test(reference): pin Grok provenance and compatibility inventory

.changeset/child-approvals-main-session.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+`codsh --rust`: an approval request from a subagent or workflow child (for example a deep-research researcher's `web_fetch` in the default ask mode) is now asked in the main interactive session instead of being refused. The status line names the workflow or subagent, the tool, and the target; `y` allows once, `a` remembers it like a main-session grant, `n` returns the refusal to the child. Requests queue, cancelled children close theirs, and headless runs keep the refusal (#220).

.changeset/isolated-rust-launch-preview.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add an opt-in `codsh --rust` launch preview beside the unchanged legacy client. Locally packed native candidates reuse licensed upstream Rust welcome/input components with an isolated dsh Home/Profile, offline startup, explicit unavailable-execution feedback, and terminal cleanup. Include source/dependency notices and installed-product PTY verification. Refuse filesystem-resolved legacy Home aliases and ambiguous case-only overlaps with initially absent Homes before any writes; refuse unresolved symlinks in explicit/default legacy Homes, while retaining valid separate legacy links. Interpret `DSH_HOME` with released dsh's blank/tilde/lexical-normalization rules. Preserve literal `GROK_HOME` and conservatively refuse every parent-traversal (`..`) component, including separate Homes, instead of guessing symlink traversal. Protect default Homes even with overrides. Refuse any unresolved non-ASCII Home component before writes instead of approximating Unicode filesystem identity, including separate missing names; retain native resolution for existing Unicode directories and missing ASCII children beneath them. Compare device/inode ancestry with missing suffixes anchored to existing directories so firmlink aliases cannot evade isolation through different realpath strings; retain separate aliased Homes and fail closed on unavailable directory identity. Include installed-product path-matrix regressions and separate missing/resolvable-Home controls. This does not enable the dsh adapter, publish native releases, or change the default client.

.changeset/memory-remember-session-toggle-fix.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Fix `codsh --rust`: an empty `/remember` (the two-step draft prompt) no longer resets this session's `t` memory toggle back to `config.toml`'s value on save or cancel. Turning memory on with `t` after this session's first prompt was already sent now says it is too late for any prompt here. `/new` drops that toggle and follows `config.toml` again, so the notice does not claim the change carries into the next new session.

.changeset/rust-background-commands.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+`codsh --rust` runs background shell commands through dsh jobs. Ctrl+B moves the running command to the background, a command past `[toolset.bash] foreground_block_budget_ms` moves on its own (or is killed at its timeout with `auto_background_on_timeout = false`), and send-now moves a running command instead of killing it. The status line counts running commands, a message interrupts a blocking `job_output` wait, `/tasks` (Ctrl+G) shows command output and stops one with `x`, and a finished command wakes an idle session with a `◎ Task completed` turn. `/new`, session switches, and quit stop the session's commands; a resumed history never shows them as running. Plain `-p` and editor ACP are unchanged.

.changeset/rust-capability-matrix.md

@@ -0,0 +1,19 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Three-platform capability matrix for the installed Rust client (#201):
+`scripts/rust-capability-matrix.py` and the `capability-matrix` job record OS /
+terminal versions and the real effect of keys, mouse, shell, cancel, screen
+modes, terminal restore, the real clipboard (macOS pasteboard, X11 `xclip`,
+Windows `clip.exe` UTF-16LE), voice doctor without fixtures, sandbox profiles,
+loopback SSH, real tmux, and the Windows ConPTY harness. Missing devices and
+refused features are `refused` / `unavailable`, never a silent pass. Related:
+`docs/rewrite/platform-capabilities.md`, `scripts/rust-clipboard-pty-test.py`,
+`scripts/rust-tmux-pty-test.py`. Windows `/copy` sends UTF-16LE to `clip.exe`
+so CJK survives; an unreachable Linux display is no longer reported as an
+empty clipboard. macOS `/copy` forces a UTF-8 locale for `pbcopy` so CJK is not
+turned into MacRoman, and a closed terminal window now ends the client on
+macOS too (stdin readable with nothing pending counts as a hangup when no
+POLLHUP arrives).

