | 应用与窗口对象、授权执行和权限控件。 | `ctx.cuaAccess` |
 | [macOS CUA](cua-macos/README.zh.md) | Swift 原生执行与平台组件准备。 | `ctx.computerUse` |
-| [`cua-bundle`](cua-bundle/README.zh.md) | 默认关闭的 Computer Use 开关与 persistent PTC 组合 | — |
+| [`cua-bundle`](cua-bundle/README.zh.md) | 面向 PTC 会话、默认关闭的 Computer Use 开关 | — |
 | [`computer-use-cua-driver-mcp`](computer-use-cua-driver-mcp/README.zh.md) | 通过 MCP 使用已安装的 Cua Driver | `ctx.computerUse` |
 | [`computer-use-cua-driver-native`](computer-use-cua-driver-native/README.zh.md) | 嵌入 Cua Driver 原生 npm 运行时 | `ctx.computerUse` |
 | [`browser-use-playwright-mcp`](browser-use-playwright-mcp/README.zh.md) | 通过 MCP 提供 Playwright 浏览器工具 | `ctx.browserUse` |
diff --git a/packages/experimental/cua-bundle/README.i18n.yaml b/packages/experimental/cua-bundle/README.i18n.yaml
index 19b0fdba00..8a9c5bf5c8 100644
--- a/packages/experimental/cua-bundle/README.i18n.yaml
+++ b/packages/experimental/cua-bundle/README.i18n.yaml
@@ -3,8 +3,8 @@
 # After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/experimental/cua-bundle/README.md
 /:
-  en: 84e3dc6f31301114
-  zh: 6d5cad8cbe82552f
+  en: cc518dcd97629a96
+  zh: 465e999011282dc3
 /deepseek-ai-dsh-cua-bundle:
   en: 9084fb48d0f6489c
   zh: ce692972d91cf663
@@ -15,32 +15,32 @@
   en: b563e4ec4727d0de
   zh: d0228da978238e05
 /deepseek-ai-dsh-cua-bundle/use-this-package:
-  en: 28e391770e1cb8f0
-  zh: 3a1bfa27e729c9bb
+  en: dc35841a42753d00
+  zh: 3c8a03a2ecbec26f
 /deepseek-ai-dsh-cua-bundle/understand-the-implementation:
-  en: 25c57d146e2097f1
-  zh: 0432586fb8441e43
+  en: b1011db52cfc17cd
+  zh: 6fa8798fedc5c0b6
 /deepseek-ai-dsh-cua-bundle/further-exploration:
   en: 9f15d56b5b16e1ca
   zh: 75eb08e8828c8877
 /deepseek-ai-dsh-cua-bundle/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90
-/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc:
-  en: b932589e03b6ff18
-  zh: b932589e03b6ff18
-/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/what-the-model-sees:
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-in-ptc-sessions:
+  en: e8f11f45b375771e
+  zh: e8f11f45b375771e
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-in-ptc-sessions/what-the-model-sees:
   en: 591af735d1eb92f6
   zh: 3632bffa33c77b28
-/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/token-effect:
-  en: 4781f86555eb9a82
-  zh: be437d25cc0a6783
-/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-and-persistent-ptc/kv-cache-effect:
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-in-ptc-sessions/token-effect:
+  en: e8de232e96220fe7
+  zh: 5c791307e2123667
+/deepseek-ai-dsh-cua-bundle/model-experience/computer-use-in-ptc-sessions/kv-cache-effect:
   en: 417c40acd93df532
   zh: 69cc5cf7140c75a9
 /deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work:
-  en: 987e53e31c00358d
-  zh: 6a42836830b6d9ca
+  en: 5586cb62bb16d601
+  zh: 8b06372c77d0cd48
 /deepseek-ai-dsh-cua-bundle/known-limitations-and-deferred-work/dev-note:
   en: 0a1253c6f7b5e8b9
   zh: ce96645b3e75874e
diff --git a/packages/experimental/cua-bundle/README.md b/packages/experimental/cua-bundle/README.md
index 7ff11c55a6..07bb816d6d 100644
--- a/packages/experimental/cua-bundle/README.md
+++ b/packages/experimental/cua-bundle/README.md
@@ -1,5 +1,5 @@
 ---
-description: "Enable experimental Computer Use and configure PTC from the plugin page."
+description: "Enable optional macOS Computer Use and its permission page."
 kind: "package-bundle"
 ---
 
@@ -35,11 +35,11 @@ For the source Desktop launcher and its separate development profile, follow [De
 
 The switch saves bundle selection in the profile’s `package.json`. Computer Use is installed only in PTC sessions. Enabling through Add plugin, a visible card, or its detail page offers setup guidance when system permissions need attention. The detail page offers **Set to PTC** for the new-session default; existing sessions keep their preset. The switch leaves PTC execution mode and other settings unchanged. The detail page’s **Use persistent mode** action separately enables in-memory state across PTC calls; its effects and reload behavior are described in the [permission page](../cua/README.md). Native preparation runs when the provider loads and reuses the source-hashed executable when available.
 
-Disabling unloads the provider and withdraws CUA tools from its Agent scopes. It retains the selected default, runtime configuration and retained PTC variables. Enabling again does not recreate the runtime. Explicitly changing from per-call to persistent execution replaces the shared runtime through HMR and can interrupt an active PTC call.
+Disabling unloads the provider and withdraws CUA tools from its Agent scopes. Runtime configuration, the new-session default and saved grants remain.
 
 Computer Use is available only on a macOS DSH Host. The native provider is an optional dependency installed only on macOS; shared CUA and Client packages remain in the installation. Other Hosts hide the bundle from default plugin lists and model recommendations and refuse enablement before saving settings. Explicit profile dependencies and saved selections remain visible for management. An already selected bundle is skipped at startup with a diagnostic and remains available for deselection; saved user settings remain. A browser on another operating system can connect to a supported Mac Host.
 
