From fb13457f6fa8b8598b4b9be0315f4bbb91de304b Mon Sep 17 00:00:00 2001
From: m4 <m4@m4deMac-mini.local>
Date: Sun, 27 Sep 2026 17:37:19 +0800
Subject: [PATCH] feat: consolidate desktop and provider updates

---
 apps/desktop/DESIGN.md                        |  16 +
 .../electron/freemodel2api-ipc.test.ts        |  36 +-
 apps/desktop/electron/freemodel2api-ipc.ts    |  32 +-
 apps/desktop/electron/freemodel2api.ts        |  24 +-
 apps/desktop/electron/preload.ts              |   3 +-
 .../desktop/electron/user-account-ipc.test.ts | 191 +++-
 apps/desktop/electron/user-account-ipc.ts     |  76 +-
 apps/desktop/package.json                     |  11 +-
 apps/desktop/scripts/launch-dev-electron.mjs  |  21 +
 .../scripts/patch-dev-electron-branding.mjs   |  88 +-
 .../patch-dev-electron-branding.test.mjs      |  76 ++
 apps/desktop/src/api/freemodel2api.ts         |   7 +
 .../app/chat/composer/attachments.test.tsx    |   2 +-
 .../src/app/chat/composer/attachments.tsx     |   1 -
 .../src/app/chat/composer/composer-utils.ts   |  23 +-
 .../hooks/use-composer-metrics.test.tsx       |   9 +-
 .../composer/hooks/use-composer-metrics.ts    |  84 +-
 apps/desktop/src/app/chat/composer/index.tsx  |  17 +-
 .../app/chat/composer/status-stack/index.tsx  |  38 +
 apps/desktop/src/app/chat/index.tsx           |   6 +-
 apps/desktop/src/app/chat/pane-mirror.ts      |   6 +
 .../desktop/src/app/chat/preview-tile.test.ts |  11 +
 apps/desktop/src/app/chat/preview-tile.tsx    |  88 +-
 .../chat/right-rail/office-preview.test.tsx   | 101 ++
 .../app/chat/right-rail/office-preview.tsx    |  74 ++
 .../app/chat/right-rail/preview-file.test.tsx |  91 +-
 .../src/app/chat/right-rail/preview-file.tsx  |  82 +-
 .../src/app/chat/right-rail/preview-image.tsx |  22 +
 .../src/app/chat/session-history-nav.tsx      |  45 +
 apps/desktop/src/app/chat/session-tile.tsx    |   1 +
 .../sidebar/chat-sidebar.integration.test.tsx |  40 +
 .../src/app/chat/sidebar/filter-menu.tsx      |  11 -
 apps/desktop/src/app/chat/sidebar/index.tsx   |  39 +-
 .../profile-dropdown-switcher.test.tsx        | 278 +++--
 .../sidebar/profile-dropdown-switcher.tsx     | 259 ++---
 .../sidebar/profile-rail-connect.test.tsx     |  22 +-
 .../src/app/chat/sidebar/profile-switcher.tsx |  14 +-
 .../chat/sidebar/projects/entered-content.tsx |   9 +
 .../src/app/chat/sidebar/projects/index.ts    |   3 +
 .../app/chat/sidebar/projects/model.test.ts   |  25 +-
 .../src/app/chat/sidebar/projects/model.ts    |  18 +
 .../sidebar/projects/overview-row.test.tsx    |  12 +
 .../chat/sidebar/projects/overview-row.tsx    |  40 +-
 .../sidebar/projects/project-menu.test.tsx    |  31 +
 .../chat/sidebar/projects/project-menu.tsx    |  23 +-
 .../chat/sidebar/projects/workspace-group.tsx |  11 +-
 .../chat/sidebar/projects/workspace-groups.ts |  19 +
 .../sidebar/projects/workspace-header.tsx     |  22 +-
 .../src/app/chat/sidebar/session-row.tsx      |   9 +-
 .../src/app/chat/sidebar/sessions-section.tsx |  48 +-
 .../app/chat/sidebar/user-account-card.tsx    | 179 +++-
 .../chat/sidebar/user-account-footer.test.tsx | 173 ++++
 .../chat/sidebar/user-account-menu.test.tsx   | 173 ++++
 .../app/chat/sidebar/version-menu.test.tsx    | 114 +++
 .../src/app/chat/sidebar/version-menu.tsx     | 156 +++
 .../src/app/chat/sidebar/zone-tabs.test.tsx   | 169 +++
 .../src/app/chat/sidebar/zone-tabs.tsx        | 152 +++
 .../src/app/chat/workspace-bar.test.tsx       |  62 +-
 apps/desktop/src/app/chat/workspace-bar.tsx   |  60 +-
 .../src/app/context-menu/app-context-menu.tsx |   7 -
 apps/desktop/src/app/contrib/controller.tsx   |  53 +-
 .../desktop/src/app/contrib/layout-presets.ts |   7 +-
 apps/desktop/src/app/contrib/wiring.tsx       |   3 +-
 apps/desktop/src/app/hooks/use-keybinds.ts    |   2 -
 .../app/hooks/use-on-profile-switch.test.tsx  |  39 +
 .../src/app/hooks/use-on-profile-switch.ts    |  11 +-
 .../src/app/me/change-password-dialog.tsx     | 178 ++++
 apps/desktop/src/app/me/me-page.test.tsx      |  19 +-
 .../components/reference-chip.tsx             |   1 -
 apps/desktop/src/app/profiles/index.test.tsx  |   2 +
 apps/desktop/src/app/profiles/index.tsx       |   4 +
 .../src/app/profiles/profile-create-host.tsx  |  50 +
 .../files/tree-dblclick.test.tsx              |  25 +-
 .../src/app/right-sidebar/files/tree.tsx      |   8 +-
 apps/desktop/src/app/right-sidebar/index.tsx  |   2 +-
 .../hooks/use-session-actions/index.ts        |  10 +-
 .../src/app/settings/env-credentials.tsx      |  16 +
 .../settings/freemodel2api-settings.test.tsx  | 605 ++++++++++-
 .../app/settings/freemodel2api-settings.tsx   | 959 +++++++++++++++---
 apps/desktop/src/app/settings/index.tsx       |  12 +-
 .../src/app/settings/model-settings.test.tsx  |  70 +-
 .../src/app/settings/model-settings.tsx       |  77 +-
 .../src/app/settings/providers-settings.tsx   |  17 +-
 .../shell/hooks/use-statusbar-items.test.tsx  |  69 ++
 .../app/shell/hooks/use-statusbar-items.tsx   | 122 +--
 .../src/app/shell/titlebar-controls.test.tsx  |  16 +-
 .../src/app/shell/titlebar-controls.tsx       |  31 +-
 apps/desktop/src/components/Backdrop.tsx      |   2 +-
 .../assistant-ui/embeds/listing-embed.tsx     |   1 -
 .../chat/generated-image-result.tsx           |  52 +-
 .../src/components/chat/image-viewer.test.tsx | 170 ++++
 .../src/components/chat/image-viewer.tsx      | 210 ++++
 .../src/components/chat/intro-copy.jsonl      |   2 +-
 apps/desktop/src/components/chat/intro.tsx    |   2 +-
 apps/desktop/src/components/chat/wordmark.tsx |   2 +-
 .../src/components/chat/zoomable-image.tsx    | 104 +-
 .../onboarding-chat/setup-profile.ts          |   2 +-
 .../components/onboarding-chat/signpost.ts    |  10 +-
 .../src/components/onboarding/index.test.tsx  |  53 +-
 .../src/components/onboarding/index.tsx       |  67 +-
 .../tree/lone-chat-sibling-zone.test.ts       |  10 +
 .../tree/renderer/left-sidebar-rail.test.tsx  | 113 +++
 .../tree/renderer/narrow-overlays.tsx         |  21 +-
 .../tree/renderer/track-model.test.ts         |  53 +
 .../pane-shell/tree/renderer/track-model.ts   |  36 +-
 .../tree/renderer/tree-group.test.tsx         |  61 ++
 .../pane-shell/tree/renderer/tree-group.tsx   |  92 +-
 .../pane-shell/tree/renderer/tree-split.tsx   |  69 +-
 .../src/components/pane-shell/tree/store.ts   |  67 +-
 apps/desktop/src/components/ui/pane-tab.tsx   |  13 +-
 .../desktop/src/components/ui/use-zoom-pan.ts |  63 +-
 .../src/components/user-account-gate.tsx      |  34 +-
 apps/desktop/src/global.d.ts                  |  10 +-
 apps/desktop/src/i18n/ar.ts                   |  28 +-
 apps/desktop/src/i18n/en.ts                   |  99 +-
 apps/desktop/src/i18n/ja.ts                   |  43 +-
 apps/desktop/src/i18n/ru.ts                   |  32 +-
 apps/desktop/src/i18n/types.ts                |  24 +-
 apps/desktop/src/i18n/zh-hant.ts              |  26 +-
 apps/desktop/src/i18n/zh.ts                   |  30 +-
 apps/desktop/src/lib/keybinds/actions.ts      |   2 -
 apps/desktop/src/lib/office-files.test.ts     |  22 +-
 apps/desktop/src/lib/office-files.ts          |  19 +-
 apps/desktop/src/lib/tips/catalog.ts          |   2 +-
 apps/desktop/src/lib/user-account-errors.ts   |  17 +
 apps/desktop/src/lib/version-status.ts        |   4 +-
 apps/desktop/src/store/onboarding.test.ts     |  17 +
 apps/desktop/src/store/onboarding.ts          |  19 +-
 apps/desktop/src/store/profile-rail-prefs.ts  |  11 -
 apps/desktop/src/store/profile.ts             |   3 +-
 apps/desktop/src/store/project-pins.test.ts   |  51 +
 apps/desktop/src/store/project-pins.ts        |  75 ++
 apps/desktop/src/store/projects.test.ts       |  52 +-
 apps/desktop/src/store/projects.ts            |  24 +-
 .../desktop/src/store/session-history.test.ts |  73 ++
 apps/desktop/src/store/session-history.ts     |  74 ++
 apps/desktop/src/store/session.test.ts        |  37 +-
 apps/desktop/src/store/session.ts             |  30 +-
 .../src/store/titlebar-app-actions.test.ts    |  10 +-
 .../desktop/src/store/titlebar-app-actions.ts |  16 +-
 apps/desktop/src/store/user-account.test.ts   |  21 +-
 apps/desktop/src/store/user-account.ts        |  22 +-
 apps/desktop/src/styles.css                   |   7 +-
 apps/desktop/src/types/hermes.ts              |  10 +-
 hermes_cli/auth.py                            |  43 +-
 hermes_cli/config_defaults.py                 |   5 +-
 hermes_cli/config_providers.py                |   5 +
 hermes_cli/inventory.py                       |  64 +-
 hermes_cli/main.py                            |  28 +-
 hermes_cli/model_switch_providers.py          |  21 +-
 hermes_cli/models.py                          |   3 +
 hermes_cli/models_pricing.py                  | 180 ++++
 hermes_cli/providers.py                       |  44 +-
 hermes_cli/runtime_provider.py                |   4 +
 hermes_cli/web_models.py                      |   3 +
 hermes_cli/web_routers/config_env.py          |  22 +-
 hermes_cli/web_server_config.py               |  16 +-
 package-lock.json                             |   9 +-
 plugins/image_gen/_common.py                  |  37 +
 plugins/image_gen/openai/__init__.py          |  31 +-
 plugins/image_gen/openai/plugin.yaml          |   6 +-
 .../model-providers/freemodel2api/__init__.py |  21 +
 .../model-providers/freemodel2api/plugin.yaml |   5 +
 .../test_custom_endpoint_pricing.py           | 158 +++
 .../hermes_cli/test_freemodel2api_provider.py | 135 +++
 tests/hermes_cli/test_inventory.py            |  54 +-
 .../hermes_cli/test_list_picker_providers.py  |  44 +
 .../test_model_switch_custom_providers.py     |  28 +
 .../test_provider_config_validation.py        |  13 +
 .../test_resolve_provider_corrupt_config.py   |   7 +
 tests/hermes_cli/test_web_server.py           |   6 +-
 .../plugins/image_gen/test_openai_provider.py |  50 +-
 website/docs/reference/tools-reference.md     |   3 +-
 .../user-guide/features/image-generation.md   |  14 +-
 174 files changed, 7669 insertions(+), 1477 deletions(-)
 create mode 100644 apps/desktop/scripts/launch-dev-electron.mjs
 create mode 100644 apps/desktop/scripts/patch-dev-electron-branding.test.mjs
 create mode 100644 apps/desktop/src/app/chat/right-rail/office-preview.test.tsx
 create mode 100644 apps/desktop/src/app/chat/right-rail/office-preview.tsx
 create mode 100644 apps/desktop/src/app/chat/right-rail/preview-image.tsx
 create mode 100644 apps/desktop/src/app/chat/session-history-nav.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/user-account-footer.test.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/user-account-menu.test.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/version-menu.test.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/version-menu.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/zone-tabs.test.tsx
 create mode 100644 apps/desktop/src/app/chat/sidebar/zone-tabs.tsx
 create mode 100644 apps/desktop/src/app/hooks/use-on-profile-switch.test.tsx
 create mode 100644 apps/desktop/src/app/me/change-password-dialog.tsx
 create mode 100644 apps/desktop/src/app/profiles/profile-create-host.tsx
 create mode 100644 apps/desktop/src/app/shell/hooks/use-statusbar-items.test.tsx
 create mode 100644 apps/desktop/src/components/chat/image-viewer.test.tsx
 create mode 100644 apps/desktop/src/components/chat/image-viewer.tsx
 create mode 100644 apps/desktop/src/components/pane-shell/tree/renderer/left-sidebar-rail.test.tsx
 create mode 100644 apps/desktop/src/components/pane-shell/tree/renderer/track-model.test.ts
 create mode 100644 apps/desktop/src/lib/user-account-errors.ts
 delete mode 100644 apps/desktop/src/store/profile-rail-prefs.ts
 create mode 100644 apps/desktop/src/store/project-pins.test.ts
 create mode 100644 apps/desktop/src/store/project-pins.ts
 create mode 100644 apps/desktop/src/store/session-history.test.ts
 create mode 100644 apps/desktop/src/store/session-history.ts
 create mode 100644 plugins/model-providers/freemodel2api/__init__.py
 create mode 100644 plugins/model-providers/freemodel2api/plugin.yaml
 create mode 100644 tests/hermes_cli/test_custom_endpoint_pricing.py
 create mode 100644 tests/hermes_cli/test_freemodel2api_provider.py

diff --git a/apps/desktop/DESIGN.md b/apps/desktop/DESIGN.md
index 7335f3ce58..70c81c4d25 100644
--- a/apps/desktop/DESIGN.md
+++ b/apps/desktop/DESIGN.md
@@ -230,6 +230,17 @@ existing traffic-light and Window Controls Overlay measurements.
 
 The left cluster shows sidebar, settings, layout editor, and HUD controls. Flip
 and the right-sidebar toggle sit on the right; haptics remain in settings.
+The sidebar account entry stays below the pane body, outside its scrolling
+content. It survives tab switches and uses an icon on the
+collapsed side rail.
+The expanded account row has a trailing menu; the collapsed account icon opens
+the same menu. Password changes use email verification and return to sign-in.
+Profiles live in a submenu of this account menu, with the current profile
+visible on its trigger. Square ordering, coloring, and advanced profile actions
+live in Manage Profiles. A single shell host owns the create-profile hotkey.
+The sidebar's version opens the existing updates flow through a target menu;
+its collapsed rail uses an update icon. Desktop and remote-backend versions
+are not repeated in the statusbar. Passive checks and update notices stay active.
 Holding Cmd (Ctrl off macOS) reveals small slot numbers over the target strip's
 status dots after 400ms, without changing tab widths. Hints follow the same
 binding and hovered/focused-zone resolver as the number shortcuts.
@@ -285,6 +296,11 @@ so glass and message-bubble transparency do not reveal scrolling text.
   from the chip to the floating pill; leaving both dismisses it.
 - A tool result may expose an inline action that opens a preview. It must not
   open the rail automatically.
+- Images in file previews and transcript lightboxes share `ImageViewer` and
+  `useZoomPan`: fit-to-window, actual size, cursor-centered wheel zoom, drag,
+  and download. Expanded views use nearly the whole viewport; image clicks
+  never dismiss a view while inspecting or panning it. Fit mode follows pane
+  resizes, while manual zoom remains under the user's control.
 - Tool rows reserve destructive red for explicit failures. Missing read paths and
   ambiguous exit-1 results use neutral notices, with details still available.
   Errors described inside returned data are not tool failures. Expanded failures
diff --git a/apps/desktop/electron/freemodel2api-ipc.test.ts b/apps/desktop/electron/freemodel2api-ipc.test.ts
index 36a562ab58..f4c1b069fb 100644
--- a/apps/desktop/electron/freemodel2api-ipc.test.ts
+++ b/apps/desktop/electron/freemodel2api-ipc.test.ts
@@ -45,23 +45,23 @@ function makeFetcher(behavior: (url: string, init?: any) => { status: number; bo
 
 const LOGIN_OK = {
   code: 0,
-  data: { access_token: 'AT-1', expires_in: 3600, token_type: 'Bearer', user: { email: 'u@example.com', balance: 9.5 } }
+  data: { access_token: 'AT-1', expires_in: 3600, token_type: 'Bearer', user: { email: 'u@example.com', username: 'yb', balance: 9.5, frozen_balance: 12.5 } }
 }
 
 test('login persists credentials and returns balance; status reuses in-memory session', async () => {
   const { handlers, ipcMain } = fakeIpcMain()
   const { io } = fakeIo()
-  const { fetcher, calls } = makeFetcher(url => (url.endsWith('/auth/login') ? { status: 200, body: LOGIN_OK } : { status: 200, body: { code: 0, data: { email: 'u@example.com', balance: 9.5 } } }))
+  const { fetcher, calls } = makeFetcher(url => (url.endsWith('/auth/login') ? { status: 200, body: LOGIN_OK } : { status: 200, body: { code: 0, data: { email: 'u@example.com', username: 'yb', balance: 9.5, frozen_balance: 12.5 } } }))
   registerFreeModel2ApiIpc({ ipcMain, io, fetcher })
 
   const login = await handlers.get('hermes:freemodel2api:login')!(null, { baseUrl: 'https://sub.example.com/', email: 'u@example.com', password: 'pw' })
-  assert.deepEqual(login, { ok: true, email: 'u@example.com', balance: 9.5 })
+  assert.deepEqual(login, { ok: true, email: 'u@example.com', balance: 9.5, username: 'yb', frozenBalance: 12.5 })
   assert.deepEqual(JSON.parse(io.decrypt(JSON.parse(io.readStoreText()).freemodel2api)), {
     baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw'
   })
 
   const status = await handlers.get('hermes:freemodel2api:status')!(null)
-  assert.deepEqual(status, { configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 9.5 })
+  assert.deepEqual(status, { configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 9.5, username: 'yb', frozenBalance: 12.5 })
   // status 用内存里的 session,没有第二次 login 请求
   assert.equal(calls.filter(c => c.url.endsWith('/auth/login')).length, 1)
 })
@@ -74,6 +74,34 @@ test('status with no stored credentials returns configured:false', async () => {
   assert.deepEqual(await handlers.get('hermes:freemodel2api:status')!(null), { configured: false })
 })
 
+test('key-balance queries by api key without a session; non-sub2api answers null', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  const { fetcher, calls } = makeFetcher(url =>
+    url.endsWith('/v1/sub2api/balance')
+      ? { status: 200, body: { object: 'sub2api.key_balance', billing_mode: 'balance', balance: 9181.34, unit: 'USD' } }
+      : { status: 200, body: LOGIN_OK })
+  registerFreeModel2ApiIpc({ ipcMain, io, fetcher })
+
+  // baseUrl 带旧 /v1 也要归到同一个端点;凭 key,不 login
+  assert.deepEqual(
+    await handlers.get('hermes:freemodel2api:key-balance')!(null, { baseUrl: 'http://h:3020/v1', apiKey: 'sk-k' }),
+    { balance: 9181.34 }
+  )
+  assert.equal(calls[0].url, 'http://h:3020/v1/sub2api/balance')
+  assert.equal(calls[0].init?.headers?.Authorization, 'Bearer sk-k')
+  assert.equal(calls.filter(c => c.url.endsWith('/auth/login')).length, 0)
+
+  // 非 sub2api 端点 404:不是错误,只是查不到
+  const { fetcher: fetcher404 } = makeFetcher(() => ({ status: 404, body: { message: 'nope' } }))
+  const second = fakeIpcMain()
+  registerFreeModel2ApiIpc({ ipcMain: second.ipcMain, io, fetcher: fetcher404 })
+  assert.deepEqual(
+    await second.handlers.get('hermes:freemodel2api:key-balance')!(null, { baseUrl: 'http://h:3020', apiKey: 'sk-k' }),
+    { balance: null }
+  )
+})
+
 test('keys re-login once on 401 then succeed', async () => {
   const { handlers, ipcMain } = fakeIpcMain()
   const { io } = fakeIo()
diff --git a/apps/desktop/electron/freemodel2api-ipc.ts b/apps/desktop/electron/freemodel2api-ipc.ts
index 0e4627e8e2..04ef00d922 100644
--- a/apps/desktop/electron/freemodel2api-ipc.ts
+++ b/apps/desktop/electron/freemodel2api-ipc.ts
@@ -16,6 +16,7 @@ import {
   persistRememberedLogin,
   sub2ApiFetchKeys,
   sub2ApiFetchProfile,
+  sub2ApiKeyBalance,
   sub2ApiLogin,
   type FetchLike,
   type FreeModel2ApiStoreIo
@@ -78,7 +79,13 @@ export function registerFreeModel2ApiIpc(deps: FreeModel2ApiIpcDeps): void {
     }
     const result = await freshLogin(baseUrl, email, password)
     persistFreeModel2ApiCredentials({ baseUrl, email, password }, io)
-    return { ok: true, email: result.email, balance: result.balance }
+    return {
+      ok: true,
+      email: result.email,
+      balance: result.balance,
+      username: result.username,
+      frozenBalance: result.frozenBalance
+    }
   })
 
   ipcMain.handle('hermes:freemodel2api:status', async () => {
@@ -87,7 +94,14 @@ export function registerFreeModel2ApiIpc(deps: FreeModel2ApiIpcDeps): void {
       return { configured: false }
     }
     const profile = await withSession(s => sub2ApiFetchProfile(s.baseUrl, s.accessToken, fetcher))
-    return { configured: true, baseUrl: creds.baseUrl, email: profile.email || creds.email, balance: profile.balance }
+    return {
+      configured: true,
+      baseUrl: creds.baseUrl,
+      email: profile.email || creds.email,
+      balance: profile.balance,
+      username: profile.username,
+      frozenBalance: profile.frozenBalance
+    }
   })
 
   ipcMain.handle('hermes:freemodel2api:keys', async () => {
@@ -105,6 +119,20 @@ export function registerFreeModel2ApiIpc(deps: FreeModel2ApiIpcDeps): void {
     return loadRememberedLogin(io)
   })
 
+  // 未登录的余额读数:凭 renderer 传来的 key 直查,不走会话。失败只报 null,不打扰人。
+  ipcMain.handle('hermes:freemodel2api:key-balance', async (_event, payload) => {
+    const baseUrl = String(payload?.baseUrl ?? '')
+    const apiKey = String(payload?.apiKey ?? '')
+    if (!baseUrl || !apiKey) {
+      return { balance: null }
+    }
+    try {
+      return { balance: await sub2ApiKeyBalance(baseUrl, apiKey, fetcher) }
+    } catch {
+      return { balance: null }
+    }
+  })
+
   ipcMain.handle('hermes:freemodel2api:remembered:save', async (_event, payload) => {
     if (!payload) {
       persistRememberedLogin(null, io)
diff --git a/apps/desktop/electron/freemodel2api.ts b/apps/desktop/electron/freemodel2api.ts
index 8cc2d9b73f..36d1d225e5 100644
--- a/apps/desktop/electron/freemodel2api.ts
+++ b/apps/desktop/electron/freemodel2api.ts
@@ -94,6 +94,8 @@ export interface Sub2ApiProfile {
   email: string
   username: string
   balance: number
+  /** 上游没这个字段时按 0 处理 —— 面板宁可显示 $0.00,也不为它单独加一次请求 */
+  frozenBalance: number
 }
 
 export interface Sub2ApiLoginResult {
@@ -101,6 +103,8 @@ export interface Sub2ApiLoginResult {
   expiresAt: number
   email: string
   balance: number
+  username: string
+  frozenBalance: number
 }
 
 export type FetchLike = (
@@ -152,7 +156,9 @@ export async function sub2ApiLogin(baseUrl: string, email: string, password: str
     // 提前 60s 视为过期,边界请求不踩死线
     expiresAt: Date.now() + expiresIn * 1000 - 60_000,
     email: String(data?.user?.email ?? email),
-    balance: Number(data?.user?.balance ?? 0)
+    balance: Number(data?.user?.balance ?? 0),
+    username: String(data?.user?.username ?? ''),
+    frozenBalance: Number(data?.user?.frozen_balance ?? 0)
   }
 }
 
@@ -161,10 +167,24 @@ export async function sub2ApiFetchProfile(baseUrl: string, token: string, fetche
   return {
     email: String(data?.email ?? ''),
     username: String(data?.username ?? ''),
-    balance: Number(data?.balance ?? 0)
+    balance: Number(data?.balance ?? 0),
+    frozenBalance: Number(data?.frozen_balance ?? 0)
   }
 }
 
+/** sub2api 凭 API key 直查余额(`{root}/v1/sub2api/balance`)——不需要会话。
+ *  非 sub2api 端点 404 / 响应不含 balance → null,不算错误:这只是块读数。 */
+export async function sub2ApiKeyBalance(baseUrl: string, apiKey: string, fetcher: FetchLike): Promise<number | null> {
+  const root = normalizeSub2ApiBaseUrl(baseUrl).replace(/\/v1$/, '')
+  const res = await fetcher(`${root}/v1/sub2api/balance`, { headers: { Authorization: `Bearer ${apiKey}` } })
+  if (!res.ok) {
+    return null
+  }
+  const payload = await res.json().catch(() => null)
+  const value = Number(payload?.balance)
+  return payload?.object === 'sub2api.key_balance' && Number.isFinite(value) ? value : null
+}
+
 export async function sub2ApiFetchKeys(baseUrl: string, token: string, fetcher: FetchLike): Promise<Sub2ApiKey[]> {
   const data = await callSub2Api(baseUrl, '/api/v1/keys', { token }, fetcher)
   const items = Array.isArray(data?.items) ? data.items : []
diff --git a/apps/desktop/electron/preload.ts b/apps/desktop/electron/preload.ts
index e1e4c0f75d..1619efe019 100644
--- a/apps/desktop/electron/preload.ts
+++ b/apps/desktop/electron/preload.ts
@@ -32,7 +32,8 @@ contextBridge.exposeInMainWorld('hermesDesktop', {
     keys: () => ipcRenderer.invoke('hermes:freemodel2api:keys'),
     logout: () => ipcRenderer.invoke('hermes:freemodel2api:logout'),
     rememberedLoad: () => ipcRenderer.invoke('hermes:freemodel2api:remembered:load'),
-    rememberedSave: payload => ipcRenderer.invoke('hermes:freemodel2api:remembered:save', payload)
+    rememberedSave: payload => ipcRenderer.invoke('hermes:freemodel2api:remembered:save', payload),
+    keyBalance: payload => ipcRenderer.invoke('hermes:freemodel2api:key-balance', payload)
   },
   // Hermes 用户账号（§21）：token 留在 main 进程，renderer 只见 profile/状态。
   userAccount: {
diff --git a/apps/desktop/electron/user-account-ipc.test.ts b/apps/desktop/electron/user-account-ipc.test.ts
index 10659c5b11..8e26133e0f 100644
--- a/apps/desktop/electron/user-account-ipc.test.ts
+++ b/apps/desktop/electron/user-account-ipc.test.ts
@@ -4,7 +4,7 @@ import { test } from 'vitest'
 
 import type { FetchLike } from './relay-account'
 import { registerUserAccountIpc } from './user-account-ipc'
-import { loadRememberedLogin, loadUserAccount, persistUserAccount, type UserAccountStoreIo } from './user-account-store'
+import { loadRememberedLogin, loadUserAccount, persistRememberedLogin, persistUserAccount, type UserAccountStoreIo } from './user-account-store'
 
 function fakeIo() {
   let fileText: string | null = null
@@ -145,7 +145,7 @@ test('me 401 → 自动 refresh 一次重试成功，轮换后的令牌落盘',
   assert.deepEqual(meAuths, ['Bearer AT-1', 'Bearer AT-1', 'Bearer AT-2'])
 })
 
-test('refresh 也被拒 = 硬会话终点：本地清零并上报 sessionExpired（U-3）', async () => {
+test('refresh 也被拒 = 服务端判过期：上报 sessionExpired，但保留本地会话（U-3 离线优先）', async () => {
   const { handlers, ipcMain } = fakeIpcMain()
   const { io } = fakeIo()
   let meCalls = 0
@@ -167,8 +167,159 @@ test('refresh 也被拒 = 硬会话终点：本地清零并上报 sessionExpired
   register({ ipcMain, io, fetcher, readMachineBindingState: unbound })
   await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
   const status = await handlers.get('hermes:account:status')!(null)
+  // 在线行为不变（renderer 照旧落登录页）……
   assert.deepEqual(status, { loggedIn: false, sessionExpired: true })
+  // ……但会话不再被当场清掉：离线时它就是放行的凭证。
+  assert.notEqual(loadUserAccount(io), null)
+})
+
+/**
+ * 可切换在线的 fetcher：断网时连调用都不记（`calls` 只收在线尝试），
+ * 「不联网」的断言因此可以直接数 calls。
+ */
+function toggleableFetcher(isOnline: () => boolean) {
+  const calls: { url: string; init?: any }[] = []
+
+  const fetcher: FetchLike = async (url, init) => {
+    if (!isOnline()) {throw new Error('ECONNREFUSED')}
+
+    calls.push({ url, init })
+
+    if (url.endsWith('/auth/login')) {return { ok: true, status: 200, json: async () => TOKENS, text: async () => ''}}
+
+    if (url.endsWith('/me')) {return { ok: true, status: 200, json: async () => ME, text: async () => ''}}
+
+    return { ok: true, status: 200, json: async () => ({}), text: async () => ''}
+  }
+
+  return { fetcher, calls }
+}
+
+test('服务端判过期后断网：本地会话仍在 → status 离线放行并回缓存 profile', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  let meCalls = 0
+
+  const { fetcher } = makeFetcher(url => {
+    if (url.endsWith('/auth/login')) {return { status: 200, body: TOKENS }}
+
+    if (url.endsWith('/auth/refresh')) {return { status: 401, text: 'session_inactive' }}
+
+    if (url.endsWith('/me')) {
+      meCalls += 1
+
+      return meCalls === 1 ? { status: 200, body: ME } : { status: 401, text: 'unauthenticated' }
+    }
+
+    return { status: 200, body: {} }
+  })
+
+  register({ ipcMain, io, fetcher, readMachineBindingState: unbound })
+  await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
+
+  // 在线：判过期，落登录页
+  assert.deepEqual(await handlers.get('hermes:account:status')!(null), { loggedIn: false, sessionExpired: true })
+
+  // 断网：这次不再砖——本地会话还在就放行，缓存 profile 与数据时间照给
+  const offline = toggleableFetcher(() => false)
+
+  register({ ipcMain, io, fetcher: offline.fetcher, readMachineBindingState: unbound })
+  const status = await handlers.get('hermes:account:status')!(null)
+
+  assert.equal(status.loggedIn, true)
+  assert.equal(status.offline, true)
+  assert.equal(status.profile.email, 'u@example.com')
+  assert.equal(typeof status.profileAsOf, 'string')
+})
+
+test('断网登录：记住的凭据命中且会话在 → 离线放行（不新建会话、不落盘）', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  let online = true
+
+  const probe = toggleableFetcher(() => online)
+
+  register({ ipcMain, io, fetcher: probe.fetcher, readMachineBindingState: unbound })
+  await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
+  const before = loadUserAccount(io)
+
+  online = false
+  const result = await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
+
+  assert.equal(result.ok, true)
+  assert.equal(result.offline, true)
+  assert.equal(result.profile.email, 'u@example.com')
+  // 会话原样留着
+  assert.deepEqual(loadUserAccount(io), before)
+})
+
+test('断网登录：口令不符 → invalid_credentials；站点/邮箱不命中 → network', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  let online = true
+
+  const probe = toggleableFetcher(() => online)
+
+  register({ ipcMain, io, fetcher: probe.fetcher, readMachineBindingState: unbound })
+  // 先在线登录一次，把记住槽写下来（离线登录的前提就是"这台机器上登过"）
+  await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
+
+  online = false
+  const attemptsBefore = probe.calls.length
+
+  assert.deepEqual(await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'other@example.com', password: 'p' }), {
+    ok: false,
+    code: 'network'
+  })
+  assert.deepEqual(await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'WRONG' }), {
+    ok: false,
+    code: 'invalid_credentials'
+  })
+  // 断网期间一次网络尝试都没有
+  assert.equal(probe.calls.length, attemptsBefore)
+})
+
+test('断网登录：本机无会话 → network（离线登入只解锁已有会话，不新建）', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  const { fetcher } = loginOkFetcher()
+
+  register({ ipcMain, io, fetcher, readMachineBindingState: unbound })
+  await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' })
+  await handlers.get('hermes:account:logout')!(null)
   assert.equal(loadUserAccount(io), null)
+
+  // 登出不清记住槽（U-6 全清才清），但离线登不回来：没有会话就没有可放行的东西。
+  const offline = toggleableFetcher(() => false)
+
+  register({ ipcMain, io, fetcher: offline.fetcher, readMachineBindingState: unbound })
+  assert.deepEqual(await handlers.get('hermes:account:login')!(null, { site: 'https://r', email: 'u', password: 'p' }), {
+    ok: false,
+    code: 'network'
+  })
+  assert.equal(loadUserAccount(io), null)
+})
+
+test('断网登录：绑定的站与登录的站不符 → machine_bound_to_other（本地可判的 U-5 部分）', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  const probe = toggleableFetcher(() => false)
+
+  persistUserAccount(
+    {
+      session: { site: 'https://other', accessToken: 'AT', refreshToken: 'RT', sessionId: 'SID' },
+      profile: null,
+      profileAsOf: null
+    },
+    io
+  )
+
+  register({ ipcMain, io, fetcher: probe.fetcher, readMachineBindingState: () => BINDING_STATE })
+  assert.deepEqual(await handlers.get('hermes:account:login')!(null, { site: 'https://other', email: 'u', password: 'p' }), {
+    ok: false,
+    code: 'machine_bound_to_other',
+    binderEmail: null
+  })
 })
 
 test('relay 不可达但本地会话在：status 标离线并回缓存 profile + 数据时间（U-3）', async () => {
@@ -351,6 +502,42 @@ test('register/reset 四通道透传路径与参数', async () => {
   assert.deepEqual(JSON.parse(calls[3].init.body), { email: 'u@e.c', code: '123456', password: 'new' })
 })
 
+test('successful password resets clear remembered credentials only for the matching site and email', async () => {
+  const { handlers, ipcMain } = fakeIpcMain()
+  const { io } = fakeIo()
+  let success = true
+
+  const { fetcher } = makeFetcher(() => success
+    ? { status: 200, body: {} }
+    : { status: 400, text: 'reset_code_invalid_or_expired' })
+
+  register({ ipcMain, io, fetcher, readMachineBindingState: unbound })
+  const remembered = { site: 'https://r', email: 'owner@example.com', password: 'old-password' }
+  const reset = handlers.get('hermes:account:reset-confirm')!
+
+  persistRememberedLogin(remembered, io)
+
+  for (const account of [
+    { site: 'https://other', email: remembered.email },
+    { site: remembered.site, email: 'other@example.com' }
+  ]) {
+    assert.deepEqual(await reset(null, { ...account, code: '123456', password: 'new-password' }), { ok: true })
+    assert.deepEqual(loadRememberedLogin(io), remembered)
+  }
+
+  success = false
+  assert.deepEqual(await reset(null, { ...remembered, code: 'bad-code' }), {
+    ok: false, code: 'reset_code_invalid_or_expired'
+  })
+  assert.deepEqual(loadRememberedLogin(io), remembered)
+
+  success = true
+  assert.deepEqual(await reset(null, {
+    site: 'https://r/', email: 'OWNER@example.com', code: '123456', password: 'new-password'
+  }), { ok: true })
+  assert.equal(loadRememberedLogin(io), null)
+})
+
 test('register-start 失败码透传（weak_password / registration_rate_limited）', async () => {
   const { handlers, ipcMain } = fakeIpcMain()
   const { io } = fakeIo()
diff --git a/apps/desktop/electron/user-account-ipc.ts b/apps/desktop/electron/user-account-ipc.ts
index 145b462701..2349e2e04f 100644
--- a/apps/desktop/electron/user-account-ipc.ts
+++ b/apps/desktop/electron/user-account-ipc.ts
@@ -5,8 +5,14 @@
  * access/refresh token——login 之后 renderer 只能拿到 profile 与状态。
  *
  * 401 反应式刷新：任何带令牌调用 401 → 用 refresh token 续一次重试；
- * refresh 也被拒（session_inactive / refresh_reuse_or_invalid）= 唯一的
- * 硬会话终点（U-3）→ 本地清零并上报 sessionExpired，由 renderer 落登录页。
+ * refresh 也被拒（session_inactive / refresh_reuse_or_invalid）= 服务端判定的
+ * 硬终点（U-3）：**不清本地会话**，只上报 sessionExpired——在线时 renderer 照旧
+ * 落登录页，离线时本地会话仍放行（离线优先，2026-09-24 用户裁定）。真正的清零
+ * 只发生在 logout / unbind。
+ *
+ * 离线登录（同一裁定）：断网时 login 回落到本地校验记住的凭据，把已在盘上的
+ * 会话解锁回登录态。它只是"别砖在门口"的临时通路，不是第二套运行模式——
+ * 不新建会话，也不放行登录以外的任何操作。
  *
  * U-5 机器-用户锁：登录成功当场校验本机 installation ∈ 该用户的列表；
  * 不符立即销毁会话并返回 machine_bound_to_other（附绑定者邮箱，便于
@@ -111,7 +117,11 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
     persistUserAccount(account, io)
   }
 
-  /** 401 → refresh 一次重试；refresh 也被拒 = 硬终点，本地清零。 */
+  /**
+   * 401 → refresh 一次重试；refresh 也被拒 = 服务端判定的硬终点，往上报
+   * session_expired，但**不清本地会话**——离线时它仍是放行的凭证（2026-09-24
+   * 用户裁定"离线优先"）。真正的清零只发生在 logout / unbind。
+   */
   async function withSession<T>(fn: (session: RelayAccountSession) => Promise<T>): Promise<T> {
     const account = current()
 
@@ -129,7 +139,6 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
       refreshed = await relayAccountRefresh(account.session, fetcher)
     } catch (error) {
       if (error instanceof RelayAccountError && error.status === 401) {
-        store(null)
         throw new RelayAccountError('session_expired', 401)
       }
 
@@ -178,6 +187,50 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
     return { ok: false, code: 'machine_bound_to_other', binderEmail }
   }
 