.changeset/rust-clone-grove-substitute.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+`codsh --rust clone` clones with plain git in place of the reference Grove lazy clone, behind the reference gates (`GROK_CLONE`, `GROK_GROVE` / `[cli] grove`, Grove's `[clone] enabled`): depth 1 of one branch with blobs on demand, `--full-history`, `--cone`, git credentials or `GROVE_AUTH_TOKEN` (never `codsh --rust login`), a missing or empty target only, nothing left behind after a failure or Ctrl-C, and `--remote ssh://…` to clone on another host. A Grove worktree request (`GROK_WORKTREE_TYPE`, `[cli] grove_worktree`, `GROK_GROVE`) is recorded and falls back to a plain git worktree.

.changeset/rust-deep-research-fixes.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+`codsh --rust`: web search and fetch registration now follows the effective settings (`config.toml` with its env overrides, requirements and `--disable-web-search`) instead of launcher environment variables, so a setup configured only in `config.toml` gives the session, `/deep-research` researchers and in-session web search their `web_search`/`web_fetch` tools. A deep-research run that completes with a partial result reads `complete (result: partial)` in the completion notice, the tasks pane and the workflow block, as `/workflow runs` already said. `codsh --rust -p "/deep-research <query>"` runs the built-in workflow in the foreground and prints its result (no query prints the usage), and the `streaming-messages-json` init line lists the session's tools and `deep-research`.

.changeset/rust-deep-research.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+`codsh --rust`: `/deep-research <query>` runs the built-in deep-research workflow, the reference script pinned byte for byte from grok-build. It plans questions, researches them in parallel with web search, has separate verifier agents open each cited source, and writes a cited report. Only verified claims are reported; failed branches, missing web services, rate limits, contradicted sources and failed citation checks mark the result partial (`Result status: partial`), and a stop, the agent budget or a missing query end the run as cancelled, budget-limited or blocked. The built-in takes precedence over project, personal and plugin workflows of the same name and cannot be saved over. It uses the configured web search substitute; it was tested only with the mock model and fake local web services.

.changeset/rust-dotenv-temp-pin.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Stop a workspace deny glob from pinning `/tmp` when the workspace lives under the resolved `/private/tmp` write root. Renaming a workspace directory onto a fresh `/tmp` sibling stays allowed, while a directory inside `secrets/**/*.key` stays pinned.

.changeset/rust-dsh-auth-enterprise-services.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add substitute login, logout, and managed-config setup to `codsh --rust`. Identity tokens stay isolated from model keys and other services; organization pins refuse API-key-only use until a matching session exists; unsigned or unverifiable organization policy is refused, and official grok.com entitlements are not reproduced. Startup and inspect refresh an expired session or clear it without blocking login or an otherwise valid API key. Slash login keeps the live dsh client when a settings write fails, and replaces it when the settings patch changes. A usable identity session is passed to the executing dsh child, while other parent `GROK_AUTH_*` variables are not. Logout revokes the session at the identity provider before clearing it, and keeps the local session when revocation fails. A signature for another principal is refused at setup and when the sidecar is loaded, including a deployment-key caller with no team. Fail-closed policy with no pubkey and no sidecar is refused.

.changeset/rust-dsh-cancel-live-turn.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Cancel a live dsh turn from the isolated Rust client without losing an unrelated draft. Empty-draft Ctrl+C sends ACP session/cancel; Esc never cancels a turn or pending approval. Cancelled tools cannot run from a late allow or process teardown.

.changeset/rust-dsh-config-enter-reload.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Empty Enter reloads isolated config and connects without submitting, and credential writes patch one ref while keeping existing records.

.changeset/rust-dsh-context-compaction.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Inspect dsh context occupancy and advertised model limits without fabricating zeros, and run manual/automatic compaction through dsh so resume keeps the same checkpoint, retained tools/todos, and original records on failure.

.changeset/rust-dsh-editor-acp.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Editors can attach to the isolated Rust client with `codsh --rust agent stdio`. The process speaks ACP/JSON-RPC 1 and forwards sessions, prompts, config, approval, and cancel to dsh. `session/load` resumes the same dsh session and replays saved history without running tools again. A denied tool whose call id lives on the nested session message is replayed as failed. Model and reasoning changes are written to `$GROK_HOME/model-selection.toml` before the next prompt and restored on load and on a terminal resume, including an advertised model that is not a catalog id. An unknown model is refused. Terminal `/dontAsk` and `/acceptEdits` share the editor permission mode, and that mode is written before dsh starts. Unsupported `x.ai` methods return method-not-found instead of a success stub. Closing the editor releases the write owner so a terminal can resume the same session.

