wangtsiao · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026 · Nov 6, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -70,8 +70,11 @@ jobs:
         if: runner.os == 'Linux'
       - run: cargo check --locked -p devo-kernel --all-targets --target ${{ matrix.target }}
         if: runner.os == 'macOS'
-      - run: cargo test --locked -p devo-kernel credential_unix::tests
+      - name: Test kernel credential environment and host protocol
         if: runner.os == 'macOS'
+        run: |
+          cargo test --locked -p devo-kernel session::credential_env_tests
+          cargo test --locked -p devo-kernel protocol::tests
 
   windows-kernel:
     needs: changes

diff --git a/.gitignore b/.gitignore
@@ -2,6 +2,7 @@
 .DS_Store
 .claude
 __pycache__/
+.venv/
 node_modules
 /apps/desktop/out/
 /apps/desktop/resources/runtime/

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/README.ja.md b/README.ja.md
@@ -66,11 +66,11 @@ DeepSeek、Qwen、Kimi、GLM、MiniMax が含まれます。
 `/model` でモデルを切り替え、`devo onboard` でプロバイダーを再設定できます。
 
 手動設定、認証情報、MCP、オフラインインストール、リリースミラーは
-[ユーザーガイド（英語）](./docs/usage.md)を参照してください。
+[ユーザーガイド（英語）](./docs/user-guide.md)を参照してください。
 
 ## ドキュメントと貢献
 
-- [ユーザーガイド（英語）](./docs/usage.md) — インストール、プロバイダー、設定、オフライン利用。
+- [ユーザーガイド（英語）](./docs/user-guide.md) — インストール、プロバイダー、設定、オフライン利用。
 - [TUI ガイド（英語）](./apps/tui/README.md) — ターミナル操作とコマンド。
 - [貢献ガイド（英語）](./CONTRIBUTING.md) — 問題報告、ドキュメント改善、小規模な修正を歓迎します。
 

diff --git a/README.md b/README.md
@@ -59,12 +59,12 @@ Terminal bundles include Node.js and Python. On Windows, install
 [Git for Windows](https://gitforwindows.org/) for shell commands and approve
 the one-time sandbox setup prompt.
 
-> **Temporarily disabled.** OS sandboxing and the permission picker are
-> disabled repo-wide: every process runs with full user permissions and new
-> sessions default to full-access. Revert by flipping
-> `SANDBOX_ENFORCEMENT_TEMPORARILY_DISABLED` (Rust, `crates/sandbox/src/lib.rs`),
-> `PERMISSIONS_COMMAND_ENABLED` (TUI), `PERMISSION_PICKER_ENABLED` (desktop),
-> and the default-preset literals back to their asking defaults.
+> Shell and terminal execution follow the configured sandbox profile; there is
+> no global sandbox-disable switch. Python kernels are trusted user-privileged
+> processes, not OS-isolated environments. See
+> [the execution boundary](docs/trusted-kernel-host-shell.md).
+> Permission-picker UI flags and new-session permission defaults are separate
+> settings; removing the global switch does not change them.
 
 ## Configuration
 
@@ -74,11 +74,11 @@ DeepSeek, Qwen, Kimi, GLM, and MiniMax. Use `/model` to switch models or
 `devo onboard` to revisit provider setup.
 
 For manual configuration, credentials, MCP, offline installation, and release
-mirrors, see the [user guide](./docs/usage.md).
+mirrors, see the [user guide](./docs/user-guide.md).
 
 ## Docs and contributing
 
-- [User guide](./docs/usage.md) — installation, providers, configuration, and offline use.
+- [User guide](./docs/user-guide.md) — installation, providers, configuration, and offline use.
 - [TUI guide](./apps/tui/README.md) — terminal controls and commands.
 - [Contributing](./CONTRIBUTING.md) — issues, documentation, and focused fixes welcome.
 

diff --git a/README.ru.md b/README.ru.md
@@ -68,11 +68,11 @@ devo
 Переключайте модели через `/model`, повторно настраивайте провайдера через `devo onboard`.
 
 Ручная конфигурация, учётные данные, MCP, офлайн-установка и зеркала релизов
-описаны в [руководстве пользователя (на английском)](./docs/usage.md).
+описаны в [руководстве пользователя (на английском)](./docs/user-guide.md).
 