+  /**
+   * 断网回落：本地校验记住的凭据，命中即放行（离线优先，2026-09-24 用户裁定）。
+   * 前提是"这台机器上登录过这个账号"——记住槽只在登录成功时写、只在校验失败时
+   * 清（unbind 全清），所以这里放行的账号，其会话与锁定在创建时都过了服务端。
+   *
+   * 不新增暴露面：口令本来就以 safeStorage 加密存在本地供表单预填，这里只是把
+   * 它当凭据用。能离线做的 U-5 复核照做（绑定状态损坏 fail-closed、绑定的站
+   * 不符即拒）；安装归属要联网查，离线判不了。
+   */
+  async function offlineLogin(site: string, email: string, password: string) {
+    // 没有会话就没有可解锁的东西：离线登入只把盘上已有的会话放回来，不新建。
+    const account = current()
+
+    if (!account) {return { ok: false, code: 'network' }}
+
+    let binding
+
+    try {
+      binding = loadMachineBinding(readMachineBindingState)
+    } catch (error) {
+      if (error instanceof MachineBindingError) {return { ok: false, code: 'binding_state_invalid' }}
+
+      throw error
+    }
+
+    if (binding && binding.site !== site) {
+      return { ok: false, code: 'machine_bound_to_other', binderEmail: null }
+    }
+
+    const remembered = loadRememberedLogin(io)
+
+    // 本地没有这个账号的凭据：离线无解，维持 network 文案等用户联网。
+    if (!remembered || remembered.site !== site || remembered.email !== email) {
+      return { ok: false, code: 'network' }
+    }
+
+    if (remembered.password !== password) {
+      return { ok: false, code: 'invalid_credentials' }
+    }
+
+    // 会话已在盘上（含被服务端判过期的）：用缓存 profile 恢复登录态，不落盘。
+    return { ok: true, site, profile: account.profile, offline: true }
+  }
+
   ipcMain.handle('hermes:account:login', async (_event, payload) => {
     let site: string
 
@@ -209,6 +262,10 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
 
       return { ok: true, site, profile }
     } catch (error) {
+      if (error instanceof RelayAccountError && error.code === 'network') {
+        return offlineLogin(site, email, password)
+      }
+
       return failure(error)
     }
   })
@@ -509,13 +566,20 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
   ipcMain.handle('hermes:account:reset-confirm', async (_event, payload) => {
     try {
       const site = canonicalizeRelaySite(String(payload?.site ?? ''))
+      const email = String(payload?.email ?? '').trim()
       await relayAccountResetConfirm(
         site,
-        String(payload?.email ?? '').trim(),
+        email,
         String(payload?.code ?? '').trim(),
         String(payload?.password ?? ''),
         fetcher
       )
+      // A successful reset invalidates the last successful login's password.
+      const remembered = loadRememberedLogin(io)
+
+      if (remembered?.site === site && remembered.email.toLowerCase() === email.toLowerCase()) {
+        persistRememberedLogin(null, io)
+      }
 
       return { ok: true }
     } catch (error) {
@@ -525,7 +589,7 @@ export function registerUserAccountIpc(deps: UserAccountIpcDeps): void {
 
   /**
    * 登录表单预填：返回最近一次成功登录记住的 {site, email, password}。
-   * 写入只发生在 login 成功（自动）与 unbind 全清（抹除）——renderer 无写口。
+   * login 成功写入；reset 成功及 unbind 清除旧凭据——renderer 无写口。
    */
   ipcMain.handle('hermes:account:remembered:load', async () => {
     return loadRememberedLogin(io)
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index d2b246156b..70fce0b6e6 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -23,10 +23,10 @@
     "dev:fake-boot": "cross-env HERMES_DESKTOP_BOOT_FAKE=1 HERMES_DESKTOP_BOOT_FAKE_STEP_MS=650 npm run dev",
     "dev:mock": "node ../../tests-js/scripts/mock-server.ts",
     "dev:renderer": "node scripts/assert-root-install.mjs && npm run clean:renderer && vite --host 127.0.0.1 --port 5174",
-    "dev:electron": "node scripts/patch-dev-electron-branding.mjs && tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron .",
-    "profile:main": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron --inspect=9229 .",
-    "profile:main:cpu": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 NODE_OPTIONS=--cpu-prof HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 electron .",
-    "start": "npm run build && electron .",
+    "dev:electron": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 node scripts/launch-dev-electron.mjs .",
+    "profile:main": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 node scripts/launch-dev-electron.mjs --inspect=9229 .",
+    "profile:main:cpu": "tsc --build tsconfig.electron.json && wait-on http://127.0.0.1:5174 && node scripts/bundle-electron-main.mjs --dev && cross-env XCURSOR_SIZE=24 HERMES_DESKTOP_CDP_PORT=9223 NODE_OPTIONS=--cpu-prof HERMES_DESKTOP_DEV_SERVER=http://127.0.0.1:5174 node scripts/launch-dev-electron.mjs .",
+    "start": "npm run build && node scripts/launch-dev-electron.mjs .",
     "prebuild": "node scripts/assert-root-install.mjs && npm run clean",
     "build": "node scripts/assert-root-install.mjs && node scripts/write-build-stamp.mjs && vite build && node scripts/bundle-electron-main.mjs && node scripts/stage-native-deps.mjs",
     "postbuild": "node scripts/assert-dist-built.mjs",
@@ -97,6 +97,7 @@
     "@lezer/highlight": "1.2.3",
     "@nanostores/react": "1.1.0",
     "@nous-research/ui": "0.18.2",
+    "@silurus/ooxml": "0.88.0",
     "@streamdown/code": "1.1.1",
     "@streamdown/math": "1.0.2",
     "@tabler/icons-react": "3.44.0",
@@ -236,7 +237,7 @@
       "entitlements": "electron/entitlements.mac.plist",
       "entitlementsInherit": "electron/entitlements.mac.inherit.plist",
       "extendInfo": {
-        "CFBundleDisplayName": "Digital Assistant",
+        "CFBundleDisplayName": "DeepWork",
         "CFBundleExecutable": "Hermes",
         "CFBundleName": "Hermes",
         "NSAudioCaptureUsageDescription": "Hermes uses audio capture for voice conversations.",
diff --git a/apps/desktop/scripts/launch-dev-electron.mjs b/apps/desktop/scripts/launch-dev-electron.mjs
new file mode 100644
index 0000000000..19a07ee082
--- /dev/null
+++ b/apps/desktop/scripts/launch-dev-electron.mjs
@@ -0,0 +1,21 @@
+import { spawn } from 'node:child_process'
+import { createRequire } from 'node:module'
+
+import { prepareBrandedElectron } from './patch-dev-electron-branding.mjs'
+
+const require = createRequire(import.meta.url)
+const binary = process.platform === 'darwin' ? prepareBrandedElectron() : require('electron')
+const child = spawn(binary, process.argv.slice(2), { stdio: 'inherit' })
+
+for (const signal of ['SIGINT', 'SIGTERM', 'SIGUSR2']) {
+  process.on(signal, () => child.kill(signal))
+}
+
+child.on('error', error => {
+  console.error('[desktop] Electron launch failed:', error)
+  process.exitCode = 1
+})
+
+child.on('close', code => {
+  process.exitCode = code ?? 1
+})
diff --git a/apps/desktop/scripts/patch-dev-electron-branding.mjs b/apps/desktop/scripts/patch-dev-electron-branding.mjs
index 072fa69f91..2f315a0aea 100644
--- a/apps/desktop/scripts/patch-dev-electron-branding.mjs
+++ b/apps/desktop/scripts/patch-dev-electron-branding.mjs
@@ -1,36 +1,64 @@
-// Dev-mode Dock tooltip: `electron .` runs the stock Electron.app bundle, whose
-// CFBundleDisplayName is "Electron" — so hovering the Dock icon says "Electron"
-// no matter what app.setName() does (macOS reads the bundle, not the runtime
-// name). Patch the dev bundle's display name to match the packaged brand.
-// Idempotent; no-op off macOS or when electron isn't installed. Deliberately
-// does NOT touch the main-process APP_NAME — that one keys the userData path.
+// macOS reads the Dock label from the launched .app bundle. Patching the stock
+// Electron.app plist alone still leaves the running tile named "Electron", so
+// launch a branded copy while keeping node_modules/electron's original intact.
 import { execFileSync } from 'node:child_process'
-import { existsSync } from 'node:fs'
+import { constants, cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
-const DISPLAY_NAME = 'Digital Assistant'
+const DISPLAY_NAME = 'DeepWork'
+const BUNDLE_ID = 'com.nousresearch.hermes.dev'
+const CACHE_FORMAT = '3'
+const BUDDY = '/usr/libexec/PlistBuddy'
+const DESKTOP_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 
-if (process.platform === 'darwin') {
-  const desktopRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-  const plist = path.join(desktopRoot, 'node_modules/electron/dist/Electron.app/Contents/Info.plist')
-
-  if (existsSync(plist)) {
-    const buddy = '/usr/libexec/PlistBuddy'
-    const read = key => {
-      try {
-        return execFileSync(buddy, ['-c', `Print :${key}`, plist], { encoding: 'utf8' }).trim()
-      } catch {
-        return ''
-      }
-    }
-    const write = (key, value) =>
-      execFileSync(buddy, ['-c', `Set :${key} ${value}`, plist], { stdio: 'ignore' })
-
-    for (const key of ['CFBundleName', 'CFBundleDisplayName']) {
-      if (read(key) !== DISPLAY_NAME) {
-        write(key, DISPLAY_NAME)
-      }
-    }
-  }
+function plistValue(plist, key) {
+  return execFileSync(BUDDY, ['-c', `Print :${key}`, plist], { encoding: 'utf8' }).trim()
+}
+
+function setPlistValue(plist, key, value) {
+  execFileSync(BUDDY, ['-c', `Set :${key} ${value}`, plist], { stdio: 'ignore' })
+}
+
+export function prepareBrandedElectron({
+  electronDist = path.join(DESKTOP_ROOT, 'node_modules/electron/dist'),
+  cacheRoot = path.join(DESKTOP_ROOT, 'node_modules/.cache/hermes-desktop')
+} = {}) {
+  const source = path.join(electronDist, 'Electron.app')
+  const sourcePlist = path.join(source, 'Contents/Info.plist')
+  const version = plistValue(sourcePlist, 'CFBundleShortVersionString')
+  const versionRoot = path.join(cacheRoot, version)
+  const branded = path.join(versionRoot, `${DISPLAY_NAME}.app`)
+  const binary = path.join(branded, 'Contents/MacOS/Electron')
+  const marker = path.join(branded, '.hermes-electron-version')
+  const cacheKey = `${version}:${CACHE_FORMAT}`
+
+  if (existsSync(binary) && existsSync(marker) && readFileSync(marker, 'utf8') === cacheKey) {
+    return binary
+  }
+
+  mkdirSync(versionRoot, { recursive: true })
+
+  const temporary = path.join(versionRoot, `${DISPLAY_NAME}.app.tmp-${process.pid}`)
+
+  rmSync(temporary, { recursive: true, force: true })
+
+  try {
+    cpSync(source, temporary, { recursive: true, mode: constants.COPYFILE_FICLONE, verbatimSymlinks: true })
+
+    const plist = path.join(temporary, 'Contents/Info.plist')
+
+    setPlistValue(plist, 'CFBundleName', DISPLAY_NAME)
+    setPlistValue(plist, 'CFBundleDisplayName', DISPLAY_NAME)
+    setPlistValue(plist, 'CFBundleIdentifier', BUNDLE_ID)
+    writeFileSync(path.join(temporary, '.hermes-electron-version'), cacheKey)
+
+    rmSync(branded, { recursive: true, force: true })
+    renameSync(temporary, branded)
+  } catch (error) {
+    rmSync(temporary, { recursive: true, force: true })
+    throw error
+  }
+
+  return binary
 }
diff --git a/apps/desktop/scripts/patch-dev-electron-branding.test.mjs b/apps/desktop/scripts/patch-dev-electron-branding.test.mjs
new file mode 100644
index 0000000000..f5f56a2992
--- /dev/null
+++ b/apps/desktop/scripts/patch-dev-electron-branding.test.mjs
@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict'
+import { execFileSync } from 'node:child_process'
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+import { prepareBrandedElectron } from './patch-dev-electron-branding.mjs'
+
+const BUDDY = '/usr/libexec/PlistBuddy'
+
+function plistValue(plist, key) {
+  return execFileSync(BUDDY, ['-c', `Print :${key}`, plist], { encoding: 'utf8' }).trim()
+}
+
+test('dev Electron launches from a versioned DeepWork.app without changing the stock bundle', {
+  skip: process.platform !== 'darwin'
+}, () => {
+  const root = mkdtempSync(path.join(tmpdir(), 'hermes-dock-brand-'))
+
+  try {
+    const electronDist = path.join(root, 'dist')
+    const cacheRoot = path.join(root, 'cache')
+    const source = path.join(electronDist, 'Electron.app/Contents')
+    const sourcePlist = path.join(source, 'Info.plist')
+
+    mkdirSync(path.join(source, 'MacOS'), { recursive: true })
+    mkdirSync(path.join(source, 'Frameworks/Test.framework/Versions/A/Resources'), { recursive: true })
+    writeFileSync(path.join(source, 'Frameworks/Test.framework/Versions/A/Resources/icudtl.dat'), 'icu')
+    symlinkSync('A', path.join(source, 'Frameworks/Test.framework/Versions/Current'))
+    writeFileSync(path.join(source, 'MacOS/Electron'), 'binary')
+    writeFileSync(sourcePlist, `<?xml version="1.0" encoding="UTF-8"?>
+<plist version="1.0"><dict>
+<key>CFBundleName</key><string>Electron</string>
+<key>CFBundleDisplayName</key><string>Electron</string>
+<key>CFBundleExecutable</key><string>Electron</string>
+<key>CFBundleIdentifier</key><string>com.github.Electron</string>
+<key>CFBundleShortVersionString</key><string>1.0</string>
+</dict></plist>`)
+
+    const options = { electronDist, cacheRoot }
+    const binary = prepareBrandedElectron(options)
+    const brandedPlist = path.join(cacheRoot, '1.0/DeepWork.app/Contents/Info.plist')
+
+    assert.equal(binary, path.join(cacheRoot, '1.0/DeepWork.app/Contents/MacOS/Electron'))
+    assert.equal(plistValue(brandedPlist, 'CFBundleDisplayName'), 'DeepWork')
+    assert.equal(plistValue(brandedPlist, 'CFBundleExecutable'), 'Electron')
+    assert.equal(plistValue(brandedPlist, 'CFBundleIdentifier'), 'com.nousresearch.hermes.dev')
+    assert.equal(plistValue(sourcePlist, 'CFBundleName'), 'Electron')
+    const copiedFramework = path.join(cacheRoot, '1.0/DeepWork.app/Contents/Frameworks/Test.framework/Versions')
+    assert.equal(readlinkSync(path.join(copiedFramework, 'Current')), 'A')
+    assert.equal(readFileSync(path.join(copiedFramework, 'Current/Resources/icudtl.dat'), 'utf8'), 'icu')
+
+    const sentinel = path.join(cacheRoot, '1.0/DeepWork.app/sentinel')
+
+    writeFileSync(sentinel, 'keep')
+    assert.equal(prepareBrandedElectron(options), binary)
+    assert.equal(readFileSync(sentinel, 'utf8'), 'keep')
+
+    writeFileSync(path.join(cacheRoot, '1.0/DeepWork.app/.hermes-electron-version'), 'stale')
+    assert.equal(prepareBrandedElectron(options), binary)
+    assert.equal(existsSync(sentinel), false)
+    assert.equal(readFileSync(path.join(copiedFramework, 'Current/Resources/icudtl.dat'), 'utf8'), 'icu')
+    assert.equal(readFileSync(path.join(cacheRoot, '1.0/DeepWork.app/.hermes-electron-version'), 'utf8').startsWith('1.0:'), true)
+
+    writeFileSync(sentinel, 'keep')
+
+    execFileSync(BUDDY, ['-c', 'Set :CFBundleShortVersionString 2.0', sourcePlist])
+    const updatedBinary = prepareBrandedElectron(options)
+
+    assert.equal(updatedBinary, path.join(cacheRoot, '2.0/DeepWork.app/Contents/MacOS/Electron'))
+    assert.equal(readFileSync(sentinel, 'utf8'), 'keep')
+  } finally {
+    rmSync(root, { recursive: true, force: true })
+  }
+})
diff --git a/apps/desktop/src/api/freemodel2api.ts b/apps/desktop/src/api/freemodel2api.ts
index 27040bbb4d..f47d6d3e50 100644
--- a/apps/desktop/src/api/freemodel2api.ts
+++ b/apps/desktop/src/api/freemodel2api.ts
@@ -3,6 +3,8 @@ export interface FreeModel2ApiStatus {
   baseUrl?: string
   email?: string
   balance?: number
+  username?: string
+  frozenBalance?: number
 }
 
 export interface FreeModel2ApiKey {
@@ -45,3 +47,8 @@ export function fm2RememberedLoad(): Promise<FreeModel2ApiRememberedLogin | null
 export function fm2RememberedSave(payload: FreeModel2ApiRememberedLogin | null) {
   return window.hermesDesktop.freemodel2api.rememberedSave(payload)
 }
+
+/** 未登录的余额读数:sub2api 凭 API key 直查,不走会话。null = 查不到(非 sub2api / 失败)。 */
+export function fm2KeyBalance(baseUrl: string, apiKey: string): Promise<{ balance: number | null }> {
+  return window.hermesDesktop.freemodel2api.keyBalance({ baseUrl, apiKey })
+}
diff --git a/apps/desktop/src/app/chat/composer/attachments.test.tsx b/apps/desktop/src/app/chat/composer/attachments.test.tsx
index 8a756b56ff..316956b2c5 100644
--- a/apps/desktop/src/app/chat/composer/attachments.test.tsx
+++ b/apps/desktop/src/app/chat/composer/attachments.test.tsx
@@ -132,7 +132,7 @@ describe('AttachmentList', () => {
     expect(lightboxImage?.getAttribute('src')).toBe(DATA_URL)
 
     await act(async () => {
-      fireEvent.click(lightboxImage!)
+      fireEvent.click(screen.getByRole('button', { name: 'Close' }))
     })
 
     await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
diff --git a/apps/desktop/src/app/chat/composer/attachments.tsx b/apps/desktop/src/app/chat/composer/attachments.tsx
index b87e69068f..580dc30a17 100644
--- a/apps/desktop/src/app/chat/composer/attachments.tsx
+++ b/apps/desktop/src/app/chat/composer/attachments.tsx
@@ -216,7 +216,6 @@ function AttachmentPill({ attachment, onRemove }: { attachment: ComposerAttachme
       {lightboxSrc && (
         <ImageLightbox
           alt={attachment.label}
-          copy={t.desktop}
           onClick={download}
           onOpenChange={open => {
             setLightboxOpen(open)
diff --git a/apps/desktop/src/app/chat/composer/composer-utils.ts b/apps/desktop/src/app/chat/composer/composer-utils.ts
index 69e7b74320..4fd31005f3 100644
--- a/apps/desktop/src/app/chat/composer/composer-utils.ts
+++ b/apps/desktop/src/app/chat/composer/composer-utils.ts
@@ -10,22 +10,18 @@ import type { TriggerState } from './text-utils'
 
 export const COMPOSER_STACK_BREAKPOINT_PX = 320
 
-// Above the stack breakpoint but still cramped: the model pill sheds its label
-// for its chevron icon so the controls stop crowding the input before the whole
-// row has to stack. Progressive collapse: full pill → icon pill → stacked.
+// Above the tight-control breakpoint but still cramped: the model pill sheds
+// its label for its chevron icon so the controls keep room for the input rail.
+// Progressive collapse: full pill → icon pill → compact controls.
 //
 // Sized off what the controls actually cost, because guessing put the two
 // stages on top of each other. With the full pill the controls take ~284px
-// (pill 111 + the icon cluster), so at the old 440 the inline input was ~156px
-// — barely over its 128px minimum. A few words wrapped, wrapping is what
-// stacks the row, and the pill's chevron arrived at the same moment the row
-// gave up, which is the one thing progressive collapse is supposed to avoid.
-// At 560 the label goes while the input still has ~276px, and the ~110px the
-// chevron frees is spent keeping the row single for another stretch.
+// (pill 111 + the icon cluster), so the label drops at 560px and the ~110px the
+// chevron frees is available to the input rail.
 export const COMPOSER_COMPACT_PILL_PX = 560
 
-// The ladder keeps going below the stack breakpoint — a pane can be far
-// narrower than even the stacked controls row. Both rungs are budgeted
+// The ladder keeps going below the tight-control breakpoint — a pane can be far
+// narrower than even the controls row. Both rungs are budgeted
 // against that row's real cost: menu ~24 + surface padding 16 + the cluster
 // (~190; ~218 mid-turn with the queue button).
 //
@@ -42,11 +38,6 @@ export const COMPOSER_FOLD_VOICE_PX = 260
 // spare at any width the layout tree allows (~74 all-in).
 export const COMPOSER_MINIMAL_PX = 180
 
-// A single editor line is ~28px (--composer-input-min-height 1.625rem + 0.5rem
-// vertical padding). Anything taller means the text wrapped to a second line,
-// which is when the composer should expand to the stacked layout.
-export const COMPOSER_SINGLE_LINE_MAX_PX = 36
-
 export const COMPOSER_FADE_BACKGROUND =
   'linear-gradient(to bottom, transparent, color-mix(in srgb, var(--dt-background) 10%, transparent))'
 
diff --git a/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.test.tsx b/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.test.tsx
index cf082d0202..389399876b 100644
--- a/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.test.tsx
+++ b/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.test.tsx
@@ -6,10 +6,6 @@ import { COMPOSER_HEIGHT_VAR, COMPOSER_SURFACE_HEIGHT_VAR } from '@/app/chat/sur
 
 import { useComposerMetrics } from './use-composer-metrics'
 
-vi.mock('@assistant-ui/react', () => ({
-  useAuiState: (selector: (state: { composer: { text: string } }) => unknown) => selector({ composer: { text: '' } })
-}))
-
 // The shared ResizeObserver delivers once per observed element after
 // observe(); replay that by hand so the hook's initial measurement runs where
 // it would in Chromium.
@@ -60,16 +56,15 @@ function Harness({ dockHeight, surfaceHeight }: { dockHeight: number; surfaceHei
   const composerDockRef = useRef<HTMLDivElement | null>(null)
   const composerRef = useRef<HTMLFormElement | null>(null)
   const composerSurfaceRef = useRef<HTMLDivElement | null>(null)
-  const editorRef = useRef<HTMLDivElement | null>(null)
 
-  useComposerMetrics({ composerDockRef, composerRef, composerSurfaceRef, editorRef, poppedOut: false })
+  useComposerMetrics({ composerDockRef, composerRef, composerSurfaceRef, poppedOut: false })
 
   return (
     <div data-chat-surface="">
       <div ref={sized(composerDockRef, dockHeight)}>
         <form ref={composerRef}>
           <div ref={sized(composerSurfaceRef, surfaceHeight)}>
-            <div ref={editorRef} />
+            <div />
           </div>
         </form>
       </div>
diff --git a/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.ts b/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.ts
index dbc0ab24b0..f4b17be7b3 100644
--- a/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.ts
+++ b/apps/desktop/src/app/chat/composer/hooks/use-composer-metrics.ts
@@ -1,4 +1,3 @@
-import { useAuiState } from '@assistant-ui/react'
 import { type RefObject, useCallback, useEffect, useRef, useState } from 'react'
 
 import {
@@ -14,7 +13,6 @@ import {
   COMPOSER_COMPACT_PILL_PX,
   COMPOSER_FOLD_VOICE_PX,
   COMPOSER_MINIMAL_PX,
-  COMPOSER_SINGLE_LINE_MAX_PX,
   COMPOSER_STACK_BREAKPOINT_PX
 } from '../composer-utils'
 
@@ -22,7 +20,6 @@ interface UseComposerMetricsArgs {
   composerDockRef: RefObject<HTMLDivElement | null>
   composerRef: RefObject<HTMLFormElement | null>
   composerSurfaceRef: RefObject<HTMLDivElement | null>
-  editorRef: RefObject<HTMLDivElement | null>
   poppedOut: boolean
 }
 
@@ -46,59 +43,25 @@ const fitForWidth = (width: number): ComposerFit => ({
 const sameFit = (a: ComposerFit, b: ComposerFit) =>
   a.compactPill === b.compactPill && a.foldVoice === b.foldVoice && a.minimal === b.minimal && a.tight === b.tight
 
-interface UseComposerMetricsResult extends ComposerFit {
-  stacked: boolean
-}
+type UseComposerMetricsResult = ComposerFit
 
 /**
- * Owns the composer's *sizing* engine: the stacked-vs-inline layout decision
- * and the measured-height CSS vars the thread reads for bottom clearance. All
- * work is edge-gated — the ResizeObserver only fires on real size changes, the
- * height vars are 8px-bucketed so per-keystroke growth never invalidates the
- * tree's computed style, and the fit only re-renders when it crosses a stage.
+ * Owns the composer's sizing engine: width-driven control collapse and the
+ * measured-height CSS vars the thread reads for bottom clearance. The input
+ * and controls are always separate rows, so this hook only resolves control
+ * density. All work is edge-gated — the ResizeObserver only fires on real size
+ * changes, the height vars are 8px-bucketed so per-keystroke growth never
+ * invalidates the tree's computed style, and the fit only re-renders when it
+ * crosses a stage.
  */
 export function useComposerMetrics({
   composerDockRef,
   composerRef,
   composerSurfaceRef,
-  editorRef,
   poppedOut
 }: UseComposerMetricsArgs): UseComposerMetricsResult {
-  const [expanded, setExpanded] = useState(false)
   const [fit, setFit] = useState<ComposerFit>(ROOMY)
 
-  // Edge signals, not the live text: these only re-render when emptiness / the
-  // presence of a non-trailing newline actually flips, so typing within a line
-  // costs nothing here.
-  const isEmpty = useAuiState(s => s.composer.text.length === 0)
-  const hasHardNewline = useAuiState(s => s.composer.text.trimEnd().includes('\n'))
-
-  // Expansion (input on its own full-width row, controls below) is driven by
-  // the editor's *actual* rendered height via the ResizeObserver in
-  // syncComposerMetrics — it only fires when the text genuinely wraps to a
-  // second line, so the layout flips exactly at the wrap point rather than at
-  // a guessed character count. We only handle the two cases the observer
-  // can't: an explicit newline (expand before layout settles) and an emptied
-  // draft (collapse back). We never read scrollHeight per keystroke.
-  useEffect(() => {
-    if (isEmpty) {
-      setExpanded(false)
-
-      return
-    }
-
-    if (expanded) {
-      return
-    }
-
-    // Only a non-trailing newline forces an immediate expand. A trailing newline
-    // (or phantom \n from contenteditable junk) is left to the ResizeObserver,
-    // which expands only when the editor's real height actually grows.
-    if (hasHardNewline) {
-      setExpanded(true)
-    }
-  }, [expanded, hasHardNewline, isEmpty])
-
   // Bucket measured heights so we only invalidate the global CSS var when
   // the size crosses a meaningful threshold. Without bucketing, the editor
   // grows ~1px per character → setProperty fires every keystroke → entire
@@ -152,18 +115,6 @@ export function useComposerMetrics({
       }
     }
 
-    // Expand once the input has actually wrapped past a single line. The
-    // observer only fires on real size changes, so this reads scrollHeight at
-    // most once per wrap (not per keystroke). One line ≈ 28px (1.625rem
-    // min-height + padding); a second line clears ~36px. We only ever expand
-    // here — collapse is handled by the emptied-draft effect to avoid
-    // oscillating across the wrap boundary as the input switches widths.
-    const editor = editorRef.current
-
-    if (editor && editor.scrollHeight > COMPOSER_SINGLE_LINE_MAX_PX) {
-      setExpanded(true)
-    }
-
     if (height > 0) {
       const bucket = Math.round(height / 8) * 8
 
@@ -181,9 +132,9 @@ export function useComposerMetrics({
         setSurfaceVar(composer, COMPOSER_SURFACE_HEIGHT_VAR, `${bucket}px`)
       }
     }
-  }, [composerDockRef, composerRef, composerSurfaceRef, editorRef])
+  }, [composerDockRef, composerRef, composerSurfaceRef])
 
-  useResizeObserver(syncComposerMetrics, composerDockRef, composerRef, composerSurfaceRef, editorRef)
+  useResizeObserver(syncComposerMetrics, composerDockRef, composerRef, composerSurfaceRef)
 
   // Toggling pop-out changes whether the composer reserves thread clearance.
   // The ResizeObserver may not fire (the box can keep the same box size), so
@@ -217,23 +168,12 @@ export function useComposerMetrics({
   }, [composerRef])
 
   // Every decision comes from the composer's OWN measured width, never the
-  // viewport's. There used to be a `(max-width: 30rem)` media query in here as
-  // well, and it quietly outranked everything: any window under 480px stacked
-  // the row AND compacted the pill in the same instant, regardless of how much
-  // room the composer actually had. That collapsed the whole progressive ladder
-  // into one step for small windows — HUD mode is ~470px, so it never saw the
-  // ladder at all — and it disagreed with the measured breakpoints (320 to
-  // stack) by 160px. The ResizeObserver knows the real width; the viewport is
-  // not a proxy for it.
-  //
-  // The ladder is monotonic: each stage implies the ones above it, so the pill
-  // is always compact by the time the row stacks, and the voice controls are
-  // always folded before minimal drops them.
+  // viewport's. The input/control split is fixed; the ladder only reduces
+  // control density as the available width shrinks.
   return {
     compactPill: fit.compactPill || fit.tight,
     foldVoice: fit.foldVoice || fit.minimal,
     minimal: fit.minimal,
-    stacked: expanded || fit.tight,
     tight: fit.tight
   }
 }
diff --git a/apps/desktop/src/app/chat/composer/index.tsx b/apps/desktop/src/app/chat/composer/index.tsx
index cb0a16cb37..fce1c20b45 100644
--- a/apps/desktop/src/app/chat/composer/index.tsx
+++ b/apps/desktop/src/app/chat/composer/index.tsx
@@ -360,11 +360,10 @@ export function ChatBar({
     return onCancel()
   }, [activeQueueSessionKeyRef, onCancel])
 
-  const { compactPill, foldVoice, minimal, stacked } = useComposerMetrics({
+  const { compactPill, foldVoice, minimal } = useComposerMetrics({
     composerDockRef,
     composerRef,
     composerSurfaceRef,
-    editorRef,
     poppedOut
   })
 
@@ -1108,17 +1107,16 @@ export function ChatBar({
   )
 
   const input = (
-    <div className={cn('relative', stacked ? 'w-full' : 'min-w-(--composer-input-inline-min-width) flex-1')}>
+    <div className="relative w-full">
       <div
         aria-disabled={inputDisabled ? true : undefined}
         aria-label={t.composer.message}
         autoCapitalize="off"
         autoCorrect="off"
         className={cn(
-          'min-h-[1.625rem] min-h-(--composer-input-min-height) max-h-(--composer-input-max-height) cursor-text overflow-y-auto whitespace-pre-wrap break-words [overflow-wrap:anywhere] bg-transparent pb-1 pr-1 pt-1 leading-normal text-foreground outline-none disabled:cursor-not-allowed',
+          'min-h-[2.25rem] min-h-(--composer-input-min-height) max-h-(--composer-input-max-height) cursor-text overflow-y-auto whitespace-pre-wrap break-words [overflow-wrap:anywhere] bg-transparent pb-1 pr-1 pt-1 leading-normal text-foreground outline-none disabled:cursor-not-allowed',
           '**:data-ref-text:cursor-default',
-          stacked && 'pl-3',
-          stacked ? 'w-full' : 'min-w-(--composer-input-inline-min-width) flex-1',
+          'w-full pl-3',
           // Inside the native Wayland HUD drag region: a drag region swallows
           // the page's mouse input whole, so the input must opt back out or it
           // becomes unclickable. Buttons use the global no-drag rule.
@@ -1450,12 +1448,7 @@ export function ChatBar({
                   )}
                   {attachments.length > 0 && <AttachmentList attachments={attachments} onRemove={onRemoveAttachment} />}
                   <div
-                    className={cn(
-                      'grid w-full',
-                      stacked
-                        ? 'grid-cols-[auto_1fr] gap-(--composer-row-gap) [grid-template-areas:"input_input"_"menu_controls"]'
-                        : 'grid-cols-[auto_1fr_auto] items-center gap-(--composer-control-gap) [grid-template-areas:"menu_input_controls"]'
-                    )}
+                    className='grid w-full grid-cols-[auto_1fr] gap-(--composer-row-gap) [grid-template-areas:"input_input"_"menu_controls"]'
                   >
                     <div className="flex translate-y-[3px] items-start gap-(--composer-control-gap) self-start [grid-area:menu]">
                       {contextMenu}
diff --git a/apps/desktop/src/app/chat/composer/status-stack/index.tsx b/apps/desktop/src/app/chat/composer/status-stack/index.tsx
index 104689fc03..a8b45c2857 100644
--- a/apps/desktop/src/app/chat/composer/status-stack/index.tsx
+++ b/apps/desktop/src/app/chat/composer/status-stack/index.tsx
@@ -9,6 +9,7 @@ import type { SubmitTextOptions } from '@/app/session/hooks/use-prompt-actions/u
 import { BillingBanner } from '@/components/billing-banner'
 import { composerDockCard } from '@/components/chat/composer-dock'
 import { StatusSection } from '@/components/chat/status-section'
+import { StatusRow } from '@/components/chat/status-row'
 import { FreeTierNoticeStrip, useFreeTierNoticeOwner } from '@/components/free-tier/notice-strip'
 import { usePaneVisible } from '@/components/pane-shell/pane-visibility'
 import { Button } from '@/components/ui/button'
@@ -29,6 +30,7 @@ import {
   stopBackgroundProcess
 } from '@/store/composer-status'
 import { $freeTierRoute, $freeTierStatus, freeTierStripPending } from '@/store/free-tier'
+import { $desktopOnboarding, startManualOnboarding } from '@/store/onboarding'
 import { $previewStatusBySession, dismissPreviewArtifact } from '@/store/preview-status'
 import { $sessionControlBySession, refreshSessionControl } from '@/store/session-control'
 import { $threadScrolledUpBySession } from '@/store/thread-scroll'
@@ -122,6 +124,12 @@ export function ComposerStatusStack({ onSubmit, queue, sessionId }: ComposerStat
   // notice once — and a non-owning stack adds no empty row to its card.
   const ownsFreeTierNotice = useFreeTierNoticeOwner()
   const freeTierNotice = ownsFreeTierNotice && freeTierStripPending(freeTierStatus, freeTierRoute)
+  // The unconfigured first-run wizard became a hint: the overlay only opens on
+  // demand, this strip is what surfaces the pending setup.
+  const setupPending = useStoreSelector(
+    $desktopOnboarding,
+    state => state.configured === false && !state.manual
+  )
 
   const isStructuredSupported = controlEntry?.capability === 'supported'
 
@@ -205,6 +213,10 @@ export function ComposerStatusStack({ onSubmit, queue, sessionId }: ComposerStat
     sections.push({ key: 'free-tier', node: <FreeTierNoticeStrip /> })
   }
 
+  if (setupPending) {
+    sections.push({ key: 'setup-pending', node: <SetupPendingStrip /> })
+  }
+
   const hasControlContent = Boolean(
     controlEntry &&
     (controlEntry.error ||
@@ -336,3 +348,29 @@ export function ComposerStatusStack({ onSubmit, queue, sessionId }: ComposerStat
     </div>
   )
 }
+
+function SetupPendingStrip() {
+  const { t } = useI18n()
+
+  return (
+    <StatusRow
+      leading={<Codicon aria-hidden className="text-(--ui-text-tertiary)" name="zap" size="0.8rem" />}
+      trailing={
+        <Button
+          className="text-foreground/90 hover:text-foreground"
+          onClick={() => startManualOnboarding(null)}
+          size="micro"
+          type="button"
+          variant="text"
+        >
+          {t.statusStack.setupPendingAction}
+        </Button>
+      }
+      trailingVisible
+    >
+      <span className="min-w-0 truncate text-[0.73rem] leading-4 text-foreground/92">
+        {t.statusStack.setupPendingTitle}
+      </span>
+    </StatusRow>
+  )
+}
diff --git a/apps/desktop/src/app/chat/index.tsx b/apps/desktop/src/app/chat/index.tsx
index 416b443c2b..01c919fb37 100644
--- a/apps/desktop/src/app/chat/index.tsx
+++ b/apps/desktop/src/app/chat/index.tsx
@@ -739,7 +739,6 @@ const ChatViewContent = memo(function ChatViewContent({
       data-composer-target={composerScope.target}
       data-session-anchor={sessionAnchor}
     >
-      <Backdrop />
       {/* Tiles get their chrome from the layout zone (chip strip); the modal
           prompt overlays stay active-session-scoped in the primary surface. */}
       {isPrimary && (
@@ -751,7 +750,7 @@ const ChatViewContent = memo(function ChatViewContent({
           selectedSessionId={selectedSessionId}
         />
       )}
-      {isPrimary && onChangeWorkspace && <WorkspaceBar cwd={currentCwd} onChangeWorkspace={onChangeWorkspace} />}
+      {isPrimary && onChangeWorkspace && <WorkspaceBar cwd={currentCwd} selectedSessionId={selectedSessionId} />}
 
       {/* Mounted for the primary AND every tile, each scoped to its own session
           so a tiled/background session's blocking prompt surfaces instead of
@@ -771,6 +770,9 @@ const ChatViewContent = memo(function ChatViewContent({
           data-slot="composer-bounds"
           {...dropHandlers}
         >
+          {/* Keep the optional image texture inside the conversation body. The
+              title/workspace chrome should remain a clean, continuous band. */}
+          <Backdrop />
           <Thread
             clampToComposer={showChatBar}
             cwd={currentCwd}
diff --git a/apps/desktop/src/app/chat/pane-mirror.ts b/apps/desktop/src/app/chat/pane-mirror.ts
index 96657794ee..e9fc7a091c 100644
--- a/apps/desktop/src/app/chat/pane-mirror.ts
+++ b/apps/desktop/src/app/chat/pane-mirror.ts
@@ -27,6 +27,10 @@ export interface PaneMirror<T> {
   dir?: (tile: T) => TileDock | undefined
   /** Pane to dock against (default `workspace`) — a drop's target zone. */
   anchor?: (tile: T) => string | undefined
+  /** Where a top-edge zone should render its tab strip. */
+  titlebar?: 'content' | 'window'
+  /** Background surface for a zone containing only these panes. */
+  headerSurface?: 'chat' | 'sidebar'
   /** Center docks: the strip slot (stack before this pane id). */
   before?: (tile: T) => null | string | undefined
   minWidth: string
@@ -89,6 +93,8 @@ export function paneMirror<T>(cfg: PaneMirror<T>): () => void {
           },
           minWidth: cfg.minWidth,
           newTab: cfg.newTab?.(key),
+          headerSurface: cfg.headerSurface,
+          titlebar: cfg.titlebar,
           // Every mirrored tile is a full workspace surface docked beside main —
           // and closeable, which is what keeps its tab when it lands in a zone of
           // its own (see strip-visibility.ts).
diff --git a/apps/desktop/src/app/chat/preview-tile.test.ts b/apps/desktop/src/app/chat/preview-tile.test.ts
index d5cea44709..ec19437a7a 100644
--- a/apps/desktop/src/app/chat/preview-tile.test.ts
+++ b/apps/desktop/src/app/chat/preview-tile.test.ts
@@ -9,6 +9,8 @@ vi.mock('./right-rail/preview-console-store', () => ({
 }))
 
 import { registry } from '@/contrib/registry'
+import { group } from '@/components/pane-shell/tree/model'
+import { $layoutTree } from '@/components/pane-shell/tree/store'
 import { $previewTabs, closeRightRail, noteBrowserPage, openPreview } from '@/store/preview'
 
 import { browserTabExternalUrl, browserTabLabel, watchPreviewTiles } from './preview-tile'
@@ -19,6 +21,7 @@ beforeAll(() => {
 
 afterEach(() => {
   closeRightRail()
+  $layoutTree.set(null)
 })
 
 describe('browserTabLabel', () => {
@@ -89,6 +92,14 @@ const fileTarget = (path: string) =>
   ({ kind: 'file', label: path.split('/').at(-1) ?? path, path, source: path, url: path }) as const
 
 describe('preview tiles stack, not split (#93610)', () => {
+  it('joins the working-directory tab group when files is present', () => {
+    $layoutTree.set(group(['files'], { id: 'grp-files' }))
+
+    openPreview(fileTarget('/tmp/a.ts'), 'file-browser')
+
+    expect(dockOf('preview-tile:file:/tmp/a.ts')).toMatchObject({ pane: 'files', pos: 'center' })
+  })
+
   it('docks the first preview right and stacks the second as a center tab in the same zone', () => {
     openPreview(fileTarget('/tmp/a.ts'), 'file-browser')
 
diff --git a/apps/desktop/src/app/chat/preview-tile.tsx b/apps/desktop/src/app/chat/preview-tile.tsx
index 7777cf954c..f94e748d4d 100644
--- a/apps/desktop/src/app/chat/preview-tile.tsx
+++ b/apps/desktop/src/app/chat/preview-tile.tsx
@@ -12,14 +12,20 @@
 
 import { useStore } from '@nanostores/react'
 