.changeset/rust-dsh-effective-config-fix.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Write isolated dsh credentials owner-only, apply overlay `api_key`, inspect the telemetry values actually forced off for dsh, and keep first-run config fields visible.

.changeset/rust-dsh-effective-config.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add first-run compatible `config.toml` mapping into isolated dsh settings, with inspectable origins. `codsh --rust inspect` / `inspect --json` report CLI, environment, overlay, file, and default sources. Invalid files are preserved; old credentials and official login/telemetry are not used.

.changeset/rust-dsh-explicit-memory.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Browse, save, search, edit, and forget local memory notes with `/memory`, `/remember`, and `codsh --rust memory clear`. `/remember` appends to the workspace `MEMORY.md` after confirmation. The memory modal highlights the selected row, hides the preview under 80 columns, and cannot delete `MEMORY.md`. `[memory] enabled = false` keeps notes out of the next prompt until the session toggle. `/new`, switch, fork, and rewind drop that toggle. `/cd` then `/new` reads the new workspace. The first turn of a new session injects a bounded global and workspace note, plus keyword session matches. `index.sqlite` is a SQLite FTS5 keyword index rebuilt from the notes; a foreign database is left unchanged. Workspace clear removes `MEMORY.md`, `sessions/`, and `index.sqlite`. A session toggle does not rewrite config, and disabling memory does not delete or upload the files.

.changeset/rust-dsh-file-attachments.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+The isolated Rust client attaches workspace files from the `@` picker, a single line or line range, or a pasted path. Dotfiles and gitignored files, including nested `.gitignore` files, `**` patterns such as `**/*.log`, and patterns that contain `/` (`logs/*.log`, `/secret.rs`, anchored at the directory that owns that `.gitignore`), stay hidden until the query starts with `!`. Pasting one of those paths leaves the text in the draft and does not read or send the file. Pasted prose that only names a path stays text. A prompt sent during a turn is queued with its chips, and Alt+Up restores that prompt once. A removed chip is not sent. A missing file, a file over 256 KiB, a permission failure, or a file that changed after preview stays in the composer and does not send its bytes. dsh receives the admitted text, and a resumed session shows the same `@path` mention.

.changeset/rust-dsh-file-search.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Search and list files through dsh grep and glob, and continue a long read with the offset dsh returns. A denied path is left out of the model result and the tool card, including a shell search of that file. An empty search, a binary file, a file that changed after it was read, and a missing language server are reported as those failures and do not invent contents or locations. A missing language server says that no LSP provider handles the file.

.changeset/rust-dsh-file-tool-approval.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Ask once before real dsh file write/edit tools run from the isolated Rust client. The UI shows the pending operation and dsh-supplied diff, allows that call once, and rejects or ends input without writing. Missing files, tool errors, and stale or duplicate approval replies are reported as failures.

.changeset/rust-dsh-fork-rewind-review.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+Refuse /rewind during a live turn, accept /fork --no-worktree, apply the fork model only on fork, store confirm/fork UI prefs in `$GROK_HOME/config.toml`, and reset minimal native history on rewind/fork.

.changeset/rust-dsh-fork-rewind.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Fork and rewind conversations through dsh seed/projection without restoring files. Isolated `codsh --rust` supports `/rewind`, `/undo`, `/fork`, `--fork-session`, and refuses `--restore-code`.

.changeset/rust-dsh-fullscreen-minimal.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Switch the isolated Rust client between official fullscreen alternate-screen and minimal native-history rendering in process. `/minimal` and `/fullscreen` keep the dsh session, draft, running turn, and pending approval; session-scoped `--minimal`/`--fullscreen` do not rewrite `[ui] screen_mode`.

.changeset/rust-dsh-hooks.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Run Grok-compatible command hooks from `codsh --rust` at SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, and SessionEnd. Exit 2 or `decision: deny` blocks the prompt or tool. A timeout, crash, or other non-zero exit is a recorded failure, not a success. Hook stdout and stderr stay hook output. An allowing hook cannot skip permission checks or widen a sandbox or permission deny. Untrusted project hooks stay skipped.