 ## Документация и участие
 
-- [Руководство пользователя (на английском)](./docs/usage.md) — установка, провайдеры, конфигурация и офлайн-работа.
+- [Руководство пользователя (на английском)](./docs/user-guide.md) — установка, провайдеры, конфигурация и офлайн-работа.
 - [Руководство TUI (на английском)](./apps/tui/README.md) — управление терминалом и команды.
 - [Участие в разработке (на английском)](./CONTRIBUTING.md) — приветствуются сообщения об ошибках, улучшения документации и небольшие исправления.
 

diff --git a/README.zh-Hans.md b/README.zh-Hans.md
@@ -61,11 +61,11 @@ devo
 **Anthropic Messages** API。内置目录包含 DeepSeek、Qwen、Kimi、GLM 和 MiniMax。
 用 `/model` 切换模型，用 `devo onboard` 重新配置提供商。
 
-手动配置、凭据、MCP、离线安装和发布镜像见[使用指南（英文）](./docs/usage.md)。
+手动配置、凭据、MCP、离线安装和发布镜像见[使用指南（英文）](./docs/user-guide.md)。
 
 ## 文档与贡献
 
-- [使用指南（英文）](./docs/usage.md) — 安装、提供商、配置与离线使用。
+- [使用指南（英文）](./docs/user-guide.md) — 安装、提供商、配置与离线使用。
 - [TUI 指南（英文）](./apps/tui/README.md) — 终端操作与命令。
 - [贡献指南（英文）](./CONTRIBUTING.md) — 欢迎问题反馈、文档改进和小范围修复。
 

diff --git a/README.zh-Hant.md b/README.zh-Hant.md
@@ -61,11 +61,11 @@ devo
 **Anthropic Messages** API。內建目錄包含 DeepSeek、Qwen、Kimi、GLM 和 MiniMax。
 用 `/model` 切換模型，用 `devo onboard` 重新設定供應商。
 
-手動設定、憑證、MCP、離線安裝和發行鏡像請見[使用指南（英文）](./docs/usage.md)。
+手動設定、憑證、MCP、離線安裝和發行鏡像請見[使用指南（英文）](./docs/user-guide.md)。
 
 ## 文件與貢獻
 
-- [使用指南（英文）](./docs/usage.md) — 安裝、供應商、設定與離線使用。
+- [使用指南（英文）](./docs/user-guide.md) — 安裝、供應商、設定與離線使用。
 - [TUI 指南（英文）](./apps/tui/README.md) — 終端操作與命令。
 - [貢獻指南（英文）](./CONTRIBUTING.md) — 歡迎問題回報、文件改進和小範圍修正。
 

diff --git a/apps/desktop/docs/windows-desktop-qa.md b/apps/desktop/docs/windows-desktop-qa.md
@@ -64,7 +64,7 @@ replaced by scripted browser end-to-end tests.
 | Provider failure | HTTP 402 was visible as “Insufficient provider balance,” with expandable details. |
 | Funded recovery | A new real Electron request produced assistant output, Python output, and a fixture read after balance was replenished. No new 402 occurred. |
 | Funded automatic queue | Enter queued a follow-up during a 60-second Python cell; it drained automatically and produced its own Python result and assistant reply. |
-| Mouse submission during work | Clicked Queue message during a fenced 150-second Python cell. Edited and resubmitted the first queued entry, then queued and steered a second. The steer produced 402; the edited queue drained automatically and produced 301. Stop remains separately available. |
+| Mouse submission during work | Clicked Queue message during a fenced 150-second Python cell (historical: the QA build then sandboxed the Python kernel). Edited and resubmitted the first queued entry, then queued and steered a second. The steer produced 402; the edited queue drained automatically and produced 301. Stop remains separately available. |
 | Completed activity label | Removed the tool suffix: completed activity displays “Worked for 1s,” with Python details inside the disclosure. |
 | Separate inner cells | Clicked Worked to reveal collapsed Thought and Python rows. Opened each independently and collapsed the whole group with Worked. Python source and output stay paired. |
 | Steering visibility after completion | A fresh steer during a 90-second Python wait remained a user bubble after completion, runtime restart, and renderer reload. The assistant applied it and produced 503. The reported disappearance was not reproduced in this checkout; live/replay regression tests preserve it. |
@@ -84,6 +84,16 @@ a fresh real Electron Python turn reported the token `DevoSandboxOffline`,
 used the fenced kernel, and emitted no new unfenced warning. Historical
 warnings remain attached to their original turns.
 