-import { findGroup } from '@/components/pane-shell/tree/model'
-import { $activeTreeGroup, $layoutTree, revealTreePane, treePanesWithPrefix } from '@/components/pane-shell/tree/store'
+import { findGroup, findGroupOfPane } from '@/components/pane-shell/tree/model'
+import {
+  $activeTreeGroup,
+  $layoutTree,
+  moveTreePaneBeside,
+  revealTreePane,
+  treePanesWithPrefix
+} from '@/components/pane-shell/tree/store'
 import { type MenuKit, renderActionItem } from '@/components/ui/actions-menu'
 import { FileTypeIcon } from '@/components/ui/file-type-icon'
 import { ToolIcon } from '@/components/ui/tool-icon'
 import { translateNow } from '@/i18n'
 import { openExternalLink } from '@/lib/external-link'
-import { $rightRailActiveTabId, type RightRailTabId, selectRightRailTab } from '@/store/layout'
+import { $rightRailActiveTabId, FILES_PANE_ID, type RightRailTabId, selectRightRailTab } from '@/store/layout'
 import {
   $browserPages,
   $dockedPreviewTabs,
@@ -64,31 +70,48 @@ export function browserTabExternalUrl(tabId: string): null | string {
 }
 
 function browserTabMenuPrefix(tabId: string) {
-  if (targetFor(tabId)?.kind !== 'url') {
-    return undefined
-  }
-
   return (kit: MenuKit) => (
     <>
-      {canOpenBrowserWindow()
-        ? renderActionItem(kit, {
-            icon: 'empty-window',
-            key: 'pop-out',
-            label: translateNow('preview.popOut'),
-            onSelect: () => popOutBrowserTab(tabId)
-          })
-        : null}
       {renderActionItem(kit, {
-        disabled: !browserTabExternalUrl(tabId),
-        icon: 'link-external',
-        key: 'open-external',
-        label: translateNow('preview.openInExternal'),
-        onSelect: () => openExternalLink(browserTabExternalUrl(tabId) ?? '')
+        icon: 'layout-sidebar-right',
+        key: 'move-to-workspace',
+        label: translateNow('preview.moveToWorkspace'),
+        onSelect: () => movePreviewToWorkspace(tabId)
       })}
+      {targetFor(tabId)?.kind === 'url' ? <kit.Separator /> : null}
+      {targetFor(tabId)?.kind === 'url' ? (
+        <>
+          {canOpenBrowserWindow()
+            ? renderActionItem(kit, {
+                icon: 'empty-window',
+                key: 'pop-out',
+                label: translateNow('preview.popOut'),
+                onSelect: () => popOutBrowserTab(tabId)
+              })
+            : null}
+          {renderActionItem(kit, {
+            disabled: !browserTabExternalUrl(tabId),
+            icon: 'link-external',
+            key: 'open-external',
+            label: translateNow('preview.openInExternal'),
+            onSelect: () => openExternalLink(browserTabExternalUrl(tabId) ?? '')
+          })}
+        </>
+      ) : null}
     </>
   )
 }
 
+/** Move a preview tab into a split beside the main Workspace pane. */
+export function movePreviewToWorkspace(tabId: string) {
+  if (!targetFor(tabId)) {
+    return
+  }
+
+  moveTreePaneBeside(previewPaneId(tabId), 'workspace')
+  selectRightRailTab(tabId as RightRailTabId)
+}
+
 /** Tab title. A URL tab is titled by the CONTRIBUTION as the surface — see
  *  `BrowserTabLabel` for the live page name the strip actually renders — so
  *  navigating doesn't re-register the pane on every hop. A file names the
@@ -173,12 +196,19 @@ const PREVIEW_TILE_PREFIX = 'preview-tile'
 
 const previewPaneId = (tabId: string) => `${PREVIEW_TILE_PREFIX}:${tabId}`
 
-/** The pane a NEW preview tile should stack into: another preview tile already
- *  in the tree, else another open tab adopted earlier in the same pass (a
- *  reload restores every tab at once, before any of them is in the tree).
- *  `undefined` means this is the first preview — it opens its own zone. */
+/** The pane a NEW preview tile should stack into. When the working-directory
+ *  pane is present, it owns the shared Workspace-tools tab group: the tree and
+ *  every preview are tabs in one place. Layouts without a files pane retain
+ *  the old preview-only zone as a fallback. */
 function existingPreviewAnchor(tabId: string): string | undefined {
   const own = previewPaneId(tabId)
+
+  const tree = $layoutTree.get()
+
+  if (tree && findGroupOfPane(tree, FILES_PANE_ID)) {
+    return FILES_PANE_ID
+  }
+
   const inTree = treePanesWithPrefix(`${PREVIEW_TILE_PREFIX}:`).find(id => id !== own)
 
   if (inTree) {
@@ -251,13 +281,13 @@ const watchPreviewTileMirror = paneMirror<{ id: string }>({
   // `openPreview` ran and the click looked like a no-op.
   key: tab => tab.id,
   prefix: PREVIEW_TILE_PREFIX,
-  // The FIRST preview still opens its own zone docked beside main (identical
-  // to route tiles — NOT anchored to the file tree, so ⌘J can't take it
-  // along). Every SUBSEQUENT preview stacks into that zone as a center tab:
-  // without the anchor each opened file split a new zone off the right edge
-  // (#93610), turning three file opens into three ever-narrower columns.
+  // With a working-directory pane, the FIRST preview joins its tab group and
+  // every later preview stacks there too. Layouts without `files` retain the
+  // preview-only fallback zone; without an anchor each opened file would split
+  // a new zone off the right edge (#93610).
   dir: tab => (existingPreviewAnchor(tab.id) ? 'center' : 'right'),
   anchor: tab => existingPreviewAnchor(tab.id),
+  titlebar: 'content',
   minWidth: '22rem',
   title: previewTitle,
   tabLead: tabId => <PreviewTabLead tabId={tabId} />,
diff --git a/apps/desktop/src/app/chat/right-rail/office-preview.test.tsx b/apps/desktop/src/app/chat/right-rail/office-preview.test.tsx
new file mode 100644
index 0000000000..8ed3757eaa
--- /dev/null
+++ b/apps/desktop/src/app/chat/right-rail/office-preview.test.tsx
@@ -0,0 +1,101 @@
+import { cleanup, render, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// The real package ships a WASM parser and a render worker; both are pointless
+// here. The fakes record what the component asked of them.
+const state = vi.hoisted(() => ({
+  docx: [] as any[],
+  pptx: [] as any[],
+  loadError: null as Error | null
+}))
+
+vi.mock('@silurus/ooxml/docx', () => ({
+  DocxScrollViewer: class {
+    destroy = vi.fn()
+    load = vi.fn(() => (state.loadError ? Promise.reject(state.loadError) : Promise.resolve()))
+    options: unknown
+
+    constructor(_host: HTMLElement, options: unknown) {
+      this.options = options
+      state.docx.push(this)
+    }
+  }
+}))
+vi.mock('@silurus/ooxml/pptx', () => ({
+  PptxScrollViewer: class {
+    destroy = vi.fn()
+    load = vi.fn(() => (state.loadError ? Promise.reject(state.loadError) : Promise.resolve()))
+    options: unknown
+
+    constructor(_host: HTMLElement, options: unknown) {
+      this.options = options
+      state.pptx.push(this)
+    }
+  }
+}))
+
+import { OfficePreview } from './office-preview'
+
+const bytes = new Uint8Array([1, 2, 3]).buffer
+
+beforeEach(() => {
+  state.docx.length = 0
+  state.pptx.length = 0
+  state.loadError = null
+})
+
+afterEach(() => {
+  cleanup()
+})
+
+describe('OfficePreview', () => {
+  it('drives the docx viewer with the bytes it was handed', async () => {
+    const onError = vi.fn()
+
+    render(<OfficePreview bytes={bytes} format="docx" onError={onError} />)
+
+    await waitFor(() => expect(state.docx).toHaveLength(1))
+    expect(state.pptx).toHaveLength(0)
+    expect(state.docx[0].load).toHaveBeenCalledWith(bytes)
+    expect(state.docx[0].options).toMatchObject({ enableTextSelection: true, onError })
+    expect(onError).not.toHaveBeenCalled()
+  })
+
+  it('drives the pptx viewer with the bytes it was handed', async () => {
+    render(<OfficePreview bytes={bytes} format="pptx" onError={vi.fn()} />)
+
+    await waitFor(() => expect(state.pptx).toHaveLength(1))
+    expect(state.docx).toHaveLength(0)
+    expect(state.pptx[0].load).toHaveBeenCalledWith(bytes)
+  })
+
+  it('destroys the viewer on unmount', async () => {
+    const { unmount } = render(<OfficePreview bytes={bytes} format="docx" onError={vi.fn()} />)
+
+    await waitFor(() => expect(state.docx).toHaveLength(1))
+    unmount()
+    expect(state.docx[0].destroy).toHaveBeenCalled()
+  })
+
+  it('rebuilds the viewer when the bytes change, tearing the old one down', async () => {
+    const onError = vi.fn()
+    const { rerender } = render(<OfficePreview bytes={bytes} format="docx" onError={onError} />)
+
+    await waitFor(() => expect(state.docx).toHaveLength(1))
+    rerender(<OfficePreview bytes={new Uint8Array([9]).buffer} format="docx" onError={onError} />)
+
+    await waitFor(() => expect(state.docx).toHaveLength(2))
+    expect(state.docx[0].destroy).toHaveBeenCalled()
+  })
+
+  it('routes a rejected load to onError instead of leaving it unhandled', async () => {
+    state.loadError = new Error('bad zip')
+
+    const onError = vi.fn()
+
+    render(<OfficePreview bytes={bytes} format="docx" onError={onError} />)
+
+    await waitFor(() => expect(onError).toHaveBeenCalledTimes(1))
+    expect(onError.mock.calls[0][0].message).toBe('bad zip')
+  })
+})
diff --git a/apps/desktop/src/app/chat/right-rail/office-preview.tsx b/apps/desktop/src/app/chat/right-rail/office-preview.tsx
new file mode 100644
index 0000000000..690f5ce8a2
--- /dev/null
+++ b/apps/desktop/src/app/chat/right-rail/office-preview.tsx
@@ -0,0 +1,74 @@
+/** office-preview.tsx — read-only inline Word/PowerPoint rendering.
+ *
+ *  @silurus/ooxml draws a document into a caller-owned container via
+ *  Docx/PptxScrollViewer: construct, hand it the raw bytes, destroy on the way
+ *  out. Both formats share that shape, so one effect covers the pair.
+ *
+ *  The package is imported dynamically: it carries a WASM parser per format
+ *  (≈1.9 MB each) plus a render worker, none of which belong on the launch path.
+ */
+import { useEffect, useRef } from 'react'
+
+export type InlineOfficeFormat = 'docx' | 'pptx'
+
+export function OfficePreview({
+  bytes,
+  format,
+  onError
+}: {
+  bytes: ArrayBuffer
+  format: InlineOfficeFormat
+  onError: (error: Error) => void
+}) {
+  const hostRef = useRef<HTMLDivElement | null>(null)
+
+  useEffect(() => {
+    const host = hostRef.current
+
+    if (!host) {
+      return
+    }
+
+    let viewer: { destroy(): void } | null = null
+    let cancelled = false
+
+    void (async () => {
+      try {
+        const ScrollViewer =
+          format === 'docx'
+            ? (await import('@silurus/ooxml/docx')).DocxScrollViewer
+            : (await import('@silurus/ooxml/pptx')).PptxScrollViewer
+
+        if (cancelled) {
+          return
+        }
+
+        const instance = new ScrollViewer(host, { enableTextSelection: true, onError })
+
+        viewer = instance
+
+        // The import above awaits, so an unmount can land after the check and
+        // before the constructor. Re-check, and tear down what we just built.
+        if (cancelled) {
+          viewer = null
+          instance.destroy()
+
+          return
+        }
+
+        await instance.load(bytes)
+      } catch (error) {
+        if (!cancelled) {
+          onError(error instanceof Error ? error : new Error(String(error)))
+        }
+      }
+    })()
+
+    return () => {
+      cancelled = true
+      viewer?.destroy()
+    }
+  }, [bytes, format, onError])
+
+  return <div className="h-full w-full overflow-hidden" ref={hostRef} />
+}
diff --git a/apps/desktop/src/app/chat/right-rail/preview-file.test.tsx b/apps/desktop/src/app/chat/right-rail/preview-file.test.tsx
index 01564253c3..49c0d1cf59 100644
--- a/apps/desktop/src/app/chat/right-rail/preview-file.test.tsx
+++ b/apps/desktop/src/app/chat/right-rail/preview-file.test.tsx
@@ -1,9 +1,35 @@
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import type * as OfficeFiles from '@/lib/office-files'
+
 const { openFileWithSystemApp } = vi.hoisted(() => ({ openFileWithSystemApp: vi.fn() }))
 
-vi.mock('@/lib/office-files', () => ({ openFileWithSystemApp }))
+// Only the OS hand-off is stubbed: inlineOfficeFormat/bytesFromDataUrl stay real
+// so the extension routing under test is the shipping one.
+vi.mock('@/lib/office-files', async importOriginal => ({
+  ...(await importOriginal<typeof OfficeFiles>()),
+  openFileWithSystemApp
+}))
+
+const loadDocx = vi.hoisted(() => vi.fn(async () => {}))
+
+vi.mock('@silurus/ooxml/docx', () => ({
+  DocxScrollViewer: class {
+    destroy = vi.fn()
+    load = loadDocx
+
+    constructor(_host: HTMLElement, _options: unknown) {}
+  }
+}))
+vi.mock('@silurus/ooxml/pptx', () => ({
+  PptxScrollViewer: class {
+    destroy = vi.fn()
+    load = vi.fn(async () => {})
+
+    constructor(_host: HTMLElement, _options: unknown) {}
+  }
+}))
 
 import { LocalFilePreview, MarkdownPreview } from './preview-file'
 
@@ -60,13 +86,15 @@ const binaryTarget = {
   binary: true,
   byteSize: 8_000,
   kind: 'file' as const,
-  label: 'report.docx',
+  // Deliberately NOT an Office extension: .docx/.pptx now render inline, so a
+  // fixture named after one would never reach the refusal screen this exercises.
+  label: 'firmware.bin',
   language: 'text',
   large: false,
-  path: '/w/report.docx',
+  path: '/w/firmware.bin',
   previewKind: 'binary' as const,
-  source: '/w/report.docx',
-  url: 'file:///w/report.docx'
+  source: '/w/firmware.bin',
+  url: 'file:///w/firmware.bin'
 }
 
 describe('LocalFilePreview binary refusal', () => {
@@ -87,7 +115,7 @@ describe('LocalFilePreview binary refusal', () => {
     expect(screen.getByRole('button', { name: 'Preview anyway' })).not.toBeNull()
 
     fireEvent.click(primary)
-    expect(openFileWithSystemApp).toHaveBeenCalledWith('/w/report.docx')
+    expect(openFileWithSystemApp).toHaveBeenCalledWith('/w/firmware.bin')
   })
 
   it('keeps Preview anyway primary for merely large text files', () => {
@@ -102,3 +130,52 @@ describe('LocalFilePreview binary refusal', () => {
     expect(screen.queryByRole('button', { name: 'Open with system app' })).toBeNull()
   })
 })
+
+describe('LocalFilePreview inline Office', () => {
+  beforeEach(() => {
+    openFileWithSystemApp.mockReset().mockResolvedValue(true)
+    loadDocx.mockClear()
+    Object.defineProperty(window, 'hermesDesktop', {
+      configurable: true,
+      value: { readFileDataUrl: vi.fn(async () => 'data:application/octet-stream;base64,AQID') }
+    })
+  })
+
+  afterEach(() => {
+    cleanup()
+    Reflect.deleteProperty(window, 'hermesDesktop')
+  })
+
+  it('renders a .docx inline, past the refusal screen it used to hit', async () => {
+    render(
+      <LocalFilePreview
+        reloadKey={0}
+        target={{ ...binaryTarget, label: 'spec.docx', path: '/w/spec.docx', source: '/w/spec.docx' }}
+      />
+    )
+
+    await waitFor(() => expect(loadDocx).toHaveBeenCalled())
+    expect(screen.queryByText('This looks like a binary file')).toBeNull()
+    expect(screen.queryByRole('button', { name: 'Open with system app' })).toBeNull()
+  })
+
+  it('falls back to the system app when the bytes never arrive', async () => {
+    Object.defineProperty(window, 'hermesDesktop', {
+      configurable: true,
+      value: { readFileDataUrl: vi.fn(async () => Promise.reject(new Error('gateway unreachable'))) }
+    })
+
+    render(
+      <LocalFilePreview
+        reloadKey={0}
+        target={{ ...binaryTarget, label: 'spec.docx', path: '/w/spec.docx', source: '/w/spec.docx' }}
+      />
+    )
+
+    const primary = await screen.findByRole('button', { name: 'Open with system app' })
+
+    expect(loadDocx).not.toHaveBeenCalled()
+    fireEvent.click(primary)
+    expect(openFileWithSystemApp).toHaveBeenCalledWith('/w/spec.docx')
+  })
+})
diff --git a/apps/desktop/src/app/chat/right-rail/preview-file.tsx b/apps/desktop/src/app/chat/right-rail/preview-file.tsx
index 198935ad61..0722cb6fae 100644
--- a/apps/desktop/src/app/chat/right-rail/preview-file.tsx
+++ b/apps/desktop/src/app/chat/right-rail/preview-file.tsx
@@ -7,7 +7,7 @@ import type {
   MouseEvent as ReactMouseEvent,
   ReactNode
 } from 'react'
-import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { Fragment, Suspense, useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { Streamdown } from 'streamdown'
 
 import { requestComposerFocus, requestComposerInsertRefs } from '@/app/chat/composer/focus'
@@ -34,13 +34,16 @@ import { createMemoizedMathPlugin } from '@/lib/katex-memo'
 import { isComposerChord } from '@/lib/keybinds/chords'
 import { shikiLanguageForFilename } from '@/lib/markdown-code'
 import { normalizeFilePreviewMath } from '@/lib/markdown-preprocess'
-import { openFileWithSystemApp } from '@/lib/office-files'
+import { bytesFromDataUrl, inlineOfficeFormat, openFileWithSystemApp } from '@/lib/office-files'
 import { cn } from '@/lib/utils'
 import type { PreviewTarget } from '@/store/preview'
 import { setPreviewDirty } from '@/store/preview-edit'
 import { $connection, $currentCwd } from '@/store/session'
 import { notifyWorkspaceChanged } from '@/store/workspace-events'
 
+import { OfficePreview } from './office-preview'
+import { ImageFilePreview } from './preview-image'
+
 const SHIKI_THEME = { dark: 'github-dark-default', light: 'github-light-default' } as const
 const TEXT_PREVIEW_MAX_BYTES = 512 * 1024
 const SOURCE_CHUNK_LINES = 200
@@ -159,6 +162,8 @@ interface LocalPreviewState {
   error?: string
   language?: string
   loading: boolean
+  /** Raw bytes for the inline Word/PowerPoint viewer (see office-preview.tsx). */
+  officeBytes?: ArrayBuffer
   text?: string
   truncated?: boolean
 }
@@ -668,6 +673,12 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
   const [forcePreview, setForcePreview] = useState(false)
   const [pdfError, setPdfError] = useState<string>()
   const [pdfUrl, setPdfUrl] = useState<string>()
+  // Set when the Office viewer rejects the bytes — the pane then offers the
+  // system app, its only remaining route to the document.
+  const [officeFailed, setOfficeFailed] = useState(false)
+  // Stable identity matters: OfficePreview tears its viewer down and rebuilds it
+  // when this changes, and an inline arrow would change on every render.
+  const handleOfficeError = useCallback(() => setOfficeFailed(true), [])
   // User-picked view; null = auto (diff when changed, else rendered markdown,
   // else source). Reset when the previewed file changes.
   const [userMode, setUserMode] = useState<null | PreviewViewMode>(null)
@@ -694,6 +705,9 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
   const filePath = filePathForTarget(target)
   const isImage = target.previewKind === 'image'
   const isPdf = target.previewKind === 'pdf'
+  // Word/PowerPoint render inline by extension, not by previewKind: the main
+  // process sniffs them as binary, so there is no kind to branch on.
+  const officeFormat = inlineOfficeFormat(filePath)
 
   // eslint-disable-next-line no-restricted-syntax -- legitimate non-atom ref write (see eslint rule comment)
   useEffect(() => {
@@ -703,6 +717,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
     setSaving(false)
     setSaveError(null)
     setConflict(false)
+    setOfficeFailed(false)
     draftRef.current = ''
     baselineRef.current = ''
   }, [filePath, reloadKey])
@@ -712,7 +727,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
   // when the file is forcibly previewed past the binary refusal screen.
   const isText = target.previewKind === 'text' || target.previewKind === 'binary' || target.previewKind === 'html'
 
-  const blockedByTarget = !isImage && !isPdf && !forcePreview && (target.binary || target.large)
+  const blockedByTarget = !isImage && !isPdf && !officeFormat && !forcePreview && (target.binary || target.large)
 
   useEffect(() => {
     let active = true
@@ -724,7 +739,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
         return
       }
 
-      if (!isImage && !isPdf && !isText) {
+      if (!isImage && !isPdf && !isText && !officeFormat) {
         setState({ loading: false })
 
         return
@@ -733,13 +748,18 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
       setState({ loading: true })
 
       try {
-        if (isImage || isPdf) {
+        if (isImage || isPdf || officeFormat) {
           // Prefer bytes the caller already handed us (a pasted/dropped
           // screenshot) over re-reading a path that may be transient/unreadable.
           const dataUrl = target.dataUrl || (await readDesktopFileDataUrl(filePath))
 
           if (active) {
-            setState({ dataUrl, loading: false })
+            // The Office viewers take an ArrayBuffer; image/PDF keep the data URL.
+            setState(
+              officeFormat
+                ? { loading: false, officeBytes: bytesFromDataUrl(dataUrl).buffer }
+                : { dataUrl, loading: false }
+            )
           }
 
           return
@@ -777,10 +797,17 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
         }
       } catch (error) {
         if (active) {
-          setState({
-            error: error instanceof Error ? error.message : String(error),
-            loading: false
-          })
+          // An unreadable Office file is not worth a raw error string: it lands
+          // on the viewer's own state, which offers the system app instead.
+          setState(
+            officeFormat
+              ? { loading: false }
+              : { error: error instanceof Error ? error.message : String(error), loading: false }
+          )
+
+          if (officeFormat) {
+            setOfficeFailed(true)
+          }
         }
       }
     }
@@ -798,6 +825,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
     isImage,
     isPdf,
     isText,
+    officeFormat,
     reloadKey,
     selfReload,
     target.dataUrl,
@@ -1027,6 +1055,29 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
     return <PreviewEmptyState body={pdfError} title={t.preview.unavailable} />
   }
 
+  // Word/PowerPoint own their whole pane: the viewer scrolls its own pages, so
+  // it takes no part of the text/diff/refusal machinery below. Bytes that never
+  // arrive (unreadable, over the remote cap) and bytes the parser rejects land
+  // on the same state, whose only route out is the system app.
+  if (officeFormat) {
+    if (state.officeBytes && !officeFailed) {
+      return (
+        <Suspense fallback={<PageLoader label={t.preview.loading} />}>
+          <OfficePreview bytes={state.officeBytes} format={officeFormat} onError={handleOfficeError} />
+        </Suspense>
+      )
+    }
+
+    return (
+      <PreviewEmptyState
+        body={t.preview.officeFailed(target.label)}
+        primaryAction={{ label: t.preview.openWithSystemApp, onClick: () => void openFileWithSystemApp(filePath) }}
+        title={t.preview.unavailable}
+        tone="warning"
+      />
+    )
+  }
+
   if (
     !isImage &&
     !isPdf &&
@@ -1055,16 +1106,7 @@ export function LocalFilePreview({ reloadKey, target }: { reloadKey: number; tar
   }
 
   if (isImage && state.dataUrl) {
-    return (
-      <div className="flex h-full w-full items-center justify-center overflow-auto bg-transparent p-4">
-        <img
-          alt={target.label}
-          className="max-h-full max-w-full rounded-lg object-contain shadow-sm"
-          draggable={false}
-          src={state.dataUrl}
-        />
-      </div>
-    )
+    return <ImageFilePreview alt={target.label} src={state.dataUrl} />
   }
 
   if (isPdf && state.dataUrl && pdfUrl) {
diff --git a/apps/desktop/src/app/chat/right-rail/preview-image.tsx b/apps/desktop/src/app/chat/right-rail/preview-image.tsx
new file mode 100644
index 0000000000..a370b0ee16
--- /dev/null
+++ b/apps/desktop/src/app/chat/right-rail/preview-image.tsx
@@ -0,0 +1,22 @@
+import { useState } from 'react'
+
+import { ImageViewer } from '@/components/chat/image-viewer'
+import { ImageLightbox } from '@/components/chat/zoomable-image'
+import { useImageDownload } from '@/hooks/use-image-download'
+
+export interface ImageFilePreviewProps {
+  alt: string
+  src: string
+}
+
+export function ImageFilePreview({ alt, src }: ImageFilePreviewProps) {
+  const { download, saving } = useImageDownload(src)
+  const [open, setOpen] = useState(false)
+
+  return (
+    <>
+      <ImageViewer alt={alt} key={src} onDownload={download} onExpand={() => setOpen(true)} saving={saving} src={src} />
+      <ImageLightbox alt={alt} onClick={download} onOpenChange={setOpen} open={open} saving={saving} src={src} />
+    </>
+  )
+}
diff --git a/apps/desktop/src/app/chat/session-history-nav.tsx b/apps/desktop/src/app/chat/session-history-nav.tsx
new file mode 100644
index 0000000000..0d16a84aff
--- /dev/null
+++ b/apps/desktop/src/app/chat/session-history-nav.tsx
@@ -0,0 +1,45 @@
+import { useStore } from '@nanostores/react'
+import { useNavigate } from 'react-router'
+
+import { openSession } from '@/app/open-session'
+import { Codicon } from '@/components/ui/codicon'
+import { useI18n } from '@/i18n'
+import { $sessionHistoryFlags, navigateSessionHistory } from '@/store/session-history'
+
+/** Back/forward over the main pane's conversation history, rendered at the
+ *  left of the workspace zone's titlebar band (see `stripLead` in
+ *  track-model). The chat's own header band is suppressed inside zones, so
+ *  this is the only home that survives every layout. */
+export function SessionHistoryNav() {
+  const flags = useStore($sessionHistoryFlags)
+  const navigate = useNavigate()
+  const { t } = useI18n()
+
+  const go = (delta: number) => navigateSessionHistory(delta, id => openSession(id, navigate))
+
+  const buttonClass =
+    'grid size-5.5 place-items-center rounded-md text-(--ui-text-tertiary) hover:bg-(--ui-control-hover-background) hover:text-foreground disabled:pointer-events-none disabled:opacity-30'
+
+  return (
+    <div className="flex items-center gap-0.5 pr-1" data-slot="session-history-nav">
+      <button
+        aria-label={t.chatNav.back}
+        className={buttonClass}
+        disabled={!flags.canBack}
+        onClick={() => go(-1)}
+        type="button"
+      >
+        <Codicon name="chevron-left" size="0.875rem" />
+      </button>
+      <button
+        aria-label={t.chatNav.forward}
+        className={buttonClass}
+        disabled={!flags.canForward}
+        onClick={() => go(1)}
+        type="button"
+      >
+        <Codicon name="chevron-right" size="0.875rem" />
+      </button>
+    </div>
+  )
+}
diff --git a/apps/desktop/src/app/chat/session-tile.tsx b/apps/desktop/src/app/chat/session-tile.tsx
index 7a7822d64e..43fc829720 100644
--- a/apps/desktop/src/app/chat/session-tile.tsx
+++ b/apps/desktop/src/app/chat/session-tile.tsx
@@ -782,6 +782,7 @@ export const watchSessionTiles = paneMirror<SessionTile>({
   dir: t => t.dir,
   anchor: t => t.anchor,
   before: t => t.before,
+  headerSurface: 'chat',
   minWidth: '20rem',
   title: tileCaption,
   // The tab's status dot — the SAME primitive the sidebar row renders, keyed by
diff --git a/apps/desktop/src/app/chat/sidebar/chat-sidebar.integration.test.tsx b/apps/desktop/src/app/chat/sidebar/chat-sidebar.integration.test.tsx
index d83e4221df..9c0e76c203 100644
--- a/apps/desktop/src/app/chat/sidebar/chat-sidebar.integration.test.tsx
+++ b/apps/desktop/src/app/chat/sidebar/chat-sidebar.integration.test.tsx
@@ -9,10 +9,13 @@ import { SidebarProvider } from '@/components/ui/sidebar'
 import { registry } from '@/contrib/registry'
 import { $selectedStoredSessionId, $sessions } from '@/store/session'
 import { $removedSessionIds } from '@/store/session-removal'
+import { $desktopVersion } from '@/store/updates'
 import { makeSessionInfo } from '@/test/session-info'
 
 import { type AppView, ROUTES_AREA, SIDEBAR_NAV_AREA } from '../../routes'
 
+import { SidebarZoneLead } from './zone-tabs'
+
 import { ChatSidebar } from './index'
 
 const noop = () => {}
@@ -28,6 +31,8 @@ const renderSidebar = (pathname: string, currentView: AppView) =>
   render(
     <MemoryRouter initialEntries={[pathname]}>
       <SidebarProvider>
+        {/* The zone's lead, which the layout tree renders above this pane. */}
+        <SidebarZoneLead />
         <ChatSidebar
           currentView={currentView}
           onArchiveSession={noop}
@@ -162,3 +167,38 @@ describe('ChatSidebar navigation activity', () => {
     expectOnlySelectedSession(null)
   })
 })
+
+// The brand block lives in the zone's lead, above this pane — the sidebar's own
+// content starts at the nav rows, so the ordering assertion is the one that
+// would break if the lead were ever rendered inside the pane again.
+describe('ChatSidebar brand row', () => {
+  beforeEach(() => {
+    $desktopVersion.set({
+      appVersion: '9.9.9',
+      electronVersion: '0',
+      hermesRoot: '/tmp',
+      nodeVersion: '0',
+      platform: 'test'
+    })
+    $sessions.set([])
+    $selectedStoredSessionId.set(null)
+    $layoutTree.set(null)
+  })
+
+  afterEach(() => {
+    cleanup()
+    $desktopVersion.set(null)
+  })
+
+  it('shows the product name and version above the nav rows', () => {
+    renderSidebar('/', 'chat')
+
+    const brand = screen.getByText('DeepWork')
+
+    expect(screen.getByText('v9.9.9')).toBeTruthy()
+    // Above "New session": the nav row follows the brand row in the document.
+    expect(
+      brand.compareDocumentPosition(screen.getByText('New session')) & Node.DOCUMENT_POSITION_FOLLOWING
+    ).toBeTruthy()
+  })
+})
diff --git a/apps/desktop/src/app/chat/sidebar/filter-menu.tsx b/apps/desktop/src/app/chat/sidebar/filter-menu.tsx
index 657db9997d..e593ebec6f 100644
--- a/apps/desktop/src/app/chat/sidebar/filter-menu.tsx
+++ b/apps/desktop/src/app/chat/sidebar/filter-menu.tsx
@@ -59,7 +59,6 @@ import {
   requestProfileCreate,
   toggleShowAllProfiles
 } from '@/store/profile'
-import { $profileRailVisible, toggleProfileRailVisible } from '@/store/profile-rail-prefs'
 import { runImportProfileFlow } from '@/store/profile-share'
 import { $projectTree } from '@/store/projects'
 import type { PullRequestBucket } from '@/store/pull-requests'
@@ -158,7 +157,6 @@ export function SidebarFilterMenu({ className }: { className?: string }) {
   const ordering = useStore($sidebarOrdering)
   const rowMeta = useStore($sidebarRowMeta)
   const cardRows = useStore($sidebarCardRows)
-  const profileRailVisible = useStore($profileRailVisible)
   const showAllSessions = useStore($sidebarShowAllSessions)
   const statusFilter = useStore($sidebarStatusFilter)
   const projectFilter = useStore($sidebarProjectFilter)
@@ -308,15 +306,6 @@ export function SidebarFilterMenu({ className }: { className?: string }) {
             onCheck={() => setSidebarCardRows(!cardRows)}
             option={{ icon: 'inbox', id: 'card-rows', label: 'Inbox style' }}
           />
-
-          {/* The colored strip at the sidebar foot. Off, the statusbar grows a
-              profile dropdown beside the gateway switcher, so nobody loses the
-              door — this is for people whose profiles are bots, not workspaces. */}
-          <OptionCheckbox
-            checked={profileRailVisible}
-            onCheck={toggleProfileRailVisible}
-            option={{ icon: 'organization', id: 'profile-rail', label: t.sidebar.profileRail }}
-          />
         </DropdownMenuGroup>
 
         <DropdownMenuSeparator />
diff --git a/apps/desktop/src/app/chat/sidebar/index.tsx b/apps/desktop/src/app/chat/sidebar/index.tsx
index afe4b3b37f..67206c360a 100644
--- a/apps/desktop/src/app/chat/sidebar/index.tsx
+++ b/apps/desktop/src/app/chat/sidebar/index.tsx
@@ -5,7 +5,6 @@ import type * as React from 'react'
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { useLocation } from 'react-router'
 
-import { UserAccountCard } from '@/app/chat/sidebar/user-account-card'
 import { PlatformAvatar } from '@/app/messaging/platform-icon'
 import { Button } from '@/components/ui/button'
 import { Codicon } from '@/components/ui/codicon'
@@ -75,6 +74,7 @@ import {
 } from '@/store/layout'
 import { notifyError } from '@/store/notifications'
 import {
+  $activeGatewayProfile,
   $newChatProfile,
   $profiles,
   $profileScope,
@@ -83,7 +83,7 @@ import {
   normalizeProfileKey,
   sidebarProfileForScope
 } from '@/store/profile'
-import { $profileRailVisible } from '@/store/profile-rail-prefs'
+import { $pinnedProjectIdsByProfile, reorderPinnedProjects } from '@/store/project-pins'
 import {
   $activeProjectId,
   $newProjectDropPlacement,
@@ -153,7 +153,6 @@ import { useGatewaySessionGroups } from './gateway-group-model'
 import { SidebarLoadMoreRow } from './load-more-row'
 import { orderByIds, reconcileOrderIds, resolveManualSessionOrderIds, sameIds } from './order'
 import { filterSessionsByProfileScope } from './profile-scope'
-import { ProfileRail } from './profile-switcher'
 import { ProjectDialog } from './project-dialog'
 import { resolveLiveProjectFilter } from './project-filter'
 import {
@@ -161,6 +160,7 @@ import {
   orderProjectsByIds,
   overlayLiveLanes,
   overlayLivePreviews,
+  prioritizePinnedProjects,
   PROJECT_PREVIEW_COUNT,
   ProjectBackRow,
   ProjectMenu,
@@ -186,6 +186,8 @@ import { SidebarSessionsSection, VIRTUALIZE_THRESHOLD } from './sessions-section
 import { CONTEXT_SPLIT_KIT, SplitSubmenu } from './split-submenu'
 import { useEnteredProjectSessions } from './use-entered-project-sessions'
 
+const NO_PINNED_PROJECT_IDS: string[] = []
+
 // Non-session groups (messaging platforms) stay compact: show a few rows up
 // front, reveal more in larger steps on demand. Keeps a busy platform from
 // dominating the sidebar before the user asks to see it.
@@ -436,6 +438,9 @@ export function ChatSidebar({
   const workspaceOrderIds = useStore($sidebarWorkspaceOrderIds)
   const workspaceParentOrderIds = useStore($sidebarWorkspaceParentOrderIds)
   const projectOrderIds = useStore($sidebarProjectOrderIds)
+  const activeGatewayProfile = useStore($activeGatewayProfile)
+  const pinnedProjectsByProfile = useStore($pinnedProjectIdsByProfile)
+  const pinnedProjectIds = pinnedProjectsByProfile[normalizeProfileKey(activeGatewayProfile)] ?? NO_PINNED_PROJECT_IDS
   const projects = useStore($projects)
   const projectTree = useStore($projectTree)
 
@@ -499,7 +504,6 @@ export function ChatSidebar({
   }, [])
 
   const activeSidebarSessionId = currentView === 'chat' ? selectedSessionId : null
-  const profileRailVisible = useStore($profileRailVisible)
 
   const dndSensors = useSensors(
     useSensor(PointerSensor, { activationConstraint: { distance: 6 } }),
@@ -966,7 +970,7 @@ export function ChatSidebar({
     // Layer the user's manual drag-order on top of the deterministic sort. Empty
     // (default) returns `sorted` untouched; projects the user hasn't ordered yet
     // keep their sorted position rather than jumping the hand-picked list.
-    return orderProjectsByIds(sorted, projectOrderIds)
+    return prioritizePinnedProjects(orderProjectsByIds(sorted, projectOrderIds), pinnedProjectIds)
   }, [
     projectTree,
     dismissedAutoProjects,
@@ -974,6 +978,7 @@ export function ChatSidebar({
     activeProjectId,
     projectFilter,
     projectOrderIds,
+    pinnedProjectIds,
     isHiddenFromProjects,
     s
   ])
@@ -1446,7 +1451,10 @@ export function ChatSidebar({
 
   // Persist the new project overview order (drag-to-reorder); orderByIds applies
   // it over the default sort, so stale/new ids reconcile on the next render.
-  const reorderProjects = (ids: string[]) => setSidebarProjectOrderIds(ids)
+  const reorderProjects = (ids: string[]) => {
+    setSidebarProjectOrderIds(ids)
+    reorderPinnedProjects(activeGatewayProfile, ids)
+  }
 
   // Sortable rows carry live session ids; the pinned store is keyed by durable
   // (lineage-root) ids, so translate before persisting the new order.
@@ -1474,7 +1482,10 @@ export function ChatSidebar({
       data-tour="sessions-sidebar"
     >
       <SidebarContent className="gap-0 overflow-hidden bg-transparent px-2.5">
-        <SidebarGroup className="shrink-0 p-0 pb-2 pt-[calc(var(--titlebar-height)+0.375rem)]">
+        {/* No titlebar inset: the brand row and the zone's tabs are painted
+            above this pane now (see `zoneLead` in zone-tabs), so the old
+            `pt-[calc(var(--titlebar-height)+…)]` would space them twice. */}
+        <SidebarGroup className="shrink-0 p-0 pb-2">
           <SidebarGroupContent>
             <SidebarMenu className="gap-px">
               {[...SIDEBAR_NAV, ...contributedNav].map(item => {
@@ -1853,6 +1864,7 @@ export function ChatSidebar({
                 onToggleUnread={toggleUnread}
                 open={agentsOpen}
                 pinned={false}
+                pinnedProjectIds={pinnedProjectIds}
                 projectBackRow={
                   inProject ? <ProjectBackRow label={s.projects.back} onClick={exitProjectScope} /> : undefined
                 }
@@ -1932,19 +1944,6 @@ export function ChatSidebar({
         )}
 