.changeset/rust-dsh-image-draft-lifecycle.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+In the isolated Rust client an unsent composer draft lives only in the running process, as in the reference: it is not written to `$GROK_HOME`, a new launch in any project starts with an empty composer, a sent prompt and its image never come back, and an exec screen-mode relaunch resumes the session without the draft. `--resume` shows a sent image turn with its `[Image #N]` placeholders, without the text-only `<pasted-image>` path, and sends nothing again. On a text-only model the attach notice says the model cannot see images and gets only the saved path, whose attribute is escaped. Rules, session rules, and the first-turn memory note wrap that user text once; they are not copied onto the `<pasted-image>` element or an attached file body. On macOS an empty bracketed paste (Cmd+V on an image-only clipboard) reads the clipboard image; on Windows it and Alt+V say the clipboard image read is not available yet and attach nothing. Whitespace alone inserts nothing, and pasting or dropping the absolute path or `file://` URL of an image file attaches it as an image instead of a binary `@file` mention.

.changeset/rust-dsh-image-input.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+The isolated Rust client pastes a clipboard image as an atomic `[Image #N]` chip. Hovering the chip, or resting the cursor on it, shows the sniffed size (png, gif, jpeg, or webp), byte length, digest, and saved path. That notice is metadata, not a terminal-graphics picture. A model that declares `image` in `input_modalities` receives an ACP image block. A text-only model receives the saved path under the isolated attachment store and does not get a hidden vision route. A queued image is rebuilt for the model selected when it sends. An empty clipboard, a corrupt file, and a file over 256 KiB stay in the composer with a notice. Removing the chip drops it from the next submit. `/minimal`, `/fullscreen`, and closing the model menu restore the parked bytes with the placeholder. The packed launcher forwards `CODSH_CLIPBOARD_IMAGE` and `GROK_CLIPBOARD_NO_NATIVE_READ`. `[model.<id>] provider` selects the dsh provider; it defaults to the catalog id. Entries that share a provider and the same key, backend, URL, and headers are written as one provider with several models. A reused provider with different credentials or a different backend is refused.

.changeset/rust-dsh-legacy-config-import.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add explicit `codsh --rust import` for selected legacy dsh providers and preferences. Preview lists conversions, conflicts, and unsupported items from current `settings.yaml` sources without copying tokens, credential files, or trust grants. The imported model follows `agent-default-model` when that model is listed. Inline keys are not copied, a missing `apiKeyEnv` is not invented, and existing nested settings are kept. UI density maps to isolated compact mode; apply writes only into the isolated Home.

.changeset/rust-dsh-managed-policy-trust.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add managed defaults, locked requirements, and workspace folder trust to `codsh --rust`. Inspectable origins keep locked values from being bypassed; untrusted project Hooks/plugins/instructions stay inactive until an explicit grant.

.changeset/rust-dsh-mcp-local.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': patch
+'codsh-bundle': patch
+---
+
+The isolated Rust client supports local MCP servers. `codsh --rust mcp list|add|remove|enable|disable|doctor` manages `[mcp_servers]` in `$GROK_HOME/config.toml`, and trusted folders add `.grok/config.toml` and `.mcp.json` servers (untrusted ones are listed but not started). dsh's own MCP client mounts the servers for each session; a missing program, a startup crash, or a refused `initialize` is reported by name while the session starts with the rest. Tools keep dsh's `mcp__<server>__<tool>` names, and Grok's `search_tool` and `use_tool` are added. Every call runs once through the same permission rules (`server__tool`), Hooks, and cancellation. Output above `[mcp] max_output_bytes` (default 20000) is cut with the full text saved to disk, startup and per-tool timeouts are enforced, and `/mcps` shows state, failures, and tools and can enable, disable, or restart servers. SSE, OAuth, plugin-provided servers, and managed MCP policy are not handled yet.

.changeset/rust-dsh-model-protocol-effort.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Map configured model backends and reasoning effort into isolated dsh, and let `/model` `/effort` select only advertised catalog options. Same-named models on different protocols stay distinct; unsupported options are refused; usage and context stay unknown unless the provider or config supplies them.

.changeset/rust-dsh-mouse-search-reading.md

@@ -0,0 +1,6 @@
+---
+'codsh-cli': minor
+'codsh-bundle': minor
+---
+
+Add fullscreen mouse selection, transcript search, turn jump, and reading-position restore to the isolated Rust client. Selection survives rebuild, hit testing uses the painted gutter, and scrollback Ctrl+D half-pages instead of quitting. `/find` and `/jump` refuse in minimal with the `/fullscreen` remedy.