-If preparation fails, the saved selection remains, while CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
+If preparation fails, the saved selection remains and CUA operations stay unavailable. Refresh or reopen the plugin page to read the component diagnostic, correct its cause, then restart DSH.
 
 Explicit activation runs a read-only permission check, which may start a helper without opening a system dialog. Open the [permission page](../cua/README.md) for system requests, settings navigation and automatic refresh. Tasks ask separately before accessing an application. Saved application decisions use profile-scoped domain storage. Conversation decisions survive turns, connections, DSH restarts and Computer Use disablement without applying to another conversation. Revoke access on the same page.
 
@@ -51,7 +51,7 @@ Explicit activation runs a read-only permission check, which may start a helper
 <details>
 <summary>Maintainer details</summary>
 
-The bundle patch mounts the shared native provider and permission UI with `agentPreset: ptc`. Using the exported `cordis.patch.yml` directly as an overlay bypasses bundle admission; its row-level condition skips the optional macOS provider on other Hosts. Shared entries alone do not provide computer control. The provider registers tools through existing Agent scopes, so other presets receive no CUA tool or guidance. Preset documents remain unchanged. The detail-page action uses the existing settings form to save `agent-preset-registry.selectedDefault: ptc` only when clicked, preserving the deployment `default`. The provider defaults to PTC scope even when a saved grants override omits that field. [CUA](../cua/README.md) owns registration and disposal.
+The bundle patch mounts the native provider and permission UI with `agentPreset: ptc`. Using the exported `cordis.patch.yml` directly as an overlay bypasses bundle admission; its row-level condition skips the optional macOS provider on other Hosts. Shared entries alone do not provide computer control. Existing Agent scopes register the tools without changing preset documents. The detail-page action uses the existing settings form to save `agent-preset-registry.selectedDefault: ptc` only when clicked. [CUA](../cua/README.md) owns registration and disposal.
 
 </details>
 
@@ -67,7 +67,7 @@ The bundle patch mounts the shared native provider and permission UI with `agent
 <a id="model-experience"></a>
 ## Model Experience
 
-### Computer Use and persistent PTC
+### Computer Use in PTC sessions
 
 #### What the model sees
 
@@ -75,7 +75,7 @@ Existing and new PTC sessions receive `cua` through the generated SDK and `run_c
 
 #### Token effect
 
-CUA activation adds its guidance. Disabling removes that guidance and retains the configured PTC instructions.
+CUA activation adds its guidance. Disabling removes that guidance; the existing PTC execution instructions remain.
 
 #### KV Cache effect
 
@@ -86,7 +86,7 @@ CUA activation and removal change the PTC SDK and system guidance; subsequent re
 <a id="known-limitations-and-deferred-work"></a>
 
 - Source Web and Desktop share permission controls on macOS. Packaged Desktop helper distribution, signing, and permission attribution are deferred.
-- PTC execution is shared by the profile. A Host without HMR applies saved changes at restart. When Coding Tools is off, the existing preset UI restores the new-session default to `standard`; choosing persistent execution leaves Coding Tools off.
+- PTC execution is shared by the profile and is configured independently. A Host without HMR applies saved changes at restart.
 
 <a id="dev-note"></a>
 ### Dev Note
diff --git a/packages/experimental/cua-bundle/README.zh.md b/packages/experimental/cua-bundle/README.zh.md
index 0683675a3b..2189839134 100644
--- a/packages/experimental/cua-bundle/README.zh.md
+++ b/packages/experimental/cua-bundle/README.zh.md
@@ -1,5 +1,5 @@
 ---
-description: "从插件页开启实验性 Computer Use 并配置 PTC。"
+description: "开启可选 macOS Computer Use 及权限页面。"
 kind: "package-bundle"
 ---
 
@@ -35,11 +35,11 @@ pnpm dsh web
 
 开关将组合包选择保存到 profile 的 `package.json`。Computer Use 仅安装在 PTC 会话中。通过「添加插件」、可见卡片或详情页启用时，系统权限未就绪会显示设置引导。详情页提供“设为 PTC”按钮来修改新会话默认模式，已有会话保留原 preset。开关保持 PTC 执行方式和其他设置不变。详情页的“设为持久化”按钮单独开启 PTC 跨调用的内存状态保留，作用范围和重载行为见[权限页面](../cua/README.zh.md)。提供方加载时准备本机组件，已有与源码摘要匹配的可执行文件时直接复用。
 
-关闭会卸载提供方，并从其 Agent 作用域中撤回 CUA 工具。用户选择的默认值、执行器配置和变量均保留。再次开启不会重建执行器。用户显式从 per-call 切换为持久化执行时，HMR 会重载共享执行器，可能中断正在执行的 PTC 调用。
+关闭会卸载提供方，并从其 Agent 作用域中撤回 CUA 工具。执行器配置、新会话默认值和已保存的授权保留。
 
 Computer Use 仅支持 macOS DSH Host。原生提供方是仅在 macOS 安装的可选依赖，共享 CUA 和 Client 包仍随安装提供。其他 Host 默认不在插件列表和模型推荐中展示此组合包，并在保存设置前拒绝启用。profile 显式安装的依赖和已保存的选择仍保留管理入口。已选中的组合包会在启动时跳过并报告原因，仍可取消选择；已保存的用户设置保留。其他操作系统上的浏览器可以连接受支持的 Mac Host。
 
-准备失败时，已保存的选择和 PTC 设置保留，CUA 操作暂不可用。刷新或重新打开插件页查看组件诊断，修复后重启 DSH。
+准备失败时，已保存的选择保留，CUA 操作不可用。刷新或重新打开插件页查看组件诊断，修复后重启 DSH。
 
 显式启用会进行只读权限检查，可能启动 helper，但不会打开系统授权弹窗。[权限页面](../cua/README.zh.md) 提供系统申请入口、设置跳转和自动检测。任务访问应用前会单独询问用户。应用授权保存在按 profile 隔离的存储域中。会话授权跨 turn、连接、DSH 重启和 Computer Use 启停保留，只在原对话中生效。可以在同一页面撤销授权。
 