         {!showSessionSections && <SidebarBlankState onNewProject={openProjectCreate} />}
-
-        {/* §21 用户卡：signed_in 才渲染，点击进 /me 资料页。 */}
-        <div className="shrink-0 px-0.5 pb-0.5">
-          <UserAccountCard />
-        </div>
-
-        {/* Off, the statusbar's profile dropdown (beside the gateway switcher)
-            takes over — the rail is a duplicate door for bot-only setups. */}
-        {profileRailVisible && (
-          <div className="shrink-0 px-0.5 pb-1 pt-0.5">
-            <ProfileRail />
-          </div>
-        )}
       </SidebarContent>
       <ProjectDialog />
       {/* One mount for the whole app. The header of WorktreeDialog tells why. */}
diff --git a/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.test.tsx b/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.test.tsx
index 89937fc0ae..695da63a31 100644
--- a/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.test.tsx
+++ b/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.test.tsx
@@ -1,90 +1,218 @@
-// @vitest-environment jsdom
-import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
-import { atom } from 'nanostores'
-import { afterEach, expect, it, vi } from 'vitest'
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { MemoryRouter, useLocation } from 'react-router'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
 
-import { $profileRailVisible } from '@/store/profile-rail-prefs'
+import { ProfileCreateHost } from '@/app/profiles/profile-create-host'
+import type * as ConnectionsStore from '@/store/connections'
+import { $connectionsRegistry, selectConnection } from '@/store/connections'
+import { $fleetRoster } from '@/store/fleet-roster'
+import type * as ProfileStore from '@/store/profile'
+import {
+  $activeGatewayProfile,
+  $profileCreateRequest,
+  $profileOrder,
+  $profiles,
+  $showAllProfiles,
+  requestProfileCreate,
+  selectProfile,
+  setShowAllProfiles
+} from '@/store/profile'
+import { runImportProfileFlow } from '@/store/profile-share'
+import { $connection } from '@/store/session'
+import { $userAccount } from '@/store/user-account'
+import { stubMenuDomApis } from '@/test/jsdom'
 
-import { ProfileSwitcher } from './profile-dropdown-switcher'
+import { UserAccountCard } from './user-account-card'
 
-// With the colored rail hidden, the statusbar's profile dropdown is the ONLY
-// door to switching profiles — it must list every profile of the active
-// gateway and select through the same store action the rail uses.
+vi.mock('@/store/profile', async importOriginal => ({
+  ...(await importOriginal<typeof ProfileStore>()),
+  selectProfile: vi.fn(),
+  setShowAllProfiles: vi.fn(),
+  refreshActiveProfile: vi.fn(async () => undefined)
+}))
+vi.mock('@/store/connections', async importOriginal => ({
+  ...(await importOriginal<typeof ConnectionsStore>()),
+  selectConnection: vi.fn(async () => undefined)
+}))
+vi.mock('@/store/profile-share', () => ({ runImportProfileFlow: vi.fn() }))
+vi.mock('./use-profile-prewarm', () => ({
+  useProfilePrewarm: () => ({ cancelPrewarm: vi.fn(), startPrewarm: vi.fn() })
+}))
 
-const selectProfile = vi.fn()
-const setShowAllProfiles = vi.fn()
-
-vi.mock('react-router', () => ({ useNavigate: () => vi.fn() }))
-
-vi.mock('@/i18n', () => ({
-  useI18n: () => ({
-    t: {
-      profiles: {
-        allProfiles: 'All profiles',
-        fleet: { onGateway: (name: string, gateway: string) => `${name} · ${gateway}` },
-        importProfile: 'Import profile…',
-        manageProfiles: 'Manage profiles…',
-        newProfile: 'New profile',
-        switchConnectionFailed: (name: string) => `Could not connect to ${name}`,
-        title: 'Profiles'
-      }
+beforeEach(() => {
+  stubMenuDomApis()
+  $userAccount.set({
+    status: 'signed_in',
+    site: 'https://account.example',
+    offline: false,
+    profileAsOf: null,
+    profile: {
+      email: 'owner@example.com',
+      username: '',
+      nickname: 'Owner',
+      phone: '',
+      planId: '',
+      periodEnd: '',
+      dataAsOf: ''
     }
   })
-}))
-
-vi.mock('@/store/profile', () => ({
-  $activeGatewayProfile: atom('default'),
-  $profileColors: atom({}),
-  $profileCreateRequest: atom(0),
-  $profileOrder: atom([]),
-  $profiles: atom([
-    { is_default: true, name: 'default' },
-    { is_default: false, name: 'clippy' }
-  ]),
-  $showAllProfiles: atom(false),
-  ALL_PROFILES: '__all__',
-  normalizeProfileKey: (name: string) => name,
-  profileLabel: (profile: { name: string }) => profile.name,
-  refreshActiveProfile: vi.fn().mockResolvedValue(undefined),
-  selectProfile: (name: string) => selectProfile(name),
-  setShowAllProfiles: (value: boolean) => setShowAllProfiles(value),
-  sortByProfileOrder: (profiles: Array<{ name: string }>) => profiles
-}))
-
-vi.mock('@/store/connections', () => ({
-  $activeConnectionId: atom<null | string>(null),
-  $connectionsRegistry: atom(null),
-  $hasMultipleConnections: atom(false),
-  selectConnection: vi.fn()
-}))
-
-vi.mock('@/store/profile-share', () => ({ runImportProfileFlow: vi.fn() }))
-vi.mock('./use-profile-prewarm', () => ({ useProfilePrewarm: () => ({ cancelPrewarm: vi.fn(), startPrewarm: vi.fn() }) }))
-vi.mock('./use-fleet-roster', () => ({ useFleetRoster: () => undefined }))
-vi.mock('../../profiles/create-profile-dialog', () => ({ CreateProfileDialog: () => null }))
+  $activeGatewayProfile.set('default')
+  $showAllProfiles.set(false)
+  $profileOrder.set(['work', 'clippy'])
+  $profiles.set(
+    ['default', 'clippy', 'work'].map(name => ({
+      name,
+      is_default: name === 'default',
+      path: `/tmp/${name}`,
+      has_env: false,
+      model: null,
+      provider: null,
+      skill_count: 0
+    }))
+  )
+  $connectionsRegistry.set(null)
+  $connection.set(null)
+  $fleetRoster.set(null)
+  $profileCreateRequest.set(0)
+})
 
 afterEach(() => {
   cleanup()
-  $profileRailVisible.set(true)
+  $userAccount.set({ status: 'unknown' })
+  $profiles.set([])
+  $profileOrder.set([])
+  $connectionsRegistry.set(null)
+  $connection.set(null)
+  $fleetRoster.set(null)
   vi.clearAllMocks()
 })
 
-it('switches profiles from the statusbar dropdown while the rail is hidden', async () => {
-  act(() => $profileRailVisible.set(false))
-  render(<ProfileSwitcher compact />)
+function Account({ compact = false }: { compact?: boolean }) {
+  const route = useLocation()
 
-  const trigger = screen.getByRole('button', { name: 'Profiles: default' })
-  await act(async () => {
-    fireEvent.pointerDown(trigger, { button: 0, ctrlKey: false, pointerType: 'mouse' })
-    await Promise.resolve()
+  return (
+    <>
+      <UserAccountCard compact={compact} />
+      <ProfileCreateHost />
+      <output data-testid="route">
+        {route.pathname}
+        {route.search}
+      </output>
+    </>
+  )
+}
+
+async function openProfiles() {
+  const account = screen.getByRole('button', { name: 'Account menu' })
+  await waitFor(() => expect(account.getAttribute('aria-expanded')).toBe('false'))
+  fireEvent.keyDown(account, { key: 'Enter' })
+  const profiles = await screen.findByRole('menuitem', { name: /^Profiles/ })
+  fireEvent.keyDown(profiles, { key: 'ArrowRight' })
+  await waitFor(() => expect(profiles.getAttribute('aria-expanded')).toBe('true'))
+  await screen.findByRole('menuitemradio', { name: 'default' })
+}
+
+it('preserves ordered checked profiles, the all-profiles filter, management and gateway-scoped switching in both sidebar widths', async () => {
+  const view = render(
+    <MemoryRouter>
+      <Account />
+    </MemoryRouter>
+  )
+
+  await openProfiles()
+  const items = screen.getAllByRole('menuitemradio')
+
+  expect(items[0]).toBe(screen.getByRole('menuitemradio', { name: 'default' }))
+  const namedIndices = $profileOrder.get().map(name => items.indexOf(screen.getByRole('menuitemradio', { name })))
+
+  expect(namedIndices).toEqual([...namedIndices].sort((a, b) => a - b))
+  expect(screen.getByRole('menuitemradio', { name: 'default' }).getAttribute('aria-checked')).toBe('true')
+  fireEvent.click(screen.getByRole('menuitemradio', { name: 'work' }))
+  expect(selectProfile).toHaveBeenCalledWith('work')
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitemradio', { name: 'All profiles' }))
+  expect(setShowAllProfiles).toHaveBeenCalledWith(true)
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Import profile…' }))
+  expect(runImportProfileFlow).toHaveBeenCalledOnce()
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Manage profiles…' }))
+  expect(screen.getByTestId('route').textContent).toBe('/profiles')
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Manage gateways…' }))
+  expect(screen.getByTestId('route').textContent).toBe('/settings?tab=gateway')
+
+  act(() => {
+    $connection.set({
+      connectionId: 'local',
+      mode: 'local',
+      baseUrl: 'http://127.0.0.1:43100',
+      wsUrl: 'ws://127.0.0.1:43100/ws',
+      isFullscreen: false,
+      nativeOverlayWidth: 0,
+      token: '',
+      logs: [],
+      windowButtonPosition: null
+    })
+    $connectionsRegistry.set({
+      version: 2,
+      primary: 'local',
+      lastUsed: 'local',
+      launchMode: 'primary',
+      secureTokenStorage: true,
+      connections: [
+        { id: 'local', kind: 'local', label: 'This device', tokenSet: false, tokenPreview: '' },
+        {
+          id: 'remote',
+          kind: 'remote',
+          label: 'Remote gateway',
+          url: 'https://remote.example',
+          tokenSet: false,
+          tokenPreview: ''
+        }
+      ]
+    })
+    $fleetRoster.set({
+      sources: [{ connectionId: 'remote', kind: 'remote', label: 'Remote gateway', reachable: false }],
+      agents: [
+        {
+          connectionId: 'remote',
+          connectionKind: 'remote',
+          connectionLabel: 'Remote gateway',
+          profile: 'builder',
+          handle: 'builder-remote'
+        }
+      ]
+    })
   })
-
-  const clippy = await screen.findByRole('menuitemradio', { name: /clippy/ })
-  await act(async () => {
-    fireEvent.click(clippy)
-    await Promise.resolve()
-  })
-
-  expect(selectProfile).toHaveBeenCalledWith('clippy')
-  expect(setShowAllProfiles).not.toHaveBeenCalled()
+  view.rerender(
+    <MemoryRouter>
+      <Account compact />
+    </MemoryRouter>
+  )
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitem', { name: /builder.*Remote gateway/ }))
+  await waitFor(() => expect(selectConnection).toHaveBeenCalledWith('remote', { profile: 'builder' }))
+  expect(selectProfile).not.toHaveBeenCalledWith('builder')
+})
+
+it('keeps the shared create dialog alive after the submenu closes and answers the hotkey exactly once', async () => {
+  render(
+    <MemoryRouter>
+      <Account compact />
+    </MemoryRouter>
+  )
+  await openProfiles()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'New profile' }))
+  await screen.findByLabelText(/SOUL\.md/i)
+  expect(screen.queryByRole('menuitemradio')).toBeNull()
+  fireEvent.change(screen.getByLabelText('Name'), { target: { value: 'new-agent' } })
+  act(() => requestProfileCreate())
+  expect(screen.getAllByRole('dialog')).toHaveLength(1)
+  expect((screen.getByLabelText('Name') as HTMLInputElement).value).toBe('new-agent')
+  fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+  act(() => requestProfileCreate())
+  await screen.findByLabelText(/SOUL\.md/i)
+  expect(screen.getAllByRole('dialog')).toHaveLength(1)
 })
diff --git a/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.tsx b/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.tsx
index 85caf0063f..b8d8375fec 100644
--- a/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.tsx
+++ b/apps/desktop/src/app/chat/sidebar/profile-dropdown-switcher.tsx
@@ -1,19 +1,18 @@
 import { useStore } from '@nanostores/react'
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useMemo, useState } from 'react'
 import { useNavigate } from 'react-router'
 
-import { Button } from '@/components/ui/button'
 import { Codicon } from '@/components/ui/codicon'
 import {
-  DropdownMenu,
-  DropdownMenuContent,
   DropdownMenuItem,
   DropdownMenuLabel,
   DropdownMenuRadioGroup,
   DropdownMenuRadioItem,
   dropdownMenuSectionLabel,
   DropdownMenuSeparator,
-  DropdownMenuTrigger
+  DropdownMenuSub,
+  DropdownMenuSubContent,
+  DropdownMenuSubTrigger
 } from '@/components/ui/dropdown-menu'
 import { ProfileGlyph } from '@/components/ui/profile-glyph'
 import { useI18n } from '@/i18n'
@@ -21,44 +20,42 @@ import { triggerHaptic } from '@/lib/haptics'
 import { Loader2 } from '@/lib/icons'
 import { resolveProfileColor } from '@/lib/profile-color'
 import { cn } from '@/lib/utils'
-import { $activeConnectionId, $connectionsRegistry, $hasMultipleConnections, selectConnection } from '@/store/connections'
+import {
+  $activeConnectionId,
+  $connectionsRegistry,
+  $hasMultipleConnections,
+  selectConnection
+} from '@/store/connections'
 import { $fleetRoster } from '@/store/fleet-roster'
 import { notifyError } from '@/store/notifications'
 import {
   $activeGatewayProfile,
   $profileColors,
-  $profileCreateRequest,
   $profileOrder,
   $profiles,
   $showAllProfiles,
   ALL_PROFILES,
   normalizeProfileKey,
   profileLabel,
-  refreshActiveProfile,
+  requestProfileCreate,
   selectProfile,
   setShowAllProfiles,
   sortByProfileOrder
 } from '@/store/profile'
 import { runImportProfileFlow } from '@/store/profile-share'
 
-import { CreateProfileDialog } from '../../profiles/create-profile-dialog'
-import { PROFILES_ROUTE } from '../../routes'
+import { PROFILES_ROUTE, SETTINGS_ROUTE } from '../../routes'
 
 import { ConnectionGlyph } from './connection-glyph'
 import { buildRestGroups, type FleetAgent, fleetRouteKey } from './fleet-rail'
-import { useFleetRoster } from './use-fleet-roster'
 import { useProfilePrewarm } from './use-profile-prewarm'
 
 /**
- * The profile picker that sits beside the gateway switcher in the statusbar
- * while the colored rail is hidden — the same choices the rail offers (this
- * gateway's profiles, every other gateway's agents in fleet mode, new / import
- * / manage) in a dropdown that reads like its neighbour. The rail keeps the
- * gestures that need squares (drag-order, hold-to-recolor); this is the
- * plain-dropdown door for people who run profiles as bots and don't want a
- * strip of them.
+ * Account-menu profile picker. Dialogs and refresh listeners belong to the
+ * standing shell host, so selecting New can close this menu without losing
+ * its dialog. Square gestures remain in Manage Profiles.
  */
-export function ProfileSwitcher({ compact = false }: { compact?: boolean }) {
+export function ProfileSubmenu() {
   const { t } = useI18n()
   const p = t.profiles
   const navigate = useNavigate()
@@ -71,26 +68,8 @@ export function ProfileSwitcher({ compact = false }: { compact?: boolean }) {
   const registry = useStore($connectionsRegistry)
   const activeConnectionId = useStore($activeConnectionId)
   const roster = useStore($fleetRoster)
-  const [createOpen, setCreateOpen] = useState(false)
   const [pendingRoute, setPendingRoute] = useState<null | string>(null)
 
-  useFleetRoster(multipleConnections)
-
-  // The `profile.create` hotkey bumps this request atom; the rail answers it
-  // while mounted, so with the rail hidden this picker owns the dialog instead.
-  const createRequest = useStore($profileCreateRequest)
-  const lastCreateRef = useRef(createRequest)
-
-  // eslint-disable-next-line no-restricted-syntax -- legitimate non-atom ref write (see eslint rule comment)
-  useEffect(() => {
-    if (createRequest === lastCreateRef.current) {
-      return
-    }
-
-    lastCreateRef.current = createRequest
-    setCreateOpen(true)
-  }, [createRequest])
-
   const connections = registry?.connections
 
   const restGroups = useMemo(
@@ -134,120 +113,93 @@ export function ProfileSwitcher({ compact = false }: { compact?: boolean }) {
   const triggerLabel = showAll ? p.allProfiles : active ? profileLabel(active) : p.title
 
   return (
-    <div
-      aria-busy={pendingRoute !== null}
-      aria-label={p.title}
-      className={cn('min-w-16 shrink overflow-hidden', compact ? 'h-full max-w-40' : 'max-w-72')}
-      data-slot="profile-switcher"
-      role="group"
-    >
-      <DropdownMenu>
-        <DropdownMenuTrigger asChild>
-          <Button
-            aria-label={`${p.title}: ${triggerLabel}`}
-            className={cn(
-              'w-full min-w-0 justify-between overflow-hidden px-1 text-(--ui-text-secondary) data-[state=open]:bg-(--ui-control-active-background) data-[state=open]:text-foreground',
-              compact && 'h-full min-h-0 rounded-none px-1.5 text-[0.6875rem] font-normal'
-            )}
-            size="xs"
-            type="button"
-            variant="ghost"
-          >
-            <span className="flex min-w-0 flex-1 items-center gap-1 overflow-hidden">
-              {pendingRoute !== null ? (
-                <Loader2 aria-hidden="true" className="size-3 shrink-0 animate-spin" />
-              ) : showAll || !active ? (
-                <Codicon aria-hidden="true" className="shrink-0" name="layers" size="0.75rem" />
-              ) : (
-                <ProfileGlyph
-                  aria-hidden="true"
-                  className="size-3 text-[0.4375rem]"
-                  color={resolveProfileColor(active.name, colors)}
-                  isDefault={active.is_default}
-                  name={active.name}
-                />
-              )}
-              <span className="truncate">{triggerLabel}</span>
-            </span>
-            <Codicon aria-hidden="true" className="shrink-0 opacity-60" name="chevron-down" size="0.875rem" />
-          </Button>
-        </DropdownMenuTrigger>
-        <DropdownMenuContent align="start" className="min-w-48 max-w-72" collisionPadding={8} side="top">
-          <DropdownMenuRadioGroup onValueChange={choose} value={value}>
-            {ordered.map(profile => (
-              <ProfileItem
-                color={resolveProfileColor(profile.name, colors)}
-                isDefault={profile.is_default}
-                key={profile.name}
-                label={profileLabel(profile)}
-                name={profile.name}
-              />
-            ))}
-            {/* Nothing to widen to with one profile: the ALL view only exists
-                once a second profile does (the rail hides its toggle then too). */}
-            {profiles.length > 1 && (
-              <DropdownMenuRadioItem className="min-w-0" value={ALL_PROFILES}>
-                <span className="flex min-w-0 items-center gap-1.5">
-                  <Codicon aria-hidden="true" className="text-(--ui-text-tertiary)" name="layers" size="0.875rem" />
-                  <span className="truncate">{p.allProfiles}</span>
-                </span>
-              </DropdownMenuRadioItem>
-            )}
-          </DropdownMenuRadioGroup>
-          {restGroups.map(group => (
-            <div data-connection-id={group.connectionId} data-slot="profile-switcher-gateway" key={group.connectionId}>
-              <DropdownMenuSeparator />
-              <DropdownMenuLabel className={cn(dropdownMenuSectionLabel, 'flex items-center gap-1.5')}>
-                <ConnectionGlyph connection={group} />
-                <span className="truncate">{group.label}</span>
-                {!group.reachable && <span aria-hidden="true" className="size-1.5 shrink-0 rounded-full bg-amber-500" />}
-              </DropdownMenuLabel>
-              {[group.defaultAgent, ...group.named].map(agent => (
-                <DropdownMenuItem
-                  aria-label={p.fleet.onGateway(agent.profile, group.label)}
-                  className="min-w-0"
-                  key={agent.profile}
-                  onSelect={() => switchToRest(agent)}
-                >
-                  <span className="flex min-w-0 items-center gap-1.5">
-                    <ProfileGlyph
-                      aria-hidden="true"
-                      color={resolveProfileColor(agent.profile, colors)}
-                      isDefault={agent.isDefault}
-                      name={agent.profile}
-                    />
-                    <span className="truncate">{agent.profile}</span>
-                  </span>
-                </DropdownMenuItem>
-              ))}
-            </div>
+    <DropdownMenuSub>
+      <DropdownMenuSubTrigger
+        aria-busy={pendingRoute !== null}
+        aria-label={showAll || active ? `${p.title}: ${triggerLabel}` : p.title}
+        className="min-w-0"
+        data-slot="account-profiles"
+      >
+        {pendingRoute !== null ? (
+          <Loader2 aria-hidden="true" className="size-3.5 animate-spin" />
+        ) : (
+          <Codicon aria-hidden="true" name="organization" size="0.875rem" />
+        )}
+        <span className="min-w-0 flex-1 truncate">{p.title}</span>
+        {(showAll || active) && <span className="max-w-24 truncate text-(--ui-text-tertiary)">{triggerLabel}</span>}
+      </DropdownMenuSubTrigger>
+      <DropdownMenuSubContent
+        className="w-56 min-w-0 max-w-(--radix-popper-available-width) max-h-[min(70vh,30rem)] overflow-y-auto"
+        collisionPadding={8}
+      >
+        <DropdownMenuRadioGroup onValueChange={choose} value={value}>
+          {ordered.map(profile => (
+            <ProfileItem
+              color={resolveProfileColor(profile.name, colors)}
+              isDefault={profile.is_default}
+              key={profile.name}
+              label={profileLabel(profile)}
+              name={profile.name}
+            />
           ))}
-          <DropdownMenuSeparator />
-          <DropdownMenuItem onSelect={() => setCreateOpen(true)}>
-            <Codicon aria-hidden="true" name="add" size="0.875rem" />
-            <span className="truncate">{p.newProfile}</span>
-          </DropdownMenuItem>
-          <DropdownMenuItem onSelect={() => void runImportProfileFlow()}>
-            <Codicon aria-hidden="true" name="cloud-download" size="0.875rem" />
-            <span className="truncate">{p.importProfile}</span>
-          </DropdownMenuItem>
-          <DropdownMenuItem onSelect={() => navigate(PROFILES_ROUTE)}>
-            <Codicon aria-hidden="true" name="settings-gear" size="0.875rem" />
-            <span className="truncate">{p.manageProfiles}</span>
-          </DropdownMenuItem>
-        </DropdownMenuContent>
-      </DropdownMenu>
-
-      <CreateProfileDialog
-        onClose={() => setCreateOpen(false)}
-        onCreated={async name => {
-          await refreshActiveProfile()
-          selectProfile(name)
-        }}
-        open={createOpen}
-        profiles={profiles}
-      />
-    </div>
+          {/* Nothing to widen to with one profile: the ALL view only exists
+                once a second profile does (the rail hides its toggle then too). */}
+          {profiles.length > 1 && (
+            <DropdownMenuRadioItem className="min-w-0" value={ALL_PROFILES}>
+              <span className="flex min-w-0 items-center gap-1.5">
+                <Codicon aria-hidden="true" className="text-(--ui-text-tertiary)" name="layers" size="0.875rem" />
+                <span className="truncate">{p.allProfiles}</span>
+              </span>
+            </DropdownMenuRadioItem>
+          )}
+        </DropdownMenuRadioGroup>
+        {restGroups.map(group => (
+          <div data-connection-id={group.connectionId} data-slot="profile-switcher-gateway" key={group.connectionId}>
+            <DropdownMenuSeparator />
+            <DropdownMenuLabel className={cn(dropdownMenuSectionLabel, 'flex items-center gap-1.5')}>
+              <ConnectionGlyph connection={group} />
+              <span className="truncate">{group.label}</span>
+              {!group.reachable && <span aria-hidden="true" className="size-1.5 shrink-0 rounded-full bg-amber-500" />}
+            </DropdownMenuLabel>
+            {[group.defaultAgent, ...group.named].map(agent => (
+              <DropdownMenuItem
+                aria-label={p.fleet.onGateway(agent.profile, group.label)}
+                className="min-w-0"
+                key={agent.profile}
+                onSelect={() => switchToRest(agent)}
+              >
+                <span className="flex min-w-0 items-center gap-1.5">
+                  <ProfileGlyph
+                    aria-hidden="true"
+                    color={resolveProfileColor(agent.profile, colors)}
+                    isDefault={agent.isDefault}
+                    name={agent.profile}
+                  />
+                  <span className="truncate">{agent.profile}</span>
+                </span>
+              </DropdownMenuItem>
+            ))}
+          </div>
+        ))}
+        <DropdownMenuSeparator />
+        <DropdownMenuItem onSelect={requestProfileCreate}>
+          <Codicon aria-hidden="true" name="add" size="0.875rem" />
+          <span className="truncate">{p.newProfile}</span>
+        </DropdownMenuItem>
+        <DropdownMenuItem onSelect={() => void runImportProfileFlow()}>
+          <Codicon aria-hidden="true" name="cloud-download" size="0.875rem" />
+          <span className="truncate">{p.importProfile}</span>
+        </DropdownMenuItem>
+        <DropdownMenuItem onSelect={() => navigate(PROFILES_ROUTE)}>
+          <Codicon aria-hidden="true" name="settings-gear" size="0.875rem" />
+          <span className="truncate">{p.manageProfiles}</span>
+        </DropdownMenuItem>
+        <DropdownMenuItem onSelect={() => navigate(`${SETTINGS_ROUTE}?tab=gateway`)}>
+          <Codicon aria-hidden="true" name="plug" size="0.875rem" />
+          <span className="truncate">{p.connectGateway}</span>
+        </DropdownMenuItem>
+      </DropdownMenuSubContent>
+    </DropdownMenuSub>
   )
 }
 
@@ -265,7 +217,12 @@ function ProfileItem({
   const { cancelPrewarm, startPrewarm } = useProfilePrewarm(name)
 
   return (
-    <DropdownMenuRadioItem className="min-w-0" onPointerEnter={startPrewarm} onPointerLeave={cancelPrewarm} value={name}>
+    <DropdownMenuRadioItem
+      className="min-w-0"
+      onPointerEnter={startPrewarm}
+      onPointerLeave={cancelPrewarm}
+      value={name}
+    >
       <span className="flex min-w-0 items-center gap-1.5">
         <ProfileGlyph aria-hidden="true" color={color} isDefault={isDefault} name={name} />
         <span className="truncate">{label}</span>
diff --git a/apps/desktop/src/app/chat/sidebar/profile-rail-connect.test.tsx b/apps/desktop/src/app/chat/sidebar/profile-rail-connect.test.tsx
index dc008fac1b..2272a24c34 100644
--- a/apps/desktop/src/app/chat/sidebar/profile-rail-connect.test.tsx
+++ b/apps/desktop/src/app/chat/sidebar/profile-rail-connect.test.tsx
@@ -1,4 +1,4 @@
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { atom } from 'nanostores'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
@@ -10,6 +10,7 @@ import { ProfileRail } from './profile-switcher'
 // gap reported against the multi-connection registry launch).
 
 const navigate = vi.fn()
+const { createDialog } = vi.hoisted(() => ({ createDialog: vi.fn(() => null) }))
 
 vi.mock('react-router', () => ({
   useNavigate: () => navigate
@@ -83,19 +84,22 @@ vi.mock('@/hermes', () => ({
 }))
 
 vi.mock('@/components/chat/code-editor', () => ({ CodeEditor: () => null }))
-vi.mock('../../profiles/create-profile-dialog', () => ({ CreateProfileDialog: () => null }))
+vi.mock('../../profiles/create-profile-dialog', () => ({ CreateProfileDialog: createDialog }))
 vi.mock('../../profiles/delete-profile-dialog', () => ({ DeleteProfileDialog: () => null }))
 vi.mock('../../profiles/rename-profile-dialog', () => ({ RenameProfileDialog: () => null }))
 
 const { $hasMultipleConnections } = await import('@/store/connections')
 const hasMultipleConnections = $hasMultipleConnections as ReturnType<typeof atom<boolean>>
-const { $profiles } = await import('@/store/profile')
+const { $profileCreateRequest, $profiles } = await import('@/store/profile')
+const createRequest = $profileCreateRequest as ReturnType<typeof atom<number>>
 const profiles = $profiles as ReturnType<typeof atom<Array<{ is_default: boolean; name: string }>>>
 
 afterEach(() => {
   cleanup()
   hasMultipleConnections.set(false)
   profiles.set([{ is_default: true, name: 'default' }])
+  createRequest.set(0)
+  vi.clearAllMocks()
 })
 
 describe('ProfileRail multi-gateway entry point', () => {
@@ -157,4 +161,16 @@ describe('ProfileRail multi-gateway entry point', () => {
     expect(screen.getByRole('group', { name: 'Profiles' }).className).toContain('min-w-0')
     expect(screen.getByRole('button', { name: 'Profiles' })).toBeTruthy()
   })
+
+  it('keeps management commands but leaves the shared create shortcut to the shell host', () => {
+    render(<ProfileRail management />)
+
+    expect(screen.getByRole('button', { name: 'default' })).toBeTruthy()
+    expect(screen.getByRole('button', { name: 'Import profile…' })).toBeTruthy()
+    expect(screen.queryByRole('button', { name: 'Manage profiles…' })).toBeNull()
+    act(() => createRequest.set(createRequest.get() + 1))
+    expect(createDialog).toHaveBeenLastCalledWith(expect.objectContaining({ open: false }), undefined)
+    fireEvent.click(screen.getByRole('button', { name: 'New profile' }))
+    expect(createDialog).toHaveBeenLastCalledWith(expect.objectContaining({ open: true }), undefined)
+  })
 })
diff --git a/apps/desktop/src/app/chat/sidebar/profile-switcher.tsx b/apps/desktop/src/app/chat/sidebar/profile-switcher.tsx
index d4ef9bbf20..e876b65619 100644
--- a/apps/desktop/src/app/chat/sidebar/profile-switcher.tsx
+++ b/apps/desktop/src/app/chat/sidebar/profile-switcher.tsx
@@ -145,7 +145,11 @@ const stepThroughCells: Modifier = ({ containerNodeRect, draggingNodeRect, trans
 // (gateway, profile); the workspace still lives on one gateway at a time, only
 // the picker spans the fleet. Groups keep registry order regardless of which
 // one is active, so a square never moves under the pointer that clicked it.
-export function ProfileRail() {
+export interface ProfileRailProps {
+  management?: boolean
+}
+
+export function ProfileRail({ management = false }: ProfileRailProps) {
   const { t } = useI18n()
   const p = t.profiles
   const profiles = useStore($profiles)
@@ -341,13 +345,13 @@ export function ProfileRail() {
 
   // eslint-disable-next-line no-restricted-syntax -- legitimate non-atom ref write (see eslint rule comment)
   useEffect(() => {
-    if (createRequest === lastCreateRef.current) {
+    if (management || createRequest === lastCreateRef.current) {
       return
     }
 
     lastCreateRef.current = createRequest
     setCreateOpen(true)
-  }, [createRequest])
+  }, [createRequest, management])
 
   // The sortable strip of the active gateway's named profiles (unchanged
   // from the single-gateway rail; fleet mode only decides where it sits).
@@ -402,7 +406,7 @@ export function ProfileRail() {
       className="flex min-w-0 items-center gap-0.5"
       data-slot="profile-rail"
       data-tip-region=""
-      data-tour="profile-rail"
+      data-tour={management ? undefined : 'profile-rail'}
       role="group"
     >
       {/* Fleet: every gateway carries its own home square inside its group, so
@@ -523,7 +527,7 @@ export function ProfileRail() {
           overlay is the only place to edit a profile's SOUL.md, and a
           single-profile user must be able to edit the default's persona
           without first creating a throwaway second profile. */}
-      <ProfilePill active={false} glyph="ellipsis" label={p.manageProfiles} onSelect={() => navigate(PROFILES_ROUTE)} />
+      {!management && <ProfilePill active={false} glyph="ellipsis" label={p.manageProfiles} onSelect={() => navigate(PROFILES_ROUTE)} />}
 
       {/* Multi-gateway discoverability: before a second source exists, a plug
           pinned beside Manage deep-links to the unified Gateways page. Once
diff --git a/apps/desktop/src/app/chat/sidebar/projects/entered-content.tsx b/apps/desktop/src/app/chat/sidebar/projects/entered-content.tsx
index ad970ec0dd..051bb87b4e 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/entered-content.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/entered-content.tsx
@@ -18,6 +18,7 @@ import { SidebarRowStack } from '../chrome'
 import { useWorkspaceNodeOpen } from './model'
 import { SidebarWorkspaceGroup } from './workspace-group'
 import {
+  groupContainsSession,
   mergeRepoWorktreeGroups,
   overlayRepoLanes,
   type SidebarProjectTree,
@@ -32,6 +33,7 @@ import { WorkspaceAddButton, WorkspaceHeader } from './workspace-header'
 // headers so the folders stay distinguishable.
 export function EnteredProjectContent({
   project,
+  activeSessionId,
   renderRows,
   onNewSession,
   onNewSessionSplit,
@@ -40,6 +42,7 @@ export function EnteredProjectContent({
   removedSessionIds
 }: {
   project: SidebarProjectTree
+  activeSessionId?: null | string
   renderRows: (sessions: SessionInfo[]) => React.ReactNode
   onNewSession?: (path: null | string) => void
   onNewSessionSplit?: NewSessionSplitHandler
@@ -63,6 +66,7 @@ export function EnteredProjectContent({
     <>
       {project.repos.map(repo => (
         <RepoFlatSection
+          activeSessionId={activeSessionId}
           discoveredWorktrees={repo.path ? repoWorktrees?.[repo.path] : undefined}
           key={repo.id}
           liveSessions={liveSessions}
@@ -80,6 +84,7 @@ export function EnteredProjectContent({
 
 function RepoFlatSection({
   repo,
+  activeSessionId,
   showHeader,
   renderRows,
   onNewSession,
@@ -89,6 +94,7 @@ function RepoFlatSection({
   removedSessionIds
 }: {
   repo: SidebarWorkspaceTree
+  activeSessionId?: null | string
   showHeader: boolean
   renderRows: (sessions: SessionInfo[]) => React.ReactNode
   onNewSession?: (path: null | string) => void
@@ -139,6 +145,7 @@ function RepoFlatSection({
       !dismissedWorktrees.includes(group.id) ||
       (removedWorktrees.includes(group.id) && group.path && discoveredWorktreePaths.has(group.path))
   )
+  const activeRepo = Boolean(activeSessionId && ordered.some(group => groupContainsSession(group, activeSessionId)))
 
   // Removal asks how: actually `git worktree remove` it, or just hide the lane
   // and leave the worktree on disk. A dirty worktree escalates to a force prompt
@@ -169,6 +176,7 @@ function RepoFlatSection({
     <>
       {ordered.map(group => (
         <SidebarWorkspaceGroup
+          activeSessionId={activeSessionId}
           group={group}
           key={group.id}
           // The kanban bucket is read-only: it aggregates many task worktrees, so
@@ -275,6 +283,7 @@ function RepoFlatSection({
             />
           )
         }
+        active={activeRepo}
         emphasis
         icon={<Codicon className="shrink-0 text-(--ui-text-tertiary)" name="repo" size="0.75rem" />}
         label={repo.label}
diff --git a/apps/desktop/src/app/chat/sidebar/projects/index.ts b/apps/desktop/src/app/chat/sidebar/projects/index.ts
index 501ba79cd9..6465bf2b07 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/index.ts
+++ b/apps/desktop/src/app/chat/sidebar/projects/index.ts
@@ -2,6 +2,7 @@
 export { EnteredProjectContent } from './entered-content'
 export {
   orderProjectsByIds,
+  prioritizePinnedProjects,
   PROJECT_PREVIEW_COUNT,
   projectTreeCwd,
   sortProjectsForOverview,
@@ -12,9 +13,11 @@ export { ProjectMenu } from './project-menu'
 export { SidebarWorkspaceGroup } from './workspace-group'
 export {
   excludeProjectSessions,
+  groupContainsSession,
   liveSessionProjectId,
   overlayLiveLanes,
   overlayLivePreviews,
+  projectContainsSession,
   reconcileEnteredProjectSessions,
   sessionMatchesProjectFilter,
   sessionRecency,
diff --git a/apps/desktop/src/app/chat/sidebar/projects/model.test.ts b/apps/desktop/src/app/chat/sidebar/projects/model.test.ts
index 8035686f38..2d02ed1256 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/model.test.ts
+++ b/apps/desktop/src/app/chat/sidebar/projects/model.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 
-import { orderProjectsByIds, sortProjectsForOverview } from './model'
+import { orderProjectsByIds, prioritizePinnedProjects, sortProjectsForOverview } from './model'
 import { NO_PROJECT_ID, type SidebarProjectTree } from './workspace-groups'
 
 function makeProject(id: string, sessionCount: number): SidebarProjectTree {
@@ -76,3 +76,26 @@ describe('sortProjectsForOverview', () => {
     expect(ids(sortProjectsForOverview(projects, 'active'))).toEqual([NO_PROJECT_ID, 'active', 'scanned'])
   })
 })
+
+describe('prioritizePinnedProjects', () => {
+  it('keeps Home first and pins ahead of an active or newly active project', () => {
+    const active = { ...makeProject('active', 5), isAuto: false }
+
+    const projects = orderProjectsByIds(
+      sortProjectsForOverview([makeProject('pinned', 0), active, home(), makeProject('new', 3)], 'active'),
+      ['active', 'pinned']
+    )
+
+    expect(ids(prioritizePinnedProjects(projects, ['pinned']))).toEqual([
+      NO_PROJECT_ID, 'pinned', 'new', 'active'
+    ])
+  })
+
+  it('uses pin order and ignores stale or synthetic ids', () => {
+    const projects = [home(), makeProject('a', 1), makeProject('b', 1)]
+
+    expect(ids(prioritizePinnedProjects(projects, ['missing', NO_PROJECT_ID, 'b', 'a']))).toEqual([
+      NO_PROJECT_ID, 'b', 'a'
+    ])
+  })
+})
diff --git a/apps/desktop/src/app/chat/sidebar/projects/model.ts b/apps/desktop/src/app/chat/sidebar/projects/model.ts
index 0836a089b3..518970e1db 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/model.ts
+++ b/apps/desktop/src/app/chat/sidebar/projects/model.ts
@@ -117,6 +117,24 @@ export function orderProjectsByIds(projects: SidebarProjectTree[], orderIds: str
   ])
 }
 