+Historical note: the Python-turn sentences above (the `DevoSandboxOffline`
+token, the fenced kernel, and the no-new-unfenced-warning result) describe the
+pre-cleanup build, where the Python kernel itself ran in the Windows sandbox.
+Current builds run the Python kernel as a trusted, user-privileged process with
+no OS sandbox (`docs/trusted-kernel-host-shell.md`); only host shell execution
+follows the configured sandbox profile. The earlier write/network probe is
+historical evidence, not validation of the current host-shell path; that path
+requires a fresh Windows runtime check. A current Python turn should not be
+expected to report that token or a fenced-kernel state.
+
 Funded Electron requests now succeed. The earlier 402 checks remain coverage
 of provider failure handling, rather than a current provider-balance blocker.
 

diff --git a/apps/desktop/src/main/provider-oauth-credential.test.ts b/apps/desktop/src/main/provider-oauth-credential.test.ts
@@ -3,7 +3,6 @@ import { credentialSetParamsFromDesktopOAuth } from "./provider-oauth-credential
 
 describe("credentialSetParamsFromDesktopOAuth", () => {
 	/**
-	 * Trace: L2-DES-AUTH-001
 	 * Verifies: Desktop OAuth login persists via Native credential/set oauth params.
 	 */
 	test("maps OAuth credential into credential/set params", () => {

diff --git a/apps/desktop/src/renderer/components/settings/desktop-oauth-providers.test.ts b/apps/desktop/src/renderer/components/settings/desktop-oauth-providers.test.ts
@@ -6,7 +6,6 @@ import {
 
 describe("resolveProviderAuthMethods", () => {
 	/**
-	 * Trace: L2-DES-AUTH-001
 	 * Verifies: Desktop exposes the four supported provider OAuth logins.
 	 */
 	test("provides the native OAuth providers", () => {
@@ -32,7 +31,6 @@ describe("resolveProviderAuthMethods", () => {
 	})
 
 	/**
-	 * Trace: L2-DES-AUTH-001
 	 * Verifies: Settings Connect routes OAuth builtins to the OAuth dialog.
 	 */
 	test("settingsConnectDialogKind routes OAuth vs API-key templates", () => {

diff --git a/apps/tui/lib/coding-agent/src/core/kernel/shared.ts b/apps/tui/lib/coding-agent/src/core/kernel/shared.ts
@@ -18,7 +18,7 @@ export type HostRequestHandlers = Record<string, HostRequestHandler>;
 /** Extra import labels advertised to the model alongside the Python skills (inert on the Native path). */
 export const DEFAULT_RLM_EXTRA_IMPORT_LABELS: string[] = [];
 
-/** One file edit, captured from a `application/vnd.devo.diff+json` display payload. */
+/** One file edit, captured from a `application/vnd.diff+json` display payload. */
 export interface KernelDiffDisplay {
 	path: string;
 	oldStr: string;

diff --git a/apps/tui/src/generated/protocol/native.ts b/apps/tui/src/generated/protocol/native.ts
@@ -490,9 +490,11 @@ model: ModelBinding, settings: SessionSettings,
  */
 gitInfo?: GitInfo | null, preview: string, lastActivityAt: string,
 /**
- * Current on-disk size of the durable JSONL transcript. This is a
- * list-view cache: servers may omit it from non-list responses or when
- * the session has no readable rollout file.
+ * Current on-disk size of the owning physical journal, when known.
+ * Root sessions report the shared journal size; a child sharing that
+ * journal reports `None` so the tree size is never presented as the
+ * child's transcript size. This is a list-view cache: servers may omit
+ * it from non-list responses or when no readable rollout exists.
  */
 transcriptSizeBytes?: bigint | null,
 /**