@@ -51,7 +51,7 @@ Computer Use 仅支持 macOS DSH Host。原生提供方是仅在 macOS 安装的
 <details>
 <summary>维护者说明</summary>
 
-组合包 patch 通过 `agentPreset: ptc` 挂载共享原生提供方和权限界面。直接将导出的 `cordis.patch.yml` 用作覆盖层时不会经过组合包准入；行级条件会在其他 Host 上跳过可选的 macOS 提供方。仅加载共享条目不能提供计算机控制。提供方在现有 Agent 作用域中注册工具，其他 preset 不获得 CUA 工具或指引，preset 文档保持不变。详情页按钮复用现有设置表单，仅在用户点击后保存 `agent-preset-registry.selectedDefault: ptc`，保留部署级 `default`。即使旧授权配置没有声明作用域字段，提供方也默认只为 PTC 会话注册工具。[CUA](../cua/README.zh.md)负责注册和销毁。
+组合包 patch 通过 `agentPreset: ptc` 挂载原生提供方和权限界面。直接将导出的 `cordis.patch.yml` 用作覆盖层时不会经过组合包准入；行级条件会在其他 Host 上跳过可选的 macOS 提供方。仅加载共享条目不能提供计算机控制。工具通过现有 Agent 作用域注册，preset 文档保持不变。详情页按钮复用现有设置表单，仅在点击后保存 `agent-preset-registry.selectedDefault: ptc`。[CUA](../cua/README.zh.md)负责注册和销毁。
 
 </details>
 
@@ -67,7 +67,7 @@ Computer Use 仅支持 macOS DSH Host。原生提供方是仅在 macOS 安装的
 <a id="model-experience"></a>
 ## 模型体验
 
-### Computer Use and persistent PTC
+### Computer Use in PTC sessions
 
 #### What the model sees
 
@@ -75,7 +75,7 @@ Computer Use 仅支持 macOS DSH Host。原生提供方是仅在 macOS 安装的
 
 #### Token effect
 
-CUA 生效时添加其指引。关闭撤回这些指引，保留已配置的 PTC 说明。
+CUA 生效时添加其指引。关闭撤回这些指引，现有 PTC 执行说明保留。
 
 #### KV Cache effect
 
@@ -86,7 +86,7 @@ CUA 生效和卸载会改变 PTC SDK 与系统指引，后续请求使用更新
 <a id="known-limitations-and-deferred-work"></a>
 
 - 源码 Web 与 Desktop 共用 macOS 权限控件。桌面安装包的 helper 分发、签名和权限归属留待后续处理。
-- PTC 执行方式由 profile 共享。未启用 HMR 的 Host 在重启时应用已保存的变更。Coding Tools 关闭时，现有预设界面会将新会话默认值恢复为 `standard`；设置持久化执行方式仍保留 Coding Tools 关闭状态。
+- PTC 执行方式由 profile 共享，需单独配置。未启用 HMR 的 Host 在重启时应用已保存的变更。
 
 <a id="dev-note"></a>
 ### 开发备注
diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index 762d055260..c78e3def69 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: db09ea66bf04180c
   zh: 9b3a573e83443482
 /deepseek-ai-dsh-cua/use-this-package/permission-controls:
-  en: 6b4b3ae85c92d3df
-  zh: 501807b4e7c7a434
+  en: 1e15a89ecb1614d7
+  zh: 1e81d085845e28ab
 /deepseek-ai-dsh-cua/understand-the-implementation:
   en: be463bdd095cc2a9
   zh: 23248be7a2f0b1db
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index f5d2bd73b3..c994f80ed8 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -49,7 +49,7 @@ The [Computer Use bundle](../cua-bundle/README.md) mounts this page with its nat
 
 System-permission operations affect the computer running DSH. When accessing DSH remotely, complete authorization on that computer.
 
-Enabling shows setup guidance when system permissions need attention, with **Later** and **Open settings** actions. The dialog navigates to the plugin details without changing the default mode. The detail page provides **Set to PTC** under **Default mode for new sessions**; only this action saves the default. Existing sessions keep their preset. **Use persistent mode** in the **PTC execution mode** row separately saves `ptc-runtime.executionMode: persistent-in-memory`. Switching reloads the shared PTC runtime and may interrupt an active call; subsequent calls retain variables and application objects in memory. Already-persistent runtimes show a disabled **Persistent mode enabled** button.
+Enabling from the plugin list or detail page shows setup guidance when system permissions need attention, with **Later** and **Open settings** actions. The detail page provides **Set to PTC** under **Default mode for new sessions**; only this action saves the default. Existing sessions keep their preset. **Use persistent mode** in the **PTC execution mode** row separately saves `ptc-runtime.executionMode: persistent-in-memory`. Switching reloads the shared PTC runtime and may interrupt an active call; subsequent calls retain variables and application objects in memory. Already-persistent runtimes show a disabled **Persistent mode enabled** button.
 
 The page lists always-allowed applications and refusals from any session. A refusal in one session does not cancel another session’s grant or prevent a new session from asking. Session-only grants remain effective within their sessions and are omitted from this page. **Revoke** removes the selected application's access and cancels affected work. Input already delivered to an application cannot be undone; observe the application before any further action. **Allow asking again** clears that application’s refusal records across all sessions; the next application selection still requires a new decision.
 