+// Pin order is independent of recency and drag order. Home remains the fixed
+// first row; a newly active or discovered project cannot jump above a pin.
+export function prioritizePinnedProjects(projects: SidebarProjectTree[], pinnedIds: readonly string[]): SidebarProjectTree[] {
+  if (!pinnedIds.length) {
+    return projects
+  }
+
+  const byId = new Map(projects.map(project => [project.id, project]))
+
+  const pinned = pinnedIds.map(id => byId.get(id)).filter((project): project is SidebarProjectTree =>
+    Boolean(project && !project.isNoProject)
+  )
+
+  const pinnedSet = new Set(pinned.map(project => project.id))
+
+  return homeFirst([...pinned, ...projects.filter(project => !pinnedSet.has(project.id))])
+}
+
 // Project drill-in lanes are git-driven: source them from `git worktree list` so
 // linked worktrees still appear even when their sessions aren't in the recents
 // payload currently loaded in memory.
diff --git a/apps/desktop/src/app/chat/sidebar/projects/overview-row.test.tsx b/apps/desktop/src/app/chat/sidebar/projects/overview-row.test.tsx
index baf7ef1fab..6ec2f48f65 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/overview-row.test.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/overview-row.test.tsx
@@ -94,6 +94,18 @@ describe('ProjectOverviewRow', () => {
     expect(container.querySelector('[data-sessions-project="p1"]')).toBeTruthy()
   })
 
+  it('marks the project that owns the focused session, including preview-only rows', () => {
+    const { container } = render(
+      <ProjectOverviewRow
+        activeSessionId="focused"
+        previewSessions={[{ id: 'focused' } as unknown as SessionInfo]}
+        project={project}
+      />
+    )
+
+    expect(container.querySelector('[data-current-session="true"]')).toBeTruthy()
+  })
+
   it('explicit projects keep the folder-library glyph and a plain accessible name', () => {
     const explicit = { id: 'p1', label: 'Explicit' } as unknown as SidebarProjectTree
 
diff --git a/apps/desktop/src/app/chat/sidebar/projects/overview-row.tsx b/apps/desktop/src/app/chat/sidebar/projects/overview-row.tsx
index bb0612fe4f..500692695b 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/overview-row.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/overview-row.tsx
@@ -9,6 +9,8 @@ import type { SessionInfo } from '@/hermes'
 import { useI18n } from '@/i18n'
 import { cn } from '@/lib/utils'
 import { $sidebarShowAllSessions } from '@/store/layout'
+import { $activeGatewayProfile, normalizeProfileKey } from '@/store/profile'
+import { $pinnedProjectIdsByProfile } from '@/store/project-pins'
 
 import {
   SIDEBAR_LEAD_ICON_SIZE,
@@ -25,7 +27,7 @@ import {
 
 import { latestProjectSessions, PROJECT_PREVIEW_COUNT, useWorkspaceNodeOpen } from './model'
 import { ProjectContextMenu, ProjectMenu } from './project-menu'
-import type { SidebarProjectTree } from './workspace-groups'
+import { projectContainsSession, type SidebarProjectTree } from './workspace-groups'
 import { WorkspaceAddButton } from './workspace-header'
 
 // A bare color dot (no icon) or an icon glyph — tinted by `color` when set, else
@@ -79,6 +81,7 @@ interface ProjectOverviewRowProps {
   onNewSessionSplit?: NewSessionSplitHandler
   renderRows?: (sessions: SessionInfo[]) => React.ReactNode
   activeProjectId?: null | string
+  activeSessionId?: null | string
   previewSessions?: SessionInfo[]
   reorderable?: boolean
   dragging?: boolean
@@ -94,6 +97,7 @@ export function ProjectOverviewRow({
   onNewSessionSplit,
   renderRows,
   activeProjectId,
+  activeSessionId,
   previewSessions,
   reorderable = false,
   dragging = false,
@@ -104,11 +108,19 @@ export function ProjectOverviewRow({
   const { t } = useI18n()
   const s = t.sidebar
   const isActive = project.id === activeProjectId
+  const isCurrentSessionProject = projectContainsSession(
+    previewSessions ? { ...project, previewSessions } : project,
+    activeSessionId
+  )
+  const isCurrentProject = isActive || isCurrentSessionProject
   const [open, toggleOpen] = useWorkspaceNodeOpen(project.id)
   // The appearance popover anchors here (the full row) so it opens flush with
   // the sidebar's content edge regardless of which side the sidebar is on.
   const rowRef = useRef<HTMLDivElement>(null)
   const showAllSessions = useStore($sidebarShowAllSessions)
+  const profile = normalizeProfileKey(useStore($activeGatewayProfile))
+  const pinnedByProfile = useStore($pinnedProjectIdsByProfile)
+  const isPinned = (pinnedByProfile[profile] ?? []).includes(project.id)
   const limit = showAllSessions ? Infinity : PROJECT_PREVIEW_COUNT
   const fetched = (previewSessions ?? []).slice(0, limit)
   const preview = renderRows ? (fetched.length ? fetched : latestProjectSessions(project, limit)) : []
@@ -123,7 +135,7 @@ export function ProjectOverviewRow({
       {projectIcon(project)}
     </SidebarRowGrab>
   ) : (
-    <SidebarRowLead>{projectIcon(project)}</SidebarRowLead>
+    <SidebarRowLead className={cn(isCurrentProject && 'text-(--ui-accent)')}>{projectIcon(project)}</SidebarRowLead>
   )
 
   const labelLink = (
@@ -135,7 +147,7 @@ export function ProjectOverviewRow({
           ? `${s.projects.enter(project.label)} (${s.projects.autoDiscovered})`
           : s.projects.enter(project.label)
       }
-      labelClassName={cn('hover:text-foreground hover:underline', isActive && 'text-foreground')}
+      labelClassName={cn('hover:text-foreground hover:underline', isCurrentProject && 'font-semibold text-foreground')}
       onClick={() => onEnter?.(project.id)}
     >
       {project.label}
@@ -180,9 +192,27 @@ export function ProjectOverviewRow({
           )}
         </>
       }
-      className={cn(dragging && 'cursor-grabbing bg-(--ui-sidebar-surface-background)')}
+      className={cn(
+        dragging && 'cursor-grabbing bg-(--ui-sidebar-surface-background)',
+        isCurrentSessionProject && 'bg-(--ui-row-active-background) ring-1 ring-inset ring-(--ui-accent)/30'
+      )}
+      data-current-session={isCurrentSessionProject ? 'true' : undefined}
       data-glass-opaque={dragging ? '' : undefined}
-      label={project.isAuto ? <Tip label={s.projects.autoDiscovered}>{labelLink}</Tip> : labelLink}
+      label={
+        <>
+          {project.isAuto ? <Tip label={s.projects.autoDiscovered}>{labelLink}</Tip> : labelLink}
+          {isCurrentSessionProject && (
+            <span aria-hidden="true" className="size-1.5 shrink-0 rounded-full bg-(--ui-accent)" />
+          )}
+          {isPinned && (
+            <Tip label={s.projects.pinned}>
+              <span aria-label={s.projects.pinned} className="flex shrink-0 items-center text-(--ui-text-tertiary)" role="img">
+                <Codicon name="pin" size="0.6875rem" />
+              </span>
+            </Tip>
+          )}
+        </>
+      }
       lead={lead}
       // The label is grab surface too, not just the lead's grabber — same
       // listeners, minus the controls that keep their own gestures. A project
diff --git a/apps/desktop/src/app/chat/sidebar/projects/project-menu.test.tsx b/apps/desktop/src/app/chat/sidebar/projects/project-menu.test.tsx
index e0df9f2a5c..5fc91ea1bc 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/project-menu.test.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/project-menu.test.tsx
@@ -1,6 +1,8 @@
 import { cleanup, fireEvent, render, screen } from '@testing-library/react'
 import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
 
+import { $pinnedProjectIdsByProfile, toggleProjectPin } from '@/store/project-pins'
+
 import { ProjectMenu } from './project-menu'
 import type { SidebarProjectTree } from './workspace-groups'
 
@@ -35,6 +37,9 @@ vi.mock('@/i18n', () => ({
           menuDelete: 'Delete',
           menuRename: 'Rename',
           menuSetActive: 'Set active',
+          menuPin: 'Pin to top',
+          menuUnpin: 'Unpin',
+          pinned: 'Pinned',
           noColor: 'No color',
           removeFromSidebar: 'Remove from sidebar',
           reveal: 'Reveal in file manager'
@@ -67,6 +72,18 @@ vi.mock('@/store/projects', () => ({
   setProjectAppearance: vi.fn().mockResolvedValue(false)
 }))
 
+vi.mock('@/store/project-pins', async () => {
+  const { atom } = await import('nanostores')
+
+  return { $pinnedProjectIdsByProfile: atom({}), toggleProjectPin: vi.fn() }
+})
+
+vi.mock('@/store/profile', async () => {
+  const { atom } = await import('nanostores')
+
+  return { $activeGatewayProfile: atom('default'), normalizeProfileKey: (value: string) => value || 'default' }
+})
+
 const project = {
   color: null,
   icon: null,
@@ -95,6 +112,20 @@ describe('ProjectMenu', () => {
     expect(tipTrigger(button)).toBeNull()
   })
 
+  it('offers pin and unpin in the project menu', async () => {
+    $pinnedProjectIdsByProfile.set({})
+    render(<ProjectMenu isActive={false} project={project} />)
+
+    openTriggerMenu(screen.getByRole('button', { name: 'Actions' }))
+    fireEvent.click(await screen.findByRole('menuitem', { name: 'Pin to top' }))
+    expect(toggleProjectPin).toHaveBeenCalledWith('default', 'p1')
+
+    $pinnedProjectIdsByProfile.set({ default: ['p1'] })
+    openTriggerMenu(screen.getByRole('button', { name: 'Actions' }))
+    fireEvent.click(await screen.findByRole('menuitem', { name: 'Unpin' }))
+    expect(toggleProjectPin).toHaveBeenLastCalledWith('default', 'p1')
+  })
+
   // When anchorRef is absent, PopoverAnchor wraps the dropdown trigger so the
   // appearance popover positions against the kebab. asChild must still reach
   // the real button (no non-forwarding wrappers inside the chain — #67500).
diff --git a/apps/desktop/src/app/chat/sidebar/projects/project-menu.tsx b/apps/desktop/src/app/chat/sidebar/projects/project-menu.tsx
index 8e8677b9ca..6146cf2fd9 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/project-menu.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/project-menu.tsx
@@ -22,6 +22,8 @@ import { Popover, PopoverAnchor, PopoverContent } from '@/components/ui/popover'
 import { useI18n } from '@/i18n'
 import { cn } from '@/lib/utils'
 import { $panesFlipped, dismissAutoProject } from '@/store/layout'
+import { $activeGatewayProfile, normalizeProfileKey } from '@/store/profile'
+import { $pinnedProjectIdsByProfile, toggleProjectPin } from '@/store/project-pins'
 import {
   copyPath,
   deleteProject,
@@ -56,6 +58,9 @@ function useProjectActions({
   const p = t.sidebar.projects
   const target = { id: project.id, name: project.label }
   const [confirmDeleteOpen, setConfirmDeleteOpen] = useState(false)
+  const profile = normalizeProfileKey(useStore($activeGatewayProfile))
+  const pinnedByProfile = useStore($pinnedProjectIdsByProfile)
+  const isPinned = (pinnedByProfile[profile] ?? []).includes(project.id)
 
   const removeAuto = () => {
     dismissAutoProject(project.id)
@@ -112,6 +117,13 @@ function useProjectActions({
     }
   ]
 
+  const pinItem: ActionItemSpec = {
+    icon: 'pin',
+    key: 'pin',
+    label: isPinned ? p.menuUnpin : p.menuPin,
+    onSelect: () => toggleProjectPin(profile, project.id)
+  }
+
   const dangerItem: ActionItemSpec = project.isAuto
     ? { icon: 'trash', key: 'remove', label: p.removeFromSidebar, onSelect: removeAuto, variant: 'destructive' }
     : {
@@ -134,7 +146,7 @@ function useProjectActions({
     />
   )
 
-  return { confirmDialog, dangerItem, identityItems, pathItems }
+  return { confirmDialog, dangerItem, identityItems, pathItems, pinItem }
 }
 
 // Per-project actions. The kebab keeps its row-anchored Appearance popover; the
@@ -166,7 +178,7 @@ export function ProjectMenu({
   // when the panes are flipped (sidebar on the right).
   const panesFlipped = useStore($panesFlipped)
 
-  const { confirmDialog, dangerItem, identityItems, pathItems } = useProjectActions({
+  const { confirmDialog, dangerItem, identityItems, pathItems, pinItem } = useProjectActions({
     isActive,
     onExitScope,
     project,
@@ -248,6 +260,8 @@ export function ProjectMenu({
               <DropdownMenuSeparator />
             </>
           )}
+          {renderActionItem(DROPDOWN_KIT, pinItem)}
+          <DropdownMenuSeparator />
           {pathItems.map(item => renderActionItem(DROPDOWN_KIT, item))}
           <DropdownMenuSeparator />
           {renderActionItem(DROPDOWN_KIT, dangerItem)}
@@ -294,7 +308,7 @@ export function ProjectContextMenu({
   const { t } = useI18n()
   const p = t.sidebar.projects
 
-  const { confirmDialog, dangerItem, identityItems, pathItems } = useProjectActions({
+  const { confirmDialog, dangerItem, identityItems, pathItems, pinItem } = useProjectActions({
     isActive,
     onExitScope,
     project,
@@ -327,7 +341,8 @@ export function ProjectContextMenu({
           </kit.SubContent>
         </kit.Sub>
       )}
-      {(identityItems.length > 0 || canTheme) && <kit.Separator />}
+      {renderActionItem(kit, pinItem)}
+      <kit.Separator />
       {pathItems.map(item => renderActionItem(kit, item))}
       <kit.Separator />
       {renderActionItem(kit, dangerItem)}
diff --git a/apps/desktop/src/app/chat/sidebar/projects/workspace-group.tsx b/apps/desktop/src/app/chat/sidebar/projects/workspace-group.tsx
index 2d03d01f31..2de7145d98 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/workspace-group.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/workspace-group.tsx
@@ -14,13 +14,14 @@ import { notifyError } from '@/store/notifications'
 import { newSessionInProfile, pinNewChatProfile, selectProfile } from '@/store/profile'
 import { switchBranchInRepo } from '@/store/projects'
 import { $sessionProfilesUsage } from '@/store/session'
+import { $sessionDotStateById, hasLiveTurn } from '@/store/session-dot-state'
 import { $sidebarSessionRankIds } from '@/store/sidebar-sort'
 
 import { SidebarGroupRow, SidebarRowLead, SidebarRowLink, SidebarRowStack } from '../chrome'
 import { rankSessions } from '../order'
 
 import { PROJECT_PREVIEW_COUNT, SIDEBAR_GROUP_PAGE, useWorkspaceNodeOpen } from './model'
-import type { SidebarSessionGroup } from './workspace-groups'
+import { groupContainsSession, type SidebarSessionGroup } from './workspace-groups'
 import {
   WorkspaceAddButton,
   WorkspaceContextMenu,
@@ -32,6 +33,7 @@ import {
 interface SidebarWorkspaceGroupProps {
   group: SidebarSessionGroup
   renderRows: (sessions: SessionInfo[]) => React.ReactNode
+  activeSessionId?: null | string
   onNewSession?: (path: null | string) => void
   onNewSessionSplit?: NewSessionSplitHandler
   // When set (linked worktree rows), shows a remove affordance that runs a real
@@ -42,6 +44,7 @@ interface SidebarWorkspaceGroupProps {
 export function SidebarWorkspaceGroup({
   group,
   renderRows,
+  activeSessionId = null,
   onNewSession,
   onNewSessionSplit,
   onRemove
@@ -52,6 +55,10 @@ export function SidebarWorkspaceGroup({
   // Totals for the whole profile, not the loaded page — a selector so a refresh
   // that leaves this profile's spend unchanged doesn't repaint its header.
   const usage = useStoreSelector($sessionProfilesUsage, all => all[group.id])
+  const active = groupContainsSession(group, activeSessionId)
+  const working = useStoreSelector($sessionDotStateById, states =>
+    group.sessions.some(session => hasLiveTurn(states[session.id] ?? 'idle'))
+  )
   const rankIds = useStore($sidebarSessionRankIds)
   // The sidebar's "Show all sessions" preference lifts the lane's page too —
   // the same switch that widens the project overview, read at the leaf like
@@ -212,11 +219,13 @@ export function SidebarWorkspaceGroup({
                 </div>
               )
             }
+            active={active}
             icon={leadingIcon}
             label={group.label}
             onToggle={toggleOpen}
             open={open}
             title={group.path ? displayPath(group.path) : undefined}
+            working={working}
           />
         </WorkspaceContextMenu>
       )}
diff --git a/apps/desktop/src/app/chat/sidebar/projects/workspace-groups.ts b/apps/desktop/src/app/chat/sidebar/projects/workspace-groups.ts
index 3f457c885e..23edfd8900 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/workspace-groups.ts
+++ b/apps/desktop/src/app/chat/sidebar/projects/workspace-groups.ts
@@ -1,6 +1,7 @@
 import type { HermesGitWorktree } from '@/global'
 import type { ProjectInfo, SessionInfo } from '@/hermes'
 import { normalize } from '@/lib/text'
+import { sessionMatchesStoredId } from '@/store/session'
 
 import { rankSessions } from '../order'
 
@@ -71,6 +72,24 @@ export interface SidebarProjectTree {
   previewSessions?: SessionInfo[]
 }
 
+/** Whether a sidebar group owns the currently focused conversation. */
+export const groupContainsSession = (group: SidebarSessionGroup, storedSessionId?: null | string): boolean =>
+  Boolean(storedSessionId && group.sessions.some(session => sessionMatchesStoredId(session, storedSessionId)))
+
+/** Whether a project owns the currently focused conversation. */
+export const projectContainsSession = (project: SidebarProjectTree, storedSessionId?: null | string): boolean => {
+  if (!storedSessionId) {
+    return false
+  }
+
+  const sessions = [
+    ...(project.repos ?? []).flatMap(repo => repo.groups.flatMap(group => group.sessions)),
+    ...(project.previewSessions ?? [])
+  ]
+
+  return sessions.some(session => sessionMatchesStoredId(session, storedSessionId))
+}
+
 /** Path split into segments, ignoring trailing slashes and mixed separators. */
 const segments = (path: string): string[] =>
   path
diff --git a/apps/desktop/src/app/chat/sidebar/projects/workspace-header.tsx b/apps/desktop/src/app/chat/sidebar/projects/workspace-header.tsx
index db4f4822c1..1a84907d66 100644
--- a/apps/desktop/src/app/chat/sidebar/projects/workspace-header.tsx
+++ b/apps/desktop/src/app/chat/sidebar/projects/workspace-header.tsx
@@ -194,16 +194,20 @@ export function StartWorkButton({ repoPath }: { repoPath: string }) {
 // button with a leading glyph, plus an optional trailing action (the +).
 export function WorkspaceHeader({
   action,
+  active = false,
   emphasis = false,
   icon,
   label,
   onToggle,
   open,
   title,
+  working = false,
   ref,
   ...rest
 }: {
   action?: React.ReactNode
+  /** Marks the lane containing the focused conversation. */
+  active?: boolean
   emphasis?: boolean
   icon: React.ReactNode
   label: string
@@ -211,13 +215,19 @@ export function WorkspaceHeader({
   open: boolean
   /** Hover tooltip — the lane's full on-disk path (worktree / repo root). */
   title?: string
+  /** Adds a subtle pulse while any session in the lane is generating. */
+  working?: boolean
 } & React.ComponentProps<'div'>) {
   return (
     <div
       className={cn(
-        'group/workspace flex min-h-6 items-center gap-1 px-2 pt-1 text-[0.6875rem]',
-        emphasis ? 'font-semibold text-(--ui-text-secondary)' : 'font-medium text-(--ui-text-tertiary)'
+        'group/workspace flex min-h-6 items-center gap-1 rounded-md px-2 pt-1 text-[0.6875rem]',
+        emphasis ? 'font-semibold text-(--ui-text-secondary)' : 'font-medium text-(--ui-text-tertiary)',
+        active && 'bg-(--ui-row-active-background) text-foreground',
+        working && 'ring-1 ring-inset ring-(--ui-accent)/30'
       )}
+      data-current-session={active ? 'true' : undefined}
+      data-working={working ? 'true' : undefined}
       ref={ref}
       {...rest}
     >
@@ -229,8 +239,14 @@ export function WorkspaceHeader({
         onClick={onToggle}
         type="button"
       >
-        <SidebarRowLead>{icon}</SidebarRowLead>
+        <SidebarRowLead className={cn(active && 'text-(--ui-accent)')}>{icon}</SidebarRowLead>
         <LaneLabel label={label} title={title ? `${label}\n${title}` : label} />
+        {active && (
+          <span
+            aria-hidden="true"
+            className={cn('size-1.5 shrink-0 rounded-full bg-(--ui-accent)', working && 'animate-pulse')}
+          />
+        )}
         <DisclosureCaret
           className="shrink-0 text-(--ui-text-tertiary) opacity-0 transition group-hover/workspace:opacity-100"
           open={open}
diff --git a/apps/desktop/src/app/chat/sidebar/session-row.tsx b/apps/desktop/src/app/chat/sidebar/session-row.tsx
index cfe2076fb2..141c6c566b 100644
--- a/apps/desktop/src/app/chat/sidebar/session-row.tsx
+++ b/apps/desktop/src/app/chat/sidebar/session-row.tsx
@@ -357,7 +357,8 @@ function SidebarSessionRowImpl({
           // metadata / preview lines below need the extra rows (#68119).
           !card && density !== 'compact' && 'min-h-[2.75rem]',
           !card && density === 'detailed' && 'min-h-[3.875rem]',
-          isSelected && 'bg-(--ui-row-active-background)',
+          isSelected &&
+            'bg-(--ui-row-active-background) text-foreground before:absolute before:inset-y-1 before:left-0 before:w-0.5 before:rounded-full before:bg-(--ui-accent)',
           // Open in another pane: the SAME band, just weaker. Its own mixed
           // token rather than row opacity — dimming the whole row would take
           // the title and the status dot down with it.
@@ -369,6 +370,7 @@ function SidebarSessionRowImpl({
           dragging && 'z-10 cursor-grabbing bg-(--ui-sidebar-surface-background)',
           className
         )}
+        data-current-session={isSelected ? 'true' : undefined}
         data-glass-opaque={dragging ? '' : undefined}
         data-working={liveTurn ? 'true' : undefined}
         // The row runs BOTH drags off one press, and each declines outside its
@@ -495,7 +497,10 @@ function SidebarSessionRowImpl({
                   <span className="min-w-0 flex-1 self-center">
                     <OverflowTip label={title}>
                       <SidebarRowLabel
-                        className="hover-marquee block font-normal group-hover:text-foreground group-data-[working=true]:text-foreground/90"
+                        className={cn(
+                          'hover-marquee block font-normal group-hover:text-foreground group-data-[working=true]:text-foreground/90',
+                          isSelected && 'font-semibold'
+                        )}
                         onPointerEnter={armMarquee}
                         onPointerLeave={disarmMarquee}
                       >
diff --git a/apps/desktop/src/app/chat/sidebar/sessions-section.tsx b/apps/desktop/src/app/chat/sidebar/sessions-section.tsx
index b05d9ab306..520714ea8c 100644
--- a/apps/desktop/src/app/chat/sidebar/sessions-section.tsx
+++ b/apps/desktop/src/app/chat/sidebar/sessions-section.tsx
@@ -27,7 +27,7 @@ import {
   listGroupNodeId,
   toggleWorkspaceNodeCollapsed
 } from '@/store/layout'
-import { sessionPinId } from '@/store/session'
+import { sessionMatchesStoredId, sessionPinId } from '@/store/session'
 import { $sessionDotStateById, hasLiveTurn } from '@/store/session-dot-state'
 
 import { SidebarDateDivider, SidebarSectionMeta } from './chrome'
@@ -132,6 +132,7 @@ interface SidebarSessionsSectionProps {
   // which then passes `projectContent` on the next render. Takes precedence
   // over `tree` / `groups`.
   projectOverview?: SidebarProjectTree[]
+  pinnedProjectIds?: readonly string[]
   // Per-project preview rows (from the backend tree), keyed by project id.
   projectOverviewPreviews?: Record<string, SessionInfo[]>
   // True while the backend project tree is loading (overview skeleton).
@@ -206,6 +207,7 @@ export function SidebarSessionsSection({
   footer,
   groups,
   projectOverview,
+  pinnedProjectIds,
   projectOverviewPreviews,
   projectsLoading = false,
   onEnterProject,
@@ -269,7 +271,7 @@ export function SidebarSessionsSection({
         branchStem,
         card,
         isPinned: pinned,
-        isSelected: session.id === activeSessionId,
+        isSelected: sessionMatchesStoredId(session, activeSessionId ?? ''),
         onArchive: () => onArchiveSession(session.id),
         onBranch: onBranchSession ? () => onBranchSession(session.id, session.profile) : undefined,
         onDelete: () => onDeleteSession(session.id),
@@ -485,6 +487,7 @@ export function SidebarSessionsSection({
         {projectBackRow}
         {hasProjectContent ? (
           <EnteredProjectContent
+            activeSessionId={activeSessionId}
             liveSessions={liveSessions}
             onNewSession={onNewSessionInWorkspace}
             onNewSessionSplit={onNewSessionSplit}
@@ -507,12 +510,14 @@ export function SidebarSessionsSection({
     // wired — Home stays outside the sortable list, it's a fixture.
     const home = projectOverview[0]?.isNoProject ? projectOverview[0] : undefined
     const sortableProjects = home ? projectOverview.slice(1) : projectOverview
-    const projectsDraggable = sortableProjects.length > 1 && !!onReorderProjects
-    const Row = projectsDraggable ? SortableProjectOverviewRow : ProjectOverviewRow
+    const pins = new Set(pinnedProjectIds ?? [])
+    const pinnedProjects = sortableProjects.filter(project => pins.has(project.id))
+    const otherProjects = sortableProjects.filter(project => !pins.has(project.id))
 
     const projectRow = (project: SidebarProjectTree, Component: typeof ProjectOverviewRow) => (
       <Component
         activeProjectId={activeProjectId}
+        activeSessionId={activeSessionId}
         key={project.id}
         onEnter={onEnterProject}
         onNewSession={onNewSessionInWorkspace}
@@ -527,22 +532,33 @@ export function SidebarSessionsSection({
       />
     )
 
-    const rows = sortableProjects.map(project => projectRow(project, Row))
+    const projectList = (items: SidebarProjectTree[], other: SidebarProjectTree[], pinnedGroup: boolean) => {
+      if (!items.length) {
+        return null
+      }
+
+      const draggable = items.length > 1 && !!onReorderProjects
+      const Row = draggable ? SortableProjectOverviewRow : ProjectOverviewRow
+      const rows = items.map(project => projectRow(project, Row))
+
+      return draggable && onReorderProjects ? (
+        <ReorderableList
+          ids={items.map(project => project.id)}
+          onReorder={ids => onReorderProjects(pinnedGroup
+            ? [...ids, ...other.map(project => project.id)]
+            : [...other.map(project => project.id), ...ids])}
+          sensors={dndSensors}
+        >
+          {rows}
+        </ReorderableList>
+      ) : rows
+    }
 
     inner = (
       <>
         {home && projectRow(home, ProjectOverviewRow)}
-        {projectsDraggable && onReorderProjects ? (
-          <ReorderableList
-            ids={sortableProjects.map(project => project.id)}
-            onReorder={onReorderProjects}
-            sensors={dndSensors}
-          >
-            {rows}
-          </ReorderableList>
-        ) : (
-          rows
-        )}
+        {projectList(pinnedProjects, otherProjects, true)}
+        {projectList(otherProjects, pinnedProjects, false)}
       </>
     )
   } else if (groups?.length && groups.every(group => group.mode === 'profile' && group.profile)) {
diff --git a/apps/desktop/src/app/chat/sidebar/user-account-card.tsx b/apps/desktop/src/app/chat/sidebar/user-account-card.tsx
index dbb11b0224..da848e5e9b 100644
--- a/apps/desktop/src/app/chat/sidebar/user-account-card.tsx
+++ b/apps/desktop/src/app/chat/sidebar/user-account-card.tsx
@@ -1,61 +1,168 @@
 /**
- * user-account-card.tsx — 侧栏底部的用户卡（§21 DB-T3，U-4）。
+ * Sidebar account entry below the pane body, including the profile submenu.
  *
- * signed_in 时显示：字母章 + U-4 展示名 + 邮箱；离线（U-3）在名后标
- * amber 圆点，点击进 `/me` 资料页（缓存数据时间在那里注明）。
+ * signed_in 时只显示 U-4 展示名；离线（U-3）在名后标 amber 圆点，
+ * 展开时点击展示名进 `/me`，尾部菜单与收缩时的用户图标提供账号操作。
  * 未登录不渲染——那时登录门（DB-T2）本就盖着全屏。
  */
 
 import { useStore } from '@nanostores/react'
+import { useState } from 'react'
 import { useNavigate } from 'react-router'
 
 import { ME_ROUTE } from '@/app/me'
-import { navigateToWorkspacePage } from '@/app/routes'
-import { AvatarChip } from '@/components/ui/avatar-chip'
+import { ChangePasswordDialog } from '@/app/me/change-password-dialog'
+import { navigateToWorkspacePage, SETTINGS_ROUTE } from '@/app/routes'
+import { Button } from '@/components/ui/button'
+import { Codicon } from '@/components/ui/codicon'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
 import { useI18n } from '@/i18n'
-import { $machineBinding, $userAccount, userAccountDisplayName } from '@/store/user-account'
+import { userAccountErrorText } from '@/lib/user-account-errors'
+import { cn } from '@/lib/utils'
+import { notify } from '@/store/notifications'
+import {
+  $machineBinding,
+  $userAccount,
+  userAccountDisplayName,
+  userAccountLogout,
+  type UserAccountState
+} from '@/store/user-account'
 
-export function UserAccountCard() {
-  const { t } = useI18n()
+import { ProfileSubmenu } from './profile-dropdown-switcher'
+
+export interface UserAccountCardProps {
+  compact?: boolean
+}
+
+export function UserAccountCard({ compact = false }: UserAccountCardProps) {
   const account = useStore($userAccount)
+
+  return account.status === 'signed_in' ? (
+    <SignedInAccountCard account={account} compact={compact} key={`${account.site}:${account.profile?.email ?? ''}`} />
+  ) : null
+}
+
+interface SignedInAccountCardProps extends UserAccountCardProps {
+  account: Extract<UserAccountState, { status: 'signed_in' }>
+}
+
+function SignedInAccountCard({ account, compact }: SignedInAccountCardProps) {
+  const { t } = useI18n()
   const binding = useStore($machineBinding)
   const navigate = useNavigate()
+  const [passwordOpen, setPasswordOpen] = useState(false)
+  const [loggingOut, setLoggingOut] = useState(false)
 
-  if (account.status !== 'signed_in') {return null}
   const name = userAccountDisplayName(account.profile) || account.profile?.email || ''
   // DB-T6：自动绑定失败或 pending 待确认 → 名后 amber 点，点卡片进 /me 处理。
   const bindIssue = binding != null && !binding.bound && (binding.bindError != null || binding.pending != null)
 
-  return (
-    <button
-      aria-label={t.userAccount.me.cardAria}
-      className="flex w-full items-center gap-2 rounded-md px-2 py-1.5 text-left hover:bg-accent"
-      onClick={() => navigateToWorkspacePage(navigate, ME_ROUTE)}
+  async function logout() {
+    setLoggingOut(true)
+
+    try {
+      await userAccountLogout()
+    } catch (failure) {
+      notify({ kind: 'error', message: userAccountErrorText(t.userAccount, failure) })
+    } finally {
+      setLoggingOut(false)
+    }
+  }
+
+  const button = (
+    <Button
+      aria-label={compact ? t.userAccount.me.menuAria : t.userAccount.me.cardAria}
+      className={cn('relative min-w-0 [-webkit-app-region:no-drag]', !compact && 'w-full justify-start text-left')}
+      data-tour={compact ? 'profile-menu' : undefined}
+      onClick={compact ? undefined : () => navigateToWorkspacePage(navigate, ME_ROUTE)}
+      size={compact ? 'icon-sm' : 'default'}
       type="button"
+      variant="ghost"
     >
-      <AvatarChip className="size-7" name={name} />
-      <span className="min-w-0 flex-1">
-        <span className="flex items-center gap-1.5">
-          <span className="truncate text-sm font-medium">{name}</span>
-          {account.offline && (
-            <span
-              aria-label={t.userAccount.me.cardOffline}
-              className="size-1.5 shrink-0 rounded-full bg-amber-500"
-              title={t.userAccount.me.cardOffline}
-            />
-          )}
-          {bindIssue && (
-            <span
-              aria-label={t.userAccount.me.cardBindIssue}
-              className="size-1.5 shrink-0 rounded-full bg-amber-500"
-              title={t.userAccount.me.cardBindIssue}
-            />
-          )}
-        </span>
-        {account.profile?.email && name !== account.profile.email && (
-          <span className="block truncate text-xs text-muted-foreground">{account.profile.email}</span>
+      <Codicon aria-hidden="true" name="account" size="0.875rem" />
+      {!compact && <span className="min-w-0 flex-1 truncate">{name || t.userAccount.me.cardAria}</span>}
+      <span className={cn('flex shrink-0 items-center gap-1.5', compact && 'absolute right-0 top-0 gap-0.5')}>
+        {account.offline && (
+          <span
+            aria-label={t.userAccount.me.cardOffline}
+            className="size-1.5 shrink-0 rounded-full bg-amber-500"
+            title={t.userAccount.me.cardOffline}
+          />
+        )}
+        {bindIssue && (
+          <span
+            aria-label={t.userAccount.me.cardBindIssue}
+            className="size-1.5 shrink-0 rounded-full bg-amber-500"
+            title={t.userAccount.me.cardBindIssue}
+          />
         )}
       </span>
-    </button>
+    </Button>
+  )
+
+  return (
+    <div
+      className={
+        compact
+          ? 'grid shrink-0 place-items-center pb-1'
+          : 'flex min-w-0 shrink-0 items-center gap-1 px-2.5 pb-1.5 pt-0.5'
+      }
+      data-slot="sidebar-account"
+    >
+      {!compact && <div className="min-w-0 flex-1">{button}</div>}
+      <DropdownMenu>
+        <DropdownMenuTrigger asChild>
+          {compact ? (
+            button
+          ) : (
+            <Button aria-label={t.userAccount.me.menuAria} data-tour="profile-menu" size="icon-xs" variant="ghost">
+              <Codicon aria-hidden="true" name="ellipsis" size="0.875rem" />
+            </Button>
+          )}
+        </DropdownMenuTrigger>
+        <DropdownMenuContent
+          align="end"
+          className="w-56 min-w-0 max-w-[calc(100vw-1rem)]"
+          collisionPadding={8}
+          side="top"
+        >
+          <DropdownMenuItem onSelect={() => navigateToWorkspacePage(navigate, ME_ROUTE)}>
+            <Codicon aria-hidden="true" name="account" size="0.875rem" />
+            {t.userAccount.me.details}
+          </DropdownMenuItem>
+          <DropdownMenuItem
+            disabled={account.offline || !account.profile?.email}
+            onSelect={() => setPasswordOpen(true)}
+          >
+            <Codicon aria-hidden="true" name="key" size="0.875rem" />
+            {t.userAccount.me.changePassword}
+          </DropdownMenuItem>
+          <ProfileSubmenu />
+          <DropdownMenuSeparator />
+          <DropdownMenuItem onSelect={() => navigate(SETTINGS_ROUTE)}>
+            <Codicon aria-hidden="true" name="settings-gear" size="0.875rem" />
+            {t.commandCenter.settings}
+          </DropdownMenuItem>
+          <DropdownMenuSeparator />
+          <DropdownMenuItem disabled={loggingOut} onSelect={() => void logout()}>
+            <Codicon aria-hidden="true" name="sign-out" size="0.875rem" />
+            {t.userAccount.me.logout}
+          </DropdownMenuItem>
+        </DropdownMenuContent>
+      </DropdownMenu>
+      {passwordOpen && account.profile?.email && (
+        <ChangePasswordDialog
+          email={account.profile.email}
+          onClose={() => setPasswordOpen(false)}
+          site={account.site}
+        />
+      )}
+    </div>
   )
 }
diff --git a/apps/desktop/src/app/chat/sidebar/user-account-footer.test.tsx b/apps/desktop/src/app/chat/sidebar/user-account-footer.test.tsx
new file mode 100644
index 0000000000..afd6fb21df
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/user-account-footer.test.tsx
@@ -0,0 +1,173 @@
+import { useStore } from '@nanostores/react'
+import { act, cleanup, fireEvent, render, screen, within } from '@testing-library/react'
+import { MemoryRouter, useLocation } from 'react-router'
+import { afterEach, beforeAll, beforeEach, expect, it, vi } from 'vitest'
+
+import { PANE_TOGGLE_REVEAL_EVENT } from '@/components/pane-shell'
+import { group, split } from '@/components/pane-shell/tree/model'
+import { NarrowOverlays } from '@/components/pane-shell/tree/renderer/narrow-overlays'
+import { TreeSplit } from '@/components/pane-shell/tree/renderer/tree-split'
+import {
+  $collapsedTreeSides,
+  $hiddenTreePanes,
+  $layoutTree,
+  $narrowViewport,
+  activateTreePane,
+  bindTreeSideVisibility
+} from '@/components/pane-shell/tree/store'
+import { registry } from '@/contrib/registry'
+import { $sidebarOpen, setSidebarOpen } from '@/store/layout'
+import { $machineBinding, $userAccount } from '@/store/user-account'
+import { stubMenuDomApis, stubResizeObserver } from '@/test/jsdom'
+
+import { UserAccountCard } from './user-account-card'
+import { SidebarZoneLead } from './zone-tabs'
+
+let disposeContributions: () => void
+
+beforeAll(() => {
+  stubResizeObserver()
+  stubMenuDomApis()
+  vi.stubGlobal('CSS', { ...globalThis.CSS, escape: (value: string) => value })
+  HTMLElement.prototype.scrollIntoView ??= () => undefined
+  bindTreeSideVisibility('left', $sidebarOpen, setSidebarOpen)
+})
+
+beforeEach(() => {
+  $hiddenTreePanes.set(new Set())
+  $narrowViewport.set(false)
+  setSidebarOpen(true)
+  $collapsedTreeSides.set(new Set())
+  $userAccount.set({
+    status: 'signed_in',
+    site: 'https://account.example',
+    offline: true,
+    profileAsOf: null,
+    profile: {
+      email: 'owner@example.com',
+      username: 'owner',
+      nickname: 'Workspace owner',
+      phone: '',
+      planId: '',
+      periodEnd: '',
+      dataAsOf: ''
+    }
+  })
+  $machineBinding.set({ bound: false, bindError: 'network' })
+  disposeContributions = registry.registerMany([
+    {
+      area: 'panes',
+      id: 'sessions',
+      title: 'Sessions',
+      data: {
+        placement: 'left',
+        width: '237px',
+        collapsible: true,
+        hideOnly: true,
+        zoneLead: (compact?: boolean) => <SidebarZoneLead compact={compact} />,
+        zoneFooter: (compact: boolean) => <UserAccountCard compact={compact} />
+      },
+      render: () => <button type="button">Sessions list</button>
+    },
+    {
+      area: 'panes',
+      id: 'bots',
+      title: 'Agents',
+      data: { placement: 'left', width: '237px', collapsible: true, hideOnly: true },
+      render: () => <div>Agent list</div>
+    },
+    { area: 'panes', id: 'workspace', data: { placement: 'main' }, render: () => <div>Chat</div> }
+  ])
+  $layoutTree.set(
+    split('row', [group(['sessions', 'bots'], { id: 'sidebar-zone' }), group(['workspace'], { id: 'main-zone' })])
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  disposeContributions()
+  $layoutTree.set(null)
+  $narrowViewport.set(false)
+  $userAccount.set({ status: 'unknown' })
+  $machineBinding.set(null)
+  setSidebarOpen(true)
+})
+
+function Layout() {
+  const tree = useStore($layoutTree)
+  const location = useLocation()
+
+  return (
+    <>
+      {tree?.type === 'split' && <TreeSplit node={tree} root rootRow topEdge />}
+      <NarrowOverlays />
+      <output data-testid="route">{location.pathname}</output>
+    </>
+  )
+}
+
+function renderLayout() {
+  return render(
+    <MemoryRouter>
+      <Layout />
+    </MemoryRouter>
+  )
+}
+
+it('keeps the account below pane content and available across sidebar tabs and narrow overlays', () => {
+  renderLayout()
+  const account = screen.getByRole('button', { name: 'Open your account page' })
+  const footer = account.closest('[data-zone-footer]')
+
+  expect(footer).not.toBeNull()
+  expect(account.closest('[data-zone-lead]')).toBeNull()
+  expect(
+    screen.getByText('Sessions list').compareDocumentPosition(account) & Node.DOCUMENT_POSITION_FOLLOWING
+  ).toBeTruthy()
+  expect(screen.getByText('Workspace owner')).toBeTruthy()
+
+  act(() => activateTreePane('sidebar-zone', 'bots'))
+  expect(screen.getByRole('button', { name: 'Open your account page' })).toBe(account)
+  expect(screen.getByText('Agent list')).toBeTruthy()
+
+  act(() => $narrowViewport.set(true))
+  act(() => {
+    window.dispatchEvent(new CustomEvent(PANE_TOGGLE_REVEAL_EVENT, { detail: { id: 'sessions', mode: 'open' } }))
+  })
+  const overlayAccount = screen.getByRole('button', { name: 'Open your account page' })
+  expect(overlayAccount.closest('[data-zone-footer]')).not.toBeNull()
+  expect(screen.getByText('Workspace owner')).toBeTruthy()
+  expect(screen.getByRole('button', { name: 'Updates' }).closest('[data-zone-lead]')).not.toBeNull()
+  expect(globalThis.document.querySelector('[data-narrow-overlay-tab="sessions"]')?.textContent).toBe('Sessions')
+  expect(globalThis.document.querySelector('[data-slot="sidebar-zone-tabs"]')).toBeNull()
+
+  fireEvent.pointerDown(globalThis.document.querySelector('[data-narrow-overlay-tab="bots"]')!, { button: 0 })
+  expect(screen.getByRole('button', { name: 'Open your account page' })).toBe(overlayAccount)
+  fireEvent.click(overlayAccount)
+  expect(screen.getByTestId('route').textContent).toBe('/me')
+})
+
+it('provides an icon-only account entry on the single collapsed rail, even when its pane is in another left zone', () => {
+  $layoutTree.set(
+    split('row', [
+      group(['bots'], { id: 'agents-zone' }),
+      group(['sessions'], { id: 'sidebar-zone' }),
+      group(['workspace'], { id: 'main-zone' })
+    ])
+  )
+  renderLayout()
+  act(() => setSidebarOpen(false))
+  const rail = globalThis.document.querySelector('[data-collapsed-side-rail="left"]') as HTMLElement
+  const account = within(rail).getByRole('button', { name: 'Account menu' })
+
+  expect(within(rail).queryByText('Workspace owner')).toBeNull()
+  expect(within(rail).getByLabelText(/Offline.*cached data/)).toBeTruthy()
+  expect(within(rail).getByLabelText(/Machine binding needs attention/)).toBeTruthy()
+  fireEvent.keyDown(account, { key: 'Enter' })
+  fireEvent.click(screen.getByRole('menuitem', { name: 'User details' }))
+  expect(screen.getByTestId('route').textContent).toBe('/me')
+  expect($sidebarOpen.get()).toBe(false)
+
+  act(() => $userAccount.set({ status: 'signed_out' }))
+  expect(within(rail).queryByRole('button', { name: 'Account menu' })).toBeNull()
+})
diff --git a/apps/desktop/src/app/chat/sidebar/user-account-menu.test.tsx b/apps/desktop/src/app/chat/sidebar/user-account-menu.test.tsx
new file mode 100644
index 0000000000..3b8305cda3
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/user-account-menu.test.tsx
@@ -0,0 +1,173 @@
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { MemoryRouter, useLocation } from 'react-router'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+import { $notifications } from '@/store/notifications'
+import { $machineBinding, $userAccount } from '@/store/user-account'
+import { stubMenuDomApis } from '@/test/jsdom'
+
+import { UserAccountCard } from './user-account-card'
+
+const ACCOUNT = {
+  status: 'signed_in' as const,
+  site: 'https://account.example',
+  offline: false,
+  profileAsOf: null,
+  profile: {
+    email: 'owner@example.com',
+    username: 'owner',
+    nickname: 'Workspace owner',
+    phone: '',
+    planId: '',
+    periodEnd: '',
+    dataAsOf: ''
+  }
+}
+
+const BINDING = { bound: false as const, bindError: 'network' }
+
+beforeEach(() => {
+  stubMenuDomApis()
+  $userAccount.set(ACCOUNT)
+  $machineBinding.set(BINDING)
+  $notifications.set([])
+})
+
+afterEach(() => {
+  cleanup()
+  Reflect.deleteProperty(window, 'hermesDesktop')
+  $userAccount.set({ status: 'unknown' })
+  $machineBinding.set(null)
+  $notifications.set([])
+})
+
+function stubBridge() {
+  const api = {
+    logout: vi.fn(async () => ({ ok: true })),
+    resetRequest: vi.fn(async (_payload: unknown) => ({ ok: true })),
+    resetConfirm: vi.fn(async (_payload: unknown): Promise<{ ok: true } | { ok: false; code: string }> => ({
+      ok: true
+    })),
+    unbind: vi.fn()
+  }
+
+  Object.defineProperty(window, 'hermesDesktop', { configurable: true, value: { userAccount: api } })
+
+  return api
+}
+
+function Account({ compact = false }: { compact?: boolean }) {
+  const location = useLocation()
+
+  return (
+    <>
+      <UserAccountCard compact={compact} />
+      <output data-testid="route">{location.pathname}</output>
+    </>
+  )
+}
+
+function openMenu() {
+  fireEvent.keyDown(screen.getByRole('button', { name: 'Account menu' }), { key: 'Enter' })
+}
+
+it('uses the same account menu in both widths, with scoped navigation, offline restrictions and non-destructive logout', async () => {
+  const api = stubBridge()
+
+  const view = render(
+    <MemoryRouter>
+      <Account />
+    </MemoryRouter>
+  )
+
+  expect(screen.getByRole('button', { name: 'Open your account page' })).toBeTruthy()
+  openMenu()
+  expect(screen.getAllByRole('menuitem').map(item => item.textContent)).toEqual([
+    'User details',
+    'Change password',
+    'Profiles',
+    'Settings',
+    'Sign out'
+  ])
+  fireEvent.click(screen.getByRole('menuitem', { name: 'User details' }))
+  expect(screen.getByTestId('route').textContent).toBe('/me')
+  openMenu()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Settings' }))
+  expect(screen.getByTestId('route').textContent).toBe('/settings')
+
+  view.rerender(
+    <MemoryRouter>
+      <Account compact />
+    </MemoryRouter>
+  )
+  expect(screen.queryByText('Workspace owner')).toBeNull()
+  act(() => $userAccount.set({ ...ACCOUNT, offline: true }))
+  openMenu()
+  expect(screen.getByRole('menuitem', { name: 'Change password' }).getAttribute('aria-disabled')).toBe('true')
+
+  api.logout.mockRejectedValueOnce(new Error('private server details'))
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Sign out' }))
+  await waitFor(() => expect($notifications.get()).toHaveLength(1))
+  expect($notifications.get()[0].message).not.toContain('private server details')
+  expect($userAccount.get().status).toBe('signed_in')
+  expect($machineBinding.get()).toBe(BINDING)
+
+  openMenu()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Sign out' }))
+  await waitFor(() => expect($userAccount.get().status).toBe('signed_out'))
+  expect(api.unbind).not.toHaveBeenCalled()
+})
+
+it('changes only the signed-in account password through email verification, validates confirmation and requires a new sign-in', async () => {
+  const api = stubBridge()
+  render(
+    <MemoryRouter>
+      <Account />
+    </MemoryRouter>
+  )
+  openMenu()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Change password' }))
+  expect(api.resetRequest).not.toHaveBeenCalled()
+  fireEvent.click(screen.getByRole('button', { name: 'Cancel' }))
+  expect(screen.queryByRole('dialog')).toBeNull()
+  expect(api.logout).not.toHaveBeenCalled()
+
+  openMenu()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Change password' }))
+  fireEvent.click(screen.getByRole('button', { name: 'Send reset code' }))
+  await screen.findByLabelText('Reset code')
+  expect(api.resetRequest).toHaveBeenCalledWith({ site: ACCOUNT.site, email: ACCOUNT.profile.email })
+  fireEvent.change(screen.getByLabelText('Reset code'), { target: { value: '123456' } })
+  fireEvent.change(screen.getByLabelText('New password'), { target: { value: 'new-password' } })
+  fireEvent.change(screen.getByLabelText('Confirm password'), { target: { value: 'different' } })
+  fireEvent.click(screen.getByRole('button', { name: 'Set new password' }))
+  await screen.findByText('Passwords do not match.')
+  expect(api.resetConfirm).not.toHaveBeenCalled()
+
+  api.resetConfirm.mockResolvedValueOnce({ ok: false, code: 'reset_code_invalid_or_expired' })
+  fireEvent.change(screen.getByLabelText('Confirm password'), { target: { value: 'new-password' } })
+  fireEvent.click(screen.getByRole('button', { name: 'Set new password' }))
+  await screen.findByText('The reset code is invalid or has expired.')
+  expect($userAccount.get().status).toBe('signed_in')
+  fireEvent.click(screen.getByRole('button', { name: 'Set new password' }))
+  await screen.findByText('Password updated. Sign in with the new password.')
+  expect(api.resetConfirm).toHaveBeenLastCalledWith({
+    site: ACCOUNT.site,
+    email: ACCOUNT.profile.email,
+    code: '123456',
+    password: 'new-password'
+  })
+  expect(screen.queryByLabelText('New password')).toBeNull()
+  fireEvent.click(screen.getByRole('button', { name: 'Back to sign in' }))
+  await waitFor(() => expect($userAccount.get().status).toBe('signed_out'))
+  expect(api.logout).toHaveBeenCalledOnce()
+  expect(api.unbind).not.toHaveBeenCalled()
+
+  act(() => $userAccount.set(ACCOUNT))
+  expect(screen.queryByRole('dialog')).toBeNull()
+  openMenu()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Change password' }))
+  act(() => $userAccount.set({ status: 'signed_out', sessionExpired: true }))
+  act(() => $userAccount.set(ACCOUNT))
+  expect(screen.queryByRole('dialog')).toBeNull()
+})
diff --git a/apps/desktop/src/app/chat/sidebar/version-menu.test.tsx b/apps/desktop/src/app/chat/sidebar/version-menu.test.tsx
new file mode 100644
index 0000000000..8101ffe0f2
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/version-menu.test.tsx
@@ -0,0 +1,114 @@
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { afterEach, beforeEach, expect, it, vi } from 'vitest'
+
+import { UpdatesOverlay } from '@/app/updates-overlay'
+import { $connection } from '@/store/session'
+import {
+  $backendUpdateChecking,
+  $backendUpdateStatus,
+  $desktopVersion,
+  $updateChecking,
+  $updateOverlayOpen,
+  $updateOverlayTarget,
+  $updateStatus,
+  resetUpdateApplyState
+} from '@/store/updates'
+import { stubMenuDomApis } from '@/test/jsdom'
+
+import { SidebarVersionMenu } from './version-menu'
+
+const version = { appVersion: '0.77.3', electronVersion: '0', nodeVersion: '0', platform: 'test', hermesRoot: '/tmp' }
+const check = vi.fn(async () => ({ supported: true, updateAvailable: true, targetSha: 'next', behind: 1 }))
+const apply = vi.fn()
+const api = vi.fn(async () => ({ current_version: '0.22.1', update_available: false, can_apply: true }))
+
+beforeEach(() => {
+  stubMenuDomApis()
+  vi.stubGlobal('hermesDesktop', { getVersion: async () => version, api, updates: { check, apply } })
+  $connection.set(null)
+  $desktopVersion.set(version)
+  $updateStatus.set(null)
+  $backendUpdateStatus.set(null)
+  $updateChecking.set(false)
+  $backendUpdateChecking.set(false)
+  $updateOverlayOpen.set(false)
+  resetUpdateApplyState()
+})
+
+afterEach(() => {
+  cleanup()
+  $connection.set(null)
+  $desktopVersion.set(null)
+  $updateStatus.set(null)
+  $backendUpdateStatus.set(null)
+  $updateOverlayOpen.set(false)
+  resetUpdateApplyState()
+  vi.clearAllMocks()
+  vi.unstubAllGlobals()
+})
+
+function openMenu() {
+  fireEvent.keyDown(screen.getByRole('button', { name: 'Updates' }), { key: 'Enter' })
+}
+
+it('checks the desktop through the existing overlay without starting installation', async () => {
+  render(
+    <>
+      <SidebarVersionMenu />
+      <UpdatesOverlay />
+    </>
+  )
+  expect(screen.getByText(`v${version.appVersion}`)).toBeTruthy()
+  openMenu()
+  expect(screen.getByText(`Hermes Desktop v${version.appVersion}`)).toBeTruthy()
+  fireEvent.click(screen.getByRole('menuitem', { name: 'Check now' }))
+
+  await screen.findByText('New update available')
+  expect($updateOverlayTarget.get()).toBe('client')
+  expect(check).toHaveBeenCalledWith({ force: true })
+  expect(apply).not.toHaveBeenCalled()
+  act(() => $updateOverlayOpen.set(false))
+  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+  openMenu()
+  expect(screen.getByRole('menuitem', { name: 'Update now' })).toBeTruthy()
+  expect(apply).not.toHaveBeenCalled()
+})
+
+it('keeps the remote-backend target in the compact menu and routes its forced check separately', async () => {
+  $connection.set({
+    mode: 'remote',
+    connectionId: 'remote',
+    baseUrl: 'https://gateway.example',
+    wsUrl: 'wss://gateway.example/ws',
+    isFullscreen: false,
+    nativeOverlayWidth: 0,
+    token: '',
+    logs: [],
+    windowButtonPosition: null
+  })
+  $backendUpdateStatus.set({ supported: true, currentVersion: '0.22.1' })
+  render(
+    <>
+      <SidebarVersionMenu compact />
+      <UpdatesOverlay />
+    </>
+  )
+  expect(screen.queryByText(`v${version.appVersion}`)).toBeNull()
+  openMenu()
+  const backendGroup = screen.getByText('Backend v0.22.1').parentElement!
+  fireEvent.click(within(backendGroup).getByRole('menuitem', { name: 'Check now' }))
+
+  await screen.findByText('The backend is running the latest version.')
+  expect($updateOverlayTarget.get()).toBe('backend')
+  expect(api).toHaveBeenCalledWith(expect.objectContaining({ path: '/api/hermes/update/check?force=true' }))
+  expect(check).not.toHaveBeenCalled()
+  expect(apply).not.toHaveBeenCalled()
+  act(() => {
+    $updateOverlayOpen.set(false)
+    $connection.set(null)
+  })
+  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+  openMenu()
+  expect(screen.queryByText('Backend v0.22.1')).toBeNull()
+  expect(screen.getByRole('menuitem', { name: 'Check now' })).toBeTruthy()
+})
diff --git a/apps/desktop/src/app/chat/sidebar/version-menu.tsx b/apps/desktop/src/app/chat/sidebar/version-menu.tsx
new file mode 100644
index 0000000000..19b1ac739e
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/version-menu.tsx
@@ -0,0 +1,156 @@
+import { useStore } from '@nanostores/react'
+
+import { Button } from '@/components/ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuLabel,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger
+} from '@/components/ui/dropdown-menu'
+import { Tip } from '@/components/ui/tooltip'
+import { useI18n } from '@/i18n'
+import { ChevronDown, Download, Loader2, RefreshCw } from '@/lib/icons'
+import { useStoreSelector } from '@/lib/use-session-slice'
+import { cn } from '@/lib/utils'
+import { resolveVersionStatus } from '@/lib/version-status'
+import { $connection } from '@/store/session'
+import {
+  $backendUpdateApply,
+  $backendUpdateChecking,
+  $backendUpdateStatus,
+  $desktopVersion,
+  $updateApply,
+  $updateChecking,
+  $updateStatus,
+  openUpdateOverlayFor
+} from '@/store/updates'
+
+export interface SidebarVersionMenuProps {
+  compact?: boolean
+}
+
+/** One entry for the existing desktop and remote-backend update flows. */
+export function SidebarVersionMenu({ compact = false }: SidebarVersionMenuProps) {
+  const { t } = useI18n()
+  const copy = t.shell.statusbar
+  const version = useStore($desktopVersion)?.appVersion
+  const remote = useStoreSelector($connection, connection => connection?.mode === 'remote')
+  const clientCheck = useStore($updateChecking)
+  const clientApply = useStore($updateApply)
+  const clientUpdate = useStore($updateStatus)
+  const backendCheck = useStore($backendUpdateChecking)
+  const backendApply = useStore($backendUpdateApply)
+  const backendUpdate = useStore($backendUpdateStatus)
+
+  const targets = [
+    { target: 'client' as const, version, checking: clientCheck, apply: clientApply, update: clientUpdate },
+    ...(remote
+      ? [
+          {
+            target: 'backend' as const,
+            version: backendUpdate?.currentVersion,
+            checking: backendCheck,
+            apply: backendApply,
+            update: backendUpdate
+          }
+        ]
+      : [])
+  ].map(entry => {
+    const applying = entry.apply.applying || entry.apply.stage === 'restart'
+
+    return {
+      ...entry,
+      applying,
+      status: resolveVersionStatus({
+        applying,
+        applyMessage: entry.apply.message,
+        behind: entry.update?.behind ?? 0,
+        branch: entry.update?.branch,
+        copy,
+        remote,
+        restarting: entry.apply.stage === 'restart',
+        sha: entry.update?.currentSha?.slice(0, 7),
+        target: entry.target,
+        updateAvailable: entry.update?.updateAvailable,
+        version: entry.version
+      })
+    }
+  })
+
+  const busy = targets.some(entry => entry.applying || entry.checking)
+  const available = targets.some(entry => entry.status.hasUpdate)
+
+  return (
+    <DropdownMenu>
+      <Tip label={t.settings.about.updates} side={compact ? 'right' : 'bottom'}>
+        <DropdownMenuTrigger asChild>
+          <Button
+            aria-label={t.settings.about.updates}
+            className={cn('min-w-0 max-w-full [-webkit-app-region:no-drag]', available && 'text-primary')}
+            data-slot="sidebar-version-menu"
+            size={compact ? 'icon-sm' : 'inline'}
+            variant={compact ? 'ghost' : 'text'}
+          >
+            {compact ? (
+              busy ? (
+                <Loader2 aria-hidden className="animate-spin" />
+              ) : (
+                <Download aria-hidden />
+              )
+            ) : (
+              <>
+                <span className="truncate text-[0.6875rem]">
+                  {version ? `v${version}` : t.settings.about.versionUnavailable}
+                </span>
+                {busy ? (
+                  <Loader2 aria-hidden className="animate-spin" />
+                ) : available ? (
+                  <Download aria-hidden />
+                ) : (
+                  <ChevronDown aria-hidden />
+                )}
+              </>
+            )}
+          </Button>
+        </DropdownMenuTrigger>
+      </Tip>
+      <DropdownMenuContent align="start" className="w-64 min-w-0 max-w-[calc(100vw-1rem)]" side="bottom">
+        {targets.map((entry, index) => (
+          <div key={entry.target}>
+            {index > 0 && <DropdownMenuSeparator />}
+            <DropdownMenuLabel className="truncate">
+              {entry.target === 'client'
+                ? copy.desktopVersion(entry.version ?? copy.unknown)
+                : copy.backendVersion(entry.version ?? copy.unknown)}
+            </DropdownMenuLabel>
+            {entry.target === 'client' && entry.status.detail && (
+              <DropdownMenuLabel className="truncate font-normal text-(--ui-text-tertiary)">
+                {copy.commit(entry.status.detail)}
+              </DropdownMenuLabel>
+            )}
+            <DropdownMenuItem onSelect={() => openUpdateOverlayFor(entry.target)}>
+              {entry.applying || entry.checking ? (
+                <Loader2 aria-hidden className="animate-spin" />
+              ) : entry.status.hasUpdate ? (
+                <Download aria-hidden />
+              ) : (
+                <RefreshCw aria-hidden />
+              )}
+              <span className="truncate">
+                {entry.applying
+                  ? copy.updateInProgress
+                  : entry.checking
+                    ? t.updates.checking
+                    : entry.status.hasUpdate
+                      ? t.updates.updateNow
+                      : t.settings.about.checkNow}
+              </span>
+            </DropdownMenuItem>
+          </div>
+        ))}
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/apps/desktop/src/app/chat/sidebar/zone-tabs.test.tsx b/apps/desktop/src/app/chat/sidebar/zone-tabs.test.tsx
new file mode 100644
index 0000000000..e51644c62a
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/zone-tabs.test.tsx
@@ -0,0 +1,169 @@
+// @vitest-environment jsdom
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { MemoryRouter } from 'react-router'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import { findGroupOfPane, group } from '@/components/pane-shell/tree/model'
+import {
+  $hiddenTreePanes,
+  $layoutTree,
+  activateTreePane,
+  markCollapsePane,
+  setTreeGroupTabStrip,
+  tabStripVisibleForGroup
+} from '@/components/pane-shell/tree/store'
+import { registry } from '@/contrib/registry'
+import { $desktopVersion } from '@/store/updates'
+
+import { SidebarZoneLead, SidebarZoneTabs } from './zone-tabs'
+
+const STANDING_CHROME = [
+  { area: 'panes', id: 'sessions', title: 'sessions', data: { hideOnly: true }, render: () => null },
+  { area: 'panes', id: 'hermes-bots:pane', title: 'bots', data: { hideOnly: true }, render: () => null },
+  // A tool pane docks as a tab too — it counts as standing chrome via
+  // `isCollapsePane`, not via the hide-only flag.
+  { area: 'panes', id: 'terminal', title: 'terminal', data: { placement: 'bottom' }, render: () => null }
+]
+
+const leftZone = () => {
+  const tree = $layoutTree.get()
+
+  return tree ? findGroupOfPane(tree, 'sessions') : null
+}
+
+const setZone = (...panes: string[]) => $layoutTree.set(group(panes, { active: panes[0], id: 'left-zone' }))
+
+describe('SidebarZoneTabs', () => {
+  let disposeContributions: () => void
+
+  beforeEach(() => {
+    disposeContributions = registry.registerMany(STANDING_CHROME)
+    markCollapsePane('terminal')
+    $hiddenTreePanes.set(new Set())
+    setZone('sessions', 'hermes-bots:pane', 'terminal')
+  })
+
+  afterEach(() => {
+    cleanup()
+    disposeContributions()
+    $hiddenTreePanes.set(new Set())
+    $layoutTree.set(null)
+    $desktopVersion.set(null)
+  })
+
+  // The point of the row: the zone's own strip gives up the window's titlebar
+  // band, so unless this fires the tabs are painted twice or not at all.
+  it("lists the zone's chrome tabs and takes over the zone's strip", () => {
+    render(<SidebarZoneTabs />)
+
+    expect(screen.getByRole('tab', { name: 'sessions' })).toBeTruthy()
+    expect(screen.getByRole('tab', { name: 'bots' })).toBeTruthy()
+    expect(leftZone()?.tabStrip).toBe('never')
+    expect(tabStripVisibleForGroup(leftZone()!)).toBe(false)
+  })
+
+  it('switches the zone to the tab it is asked for', () => {
+    render(<SidebarZoneTabs />)
+
+    fireEvent.click(screen.getByRole('tab', { name: 'bots' }))
+
+    expect(leftZone()?.active).toBe('hermes-bots:pane')
+  })
+
+  // A zone holding a tile needs its own strip — those tabs carry verbs
+  // (close, drag, session menus) this row does not offer.
+  it('stays out of a zone that holds a tile', () => {
+    setZone('sessions', 'session-tile:abc')
+
+    render(<SidebarZoneTabs />)
+
+    expect(screen.queryByRole('tab')).toBeNull()
+    expect(leftZone()?.tabStrip).toBeUndefined()
+  })
+
+  // ⌘⌥T restores the strip; the row retires rather than fighting it back.
+  it('retires while the zone is showing its own strip', () => {
+    setTreeGroupTabStrip('left-zone', 'always')
+
+    render(<SidebarZoneTabs />)
+
+    expect(screen.queryByRole('tab')).toBeNull()
+    expect(leftZone()?.tabStrip).toBe('always')
+  })
+
+  it('drops a chrome-hidden pane from the row', () => {
+    render(<SidebarZoneTabs />)
+    act(() => $hiddenTreePanes.set(new Set(['hermes-bots:pane'])))
+
+    expect(screen.queryByRole('tab', { name: 'bots' })).toBeNull()
+    expect(screen.getByRole('tab', { name: 'sessions' })).toBeTruthy()
+    expect(screen.getByRole('tab', { name: 'terminal' })).toBeTruthy()
+  })
+
+  // A lone pane left in the zone is not a tab row, so the row retires.
+  it('retires when a hide leaves a single pane', () => {
+    render(<SidebarZoneTabs />)
+    act(() => $hiddenTreePanes.set(new Set(['hermes-bots:pane', 'terminal'])))
+
+    expect(screen.queryByRole('tab')).toBeNull()
+  })
+})
+
+// The lead is the ZONE's, not the sessions pane's: the brand and the tabs stay
+// up while the zone shows a surface stacked beside the sidebar. Rendered from
+// inside the pane they vanished with it, taking the only way back.
+describe('SidebarZoneLead', () => {
+  let disposeContributions: () => void
+
+  beforeEach(() => {
+    disposeContributions = registry.registerMany(STANDING_CHROME)
+    markCollapsePane('terminal')
+    $hiddenTreePanes.set(new Set())
+    $desktopVersion.set({
+      appVersion: '9.9.9',
+      electronVersion: '0',
+      hermesRoot: '/tmp',
+      nodeVersion: '0',
+      platform: 'test'
+    })
+    setZone('sessions', 'hermes-bots:pane', 'terminal')
+  })
+
+  afterEach(() => {
+    cleanup()
+    disposeContributions()
+    $hiddenTreePanes.set(new Set())
+    $layoutTree.set(null)
+    $desktopVersion.set(null)
+  })
+
+  const renderLead = () =>
+    render(
+      <MemoryRouter>
+        <SidebarZoneLead />
+      </MemoryRouter>
+    )
+
+  it('keeps the brand and the tabs up under another tab', () => {
+    renderLead()
+
+    expect(screen.getByText('DeepWork')).toBeTruthy()
+    expect(screen.getByText('v9.9.9')).toBeTruthy()
+
+    act(() => activateTreePane('left-zone', 'hermes-bots:pane'))
+
+    expect(leftZone()?.active).toBe('hermes-bots:pane')
+    expect(screen.getByText('DeepWork')).toBeTruthy()
+    expect(screen.getByRole('tab', { name: 'sessions' })).toBeTruthy()
+  })
+
+  it('does not bring back the retired brand-row picker from an old saved preference', () => {
+    window.localStorage.setItem('hermes.desktop.profileRailVisible', 'false')
+    renderLead()
+
+    expect(screen.getByRole('button', { name: 'Updates' })).toBeTruthy()
+    expect(screen.queryByRole('button', { name: /Profiles/ })).toBeNull()
+    expect(screen.getByRole('tab', { name: 'sessions' })).toBeTruthy()
+    window.localStorage.removeItem('hermes.desktop.profileRailVisible')
+  })
+})
diff --git a/apps/desktop/src/app/chat/sidebar/zone-tabs.tsx b/apps/desktop/src/app/chat/sidebar/zone-tabs.tsx
new file mode 100644
index 0000000000..e22e75f759
--- /dev/null
+++ b/apps/desktop/src/app/chat/sidebar/zone-tabs.tsx
@@ -0,0 +1,152 @@
+import { useStore } from '@nanostores/react'
+import { useEffect, useMemo } from 'react'
+
+import { findGroupOfPane } from '@/components/pane-shell/tree/model'
+import {
+  $hiddenTreePanes,
+  $layoutTree,
+  activateTreePane,
+  isCollapsePane,
+  isHideOnlyPane,
+  restoreTreePane,
+  setTreeGroupTabStrip,
+  shownPanesInGroup,
+  tabStripVisibleForGroup
+} from '@/components/pane-shell/tree/store'
+import { clearTabSelection } from '@/components/pane-shell/tree/tab-selection'
+import { PaneTab, PaneTabLabel, PaneTabStrip } from '@/components/ui/pane-tab'
+import { useContributions } from '@/contrib/react/use-contributions'
+
+import { SidebarVersionMenu } from './version-menu'
+
+/** The pane whose zone this sidebar IS. Its zone's tabs are the ones this row
+ *  offers — the sessions / Bots standing chrome, plus any tool pane the user
+ *  has stacked beside them. */
+const SIDEBAR_PANE = 'sessions'
+
+/** Standing side chrome: no close verb and no live title, so its tab is a
+ *  plain switch. A zone holding anything else (a session tile, a page) keeps
+ *  its own strip — those tabs carry verbs this row does not. */
+const isStandingChrome = (paneId: string) => isHideOnlyPane(paneId) || isCollapsePane(paneId)
+
+/**
+ * The sidebar zone's lead: the brand block and the zone's tab row.
+ *
+ * All of them are the ZONE's chrome, not the sessions pane's, so they are
+ * rendered by the zone (see `zoneLead` in track-model) rather than inside the
+ * pane they happen to name. Inside the pane they went dark the moment the user
+ * switched to a surface stacked beside it — Bots, a terminal — taking the only
+ * way back with them.
+ */
+export interface SidebarZoneLeadProps {
+  compact?: boolean
+}
+
+export function SidebarZoneLead({ compact = false }: SidebarZoneLeadProps) {
+  if (compact) {
+    return (
+      <div className="grid shrink-0 place-items-center py-1">
+        <SidebarVersionMenu compact />
+      </div>
+    )
+  }
+
+  return (
+    <div className="bg-(--ui-sidebar-surface-background) px-2.5 pt-1.5">
+      <div className="flex items-center gap-1 px-2 pb-1.5">
+        <div className="min-w-0 flex-1">
+          <p className="truncate text-[0.8125rem] font-semibold tracking-tight text-foreground">DeepWork</p>
+          <SidebarVersionMenu />
+        </div>
+      </div>
+      <SidebarZoneTabs />
+    </div>
+  )
+}
+
+/**
+ * The sidebar zone's tabs, under the brand instead of in the titlebar band.
+ *
+ * Standing chrome is just a switch between fixed surfaces, so its strip spends
+ * the window's titlebar band on three labels. Moved here it reads as part of
+ * the sidebar it labels, and the band goes back to the window controls.
+ *
+ * The zone's own strip is switched off while this row is up, and the row
+ * retires the moment the strip comes back (⌘⌥T) — one of the two is always
+ * painted, never both, and neither can strand a pane.
+ */
+export function SidebarZoneTabs() {
+  const tree = useStore($layoutTree)
+  const hidden = useStore($hiddenTreePanes)
+  const panes = useContributions('panes')
+
+  const group = tree ? findGroupOfPane(tree, SIDEBAR_PANE) : null
+
+  const tabs = useMemo(() => {
+    if (!group) {
+      return []
+    }
+
+    const shown = shownPanesInGroup(group)
+
+    // One tab is not a tab row, and a zone holding a tile keeps its own strip.
+    if (shown.length < 2 || !shown.every(isStandingChrome) || tabStripVisibleForGroup(group)) {
+      return []
+    }
+
+    const titles = new Map(panes.map(pane => [pane.id, pane.title ?? pane.id]))
+
+    return shown.map(id => ({ id, title: titles.get(id) ?? id }))
+    // `hidden` and `panes` are read through the store helpers, not referenced
+    // here: the first decides which panes are chips, the second labels them.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [group, hidden, panes])
+
+  // Claim the zone's tabs once, only from AUTO: a zone the user has since told
+  // to show its strip again ('always') is left alone, so ⌘⌥T keeps working.
+  useEffect(() => {
+    if (!group || group.tabStrip !== undefined) {
+      return
+    }
+
+    const shown = shownPanesInGroup(group)
+
+    if (shown.length >= 2 && shown.every(isStandingChrome)) {
+      setTreeGroupTabStrip(group.id, 'never')
+    }
+  }, [group, hidden])
+
+  if (!tabs.length || !group) {
+    return null
+  }
+
+  return (
+    <div className="px-1 pb-1.5 [-webkit-app-region:no-drag]" data-slot="sidebar-zone-tabs">
+      <PaneTabStrip>
+        {tabs.map(tab => {
+          const active = group.active === tab.id && !group.minimized
+
+          return (
+            <PaneTab
+              active={active}
+              aria-selected={active}
+              key={tab.id}
+              onClick={() => {
+                clearTabSelection()
+
+                if (group.minimized) {
+                  restoreTreePane(tab.id)
+                }
+
+                activateTreePane(group.id, tab.id)
+              }}
+              role="tab"
+            >
+              <PaneTabLabel>{tab.title}</PaneTabLabel>
+            </PaneTab>
+          )
+        })}
+      </PaneTabStrip>
+    </div>
+  )
+}
diff --git a/apps/desktop/src/app/chat/workspace-bar.test.tsx b/apps/desktop/src/app/chat/workspace-bar.test.tsx
index 34c886e478..7460dfabfc 100644
--- a/apps/desktop/src/app/chat/workspace-bar.test.tsx
+++ b/apps/desktop/src/app/chat/workspace-bar.test.tsx
@@ -1,62 +1,54 @@
-import { cleanup, fireEvent, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it, vi } from 'vitest'
-
-const pickAndChangeWorkspace = vi.fn()
-
-vi.mock('@/app/shell/workspace-menu', () => ({
-  pickAndChangeWorkspace: (...args: any[]) => pickAndChangeWorkspace(...args)
-}))
+import { cleanup, render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
 
 import { $projectTree } from '@/store/projects'
-import { $currentBranch } from '@/store/session'
+import { $currentBranch, $sessions } from '@/store/session'
 
 import { WorkspaceBar } from './workspace-bar'
 
 afterEach(() => {
   cleanup()
-  vi.clearAllMocks()
-  $projectTree.set([])
+  $sessions.set([])
   $currentBranch.set('')
+  $projectTree.set([])
 })
 
 describe('WorkspaceBar', () => {
-  it('names the owning project and branch for a cwd inside a named project', () => {
+  it("reads the open session's title, then its branch and project name", () => {
+    $sessions.set([{ id: 's_1', title: 'Redesign slides' } as any])
     $projectTree.set([{ id: 'p_web', label: 'Website', path: '/repos/website', repos: [], sessionCount: 0 } as any])
     $currentBranch.set('main')
 
-    render(<WorkspaceBar cwd="/repos/website/src" onChangeWorkspace={vi.fn()} />)
+    render(<WorkspaceBar cwd="/repos/website/src" selectedSessionId="s_1" />)
 
-    expect(screen.getByText('Website')).toBeTruthy()
-    expect(screen.getByText('· main')).toBeTruthy()
+    expect(screen.getByText(/Redesign slides/)).toBeTruthy()
+    expect(screen.getByText('· main Website')).toBeTruthy()
   })
 
-  it('falls back to the cwd leaf when no project owns the path', () => {
-    render(<WorkspaceBar cwd="/somewhere/else" onChangeWorkspace={vi.fn()} />)
+  it('resolves the title through the lineage id, like every other session lookup', () => {
+    $sessions.set([{ id: 's_tip', _lineage_root_id: 's_root', title: 'Compressed chat' } as any])
 
-    expect(screen.getByText('else')).toBeTruthy()
+    render(<WorkspaceBar cwd="/somewhere/else" selectedSessionId="s_root" />)
+
+    expect(screen.getByText(/Compressed chat/)).toBeTruthy()
+    expect(screen.getByText('· else')).toBeTruthy()
   })
 
-  it('shows a choose-workspace placeholder without a cwd', () => {
-    render(<WorkspaceBar cwd="" onChangeWorkspace={vi.fn()} />)
+  it('falls back to the new-session placeholder while no row exists yet', () => {
+    render(<WorkspaceBar cwd="" selectedSessionId={null} />)
 
-    expect(screen.getAllByText(/choose workspace/i).length).toBeGreaterThan(0)
+    expect(screen.getByText(/New session/)).toBeTruthy()
   })
 
-  it('opens the picker seeded with the current cwd on change click', () => {
-    const onChangeWorkspace = vi.fn()
-    render(<WorkspaceBar cwd="/repos/website" onChangeWorkspace={onChangeWorkspace} />)
+  // The path and the switcher moved out: the full path was the long half of the
+  // strip, and the statusbar's cwd item already owns switching workspaces.
+  it('shows the project name only, with no path and no workspace action', () => {
+    $projectTree.set([{ id: 'p_web', label: 'Website', path: '/repos/website', repos: [], sessionCount: 0 } as any])
 
-    fireEvent.click(screen.getByRole('button', { name: /change workspace/i }))
+    render(<WorkspaceBar cwd="/repos/website/src" selectedSessionId={null} />)
 
-    expect(pickAndChangeWorkspace).toHaveBeenCalledWith('/repos/website', onChangeWorkspace)
-  })
-
-  it('opens the picker from the placeholder state too', () => {
-    const onChangeWorkspace = vi.fn()
-    render(<WorkspaceBar cwd="" onChangeWorkspace={onChangeWorkspace} />)
-
-    fireEvent.click(screen.getByRole('button', { name: /choose workspace/i }))
-
-    expect(pickAndChangeWorkspace).toHaveBeenCalledWith('', onChangeWorkspace)
+    expect(screen.getByText(/Website/)).toBeTruthy()
+    expect(screen.queryByText(/repos/)).toBeNull()
+    expect(screen.queryByRole('button')).toBeNull()
   })
 })
diff --git a/apps/desktop/src/app/chat/workspace-bar.tsx b/apps/desktop/src/app/chat/workspace-bar.tsx
index 67236ebc98..d4bb0af242 100644
--- a/apps/desktop/src/app/chat/workspace-bar.tsx
+++ b/apps/desktop/src/app/chat/workspace-bar.tsx
@@ -1,49 +1,39 @@
 import { useStore } from '@nanostores/react'
 
-import { pickAndChangeWorkspace } from '@/app/shell/workspace-menu'
-import { Button } from '@/components/ui/button'
-import { useI18n } from '@/i18n'
-import { displayPath, pathLeaf } from '@/lib/display-path'
-import { FolderOpen } from '@/lib/icons'
+import { NEW_SESSION_TITLE, sessionTitle } from '@/lib/chat-runtime'
+import { pathLeaf } from '@/lib/display-path'
 import { $projectTree, projectNameForCwd } from '@/store/projects'
-import { $currentBranch } from '@/store/session'
+import { $currentBranch, $sessions, sessionMatchesStoredId } from '@/store/session'
 