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index 079000c5e5..2326879018 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -49,7 +49,7 @@ kind: "package-reference"
 
 系统权限操作作用于运行 DSH 的电脑。远程访问时，请在该电脑上完成授权。
 
-启用后，系统权限尚未就绪时会显示设置引导，提供“稍后”和“前往设置”。弹窗进入插件详情页，不修改默认模式。详情页的“新会话默认模式”提供“设为 PTC”按钮，仅点击此按钮才保存默认值。已有会话保留原 preset。“PTC 执行方式”一行的“设为持久化”单独保存 `ptc-runtime.executionMode: persistent-in-memory`。切换会重载共享 PTC 执行器，可能打断当前调用；后续调用在内存中保留变量和应用对象。已经使用持久化模式时，按钮显示“已设为持久化”并禁用。
+从插件列表或详情页启用后，系统权限尚未就绪时会显示设置引导，提供“稍后”和“前往设置”。详情页的“新会话默认模式”提供“设为 PTC”按钮，仅点击此按钮才保存默认值。已有会话保留原 preset。“PTC 执行方式”一行的“设为持久化”单独保存 `ptc-runtime.executionMode: persistent-in-memory`。切换会重载共享 PTC 执行器，可能打断当前调用；后续调用在内存中保留变量和应用对象。已经使用持久化模式时，按钮显示“已设为持久化”并禁用。
 
 页面展示“始终允许的应用”和“不允许访问的应用”。后者汇总任一会话的拒绝记录，不取消其他会话已有的授权，也不阻止新会话询问授权。会话授权仍在对应会话中生效，详情页不展示这类应用。“撤销”会移除对应应用的访问许可并取消相关操作。已发送到应用的输入无法撤回，继续操作前需重新观察应用。“允许再次询问”清除该应用在所有会话中的拒绝记录；下次选择应用时仍需用户重新决定。
 

From e979223a76783a3e058414bc20e002276d08e845 Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 16:38:11 +0800
Subject: [PATCH 42/44] fix(cua): scope detail separators to computer use

---
 packages/client/ui-plugin-manager/README.i18n.yaml       | 4 ++--
 packages/client/ui-plugin-manager/README.md              | 2 +-
 packages/client/ui-plugin-manager/README.zh.md           | 2 +-
 .../src/client/PluginManagerPage.module.css              | 9 +++++++--
 packages/experimental/cua/README.i18n.yaml               | 4 ++--
 packages/experimental/cua/README.md                      | 2 +-
 packages/experimental/cua/README.zh.md                   | 2 +-
 7 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/packages/client/ui-plugin-manager/README.i18n.yaml b/packages/client/ui-plugin-manager/README.i18n.yaml
index 3ba2f77690..c1aab681db 100644
--- a/packages/client/ui-plugin-manager/README.i18n.yaml
+++ b/packages/client/ui-plugin-manager/README.i18n.yaml
@@ -33,8 +33,8 @@
   en: e9da90f03691101b
   zh: 902cda935a4ce3c8
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/detail-page-extension-points:
-  en: 651eb33f2e1c5c42
-  zh: ba679af009805c3e
+  en: d5e3cad5c31cae59
+  zh: 6dc38f09b410d247
 /deepseek-ai-dsh-client-ui-plugin-manager/use-this-package/page-tabs:
   en: fc469bab4fbd6028
   zh: 8f5a04e1b9a46471
diff --git a/packages/client/ui-plugin-manager/README.md b/packages/client/ui-plugin-manager/README.md
index 9f0e3d1fe6..397dd2495f 100644
--- a/packages/client/ui-plugin-manager/README.md
+++ b/packages/client/ui-plugin-manager/README.md
@@ -110,7 +110,7 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 A row's page exists only while a `plugins.row.config` entry names the row, so a contribution meant for a row renders on the page that configuration opens.
 
-Component lists and detail pages show current startup diagnostics from the Host inventory. The diagnostic remains visible after reopening the page and disappears when the component recovers. Component and source rows use the shared l3 separator color.
+Component lists and detail pages show current startup diagnostics from the Host inventory. The diagnostic remains visible after reopening the page and disappears when the component recovers. Component and source rows use l2 separators by default; the Computer Use detail page uses l3.
 
 ### Page tabs
 
diff --git a/packages/client/ui-plugin-manager/README.zh.md b/packages/client/ui-plugin-manager/README.zh.md
index 40f5855ed0..dccd4cacd3 100644
--- a/packages/client/ui-plugin-manager/README.zh.md
+++ b/packages/client/ui-plugin-manager/README.zh.md
@@ -110,7 +110,7 @@ ctx.slots.inject('plugins.detail.section', () => ctx.slots.register({
 
 行页只在某个 `plugins.row.config` 条目点名这一行时存在，因此给行的贡献渲染在该配置打开的页面上。
 
-组件列表和详情页显示 Host 清单中的当前启动诊断。重新打开页面后仍能看到原因，组件恢复后诊断消失。 组件列表与来源信息使用共享 l3 分割线颜色。
+组件列表和详情页显示 Host 清单中的当前启动诊断。重新打开页面后仍能看到原因，组件恢复后诊断消失。组件列表与来源信息默认使用 l2 分割线，Computer Use 详情页使用 l3。
 
 ### 页面标签页
 
diff --git a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
index 1c6d1213f2..b9516b2a10 100644
--- a/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
+++ b/packages/client/ui-plugin-manager/src/client/PluginManagerPage.module.css
@@ -1525,7 +1525,7 @@ label.registryOption {
   gap: 16px;
   min-height: 44px;
   padding: 8px 2px;
-  border-bottom: 0.5px solid var(--dsw-alias-border-l3);
+  border-bottom: 0.5px solid var(--dsw-alias-border-l2);
 }
 
 .facts dt {
@@ -1570,13 +1570,18 @@ label.registryOption {
 
 .row {
   padding: 12px 2px;
-  border-bottom: 0.5px solid var(--dsw-alias-border-l3);
+  border-bottom: 0.5px solid var(--dsw-alias-border-l2);
 }
 