-/** Slim workspace strip under the chat header: which folder this conversation
- *  runs in, plus the switch action. Always rendered (even for a folder-less
- *  draft) so the entry point never disappears — the draft case is exactly
- *  where picking a workspace matters. */
-export function WorkspaceBar({ cwd, onChangeWorkspace }: { cwd: string; onChangeWorkspace: (cwd: string) => Promise<void> }) {
-  const { t } = useI18n()
-  const copy = t.shell.statusbar
+/** Slim strip under the chat header: what this conversation is called, on which
+ *  branch, in which project. Always rendered (even for a draft) so the strip
+ *  never disappears — an unsent chat is exactly where the name matters.
+ *
+ *  The name is the session's title — the same string the titlebar header would
+ *  carry, but that header is collapsed inside the pane tree, where the zone tab
+ *  owns the title. The project rides as its NAME, not its path: the full path was
+ *  the long half of the strip and the workspace SWITCHER lives on the statusbar's
+ *  cwd item, so nothing here needs the path to stay reachable. */
+export function WorkspaceBar({ cwd, selectedSessionId }: { cwd: string; selectedSessionId: null | string }) {
   const branch = useStore($currentBranch)
   const projectTree = useStore($projectTree)
+  const sessions = useStore($sessions)
   const trimmed = cwd.trim()
-  const name = trimmed ? projectNameForCwd(trimmed) || pathLeaf(trimmed) : ''
+  const project = trimmed ? projectNameForCwd(trimmed) || pathLeaf(trimmed) : ''
+
+  const stored = selectedSessionId
+    ? (sessions.find(session => sessionMatchesStoredId(session, selectedSessionId)) ?? null)
+    : null
+
+  const title = stored ? sessionTitle(stored) : NEW_SESSION_TITLE
+  const meta = [branch, project].filter(Boolean).join(' ')
 
   return (
-    <div className="flex h-7 shrink-0 items-center gap-1.5 border-b border-border/50 px-3 text-xs text-muted-foreground">
-      <FolderOpen className="size-3.5 shrink-0" />
+    <div className="flex h-7 shrink-0 items-center bg-(--ui-chat-surface-background) px-3 text-xs text-muted-foreground">
       <span className="min-w-0 flex-1 truncate">
-        {trimmed ? name : copy.chooseWorkspace}
-        {trimmed && branch ? <span className="text-muted-foreground/60"> · {branch}</span> : null}
-        {/* Breadcrumb trail: the chat header (which would carry this) is hidden
-            inside the pane tree — the title lives in the zone tab — so the
-            full workspace path rides here where it stays visible. */}
-        {trimmed ? (
-          <span className="text-muted-foreground/50" title={trimmed}>
-            {' '}
-            · {displayPath(trimmed)}
-          </span>
-        ) : null}
+        {title}
+        {meta ? <span className="text-muted-foreground/60"> · {meta}</span> : null}
       </span>
-      <Button
-        className="h-5 px-1.5 text-xs text-muted-foreground"
-        onClick={() => void pickAndChangeWorkspace(trimmed, onChangeWorkspace)}
-        size="xs"
-        variant="ghost"
-      >
-        {trimmed ? copy.changeWorkspace : copy.chooseWorkspace}
-      </Button>
     </div>
   )
 }
diff --git a/apps/desktop/src/app/context-menu/app-context-menu.tsx b/apps/desktop/src/app/context-menu/app-context-menu.tsx
index 8c4162b816..b49397e283 100644
--- a/apps/desktop/src/app/context-menu/app-context-menu.tsx
+++ b/apps/desktop/src/app/context-menu/app-context-menu.tsx
@@ -23,7 +23,6 @@ import { isRemoteGateway } from '@/lib/media'
 import { reachablePreviewUrl } from '@/lib/preview-reach'
 import { openCommandPalette } from '@/store/command-palette'
 import { openPreview } from '@/store/preview'
-import { toggleProfileRailVisible } from '@/store/profile-rail-prefs'
 import { toggleStatusbarVisible } from '@/store/statusbar-prefs'
 import { requestActiveUpdate } from '@/store/updates'
 import { canOpenNewWindow, openNewWindow } from '@/store/windows'
@@ -574,12 +573,6 @@ function shellSections({ navigate, t }: ShellVerbs): ReactNode[][] {
         label={t.keybinds.actions['view.toggleStatusbar']}
         onSelect={toggleStatusbarVisible}
       />,
-      <Item
-        icon="organization"
-        key="shell-profile-rail"
-        label={t.keybinds.actions['view.toggleProfileRail']}
-        onSelect={toggleProfileRailVisible}
-      />,
       // The pointer-only way back to a hidden tab strip: right-clicking the
       // shell reaches this menu from anywhere, including a zone that has no
       // chrome left to right-click.
diff --git a/apps/desktop/src/app/contrib/controller.tsx b/apps/desktop/src/app/contrib/controller.tsx
index 9b17086581..1c1aa66f32 100644
--- a/apps/desktop/src/app/contrib/controller.tsx
+++ b/apps/desktop/src/app/contrib/controller.tsx
@@ -45,7 +45,7 @@ import { registry } from '@/contrib/registry'
 import { discoverRuntimePlugins } from '@/contrib/runtime-loader'
 import { translateNow } from '@/i18n'
 import { NEW_SESSION_TITLE, sessionTitle as storedSessionTitle } from '@/lib/chat-runtime'
-import { Download, FileText, LayoutDashboard, PanelBottom, PanelTop, Terminal, Upload, Users, Zap } from '@/lib/icons'
+import { Download, FileText, LayoutDashboard, PanelBottom, PanelTop, Terminal, Upload, Zap } from '@/lib/icons'
 import { type KeybindContribution, KEYBINDS_AREA } from '@/lib/keybinds/actions'
 import { isOnboardingEnabled } from '@/lib/onboarding-enabled'
 import { TRANSCRIPT_DIRECTIVE_AREA, type TranscriptDirectiveContribution } from '@/lib/transcript-directives'
@@ -63,7 +63,6 @@ import {
   SIDEBAR_DEFAULT_WIDTH,
   SIDEBAR_MAX_WIDTH
 } from '@/store/layout'
-import { $profileRailVisible } from '@/store/profile-rail-prefs'
 import { runExportProfileFlow, runImportProfileFlow } from '@/store/profile-share'
 import {
   $reviewOpen,
@@ -73,7 +72,14 @@ import {
   openReview,
   REVIEW_PANE_ID
 } from '@/store/review'
-import { $currentCwd, $selectedStoredSessionId, $sessions, $yoloActive, sessionMatchesStoredId } from '@/store/session'
+import {
+  $currentCwd,
+  $selectedStoredSessionId,
+  $sessions,
+  $workspaceCwdOwner,
+  $yoloActive,
+  sessionMatchesStoredId
+} from '@/store/session'
 import { watchSessionPins } from '@/store/session-pin-sync'
 import { $botChatScopes } from '@/store/session-states'
 import { watchUnreadWriteGuard } from '@/store/session-unread-remote'
@@ -85,6 +91,7 @@ import type { SessionDragPayload } from '../chat/composer/inline-refs'
 import { watchPreviewTiles } from '../chat/preview-tile'
 import { watchRouteTiles } from '../chat/route-tile'
 import { startSessionDrag } from '../chat/session-drag'
+import { SessionHistoryNav } from '../chat/session-history-nav'
 import {
   SessionTileCloseConfirm,
   stackSessionTilesIntoMain,
@@ -92,6 +99,8 @@ import {
   watchSessionTiles,
   WorkspaceTabMenu
 } from '../chat/session-tile'
+import { UserAccountCard } from '../chat/sidebar/user-account-card'
+import { SidebarZoneLead } from '../chat/sidebar/zone-tabs'
 import { AppContextMenu } from '../context-menu/app-context-menu'
 import { HudShell } from '../hud/hud-shell'
 import { $terminalTakeover, setTerminalTakeover } from '../right-sidebar/store'
@@ -145,6 +154,20 @@ const workspaceDragPayload = (): SessionDragPayload | null => {
   return { id: selected, profile: stored?.profile ?? '', title: stored ? storedSessionTitle(stored) : '' }
 }
 
+function FilesTabTitle() {
+  const cwd = useStore($currentCwd).trim()
+  const selectedStoredSessionId = useStore($selectedStoredSessionId)
+  const workspaceCwdOwner = useStore($workspaceCwdOwner)
+  const hasWorkspace = Boolean(cwd) && (workspaceCwdOwner ?? null) === (selectedStoredSessionId ?? null)
+  const folderName =
+    cwd
+      .split(/[\\/]+/)
+      .filter(Boolean)
+      .at(-1) ?? cwd
+
+  return <>{hasWorkspace && folderName ? folderName : translateNow('rightSidebar.files')}</>
+}
+
 // The main tab drags like a session tile — drop it on a composer to link the
 // chat, on a zone/edge to stack/split. Defers (`false`) to the generic pane
 // move when there's no loaded session to carry.
@@ -178,7 +201,12 @@ registry.registerMany([
       hideOnly: true,
       width: `${SIDEBAR_DEFAULT_WIDTH}px`,
       minWidth: `${SIDEBAR_DEFAULT_WIDTH}px`,
-      maxWidth: `${SIDEBAR_MAX_WIDTH}px`
+      maxWidth: `${SIDEBAR_MAX_WIDTH}px`,
+      // The brand row and the zone's tabs are this ZONE's chrome: rendered
+      // above the pane body so Bots / the terminal, stacked beside this pane,
+      // can't take the sidebar's own name and its way back off the screen.
+      zoneLead: (compact?: boolean) => <SidebarZoneLead compact={compact} />,
+      zoneFooter: (compact: boolean) => <UserAccountCard compact={compact} />
     },
     render: () => <WiredPane part="sidebar" />
   },
@@ -188,8 +216,10 @@ registry.registerMany([
     // Live-retitled to the loaded session by syncWorkspaceTitle below.
     title: NEW_SESSION_TITLE,
     data: {
+      headerSurface: 'chat',
       placement: 'main',
       minWidth: '22vw',
+      stripLead: () => <SessionHistoryNav />,
       tabDrag: workspaceTabDrag,
       tabWrap: wrapWorkspaceTab,
       uncloseable: true
@@ -230,7 +260,9 @@ registry.registerMany([
       revealAliases: ['file-browser'],
       width: FILE_BROWSER_DEFAULT_WIDTH,
       minWidth: FILE_BROWSER_MIN_WIDTH,
-      maxWidth: FILE_BROWSER_MAX_WIDTH
+      maxWidth: FILE_BROWSER_MAX_WIDTH,
+      titlebar: 'content',
+      tabTitle: () => <FilesTabTitle />
     },
     render: () => idle(<FilesPane />)
   },
@@ -364,15 +396,6 @@ registry.registerMany([
     get: () => $statusbarVisible.get(),
     set: enabled => $statusbarVisible.set(enabled)
   }),
-  paletteToggle({
-    id: 'view.toggleProfileRail',
-    label: 'Toggle profile rail',
-    action: 'view.toggleProfileRail',
-    icon: Users,
-    keywords: ['profile rail', 'profile bar', 'profile strip', 'profiles', 'sidebar', 'hide', 'show', 'chrome'],
-    get: () => $profileRailVisible.get(),
-    set: enabled => $profileRailVisible.set(enabled)
-  }),
   paletteToggle({
     id: 'view.toggleTabStrip',
     label: 'Toggle tabs',
@@ -484,6 +507,7 @@ const syncWorkspaceTitle = () => {
       selected ? $botChatScopes.get()[selected] : undefined
     ),
     data: {
+      headerSurface: 'chat',
       // The tab's status dot — the SAME primitive the sidebar row and session
       // tiles render, so the main tab never disagrees with its sidebar row. A
       // fresh draft has no session to key by, which IS its status: the dot
@@ -497,6 +521,7 @@ const syncWorkspaceTitle = () => {
       headerVeto: $workspaceIsPage.get(),
       placement: 'main',
       minWidth: '22vw',
+      stripLead: () => <SessionHistoryNav />,
       tabDrag: workspaceTabDrag,
       tabWrap: wrapWorkspaceTab,
       uncloseable: true
diff --git a/apps/desktop/src/app/contrib/layout-presets.ts b/apps/desktop/src/app/contrib/layout-presets.ts
index 786d955457..631fc77747 100644
--- a/apps/desktop/src/app/contrib/layout-presets.ts
+++ b/apps/desktop/src/app/contrib/layout-presets.ts
@@ -11,10 +11,9 @@ import { isOnboardingEnabled } from '@/lib/onboarding-enabled'
 // zone. Review collapses to nothing while its pane is hidden (⌘G off).
 //
 // Preview tiles are DYNAMIC panes (like session tiles), so no preset names one:
-// they're registered by watchPreviewTiles as tabs open, and dockPaneBeside lands
-// each one directly beside the file tree wherever that currently lives — so a
-// file double-click still slides a preview open as its own pane next to the
-// tree, never as a tab stacked into the files sidebar.
+// they're registered by watchPreviewTiles as tabs open and join the files pane's
+// tab group wherever that pane currently lives. Layouts without a files pane
+// fall back to a preview-only zone beside the main workspace.
 export const DEFAULT_TREE = split(
   'row',
   [
diff --git a/apps/desktop/src/app/contrib/wiring.tsx b/apps/desktop/src/app/contrib/wiring.tsx
index 65d7a4959d..391a156ee5 100644
--- a/apps/desktop/src/app/contrib/wiring.tsx
+++ b/apps/desktop/src/app/contrib/wiring.tsx
@@ -113,6 +113,7 @@ import { ModelPickerOverlay } from '../model-picker-overlay'
 import { ModelVisibilityOverlay } from '../model-visibility-overlay'
 import { mainChatOccupied, openSession, openSessionForOwner } from '../open-session'
 import { PetGenerateOverlay } from '../pet-generate/pet-generate-overlay'
+import { ProfileCreateHost } from '../profiles/profile-create-host'
 import { FileActionDialogs } from '../right-sidebar/file-actions'
 import { RemoteFolderPicker } from '../right-sidebar/files/remote-picker'
 import { resetProjectTreeState } from '../right-sidebar/files/use-project-tree'
@@ -1307,7 +1308,6 @@ export function ContribWiring({ children }: { children: ReactNode }) {
         {!isHudWindow() && !isBrowserWindow() && (
           <TitlebarControls
             leftTools={leftTitlebarTools}
-            onOpenSettings={() => navigate(SETTINGS_ROUTE)}
             tools={rightTitlebarTools}
           />
         )}
@@ -1451,6 +1451,7 @@ export function ContribWiring({ children }: { children: ReactNode }) {
 
       {/* Backs confirm() from @/store/confirm — renders only while one is open. */}
       <ConfirmHost />
+      {!isAuxiliaryWindow() && <ProfileCreateHost />}
 
       {/* Send Diagnostics consent/upload dialog — driven by $sendDiagnostics
           (error card action); renders nothing until requested. */}
diff --git a/apps/desktop/src/app/hooks/use-keybinds.ts b/apps/desktop/src/app/hooks/use-keybinds.ts
index 37673b05de..3dec2933c7 100644
--- a/apps/desktop/src/app/hooks/use-keybinds.ts
+++ b/apps/desktop/src/app/hooks/use-keybinds.ts
@@ -46,7 +46,6 @@ import {
   switchToDefaultProfile,
   toggleShowAllProfiles
 } from '@/store/profile'
-import { toggleProfileRailVisible } from '@/store/profile-rail-prefs'
 import { openFolderAsProject } from '@/store/projects'
 import { toggleReview } from '@/store/review'
 import { $selectedStoredSessionId, setModelPickerOpen } from '@/store/session'
@@ -250,7 +249,6 @@ export function useKeybinds(deps: KeybindRuntimeDeps): void {
       layoutHasRootSide('right') ? toggleFileBrowserOpen() : togglePaneVisible('terminal'),
     'view.toggleReview': toggleReview,
     'view.toggleStatusbar': toggleStatusbarVisible,
-    'view.toggleProfileRail': toggleProfileRailVisible,
     'view.toggleTabStrip': () => void toggleTargetZoneTabStrip(),
     'view.showFiles': showFiles,
     'view.showBrowser': openBrowserTab,
diff --git a/apps/desktop/src/app/hooks/use-on-profile-switch.test.tsx b/apps/desktop/src/app/hooks/use-on-profile-switch.test.tsx
new file mode 100644
index 0000000000..515c4fdb8a
--- /dev/null
+++ b/apps/desktop/src/app/hooks/use-on-profile-switch.test.tsx
@@ -0,0 +1,39 @@
+// @vitest-environment jsdom
+import { act, renderHook } from '@testing-library/react'
+import { StrictMode } from 'react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { $activeGatewayProfile } from '@/store/profile'
+
+import { useOnProfileSwitch } from './use-on-profile-switch'
+
+describe('useOnProfileSwitch', () => {
+  beforeEach(() => {
+    act(() => $activeGatewayProfile.set('default'))
+  })
+
+  it('never fires on mount', () => {
+    const onSwitch = vi.fn()
+
+    renderHook(() => useOnProfileSwitch(onSwitch))
+    expect(onSwitch).not.toHaveBeenCalled()
+  })
+
+  // StrictMode replays mount effects, so a "first mount" boolean is spent by
+  // the first pass and the replay fires onSwitch — wiping per-profile state on
+  // every mount instead of only on a real switch.
+  it('never fires on mount under the StrictMode effect replay', () => {
+    const onSwitch = vi.fn()
+
+    renderHook(() => useOnProfileSwitch(onSwitch), { wrapper: StrictMode })
+    expect(onSwitch).not.toHaveBeenCalled()
+  })
+
+  it('fires once per real profile change', () => {
+    const onSwitch = vi.fn()
+
+    renderHook(() => useOnProfileSwitch(onSwitch), { wrapper: StrictMode })
+    act(() => $activeGatewayProfile.set('scout'))
+    expect(onSwitch).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/apps/desktop/src/app/hooks/use-on-profile-switch.ts b/apps/desktop/src/app/hooks/use-on-profile-switch.ts
index dfdfd84f2c..3e50088b37 100644
--- a/apps/desktop/src/app/hooks/use-on-profile-switch.ts
+++ b/apps/desktop/src/app/hooks/use-on-profile-switch.ts
@@ -8,16 +8,19 @@ import { $activeGatewayProfile } from '@/store/profile'
  *  when the backend the app talks to swaps underneath a still-mounted view. */
 export function useOnProfileSwitch(onSwitch: () => void): void {
   const profile = useStore($activeGatewayProfile)
-  const first = useRef(true)
+  // Latch the last-SEEN profile rather than a "first mount" boolean: StrictMode
+  // replays mount effects, which spends such a boolean on the first pass and
+  // then fires onSwitch on the replay — wiping per-profile state on every mount
+  // instead of only on a real switch.
+  const seen = useRef(profile)
 
   // eslint-disable-next-line no-restricted-syntax -- legitimate non-atom ref write (see eslint rule comment)
   useEffect(() => {
-    if (first.current) {
-      first.current = false
-
+    if (seen.current === profile) {
       return
     }
 
+    seen.current = profile
     onSwitch()
     // Fire on profile change only; onSwitch identity is intentionally ignored.
     // eslint-disable-next-line react-hooks/exhaustive-deps
diff --git a/apps/desktop/src/app/me/change-password-dialog.tsx b/apps/desktop/src/app/me/change-password-dialog.tsx
new file mode 100644
index 0000000000..54af9a3d89
--- /dev/null
+++ b/apps/desktop/src/app/me/change-password-dialog.tsx
@@ -0,0 +1,178 @@
+import { type FormEvent, useState } from 'react'
+
+import { Button } from '@/components/ui/button'
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from '@/components/ui/dialog'
+import { Input } from '@/components/ui/input'
+import { useI18n } from '@/i18n'
+import { userAccountErrorText } from '@/lib/user-account-errors'
+import { userAccountLogout, userAccountResetConfirm, userAccountResetRequest } from '@/store/user-account'
+
+export interface ChangePasswordDialogProps {
+  site: string
+  email: string
+  onClose: () => void
+}
+
+export function ChangePasswordDialog({ site, email, onClose }: ChangePasswordDialogProps) {
+  const { t } = useI18n()
+  const copy = t.userAccount
+  const [sent, setSent] = useState(false)
+  const [changed, setChanged] = useState(false)
+  const [code, setCode] = useState('')
+  const [password, setPassword] = useState('')
+  const [confirmation, setConfirmation] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  async function signOut() {
+    setBusy(true)
+    setError(null)
+
+    try {
+      await userAccountLogout()
+    } catch (failure) {
+      setError(userAccountErrorText(copy, failure))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  function close() {
+    if (busy) {
+      return
+    }
+
+    if (changed) {
+      void signOut()
+    } else {
+      onClose()
+    }
+  }
+
+  async function submit(event: FormEvent) {
+    event.preventDefault()
+    setError(null)
+
+    if (sent && password !== confirmation) {
+      setError(copy.passwordMismatch)
+
+      return
+    }
+
+    setBusy(true)
+
+    try {
+      if (sent) {
+        await userAccountResetConfirm(site, email, code, password)
+        setPassword('')
+        setConfirmation('')
+        setCode('')
+        setChanged(true)
+      } else {
+        await userAccountResetRequest(site, email)
+        setSent(true)
+      }
+    } catch (failure) {
+      setError(userAccountErrorText(copy, failure))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Dialog
+      onOpenChange={open => {
+        if (!open) {
+          close()
+        }
+      }}
+      open
+    >
+      <DialogContent className="w-[calc(100%-2rem)] max-w-sm" showCloseButton={!busy}>
+        <DialogHeader>
+          <DialogTitle>{copy.me.changePassword}</DialogTitle>
+          <DialogDescription>{copy.me.passwordChangeDescription}</DialogDescription>
+        </DialogHeader>
+        {changed ? (
+          <>
+            <p className="text-sm" role="status">
+              {copy.resetDoneBody}
+            </p>
+            {error && (
+              <p className="text-sm text-destructive" role="alert">
+                {error}
+              </p>
+            )}
+            <DialogFooter>
+              <Button loading={busy} onClick={() => void signOut()}>
+                {copy.backToSignIn}
+              </Button>
+            </DialogFooter>
+          </>
+        ) : (
+          <form className="space-y-4" onSubmit={event => void submit(event)}>
+            <p className="break-all text-sm text-(--ui-text-secondary)">{email}</p>
+            {sent && (
+              <>
+                <p className="text-sm text-(--ui-text-tertiary)">{copy.resetSentBody}</p>
+                <label className="block space-y-1 text-sm">
+                  <span>{copy.codeLabel}</span>
+                  <Input
+                    autoComplete="one-time-code"
+                    autoFocus
+                    disabled={busy}
+                    onChange={event => setCode(event.target.value)}
+                    required
+                    value={code}
+                  />
+                </label>
+                <label className="block space-y-1 text-sm">
+                  <span>{copy.newPasswordLabel}</span>
+                  <Input
+                    autoComplete="new-password"
+                    disabled={busy}
+                    onChange={event => setPassword(event.target.value)}
+                    required
+                    type="password"
+                    value={password}
+                  />
+                </label>
+                <label className="block space-y-1 text-sm">
+                  <span>{copy.confirmPasswordLabel}</span>
+                  <Input
+                    autoComplete="new-password"
+                    disabled={busy}
+                    onChange={event => setConfirmation(event.target.value)}
+                    required
+                    type="password"
+                    value={confirmation}
+                  />
+                </label>
+              </>
+            )}
+            {error && (
+              <p className="text-sm text-destructive" role="alert">
+                {error}
+              </p>
+            )}
+            <DialogFooter>
+              <Button disabled={busy} onClick={onClose} type="button" variant="text">
+                {t.common.cancel}
+              </Button>
+              <Button loading={busy} type="submit">
+                {sent ? copy.resetConfirm : copy.resetSend}
+              </Button>
+            </DialogFooter>
+          </form>
+        )}
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/apps/desktop/src/app/me/me-page.test.tsx b/apps/desktop/src/app/me/me-page.test.tsx
index 323f600947..a52c5052b5 100644
--- a/apps/desktop/src/app/me/me-page.test.tsx
+++ b/apps/desktop/src/app/me/me-page.test.tsx
@@ -17,7 +17,14 @@ const PROFILE = {
 }
 
 function signedIn(overrides: Record<string, unknown> = {}) {
-  $userAccount.set({ status: 'signed_in', site: 'https://r', offline: false, profile: PROFILE, profileAsOf: null, ...overrides })
+  $userAccount.set({
+    status: 'signed_in',
+    site: 'https://r',
+    offline: false,
+    profile: PROFILE,
+    profileAsOf: null,
+    ...overrides
+  })
 }
 
 function stubBridge(overrides: Record<string, unknown> = {}) {
@@ -177,7 +184,12 @@ describe('MePage', () => {
 
   it('机器码随绑定状态展示（已绑定与未绑定同口径）', async () => {
     stubBridge({
-      bindingStatus: vi.fn(async () => ({ bound: true, site: 'https://r', installationId: 'inst-1', machineId: 'MR-ABCD-1234' }))
+      bindingStatus: vi.fn(async () => ({
+        bound: true,
+        site: 'https://r',
+        installationId: 'inst-1',
+        machineId: 'MR-ABCD-1234'
+      }))
     })
     signedIn()
     render(<MePage />)
@@ -204,7 +216,7 @@ describe('MePage', () => {
 })
 
 describe('UserAccountCard', () => {
-  it('signed_in：渲染展示名+邮箱；未登录不渲染', () => {
+  it('signed_in：只渲染展示名；未登录不渲染', () => {
     stubBridge()
     signedIn()
 
@@ -215,7 +227,6 @@ describe('UserAccountCard', () => {
     )
 
     expect(screen.getByText('小赫')).toBeTruthy()
-    expect(screen.getByText('u@example.com')).toBeTruthy()
     unmount()
 
     $userAccount.set({ status: 'signed_out' })
diff --git a/apps/desktop/src/app/pet-generate/components/reference-chip.tsx b/apps/desktop/src/app/pet-generate/components/reference-chip.tsx
index 266658a9da..b0131d21fd 100644
--- a/apps/desktop/src/app/pet-generate/components/reference-chip.tsx
+++ b/apps/desktop/src/app/pet-generate/components/reference-chip.tsx
@@ -36,7 +36,6 @@ export function ReferenceChip({ name, onRemove, src }: ReferenceChipProps) {
 
       <ImageLightbox
         alt={name}
-        copy={t.desktop}
         onClick={download}
         onOpenChange={setViewing}
         open={viewing}
diff --git a/apps/desktop/src/app/profiles/index.test.tsx b/apps/desktop/src/app/profiles/index.test.tsx
index 939af89e0f..e4e4eedf7f 100644
--- a/apps/desktop/src/app/profiles/index.test.tsx
+++ b/apps/desktop/src/app/profiles/index.test.tsx
@@ -27,6 +27,8 @@ vi.mock('@/components/chat/code-editor', () => ({
   CodeEditor: () => null
 }))
 
+vi.mock('../chat/sidebar/profile-switcher', () => ({ ProfileRail: () => <div data-testid="profile-controls" /> }))
+
 vi.mock('@/hermes', () => ({
   createProfile: vi.fn(async () => ({ name: 'x', ok: true, path: '/x' })),
   deleteProfile: vi.fn(async () => ({ ok: true, path: '/x' })),
diff --git a/apps/desktop/src/app/profiles/index.tsx b/apps/desktop/src/app/profiles/index.tsx
index af654e9d20..2d1cc2ee72 100644
--- a/apps/desktop/src/app/profiles/index.tsx
+++ b/apps/desktop/src/app/profiles/index.tsx
@@ -15,6 +15,7 @@ import { normalize } from '@/lib/text'
 import { notify, notifyError } from '@/store/notifications'
 import { $profileColors, profileLabel, refreshProfiles } from '@/store/profile'
 
+import { ProfileRail } from '../chat/sidebar/profile-switcher'
 import { useRefreshHotkey } from '../hooks/use-refresh-hotkey'
 import {
   Panel,
@@ -120,6 +121,9 @@ export function ProfilesView({ onClose }: ProfilesViewProps) {
       ) : (
         <>
           <PanelHeader subtitle={p.count(profiles.length)} title={p.title} />
+          <div className="mb-3 min-w-0 shrink-0" data-slot="profile-management-controls">
+            <ProfileRail management />
+          </div>
           <PanelBody>
             <PanelList
               onSearchChange={setQuery}
diff --git a/apps/desktop/src/app/profiles/profile-create-host.tsx b/apps/desktop/src/app/profiles/profile-create-host.tsx
new file mode 100644
index 0000000000..b88c987c3a
--- /dev/null
+++ b/apps/desktop/src/app/profiles/profile-create-host.tsx
@@ -0,0 +1,50 @@
+import { useStore } from '@nanostores/react'
+import { useEffect, useRef, useState } from 'react'
+
+import { useFleetRoster } from '@/app/chat/sidebar/use-fleet-roster'
+import { useProfileRailRefreshOnActive } from '@/app/chat/sidebar/use-profile-rail-refresh-on-active'
+import { $hasMultipleConnections } from '@/store/connections'
+import { $profileCreateRequest, $profiles, refreshActiveProfile, selectProfile } from '@/store/profile'
+import { $userAccount } from '@/store/user-account'
+
+import { CreateProfileDialog } from './create-profile-dialog'
+
+/** One shell-owned dialog, shared by menu commands and the create hotkey. */
+export function ProfileCreateHost() {
+  const account = useStore($userAccount)
+
+  return account.status === 'signed_in' ? (
+    <SignedInProfileCreateHost key={`${account.site}:${account.profile?.email ?? ''}`} />
+  ) : null
+}
+
+function SignedInProfileCreateHost() {
+  const profiles = useStore($profiles)
+  const multipleConnections = useStore($hasMultipleConnections)
+  const request = useStore($profileCreateRequest)
+  const lastRequest = useRef(request)
+  const [open, setOpen] = useState(false)
+
+  useProfileRailRefreshOnActive()
+  useFleetRoster(multipleConnections)
+
+  // eslint-disable-next-line no-restricted-syntax -- tracks a command sequence, not render state
+  useEffect(() => {
+    if (lastRequest.current !== request) {
+      lastRequest.current = request
+      setOpen(true)
+    }
+  }, [request])
+
+  return (
+    <CreateProfileDialog
+      onClose={() => setOpen(false)}
+      onCreated={async name => {
+        await refreshActiveProfile()
+        selectProfile(name)
+      }}
+      open={open}
+      profiles={profiles}
+    />
+  )
+}
diff --git a/apps/desktop/src/app/right-sidebar/files/tree-dblclick.test.tsx b/apps/desktop/src/app/right-sidebar/files/tree-dblclick.test.tsx
index f345ac690c..7c3d5b805e 100644
--- a/apps/desktop/src/app/right-sidebar/files/tree-dblclick.test.tsx
+++ b/apps/desktop/src/app/right-sidebar/files/tree-dblclick.test.tsx
@@ -7,7 +7,8 @@ import type * as FileActions from '../file-actions'
 const { openFileWithSystemApp } = vi.hoisted(() => ({ openFileWithSystemApp: vi.fn() }))
 
 vi.mock('@/lib/office-files', () => ({
-  isOfficeFilePath: (value: string) => /\.docx$|\.pptx$/i.test(value),
+  inlineOfficeFormat: (value: string) => (/\.docx$/i.test(value) ? 'docx' : /\.pptx$/i.test(value) ? 'pptx' : null),
+  isOfficeFilePath: (value: string) => /\.(doc|docx|ppt|pptx)$/i.test(value),
   openFileWithSystemApp
 }))
 vi.mock('../file-actions', async importOriginal => {
@@ -58,12 +59,30 @@ afterEach(() => {
 })
 
 describe('ProjectTreeRow double-click', () => {
-  it('opens office files with the system app instead of the preview', () => {
+  it('previews inline-renderable office files instead of system-opening them', () => {
     const { onPreviewFile, view } = renderRow('/w/report.docx')
 
     fireEvent.doubleClick(view.container.querySelector('[title="/w/report.docx"]')!)
 
-    expect(openFileWithSystemApp).toHaveBeenCalledWith('/w/report.docx')
+    expect(onPreviewFile).toHaveBeenCalledWith('/w/report.docx')
+    expect(openFileWithSystemApp).not.toHaveBeenCalled()
+  })
+
+  it('previews pptx inline', () => {
+    const { onPreviewFile, view } = renderRow('/w/deck.pptx')
+
+    fireEvent.doubleClick(view.container.querySelector('[title="/w/deck.pptx"]')!)
+
+    expect(onPreviewFile).toHaveBeenCalledWith('/w/deck.pptx')
+    expect(openFileWithSystemApp).not.toHaveBeenCalled()
+  })
+
+  it('still opens legacy office formats with the system app', () => {
+    const { onPreviewFile, view } = renderRow('/w/old.doc')
+
+    fireEvent.doubleClick(view.container.querySelector('[title="/w/old.doc"]')!)
+
+    expect(openFileWithSystemApp).toHaveBeenCalledWith('/w/old.doc')
     expect(onPreviewFile).not.toHaveBeenCalled()
   })
 
diff --git a/apps/desktop/src/app/right-sidebar/files/tree.tsx b/apps/desktop/src/app/right-sidebar/files/tree.tsx
index de3fcadb84..4df625a927 100644
--- a/apps/desktop/src/app/right-sidebar/files/tree.tsx
+++ b/apps/desktop/src/app/right-sidebar/files/tree.tsx
@@ -7,7 +7,7 @@ import { TreeSkeleton } from '@/components/chat/skeletons'
 import { Codicon } from '@/components/ui/codicon'
 import { markRightPanePerf } from '@/debug/right-pane-events'
 import { useResizeObserver } from '@/hooks/use-resize-observer'
-import { isOfficeFilePath, openFileWithSystemApp } from '@/lib/office-files'
+import { inlineOfficeFormat, isOfficeFilePath, openFileWithSystemApp } from '@/lib/office-files'
 import { cn } from '@/lib/utils'
 import { type RepoChangeKind, repoChangeKindForPath } from '@/store/coding-status'
 import { $renamingPath, beginInlineRename } from '@/store/file-actions'
@@ -327,9 +327,9 @@ export function ProjectTreeRow({
         event.stopPropagation()
 
         if (!isFolder && !isPlaceholder && $renamingPath.get() !== node.data.id) {
-          // Office documents have no inline renderer — hand them to the OS
-          // default application instead of the (useless) binary refusal page.
-          if (isOfficeFilePath(node.data.id)) {
+          // Only Office formats the preview pane can't render (legacy .doc/.ppt
+          // etc.) go to the OS default application; .docx/.pptx preview inline.
+          if (isOfficeFilePath(node.data.id) && !inlineOfficeFormat(node.data.id)) {
             void openFileWithSystemApp(node.data.id)
 
             return
diff --git a/apps/desktop/src/app/right-sidebar/index.tsx b/apps/desktop/src/app/right-sidebar/index.tsx
index b154ecf304..82ad729dc1 100644
--- a/apps/desktop/src/app/right-sidebar/index.tsx
+++ b/apps/desktop/src/app/right-sidebar/index.tsx
@@ -77,7 +77,7 @@ export function RightSidebarPane({ onActivateFile, onActivateFolder }: RightSide
     <aside
       aria-label={r.aria}
       className={cn(
-        'before:pointer-events-none relative flex h-full w-full min-w-0 flex-col overflow-hidden border-(--ui-stroke-secondary) bg-(--ui-sidebar-surface-background) pt-(--titlebar-height) text-(--ui-text-tertiary)',
+        'before:pointer-events-none relative flex h-full w-full min-w-0 flex-col overflow-hidden border-(--ui-stroke-secondary) bg-(--ui-editor-surface-background) pt-(--titlebar-height) text-(--ui-text-tertiary)',
         panesFlipped
           ? 'border-r shadow-[inset_-0.0625rem_0_0_color-mix(in_srgb,white_18%,transparent)]'
           : 'border-l shadow-[inset_0.0625rem_0_0_color-mix(in_srgb,white_18%,transparent)]'
diff --git a/apps/desktop/src/app/session/hooks/use-session-actions/index.ts b/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
index 321465e62a..40467813d9 100644
--- a/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
+++ b/apps/desktop/src/app/session/hooks/use-session-actions/index.ts
@@ -474,6 +474,10 @@ export function useSessionActions({
       const workspaceTarget = hasWorkspaceTarget
         ? normalizeNewChatWorkspaceTarget(draftOptions.workspaceTarget)
         : undefined
+      // Resolve before clearing the selected stored id below. In the unscoped
+      // sidebar view, a new draft intentionally inherits the previous
+      // conversation's owned workspace.
+      const resolvedWorkspaceCwd = !hasWorkspaceTarget ? resolveNewSessionCwd() : ''
 
       resetViewSync()
       busyRef.current = false
@@ -525,11 +529,11 @@ export function useSessionActions({
       setNewChatWorkspaceTarget(hasWorkspaceTarget ? workspaceTarget : undefined)
 
       if (!hasWorkspaceTarget) {
-        // In a project → the repo's default-branch checkout; not in a project →
-        // detached. So cmd-n does not inherit an unrelated linked worktree.
+        // In a project → the repo's default-branch checkout; outside a project
+        // → the previous conversation's workspace, then the configured default.
         // Transient: a resolved default is not the user naming a workspace, and
         // remembering it here would make the NEXT new chat inherit it.
-        setCurrentCwdTransient(resolveNewSessionCwd())
+        setCurrentCwdTransient(resolvedWorkspaceCwd)
       } else if (workspaceTarget === null) {
         setCurrentCwdTransient('')
       } else if (typeof workspaceTarget === 'string') {
diff --git a/apps/desktop/src/app/settings/env-credentials.tsx b/apps/desktop/src/app/settings/env-credentials.tsx
index 8be974dc68..c71c38e4b0 100644
--- a/apps/desktop/src/app/settings/env-credentials.tsx
+++ b/apps/desktop/src/app/settings/env-credentials.tsx
@@ -93,6 +93,20 @@ export function useEnvCredentials(profile?: string): UseEnvCredentials {
     // eslint-disable-next-line react-hooks/exhaustive-deps -- reload per target profile; copy is stable
   }, [profile])
 
+  // Re-read for callers that write to the env store themselves (the
+  // FreeModel2API panel owns its own Save). The reload effect above only fires
+  // on a profile change, so without this `vars` would keep describing the
+  // pre-save store and the Keys page would show the fresh slots as unset.
+  // Deliberately leaves `edits`/`revealed` alone: those belong to the user's
+  // in-progress typing, not to the store being re-read.
+  async function refresh() {
+    try {
+      setVars(await getEnvVars(profile))
+    } catch (err) {
+      notifyError(err, t.settings.keys.failedLoad)
+    }
+  }
+
   function patchVar(key: string, patch: Partial<Pick<EnvVarInfo, 'is_set' | 'redacted_value'>>) {
     setVars(c => (c ? { ...c, [key]: { ...c[key], ...patch } } : c))
   }
@@ -186,6 +200,7 @@ export function useEnvCredentials(profile?: string): UseEnvCredentials {
   }
 
   return {
+    refresh,
     saveValue,
     vars,
     rowProps: {
@@ -207,6 +222,7 @@ interface CategoryHeadingProps {
 }
 
 interface UseEnvCredentials {
+  refresh: () => Promise<void>
   rowProps: Omit<EnvRowProps, 'varKey' | 'info'>
   saveValue: (key: string, value: string) => Promise<{ message?: string; ok: boolean }>
   vars: Record<string, EnvVarInfo> | null
diff --git a/apps/desktop/src/app/settings/freemodel2api-settings.test.tsx b/apps/desktop/src/app/settings/freemodel2api-settings.test.tsx
index 89ab841a86..5f660b8706 100644
--- a/apps/desktop/src/app/settings/freemodel2api-settings.test.tsx
+++ b/apps/desktop/src/app/settings/freemodel2api-settings.test.tsx
@@ -1,6 +1,8 @@
 import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
+import { notify } from '@/store/notifications'
+
 import { FreeModel2ApiSettings } from './freemodel2api-settings'
 
 const fm2 = {
@@ -9,25 +11,86 @@ const fm2 = {
   keys: vi.fn(),
   logout: vi.fn(),
   rememberedLoad: vi.fn(),
-  rememberedSave: vi.fn()
+  rememberedSave: vi.fn(),
+  keyBalance: vi.fn()
 }
 