 .row:last-child {
   border-bottom: 0;
 }
 
+.detail[data-plugin-detail='@deepseek-ai/dsh-cua-bundle'] .facts div,
+.detail[data-plugin-detail='@deepseek-ai/dsh-cua-bundle'] .row {
+  border-bottom-color: var(--dsw-alias-border-l3);
+}
+
 .rowLine {
   display: flex;
   align-items: center;
diff --git a/packages/experimental/cua/README.i18n.yaml b/packages/experimental/cua/README.i18n.yaml
index c78e3def69..9524bd3f5a 100644
--- a/packages/experimental/cua/README.i18n.yaml
+++ b/packages/experimental/cua/README.i18n.yaml
@@ -18,8 +18,8 @@
   en: db09ea66bf04180c
   zh: 9b3a573e83443482
 /deepseek-ai-dsh-cua/use-this-package/permission-controls:
-  en: 1e15a89ecb1614d7
-  zh: 1e81d085845e28ab
+  en: 6706beb084a70fe4
+  zh: b188bf09b115ce84
 /deepseek-ai-dsh-cua/understand-the-implementation:
   en: be463bdd095cc2a9
   zh: 23248be7a2f0b1db
diff --git a/packages/experimental/cua/README.md b/packages/experimental/cua/README.md
index c994f80ed8..3ead70dd48 100644
--- a/packages/experimental/cua/README.md
+++ b/packages/experimental/cua/README.md
@@ -43,7 +43,7 @@ Actions return `dispatched:true, verified:false`; read fresh state to verify the
 
 ### Permission controls
 
-Permission groups use the shared l3 border color and 32px section spacing, matching the plugin page’s component and source sections.
+On the Computer Use detail page, permission cards, component rows, and source facts use l3 borders, with 32px gaps between sections. Application badges retain their l1 borders.
 
 The [Computer Use bundle](../cua-bundle/README.md) mounts this page with its native provider. **Authorize computer use** groups the new-session default, PTC execution mode, Accessibility, and Screen Recording inside one border, with dividers between the rows. Each system-permission row shows the system-reported responsible application’s `.app` bundle filename and icon together in a bordered label. **Manage applications computer use can access** places the application lists inside a separate bordered group. Choose **Request permission**, find that application in the macOS permission list, and enable its switch; if macOS names another application, follow that prompt. With no detected source, the page directs the user to the application named by macOS. Each system-permission row has one control: **Request permission** when access is missing, or an outlined **Allowed** button with a settings icon after authorization. Clicking it opens the corresponding privacy pane, where the user can revoke access; hovering shows **Open System Settings**. Unknown status uses the same button with an **Unknown** label; pending initial observations retain a single placeholder. The page refreshes on entry, when the window regains focus, and after permission actions. A failed query offers **Retry**. Follow any macOS quit-and-reopen prompt and restart DSH as needed.
 
diff --git a/packages/experimental/cua/README.zh.md b/packages/experimental/cua/README.zh.md
index 2326879018..403d0ab5ca 100644
--- a/packages/experimental/cua/README.zh.md
+++ b/packages/experimental/cua/README.zh.md
@@ -43,7 +43,7 @@ kind: "package-reference"
 
 ### 权限控件
 
-权限分组使用共享 l3 边框色，区块间距与插件页的组件和来源信息区块统一为 32px。
+Computer Use 详情页的权限卡片、组件列表和来源信息使用 l3 边框，区块间距为 32px。应用名称徽标保留 l1 边框。
 
 [Computer Use 组合](../cua-bundle/README.zh.md)将本页与原生 provider 一起挂载。“给 Computer Use 授权”把新会话默认模式、PTC 执行方式、辅助功能和屏幕录制放在同一个边框内，四排之间使用分隔线。两条系统权限要求在能识别责任应用时，把该应用的 `.app` 包名称和图标放在同一个标签中。“管理 Computer Use 可访问的应用”使用独立边框包住应用列表。点击“申请权限”，在 macOS 权限列表中找到该应用并开启对应开关；若 macOS 显示其他名称，以系统提示为准。来源无法识别时，页面引导用户查找系统提示的应用。每条系统权限要求只显示一个控件：未授权时为“申请权限”，已授权时为带设置图标的“已允许”描边按钮，点击直接进入对应隐私设置页，由用户撤销权限，悬停提示“打开系统设置”。无法确认状态时使用同样的按钮，文字为“未确认”。首次查询期间保留一个占位。进入详情页、返回窗口或完成授权操作后会自动刷新；查询失败时可点击“重试”。若系统要求退出并重新打开应用，请按提示操作并重新启动 DSH。
 

From 075e9e4de763ec7cb3f83d0d487b897d00ebcddf Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 18:20:09 +0800
Subject: [PATCH 43/44] refactor(plugin-inventory): collect startup diagnostics
 concurrently

---
 .../host/plugin-inventory/README.i18n.yaml    |  4 +-
 packages/host/plugin-inventory/README.md      |  2 +-
 packages/host/plugin-inventory/README.zh.md   |  2 +-
 packages/host/plugin-inventory/src/index.ts   | 23 ++++++----
 .../plugin-inventory/tests/inventory.spec.ts  | 44 ++++++++++++++++++-
 5 files changed, 61 insertions(+), 14 deletions(-)

diff --git a/packages/host/plugin-inventory/README.i18n.yaml b/packages/host/plugin-inventory/README.i18n.yaml
index 436960c853..ac0621fd27 100644
--- a/packages/host/plugin-inventory/README.i18n.yaml
+++ b/packages/host/plugin-inventory/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: dfc89b14d4c0d21e
   zh: 062b233951ed157b
 /deepseek-ai-dsh-host-plugin-inventory/use-this-package/what-you-can-and-cannot-do-with-it:
-  en: 0243819e8404c74a
-  zh: 05dab926c0ecff34
+  en: 196540b2ba8bd620
+  zh: 909fd29d010a6c00
 /deepseek-ai-dsh-host-plugin-inventory/understand-the-implementation:
   en: 42b15ac6321706aa
   zh: 4ed0861911abaf5d
diff --git a/packages/host/plugin-inventory/README.md b/packages/host/plugin-inventory/README.md
index cd9ce7c0fa..d0b63b574a 100644
--- a/packages/host/plugin-inventory/README.md
+++ b/packages/host/plugin-inventory/README.md
@@ -41,7 +41,7 @@ With a roster composed, `agentPresets` carries one group per preset in roster or
 
 The inventory is a snapshot for display and diagnostics: a client can render the roster, flag failed entries, and detect changes by comparing snapshots. It cannot enable, disable, add, or remove plugins, and it carries no history — a fiber that already failed and was removed is absent. Because the service reads the Loader on every call, the answer always reflects the current composition rather than a cached view.
 
-Failed entries include the current startup diagnostic read from their Cordis fiber. Recovery removes it; inventory reads do not wait for loading entries or retain a separate error cache.
+Failed entries include the current startup diagnostic read from their Cordis fiber. Entry states are sampled before diagnostics are read concurrently. Recovery removes the diagnostic; inventory reads do not wait for loading entries or retain a separate error cache.
 
 -----
 
diff --git a/packages/host/plugin-inventory/README.zh.md b/packages/host/plugin-inventory/README.zh.md
index 8392526a96..0c892c1523 100644
--- a/packages/host/plugin-inventory/README.zh.md
+++ b/packages/host/plugin-inventory/README.zh.md
@@ -41,7 +41,7 @@ Loader 行与预设行可以携带可选的 `meta`，其中包含标题、描述
 
 该清单是供展示与诊断的快照：客户端可以渲染名单、标出失败条目，并通过比较快照检测变化。它不能启用、停用、添加或移除插件，也不携带历史——已经失败并被移除的 fiber 缺席。由于服务每次调用都读取 Loader，答案总是反映当前组合，而不是缓存视图。
 
-失败条目包含从 Cordis fiber 读取的当前启动诊断。恢复后移除该诊断；清单查询不等待仍在加载的条目，也不另存错误缓存。
+失败条目包含从 Cordis fiber 读取的当前启动诊断。条目状态在并发读取诊断之前采集。恢复后移除该诊断；清单查询不等待仍在加载的条目，也不另存错误缓存。
 
 -----
 
diff --git a/packages/host/plugin-inventory/src/index.ts b/packages/host/plugin-inventory/src/index.ts
index a47c673ba9..9112b46e4f 100644
--- a/packages/host/plugin-inventory/src/index.ts
+++ b/packages/host/plugin-inventory/src/index.ts
@@ -1,6 +1,6 @@
 /** Read-only projection of the current Cordis Loader plugin entries. */
 
-import type { Context, FiberState } from '@deepseek-ai/cordis'
+import type { Context, Fiber, FiberState } from '@deepseek-ai/cordis'
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 // Type-only: the optional agent-preset roster resolved through `ctx.get`.
 import type {} from '@deepseek-ai/dsh-agent-preset-registry'
@@ -77,10 +77,11 @@ export default PluginInventoryGateway
 
 /** Read current Loader entries and optional preset compositions.
  * @param ctx Context with the Loader service.
- * @returns Current inventory with optional display metadata and no separate runtime cache.
+ * @returns Current inventory with entry states sampled before concurrent diagnostic reads.
  */
 export async function readPluginInventory(ctx: Context): Promise<PluginInventorySnapshot> {
   const entries: PluginInventoryEntry[] = []
+  const failed: { row: PluginInventoryEntry; fiber: Fiber }[] = []
   const packages = ctx.get('pluginPackages')
   for (const entry of ctx.loader.entries()) {
     if (entry.options.group) continue
@@ -88,18 +89,22 @@ export async function readPluginInventory(ctx: Context): Promise<PluginInventory
     const meta = base === undefined ? undefined : packages?.metaOf(entry.options.name, base)
     const fiber = entry.fiber
     const fiberPhase = fiber === undefined ? null : FIBER_PHASE[fiber.state]
-    let diagnostic: string | undefined
-    if (fiber !== undefined && fiberPhase === 'failed') {
-      try { await fiber.await() } catch (error) { diagnostic = error instanceof Error ? error.message : String(error) }
-    }
-    entries.push({
+    const row: PluginInventoryEntry = {
       entryId: pluginEntryId(entry.id),
       moduleName: entry.options.name,
       enabled: !entry.disabled,
       fiberPhase,
-      ...diagnostic === undefined ? {} : { diagnostic },
       ...meta === undefined ? {} : { meta },
-    })
+    }
+    entries.push(row)
+    if (fiber !== undefined && fiberPhase === 'failed') failed.push({ row, fiber })
+  }
+  const diagnostics = await Promise.all(failed.map(({ row, fiber }) => fiber.await().then(
+    () => ({ row, diagnostic: undefined }),
+    (error: unknown) => ({ row, diagnostic: error instanceof Error ? error.message : String(error) }),
+  )))
+  for (const { row, diagnostic } of diagnostics) {
+    if (diagnostic !== undefined) Object.assign(row, { diagnostic })
   }
   const presets = ctx.get('agentPresets')
   const management = ctx.get('pluginManager') === undefined ? {} : { managementAvailable: true }
diff --git a/packages/host/plugin-inventory/tests/inventory.spec.ts b/packages/host/plugin-inventory/tests/inventory.spec.ts
index 6e022ea922..b3d41ba5de 100644
--- a/packages/host/plugin-inventory/tests/inventory.spec.ts
+++ b/packages/host/plugin-inventory/tests/inventory.spec.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { lstatSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -173,6 +173,48 @@ describe('PluginInventoryGateway', () => {
     })
   })
 
+  it.each([false, true])('reads failed diagnostics concurrently and preserves row order (recovery: %s)', async (recover) => {
+    const { ctx, inventory } = await harness()
+    ctx.loader.builtins.failing = {
+      apply(_ctx: Context, config: { fail: boolean; message: string }) {
+        if (config.fail) throw new Error(config.message)
+      },
+    }
+    const firstEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:failing', config: { fail: true, message: 'first failure' } }))
+    const activeEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:active' }))
+    const secondEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:failing', config: { fail: true, message: 'second failure' } }))
+    const first = firstEntry.fiber!, second = secondEntry.fiber!
+    await expect(first.await()).rejects.toThrow('first failure')
+    await activeEntry.fiber!.await()
+    await expect(second.await()).rejects.toThrow('second failure')
+    const firstAwait = first.await.bind(first), secondAwait = second.await.bind(second)
+    const firstGate = Promise.withResolvers<undefined>(), secondGate = Promise.withResolvers<undefined>()
+    // Hold completion to exercise overlapping reads without scheduler delays.
+    const firstRead = vi.spyOn(first, 'await').mockImplementation(() => firstGate.promise.then(firstAwait))
+    const secondRead = vi.spyOn(second, 'await').mockImplementation(() => secondGate.promise.then(secondAwait))
+    const reading = inventory.list()
+    try {
+      expect(firstRead).toHaveBeenCalledOnce()
+      expect(secondRead).toHaveBeenCalledOnce()
+      if (recover) {
+        await secondEntry.update({ config: { fail: false, message: 'second failure' } })
+        await secondAwait()
+      }
+      secondGate.resolve(undefined)
+      firstGate.resolve(undefined)
+      expect((await reading).entries).toEqual([
+        { entryId: firstEntry.id, moduleName: 'cordis:failing', enabled: true, fiberPhase: 'failed', diagnostic: 'first failure' },
+        { entryId: activeEntry.id, moduleName: 'cordis:active', enabled: true, fiberPhase: 'active' },
+        { entryId: secondEntry.id, moduleName: 'cordis:failing', enabled: true, fiberPhase: 'failed',
+          ...recover ? {} : { diagnostic: 'second failure' } },
+      ])
+    } finally {
+      firstGate.resolve(undefined)
+      secondGate.resolve(undefined)
+      try { await reading } finally { firstRead.mockRestore(); secondRead.mockRestore() }
+    }
+  })
+
   it('projects current non-group Loader entries without a second cache', async () => {
     const { ctx, inventory } = await harness()
     const activeId = await ctx.loader.create({ name: 'cordis:active' })

From 06ebda43853b30e9640035c2009b2795b64299fa Mon Sep 17 00:00:00 2001
From: creatixchu <creatixchu@deepseek.com>
Date: Sun, 25 Oct 2026 18:36:55 +0800
Subject: [PATCH 44/44] Revert "refactor(plugin-inventory): collect startup
 diagnostics concurrently"

This reverts commit c3d4f4bb70f685acdd289acb5d72472087e8377a.
---
 .../host/plugin-inventory/README.i18n.yaml    |  4 +-
 packages/host/plugin-inventory/README.md      |  2 +-
 packages/host/plugin-inventory/README.zh.md   |  2 +-
 packages/host/plugin-inventory/src/index.ts   | 23 ++++------
 .../plugin-inventory/tests/inventory.spec.ts  | 44 +------------------
 5 files changed, 14 insertions(+), 61 deletions(-)

diff --git a/packages/host/plugin-inventory/README.i18n.yaml b/packages/host/plugin-inventory/README.i18n.yaml
index ac0621fd27..436960c853 100644
--- a/packages/host/plugin-inventory/README.i18n.yaml
+++ b/packages/host/plugin-inventory/README.i18n.yaml
@@ -24,8 +24,8 @@
   en: dfc89b14d4c0d21e
   zh: 062b233951ed157b
 /deepseek-ai-dsh-host-plugin-inventory/use-this-package/what-you-can-and-cannot-do-with-it:
-  en: 196540b2ba8bd620
-  zh: 909fd29d010a6c00
+  en: 0243819e8404c74a
+  zh: 05dab926c0ecff34
 /deepseek-ai-dsh-host-plugin-inventory/understand-the-implementation:
   en: 42b15ac6321706aa
   zh: 4ed0861911abaf5d
diff --git a/packages/host/plugin-inventory/README.md b/packages/host/plugin-inventory/README.md
index d0b63b574a..cd9ce7c0fa 100644
--- a/packages/host/plugin-inventory/README.md
+++ b/packages/host/plugin-inventory/README.md
@@ -41,7 +41,7 @@ With a roster composed, `agentPresets` carries one group per preset in roster or
 
 The inventory is a snapshot for display and diagnostics: a client can render the roster, flag failed entries, and detect changes by comparing snapshots. It cannot enable, disable, add, or remove plugins, and it carries no history — a fiber that already failed and was removed is absent. Because the service reads the Loader on every call, the answer always reflects the current composition rather than a cached view.
 
-Failed entries include the current startup diagnostic read from their Cordis fiber. Entry states are sampled before diagnostics are read concurrently. Recovery removes the diagnostic; inventory reads do not wait for loading entries or retain a separate error cache.
+Failed entries include the current startup diagnostic read from their Cordis fiber. Recovery removes it; inventory reads do not wait for loading entries or retain a separate error cache.
 
 -----
 
diff --git a/packages/host/plugin-inventory/README.zh.md b/packages/host/plugin-inventory/README.zh.md
index 0c892c1523..8392526a96 100644
--- a/packages/host/plugin-inventory/README.zh.md
+++ b/packages/host/plugin-inventory/README.zh.md
@@ -41,7 +41,7 @@ Loader 行与预设行可以携带可选的 `meta`，其中包含标题、描述
 
 该清单是供展示与诊断的快照：客户端可以渲染名单、标出失败条目，并通过比较快照检测变化。它不能启用、停用、添加或移除插件，也不携带历史——已经失败并被移除的 fiber 缺席。由于服务每次调用都读取 Loader，答案总是反映当前组合，而不是缓存视图。
 
-失败条目包含从 Cordis fiber 读取的当前启动诊断。条目状态在并发读取诊断之前采集。恢复后移除该诊断；清单查询不等待仍在加载的条目，也不另存错误缓存。
+失败条目包含从 Cordis fiber 读取的当前启动诊断。恢复后移除该诊断；清单查询不等待仍在加载的条目，也不另存错误缓存。
 
 -----
 
diff --git a/packages/host/plugin-inventory/src/index.ts b/packages/host/plugin-inventory/src/index.ts
index 9112b46e4f..a47c673ba9 100644
--- a/packages/host/plugin-inventory/src/index.ts
+++ b/packages/host/plugin-inventory/src/index.ts
@@ -1,6 +1,6 @@
 /** Read-only projection of the current Cordis Loader plugin entries. */
 
-import type { Context, Fiber, FiberState } from '@deepseek-ai/cordis'
+import type { Context, FiberState } from '@deepseek-ai/cordis'
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 // Type-only: the optional agent-preset roster resolved through `ctx.get`.
 import type {} from '@deepseek-ai/dsh-agent-preset-registry'
@@ -77,11 +77,10 @@ export default PluginInventoryGateway
 
 /** Read current Loader entries and optional preset compositions.
  * @param ctx Context with the Loader service.
- * @returns Current inventory with entry states sampled before concurrent diagnostic reads.
+ * @returns Current inventory with optional display metadata and no separate runtime cache.
  */
 export async function readPluginInventory(ctx: Context): Promise<PluginInventorySnapshot> {
   const entries: PluginInventoryEntry[] = []
-  const failed: { row: PluginInventoryEntry; fiber: Fiber }[] = []
   const packages = ctx.get('pluginPackages')
   for (const entry of ctx.loader.entries()) {
     if (entry.options.group) continue
@@ -89,22 +88,18 @@ export async function readPluginInventory(ctx: Context): Promise<PluginInventory
     const meta = base === undefined ? undefined : packages?.metaOf(entry.options.name, base)
     const fiber = entry.fiber
     const fiberPhase = fiber === undefined ? null : FIBER_PHASE[fiber.state]
-    const row: PluginInventoryEntry = {
+    let diagnostic: string | undefined
+    if (fiber !== undefined && fiberPhase === 'failed') {
+      try { await fiber.await() } catch (error) { diagnostic = error instanceof Error ? error.message : String(error) }
+    }
+    entries.push({
       entryId: pluginEntryId(entry.id),
       moduleName: entry.options.name,
       enabled: !entry.disabled,
       fiberPhase,
+      ...diagnostic === undefined ? {} : { diagnostic },
       ...meta === undefined ? {} : { meta },
-    }
-    entries.push(row)
-    if (fiber !== undefined && fiberPhase === 'failed') failed.push({ row, fiber })
-  }
-  const diagnostics = await Promise.all(failed.map(({ row, fiber }) => fiber.await().then(
-    () => ({ row, diagnostic: undefined }),
-    (error: unknown) => ({ row, diagnostic: error instanceof Error ? error.message : String(error) }),
-  )))
-  for (const { row, diagnostic } of diagnostics) {
-    if (diagnostic !== undefined) Object.assign(row, { diagnostic })
+    })
   }
   const presets = ctx.get('agentPresets')
   const management = ctx.get('pluginManager') === undefined ? {} : { managementAvailable: true }
diff --git a/packages/host/plugin-inventory/tests/inventory.spec.ts b/packages/host/plugin-inventory/tests/inventory.spec.ts
index b3d41ba5de..6e022ea922 100644
--- a/packages/host/plugin-inventory/tests/inventory.spec.ts
+++ b/packages/host/plugin-inventory/tests/inventory.spec.ts
@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it } from 'vitest'
 import { lstatSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -173,48 +173,6 @@ describe('PluginInventoryGateway', () => {
     })
   })
 
-  it.each([false, true])('reads failed diagnostics concurrently and preserves row order (recovery: %s)', async (recover) => {
-    const { ctx, inventory } = await harness()
-    ctx.loader.builtins.failing = {
-      apply(_ctx: Context, config: { fail: boolean; message: string }) {
-        if (config.fail) throw new Error(config.message)
-      },
-    }
-    const firstEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:failing', config: { fail: true, message: 'first failure' } }))
-    const activeEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:active' }))
-    const secondEntry = ctx.loader.resolve(await ctx.loader.create({ name: 'cordis:failing', config: { fail: true, message: 'second failure' } }))
-    const first = firstEntry.fiber!, second = secondEntry.fiber!
-    await expect(first.await()).rejects.toThrow('first failure')
-    await activeEntry.fiber!.await()
-    await expect(second.await()).rejects.toThrow('second failure')
-    const firstAwait = first.await.bind(first), secondAwait = second.await.bind(second)
-    const firstGate = Promise.withResolvers<undefined>(), secondGate = Promise.withResolvers<undefined>()
-    // Hold completion to exercise overlapping reads without scheduler delays.
-    const firstRead = vi.spyOn(first, 'await').mockImplementation(() => firstGate.promise.then(firstAwait))
-    const secondRead = vi.spyOn(second, 'await').mockImplementation(() => secondGate.promise.then(secondAwait))
-    const reading = inventory.list()
-    try {
-      expect(firstRead).toHaveBeenCalledOnce()
-      expect(secondRead).toHaveBeenCalledOnce()
-      if (recover) {
-        await secondEntry.update({ config: { fail: false, message: 'second failure' } })
-        await secondAwait()
-      }
-      secondGate.resolve(undefined)
-      firstGate.resolve(undefined)
-      expect((await reading).entries).toEqual([
-        { entryId: firstEntry.id, moduleName: 'cordis:failing', enabled: true, fiberPhase: 'failed', diagnostic: 'first failure' },
-        { entryId: activeEntry.id, moduleName: 'cordis:active', enabled: true, fiberPhase: 'active' },
-        { entryId: secondEntry.id, moduleName: 'cordis:failing', enabled: true, fiberPhase: 'failed',
-          ...recover ? {} : { diagnostic: 'second failure' } },
-      ])
-    } finally {
-      firstGate.resolve(undefined)
-      secondGate.resolve(undefined)
-      try { await reading } finally { firstRead.mockRestore(); secondRead.mockRestore() }
-    }
-  })
-
   it('projects current non-group Loader entries without a second cache', async () => {
     const { ctx, inventory } = await harness()
     const activeId = await ctx.loader.create({ name: 'cordis:active' })