-const saveCustomEndpoint = vi.fn()
 const validateCustomEndpoint = vi.fn()
+const getGlobalModelOptions = vi.fn()
+const getRecommendedDefaultModel = vi.fn()
+const setModelAssignment = vi.fn()
+const setEnvVar = vi.fn()
+const deleteEnvVar = vi.fn()
+const getEnvVars = vi.fn()
+const revealEnvVar = vi.fn()
+const getHermesConfig = vi.fn()
+const saveHermesConfig = vi.fn()
+const confirm = vi.fn()
+// 面板自己写 env 槽,宿主靠这个信号重读 Keys 页(providers-settings.tsx)
+const onConfigSaved = vi.fn()
 
 vi.mock('@/hermes', () => ({
-  saveCustomEndpoint: (...args: any[]) => saveCustomEndpoint(...args),
-  validateCustomEndpoint: (...args: any[]) => validateCustomEndpoint(...args)
+  getApiRequestProfile: () => 'default',
+  validateCustomEndpoint: (...args: any[]) => validateCustomEndpoint(...args),
+  getGlobalModelOptions: (...args: any[]) => getGlobalModelOptions(...args),
+  getRecommendedDefaultModel: (...args: any[]) => getRecommendedDefaultModel(...args),
+  setModelAssignment: (...args: any[]) => setModelAssignment(...args),
+  setEnvVar: (...args: any[]) => setEnvVar(...args),
+  deleteEnvVar: (...args: any[]) => deleteEnvVar(...args),
+  getEnvVars: (...args: any[]) => getEnvVars(...args),
+  revealEnvVar: (...args: any[]) => revealEnvVar(...args),
+  getHermesConfig: (...args: any[]) => getHermesConfig(...args),
+  saveHermesConfig: (...args: any[]) => saveHermesConfig(...args)
 }))
 
+vi.mock('@/store/confirm', () => ({ confirm: (...args: any[]) => confirm(...args) }))
 vi.mock('@/store/notifications', () => ({ notify: vi.fn(), notifyError: vi.fn() }))
 vi.mock('@/lib/haptics', () => ({ triggerHaptic: vi.fn() }))
 
 const KEY = { id: 7, name: 'main', key: 'sk-full-value-1234', status: 'enabled', quota: 0, quotaUsed: 0, createdAt: '2026-01-01', lastUsedAt: null }
 
+/** 面板后半的「绑定 FreeModelAPI Key」卡片。取整段而不是单个文本节点:key 名在前后两处都出现 */
+function card(): HTMLElement {
+  const box = screen.getByText('绑定 FreeModelAPI Key').closest('section')
+
+  if (!box) {
+    throw new Error('current-key card not rendered')
+  }
+
+  return box
+}
+
+/** 面板最后的「测试」那一段(标题 `测试`,按钮 `测试所选 Key`) */
+function testBox(): HTMLElement {
+  const box = screen.getByText('测试').closest('section')
+
+  if (!box) {
+    throw new Error('test section not rendered')
+  }
+
+  return box
+}
+
 beforeEach(() => {
   vi.clearAllMocks()
   fm2.rememberedLoad.mockResolvedValue(null)
+  setEnvVar.mockResolvedValue({ ok: true })
+  deleteEnvVar.mockResolvedValue({ ok: true })
+  // 默认没有已保存的 key(首次配置),也没有目录价格
+  getHermesConfig.mockResolvedValue({})
+  getEnvVars.mockResolvedValue({})
+  revealEnvVar.mockResolvedValue({ key: '', value: '' })
+  getGlobalModelOptions.mockResolvedValue({ providers: [] })
+  getRecommendedDefaultModel.mockResolvedValue({ provider: 'freemodel2api', model: '', free_tier: null })
+  setModelAssignment.mockResolvedValue({
+    ok: true,
+    provider: 'freemodel2api',
+    model: 'gpt-5.4',
+    gateway_tools: []
+  })
+  saveHermesConfig.mockResolvedValue({ ok: true })
+  confirm.mockResolvedValue(true)
+  fm2.keyBalance.mockResolvedValue({ balance: null })
   ;(window as any).hermesDesktop = { ...(window as any).hermesDesktop, freemodel2api: fm2 }
 })
 
@@ -37,16 +100,42 @@ describe('FreeModel2ApiSettings', () => {
   it('shows login form when not configured', async () => {
     fm2.status.mockResolvedValue({ configured: false })
     render(<FreeModel2ApiSettings />)
-    await screen.findByLabelText(/base url/i)
-    expect(screen.getByLabelText(/email/i)).toBeTruthy()
-    expect(screen.getByLabelText(/password/i)).toBeTruthy()
+    await screen.findByLabelText(/FreeModelAPI URL/i)
+    expect(screen.getByLabelText(/用户\(邮箱\)/)).toBeTruthy()
+    expect(screen.getByLabelText(/FreeModelAPI 密码/i)).toBeTruthy()
+    // 登录和管理在同一页:未登录时只是下半部分还没长出来
+    expect(screen.getByRole('checkbox', { name: /记住用户名密码/ })).toBeTruthy()
+    expect(screen.queryByText('账户')).toBeNull()
+  })
+
+  it('shows the saved api key instead of account info when not logged in', async () => {
+    fm2.status.mockResolvedValue({ configured: false })
+    // 凭据还在 env 里(sub2api 会话没了),面板降级成「选中的 API Key」读数
+    getEnvVars.mockResolvedValue({
+      FREEMODEL2API_API_KEY: { is_set: true, redacted_value: 'sk-dyw...6a3f' },
+      FREEMODEL2API_BASE_URL: { is_set: true, redacted_value: 'http...0/v1' }
+    })
+    revealEnvVar.mockResolvedValue({ key: 'FREEMODEL2API_BASE_URL', value: 'http://124.232.163.75:3020/v1' })
+
+    render(<FreeModel2ApiSettings />)
+
+    expect(await screen.findByText('已配置 sk-dyw...6a3f')).toBeTruthy()
+    // base url 不是机密:显示 reveal 回来的全值,不是掩码行那个「http...0/v1」
+    expect(screen.getByText('http://124.232.163.75:3020/v1')).toBeTruthy()
+    // 没登录就没有账户读数,也不该出现 key 管理
+    expect(screen.queryByText('账号')).toBeNull()
+    expect(screen.queryByRole('combobox', { name: /api key/i })).toBeNull()
   })
 
   it('auto-connects from stored credentials', async () => {
     fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
     fm2.keys.mockResolvedValue({ keys: [] })
     render(<FreeModel2ApiSettings />)
-    await screen.findByText(/\$3\.00/)
+    // 已登录:登录按钮换成绿色「已登录」章(点它退会话),Disconnect 不复存在
+    await screen.findByRole('button', { name: '已登录' })
+    expect(screen.queryByRole('button', { name: /disconnect/i })).toBeNull()
+    // 余额在账户区和绑定卡片各显示一份
+    await screen.findAllByText(/\$3\.00/)
     expect(screen.getByText(/no api keys/i)).toBeTruthy()
   })
 
@@ -56,52 +145,261 @@ describe('FreeModel2ApiSettings', () => {
     fm2.keys.mockResolvedValue({ keys: [KEY] })
 
     render(<FreeModel2ApiSettings />)
-    fireEvent.change(await screen.findByLabelText(/base url/i), { target: { value: 'https://sub.example.com/' } })
-    fireEvent.change(screen.getByLabelText(/email/i), { target: { value: 'u@example.com' } })
-    fireEvent.change(screen.getByLabelText(/password/i), { target: { value: 'pw' } })
-    fireEvent.click(screen.getByRole('button', { name: /connect/i }))
+    fireEvent.change(await screen.findByLabelText(/FreeModelAPI URL/i), { target: { value: 'https://sub.example.com/' } })
+    fireEvent.change(screen.getByLabelText(/用户\(邮箱\)/), { target: { value: 'u@example.com' } })
+    fireEvent.change(screen.getByLabelText(/FreeModelAPI 密码/i), { target: { value: 'pw' } })
+    fireEvent.click(screen.getByRole('button', { name: /登录 FreeModelAPI/ }))
 
-    const balance = await screen.findByText(/\$9\.50/)
+    // 余额必须在 key 下拉列表上方(取文档序第一份 = 账户区那格)
+    const [balance] = await screen.findAllByText(/\$9\.50/)
     const select = await screen.findByRole('combobox', { name: /api key/i })
     // 余额必须在 key 下拉列表上方
     expect(balance.compareDocumentPosition(select) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy()
-    // 下拉项显示名称 + 首尾片段,不露完整 key
+    // 下拉项显示名称 + 状态;掩码在下面那行,完整 key 哪里都不出现
     const option = screen.getByRole('option', { name: /main/ })
-    expect(option.textContent).toContain('sk-ful')
-    expect(option.textContent).toContain('1234')
+    expect(option.textContent).toContain('可用')
     expect(option.textContent).not.toContain('sk-full-value-1234')
   })
 
-  it('tests models for the selected key, then writes provider with /v1', async () => {
+  it('auto-loads models for the selected key, then saves it as the main default', async () => {
     fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 9.5 })
     fm2.keys.mockResolvedValue({ keys: [KEY] })
     validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4', 'claude-x'] })
-    saveCustomEndpoint.mockResolvedValue({ ok: true, endpoints: [], current: null })
 
-    render(<FreeModel2ApiSettings />)
-    fireEvent.click(await screen.findByRole('button', { name: /test models/i }))
+    render(<FreeModel2ApiSettings onConfigSaved={onConfigSaved} />)
 
+    // 不点任何按钮,选中 key 就位即自动拉取
     await waitFor(() => expect(validateCustomEndpoint).toHaveBeenCalled())
     expect(validateCustomEndpoint.mock.calls[0][0]).toMatchObject({
       base_url: 'https://sub.example.com/v1',
       api_key: 'sk-full-value-1234'
     })
-    // 模型列表展示出来
-    await screen.findByText('gpt-5.4')
-    await screen.findByText('claude-x')
 
-    fireEvent.click(screen.getByRole('button', { name: /write provider/i }))
-    await waitFor(() => expect(saveCustomEndpoint).toHaveBeenCalled())
-    expect(saveCustomEndpoint.mock.calls[0][0]).toMatchObject({
-      id: 'FreeModel2API',
-      name: 'FreeModel2API',
-      base_url: 'https://sub.example.com/v1',
-      api_key: 'sk-full-value-1234',
-      model: 'gpt-5.4',
-      models: ['gpt-5.4', 'claude-x'],
-      discover_models: true,
-      make_default: false
+    // 该 key 的模型只是「显示」:keys 区没有勾选框,也没有主模型下拉
+    // (页面顶部的「记住用户名密码」勾选框不属于这个 section)
+    await screen.findAllByText('gpt-5.4')
+    await screen.findAllByText('claude-x')
+    const keysSection = screen.getByRole('combobox', { name: /api key/i }).closest('section')
+    expect(keysSection?.querySelectorAll('input[type="checkbox"]').length).toBe(0)
+    expect(screen.queryByRole('combobox', { name: /main model/i })).toBeNull()
+
+    fireEvent.click(screen.getByRole('button', { name: /保存并设为默认/ }))
+    await waitFor(() => expect(setEnvVar).toHaveBeenCalledTimes(2))
+    expect(setEnvVar.mock.calls[0]).toEqual(['FREEMODEL2API_API_KEY', 'sk-full-value-1234', undefined])
+    expect(setEnvVar.mock.calls[1]).toEqual(['FREEMODEL2API_BASE_URL', 'https://sub.example.com/v1', undefined])
+    // config 里只留「保存的是哪把 key」;models 写空数组是为了抹掉旧白名单,
+    // discover_models 必须回 true,否则旧条目的 false 会把这行钉死在空清单上
+    expect(saveHermesConfig).toHaveBeenCalledWith(
+      { providers: { freemodel2api: { discover_models: true, key_id: 7, models: [] } } },
+      undefined
+    )
+    await waitFor(() =>
+      expect(setModelAssignment).toHaveBeenCalledWith(
+        { provider: 'freemodel2api', model: 'gpt-5.4', scope: 'main' }
+      )
+    )
+    expect(onConfigSaved).toHaveBeenCalled()
+  })
+
+  it('copies the selected api key to the clipboard', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    Object.assign(navigator, { clipboard: { writeText } })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    fireEvent.click(screen.getByRole('button', { name: /copy api key/i }))
+    expect(writeText).toHaveBeenCalledWith('sk-full-value-1234')
+    // 复制有反馈:成功后弹 notify,不然用户不知道复制上了没有
+    await waitFor(() => expect(notify).toHaveBeenCalled())
+  })
+
+  it('shows each model with the price the catalog reports', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 9.5 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4', 'claude-x', 'half-priced'] })
+    getGlobalModelOptions.mockResolvedValue({
+      providers: [
+        {
+          slug: 'freemodel2api',
+          pricing: {
+            'gpt-5.4': { input: '$0.10', output: '$0.40', free: false },
+            'claude-x': { input: '', output: '', free: true },
+            'half-priced': { input: '$2.00', output: '', free: false }
+          }
+        }
+      ]
     })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    // 有价的显示 in/out,免费的写 free,目录没报价的就空着(不编一个 0 出来);
+    // 只报半边价的,缺的那半写 — 而不是 ?
+    await screen.findByText('$0.10 / $0.40')
+    expect(screen.getByText('free')).toBeTruthy()
+    await screen.findByText('$2.00 / —')
+  })
+
+  it('tests the selected key: group multiplier, model count and every price', async () => {
+    const KEY2 = { ...KEY, id: 8, name: 'backup', key: 'sk-other-9999' }
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY, KEY2] })
+    validateCustomEndpoint.mockResolvedValue({
+      ok: true,
+      reachable: true,
+      message: '',
+      models: ['gpt-5.4', 'claude-x', 'no-price-model'],
+      pricing: {
+        'gpt-5.4': { input: '$0.30', output: '$1.20', free: false },
+        'claude-x': { input: '$2.00', output: '$4.00', free: false }
+      },
+      rate_multiplier: 2
+    })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    // 点之前只有提示,没有结果
+    expect(testBox().textContent).not.toContain('×2')
+
+    fireEvent.click(screen.getByRole('button', { name: /测试所选 Key/ }))
+
+    await waitFor(() => expect(testBox().textContent).toContain('×2'))
+    // 这一次探测带价:价格里已经乘过倍率,倍率另给一个数
+    expect(validateCustomEndpoint.mock.calls.at(-1)?.[0]).toMatchObject({
+      api_key: 'sk-full-value-1234',
+      with_pricing: true
+    })
+    expect(testBox().textContent).toContain('$0.30 / $1.20')
+    expect(testBox().textContent).toContain('$2.00 / $4.00')
+    // 端点没报价的模型照样列出来(价格那格是不知道)
+    expect(testBox().textContent).toContain('no-price-model')
+
+    // 换一把 key:上一次的结果不能留在面板上冒充这把 key 的
+    fireEvent.change(screen.getByRole('combobox', { name: /api key/i }), { target: { value: '8' } })
+    await waitFor(() => expect(testBox().textContent).not.toContain('×2'))
+  })
+
+  it('says the multiplier is unknown when the endpoint never reports one', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({
+      ok: true,
+      reachable: true,
+      message: '',
+      models: ['gpt-5.4'],
+      pricing: {},
+      rate_multiplier: 0
+    })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+    fireEvent.click(screen.getByRole('button', { name: /测试所选 Key/ }))
+
+    await waitFor(() => expect(testBox().textContent).toContain('模型数'))
+    // 倍率 0 = 不知道:不写「×0」,价格那格也照实空着
+    expect(testBox().textContent).not.toContain('×')
+    expect(testBox().textContent).toContain('—')
+  })
+
+  it('re-pulls models for the key that replaced the previous one', async () => {
+    const KEY2 = { ...KEY, id: 8, name: 'backup', key: 'sk-other-9999' }
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY, KEY2] })
+    validateCustomEndpoint
+      .mockResolvedValueOnce({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+      .mockResolvedValueOnce({ ok: true, reachable: true, message: '', models: ['claude-x'] })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    fireEvent.change(screen.getByRole('combobox', { name: /api key/i }), { target: { value: '8' } })
+
+    await screen.findAllByText('claude-x')
+    expect(validateCustomEndpoint.mock.calls.at(-1)?.[0]).toMatchObject({ api_key: 'sk-other-9999' })
+    // 上一把 key 的模型不再残留
+    expect(screen.queryByText('gpt-5.4')).toBeNull()
+  })
+
+  it('logs out from the 已登录 chip without touching the saved key', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    fm2.logout.mockResolvedValue({ ok: true })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    getEnvVars.mockResolvedValue({
+      FREEMODEL2API_API_KEY: { is_set: true, redacted_value: 'sk-ful...1234' },
+      FREEMODEL2API_BASE_URL: { is_set: true, redacted_value: 'https.../v1' }
+    })
+    revealEnvVar.mockImplementation((key: any) =>
+      key === 'FREEMODEL2API_BASE_URL'
+        ? Promise.resolve({ key, value: 'https://sub.example.com/v1' })
+        : Promise.resolve({ key, value: 'sk-full-value-1234' }))
+    fm2.keyBalance.mockResolvedValue({ balance: 5.25 })
+
+    render(<FreeModel2ApiSettings onConfigSaved={onConfigSaved} />)
+    fireEvent.click(await screen.findByRole('button', { name: '已登录' }))
+
+    await waitFor(() => expect(fm2.logout).toHaveBeenCalled())
+    // env 和 config 都不动 —— 删凭据是「删除当前 Key」的事,退会话不该顺手删
+    expect(deleteEnvVar).not.toHaveBeenCalled()
+    expect(saveHermesConfig).not.toHaveBeenCalled()
+    expect(onConfigSaved).not.toHaveBeenCalled()
+    // 退完仍能看到选中的 key 读数:掩码、全值 base url(不是「https.../v1」)、余额、能点的测试按钮
+    await screen.findByText('已配置 sk-ful...1234')
+    expect((await screen.findAllByText('https://sub.example.com/v1')).length).toBeGreaterThan(0)
+    await screen.findByText('$5.25')
+    expect(fm2.keyBalance).toHaveBeenCalledWith({ baseUrl: 'https://sub.example.com/v1', apiKey: 'sk-full-value-1234' })
+    expect((screen.getByRole('button', { name: /测试所选 Key/ }) as HTMLButtonElement).disabled).toBe(false)
+  })
+
+  it('tests the saved key without a session', async () => {
+    fm2.status.mockResolvedValue({ configured: false })
+    getEnvVars.mockResolvedValue({
+      FREEMODEL2API_API_KEY: { is_set: true, redacted_value: 'sk-dyw...6a3f' },
+      FREEMODEL2API_BASE_URL: { is_set: true, redacted_value: 'http...0/v1' }
+    })
+    revealEnvVar.mockImplementation((key: any) =>
+      key === 'FREEMODEL2API_BASE_URL'
+        ? Promise.resolve({ key, value: 'http://124.232.163.75:3020/v1' })
+        : Promise.resolve({ key, value: 'sk-saved-9999' }))
+    validateCustomEndpoint.mockResolvedValue({
+      ok: true,
+      reachable: true,
+      message: '',
+      models: ['gpt-5.4'],
+      pricing: { 'gpt-5.4': { input: '$0.30', output: '$1.20', free: false } },
+      rate_multiplier: 2
+    })
+    fm2.keyBalance.mockResolvedValue({ balance: 9181.34 })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findByText('已配置 sk-dyw...6a3f')
+
+    // 不登录也能看余额:凭 env 里那把 key 直查(sub2api /v1/sub2api/balance),不走会话
+    await waitFor(() => expect(fm2.keyBalance).toHaveBeenCalledWith({
+      baseUrl: 'http://124.232.163.75:3020/v1',
+      apiKey: 'sk-saved-9999'
+    }))
+    expect(await screen.findByText('$9181.34')).toBeTruthy()
+    const rechargeHrefs = screen.getAllByText('充值').map(e => e.closest('a')?.getAttribute('href'))
+    expect(rechargeHrefs).toContain('http://124.232.163.75:3020')
+    // 删除是未登录唯一不许做的事:按钮只长在登录后的绑定卡片里
+    expect(screen.queryByRole('button', { name: /删除当前 Key/ })).toBeNull()
+
+    // 断开后测试照样能打:用的 key 是 env 里保存的那把(reveal 回来的全值)
+    fireEvent.click(screen.getByRole('button', { name: /测试所选 Key/ }))
+    await waitFor(() => expect(validateCustomEndpoint).toHaveBeenCalled())
+    expect(validateCustomEndpoint.mock.calls.at(-1)?.[0]).toMatchObject({
+      api_key: 'sk-saved-9999',
+      base_url: 'http://124.232.163.75:3020/v1',
+      with_pricing: true
+    })
+    await waitFor(() => expect(testBox().textContent).toContain('×2'))
+    expect(testBox().textContent).toContain('$0.30 / $1.20')
   })
 
   it('refreshes balance and keys when clicking refresh', async () => {
@@ -110,13 +408,13 @@ describe('FreeModel2ApiSettings', () => {
     fm2.keys.mockResolvedValue({ keys: [KEY] })
 
     render(<FreeModel2ApiSettings />)
-    await screen.findByText(/\$3\.00/)
+    await screen.findAllByText(/\$3\.00/)
 
     fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 12.5 })
     fm2.keys.mockResolvedValue({ keys: [KEY, KEY2] })
     fireEvent.click(screen.getByRole('button', { name: /refresh/i }))
 
-    await screen.findByText(/\$12\.50/)
+    await screen.findAllByText(/\$12\.50/)
     await waitFor(() => expect(screen.getByRole('option', { name: /backup/ })).toBeTruthy())
     // 已选中的 key 仍然存在时保持选中
     expect((screen.getByRole('combobox', { name: /api key/i }) as HTMLSelectElement).value).toBe('7')
@@ -136,41 +434,238 @@ describe('FreeModel2ApiSettings', () => {
     await waitFor(() => expect((screen.getByRole('combobox', { name: /api key/i }) as HTMLSelectElement).value).toBe('8'))
   })
 
-  it('prefills the form from remembered login', async () => {
+  it('prefills url and email from remembered login, keeping the password off the page', async () => {
     fm2.status.mockResolvedValue({ configured: false })
     fm2.rememberedLoad.mockResolvedValue({ baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw-123' })
 
     render(<FreeModel2ApiSettings />)
-    await waitFor(() => expect((screen.getByLabelText(/base url/i) as HTMLInputElement).value).toBe('https://sub.example.com'))
-    expect((screen.getByLabelText(/email/i) as HTMLInputElement).value).toBe('u@example.com')
-    expect((screen.getByLabelText(/password/i) as HTMLInputElement).value).toBe('pw-123')
-    expect((screen.getByLabelText(/remember/i) as HTMLInputElement).checked).toBe(true)
+    await waitFor(() => expect((screen.getByLabelText(/FreeModelAPI URL/i) as HTMLInputElement).value).toBe('https://sub.example.com'))
+    expect((screen.getByLabelText(/用户\(邮箱\)/) as HTMLInputElement).value).toBe('u@example.com')
+    // 密码不回显明文:输入框空着,只提示有一份存着的
+    const pwField = screen.getByLabelText(/FreeModelAPI 密码/i) as HTMLInputElement
+    expect(pwField.value).toBe('')
+    expect(pwField.placeholder).toBe('已保存，留空即不修改')
+    expect(screen.getByRole('checkbox', { name: /记住用户名密码/ })).toBeTruthy()
   })
 
-  it('saves remembered login on connect when checked, clears when unchecked', async () => {
+  it('prefills url and email from remembered login while connected too', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.rememberedLoad.mockResolvedValue({ baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw-123' })
+    fm2.keys.mockResolvedValue({ keys: [] })
+
+    render(<FreeModel2ApiSettings />)
+
+    // 已登录时登录框也不能空着 —— 那会让用户以为「记住用户名密码」没生效
+    await waitFor(() => expect((screen.getByLabelText(/FreeModelAPI URL/i) as HTMLInputElement).value).toBe('https://sub.example.com'))
+    expect((screen.getByLabelText(/用户\(邮箱\)/) as HTMLInputElement).value).toBe('u@example.com')
+    expect((screen.getByLabelText(/FreeModelAPI 密码/i) as HTMLInputElement).placeholder).toBe('已保存，留空即不修改')
+  })
+
+  it('logs in with the remembered password when the field is left blank', async () => {
+    fm2.status.mockResolvedValue({ configured: false })
+    fm2.rememberedLoad.mockResolvedValue({ baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw-123' })
+    fm2.login.mockResolvedValue({ ok: true, email: 'u@example.com', balance: 1 })
+    fm2.keys.mockResolvedValue({ keys: [] })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findByLabelText(/FreeModelAPI URL/i)
+    // 密码留空直接点登录:用 Gateway 记住的那份
+    fireEvent.click(screen.getByRole('button', { name: /登录 FreeModelAPI/ }))
+
+    await waitFor(() => expect(fm2.login).toHaveBeenCalledWith({
+      baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw-123'
+    }))
+  })
+
+  it('remembers the login only while the checkbox is on', async () => {
     fm2.status.mockResolvedValue({ configured: false })
     fm2.login.mockResolvedValue({ ok: true, email: 'u@example.com', balance: 1 })
     fm2.keys.mockResolvedValue({ keys: [] })
 
-    const { unmount } = render(<FreeModel2ApiSettings />)
-    fireEvent.change(await screen.findByLabelText(/base url/i), { target: { value: 'https://sub.example.com' } })
-    fireEvent.change(screen.getByLabelText(/email/i), { target: { value: 'u@example.com' } })
-    fireEvent.change(screen.getByLabelText(/password/i), { target: { value: 'pw' } })
-    fireEvent.click(screen.getByRole('button', { name: /connect/i }))
+    // 勾着(默认):登录后落盘
+    const first = render(<FreeModel2ApiSettings />)
+    fireEvent.change(await screen.findByLabelText(/FreeModelAPI URL/i), { target: { value: 'https://sub.example.com' } })
+    fireEvent.change(screen.getByLabelText(/用户\(邮箱\)/), { target: { value: 'u@example.com' } })
+    fireEvent.change(screen.getByLabelText(/FreeModelAPI 密码/i), { target: { value: 'pw' } })
+    fireEvent.click(screen.getByRole('button', { name: /登录 FreeModelAPI/ }))
 
     await waitFor(() => expect(fm2.rememberedSave).toHaveBeenCalledWith({
       baseUrl: 'https://sub.example.com', email: 'u@example.com', password: 'pw'
     }))
-    unmount()
+    first.unmount()
 
-    // 取消勾选后连接 → 清除记住的登录信息
+    // 取消勾选:这一次登录不落盘(没 Disconnect,只能换个新渲染从没登录态开始)
     fm2.rememberedSave.mockClear()
+    fm2.login.mockClear()
     render(<FreeModel2ApiSettings />)
-    fireEvent.change(await screen.findByLabelText(/base url/i), { target: { value: 'https://sub.example.com' } })
-    fireEvent.change(screen.getByLabelText(/email/i), { target: { value: 'u@example.com' } })
-    fireEvent.change(screen.getByLabelText(/password/i), { target: { value: 'pw' } })
-    fireEvent.click(screen.getByLabelText(/remember/i))
-    fireEvent.click(screen.getByRole('button', { name: /connect/i }))
-    await waitFor(() => expect(fm2.rememberedSave).toHaveBeenCalledWith(null))
+    fireEvent.change(await screen.findByLabelText(/FreeModelAPI URL/i), { target: { value: 'https://other.example.com' } })
+    fireEvent.change(screen.getByLabelText(/用户\(邮箱\)/), { target: { value: 'u@example.com' } })
+    fireEvent.change(screen.getByLabelText(/FreeModelAPI 密码/i), { target: { value: 'pw' } })
+    fireEvent.click(screen.getByRole('checkbox', { name: /记住用户名密码/ }))
+    fireEvent.click(screen.getByRole('button', { name: /登录 FreeModelAPI/ }))
+    await waitFor(() => expect(fm2.login).toHaveBeenCalledTimes(1))
+    expect(fm2.rememberedSave).not.toHaveBeenCalled()
+  })
+
+  it('toggles the login password between masked and plain', async () => {
+    fm2.status.mockResolvedValue({ configured: false })
+
+    render(<FreeModel2ApiSettings />)
+    const field = (await screen.findByLabelText(/FreeModelAPI 密码/i)) as HTMLInputElement
+    expect(field.type).toBe('password')
+
+    fireEvent.click(screen.getByRole('button', { name: /show password/i }))
+    expect((screen.getByLabelText(/FreeModelAPI 密码/i) as HTMLInputElement).type).toBe('text')
+
+    fireEvent.click(screen.getByRole('button', { name: /hide password/i }))
+    expect((screen.getByLabelText(/FreeModelAPI 密码/i) as HTMLInputElement).type).toBe('password')
+  })
+
+  it('shows account, balance, frozen balance and api address', async () => {
+    fm2.status.mockResolvedValue({
+      configured: true,
+      baseUrl: 'http://124.232.163.75:3020/v1',
+      email: '312820574@qq.com',
+      balance: 9181.342,
+      username: 'yb',
+      frozenBalance: 12.5
+    })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+
+    render(<FreeModel2ApiSettings />)
+
+    // 账号优先用 username,没有才退回邮箱
+    await screen.findByText('yb')
+    expect((await screen.findAllByText('$9181.34')).length).toBeGreaterThan(0)
+    expect(screen.getByText('$12.50')).toBeTruthy()
+    // 账户格的 API 地址和卡片归一后的 Base URL 同串(gatewayUrl 会剥掉旧 /v1 再补),各一枚
+    expect((await screen.findAllByText('http://124.232.163.75:3020/v1')).length).toBeGreaterThan(0)
+    // 充值入口指向控制台地址(剥掉 /v1),不是模型接口;账户区和卡片各一枚
+    const rechargeHrefs = screen.getAllByText('充值').map(e => e.closest('a')?.getAttribute('href'))
+    expect(rechargeHrefs).toContain('http://124.232.163.75:3020')
+  })
+
+  it('falls back to the email as the account label when upstream has no username', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [] })
+
+    render(<FreeModel2ApiSettings />)
+
+    await screen.findByText('u@example.com')
+  })
+
+  it('reopens with the api key that was saved, not the first one', async () => {
+    const KEY2 = { ...KEY, id: 8, name: 'backup', key: 'sk-other-9999' }
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY, KEY2] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    getHermesConfig.mockResolvedValue({ providers: { freemodel2api: { key_id: 8 } } })
+
+    render(<FreeModel2ApiSettings />)
+
+    await waitFor(() => expect((screen.getByRole('combobox', { name: /api key/i }) as HTMLSelectElement).value).toBe('8'))
+    // 探测也必须用回显的那把 key,否则面板显示 B 却在按 A 拉模型
+    await waitFor(() => expect(validateCustomEndpoint.mock.calls[0][0]).toMatchObject({ api_key: 'sk-other-9999' }))
+  })
+
+  it('falls back to the first api key when the saved one is gone', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    // 上次存的是 8,sub2api 那边已经删了
+    getHermesConfig.mockResolvedValue({ providers: { freemodel2api: { key_id: 8 } } })
+
+    render(<FreeModel2ApiSettings />)
+
+    await waitFor(() => expect((screen.getByRole('combobox', { name: /api key/i }) as HTMLSelectElement).value).toBe('7'))
+  })
+
+  it('shows the saved key, its masked secret and the base url in the current-key card', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 9.5 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    // 还没保存:卡片只说「还没保存」,不编一把「当前 Key」出来
+    expect(card().textContent).toContain('还没有保存 key')
+
+    fireEvent.click(screen.getByRole('button', { name: /保存并设为默认/ }))
+
+    await waitFor(() => expect(card().textContent).toContain('main'))
+    expect(card().textContent).toContain('已配置')
+    expect(card().textContent).toContain('创建于 2026-01-01')
+    // 卡片里也带余额和充值入口(账户区和卡片各一枚)
+    expect(card().textContent).toContain('$9.50')
+    const rechargeHrefs = screen.getAllByText('充值').map(e => e.closest('a')?.getAttribute('href'))
+    expect(rechargeHrefs).toContain('https://sub.example.com')
+    // 掩码,不露完整 key
+    expect(card().textContent).toContain('sk-ful')
+    expect(card().textContent).not.toContain('sk-full-value-1234')
+    expect(card().textContent).toContain('https://sub.example.com/v1')
+    expect(screen.getByRole('button', { name: /删除当前 Key/ })).toBeTruthy()
+  })
+
+  it('reopens the card from config, and browsing another key does not rewrite it', async () => {
+    const KEY2 = { ...KEY, id: 8, name: 'backup', key: 'sk-other-9999' }
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY, KEY2] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    getHermesConfig.mockResolvedValue({ providers: { freemodel2api: { key_id: 8 } } })
+
+    render(<FreeModel2ApiSettings />)
+
+    await waitFor(() => expect(card().textContent).toContain('backup'))
+
+    // 前面的 key 下拉只是「看」:换成 A,卡片(仍是被保存的 B)不许跟着变
+    fireEvent.change(screen.getByRole('combobox', { name: /api key/i }), { target: { value: '7' } })
+    await screen.findAllByText('gpt-5.4')
+    expect(card().textContent).toContain('backup')
+    expect(card().textContent).not.toContain('sk-ful')
+    expect(saveHermesConfig).not.toHaveBeenCalled()
+  })
+
+  it('deletes the saved key after confirming, and keeps it when cancelled', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+    getHermesConfig.mockResolvedValue({ providers: { freemodel2api: { key_id: 7 } } })
+
+    render(<FreeModel2ApiSettings onConfigSaved={onConfigSaved} />)
+    await waitFor(() => expect(card().textContent).toContain('main'))
+
+    // 点了确认框里说「不」:什么都不动
+    confirm.mockResolvedValueOnce(false)
+    fireEvent.click(screen.getByRole('button', { name: /删除当前 Key/ }))
+    await waitFor(() => expect(confirm).toHaveBeenCalled())
+    expect(deleteEnvVar).not.toHaveBeenCalled()
+    expect(card().textContent).toContain('main')
+
+    fireEvent.click(screen.getByRole('button', { name: /删除当前 Key/ }))
+    await waitFor(() => expect(deleteEnvVar).toHaveBeenCalledTimes(2))
+    expect(deleteEnvVar.mock.calls[0]).toEqual(['FREEMODEL2API_API_KEY', undefined])
+    expect(deleteEnvVar.mock.calls[1]).toEqual(['FREEMODEL2API_BASE_URL', undefined])
+    await waitFor(() => expect(card().textContent).toContain('还没有保存 key'))
+    expect(onConfigSaved).toHaveBeenCalled()
+  })
+
+  it('reveals the selected api key on demand and masks it again', async () => {
+    fm2.status.mockResolvedValue({ configured: true, baseUrl: 'https://sub.example.com', email: 'u@example.com', balance: 3 })
+    fm2.keys.mockResolvedValue({ keys: [KEY] })
+    validateCustomEndpoint.mockResolvedValue({ ok: true, reachable: true, message: '', models: ['gpt-5.4'] })
+
+    render(<FreeModel2ApiSettings />)
+    await screen.findAllByText('gpt-5.4')
+
+    // 默认掩码:面板上不留明文
+    expect(screen.queryByText('sk-full-value-1234')).toBeNull()
+
+    fireEvent.click(screen.getByRole('button', { name: /reveal api key/i }))
+    expect(screen.getByText('sk-full-value-1234')).toBeTruthy()
+
+    fireEvent.click(screen.getByRole('button', { name: /hide api key/i }))
+    expect(screen.queryByText('sk-full-value-1234')).toBeNull()
   })
 })
diff --git a/apps/desktop/src/app/settings/freemodel2api-settings.tsx b/apps/desktop/src/app/settings/freemodel2api-settings.tsx
index c582a8a2bf..becfe868b0 100644
--- a/apps/desktop/src/app/settings/freemodel2api-settings.tsx
+++ b/apps/desktop/src/app/settings/freemodel2api-settings.tsx
@@ -1,11 +1,25 @@
-import { useCallback, useEffect, useState } from 'react'
+import type { ModelPricing } from '@hermes/shared'
+import { useCallback, useEffect, useRef, useState } from 'react'
 
-import { fm2Keys, fm2Login, fm2Logout, fm2RememberedLoad, fm2RememberedSave, fm2Status, type FreeModel2ApiKey, type FreeModel2ApiStatus } from '@/api/freemodel2api'
+import { fm2KeyBalance, fm2Keys, fm2Login, fm2Logout, fm2RememberedLoad, fm2RememberedSave, fm2Status, type FreeModel2ApiKey, type FreeModel2ApiRememberedLogin, type FreeModel2ApiStatus } from '@/api/freemodel2api'
 import { Button } from '@/components/ui/button'
+import { Checkbox } from '@/components/ui/checkbox'
 import { Input } from '@/components/ui/input'
-import { saveCustomEndpoint, validateCustomEndpoint } from '@/hermes'
+import {
+  deleteEnvVar,
+  getEnvVars,
+  getGlobalModelOptions,
+  getHermesConfig,
+  getRecommendedDefaultModel,
+  revealEnvVar,
+  saveHermesConfig,
+  setEnvVar,
+  validateCustomEndpoint
+} from '@/hermes'
 import { triggerHaptic } from '@/lib/haptics'
-import { Globe, KeyRound, Loader2, RefreshCw, Save, X, Zap } from '@/lib/icons'
+import { Activity, CheckCircle2, Copy, CreditCard, Eye, EyeOff, Globe, KeyRound, Loader2, RefreshCw, Save, Trash2, Zap } from '@/lib/icons'
+import { confirm } from '@/store/confirm'
+import { setMainModelAssignment } from '@/store/cron-model-impact'
 import { notify, notifyError } from '@/store/notifications'
 
 import { EmptyState, SectionHeading, SettingsContent, SettingsSkeleton } from './primitives'
@@ -14,7 +28,117 @@ function maskKey(key: string): string {
   return key.length > 10 ? `${key.slice(0, 6)}…${key.slice(-4)}` : key
 }
 
-export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () => void }) {
+function statusLabel(status: string): string {
+  return status === 'active' || status === 'enabled' ? '可用' : '禁用'
+}
+
+/** 价格串。后端已经格式化成 $/Mtok(自由的模型成 "free"),这里只负责「不知道就说不知道」。 */
+function priceLabel(price: ModelPricing | undefined): string {
+  if (!price) {
+    return '—'
+  }
+
+  if (price.free) {
+    return 'free'
+  }
+
+  return price.input || price.output ? `${price.input || '—'} / ${price.output || '—'}` : '—'
+}
+
+/** 分组倍率。0 = 后端没取到(不是「倍率是 0」),照实说不知道。价格里已经乘过它。 */
+function rateLabel(rate: number): string {
+  return rate > 0 ? `×${rate}` : '—'
+}
+
+/** 只读读数格子:标签在上,细边框盒子在下。值长了在盒子里截断(悬停看全文);
+ *  children 渲染在值后面(余额格子的「充值」链接)。 */
+function ReadonlyField({ children, className, label, mono, value }: {
+  children?: React.ReactNode
+  className?: string
+  label: string
+  mono?: boolean
+  value: string
+}) {
+  return (
+    <div className={`grid min-w-0 gap-1.5 text-xs text-muted-foreground${className ? ` ${className}` : ''}`}>
+      {label}
+      <span className="flex h-9 min-w-0 items-center rounded-md border border-input bg-background px-3 text-foreground">
+        <span className={`truncate${mono ? ' font-mono' : ''}`} title={value}>
+          {value}
+        </span>
+        {children}
+      </span>
+    </div>
+  )
+}
+
+/** 模型价格表。保存前那把 key 的模型和「测试」结果的模型共用同一副长相。 */
+function ModelPriceList({ busy, models, pricing }: {
+  busy?: boolean
+  models: string[]
+  pricing: Record<string, ModelPricing>
+}) {
+  return (
+    <div className="grid gap-1.5 text-xs text-muted-foreground">
+      <span className="flex items-center gap-2">
+        可用模型 <span className="font-medium text-foreground">{models.length}</span>
+        <span>· 价格 $/Mtok (in / out)</span>
+        {busy && <Loader2 className="animate-spin" />}
+      </span>
+      {/* 紧凑芯片云:模型多了逐行清单会撑得很长,一枚模型一枚小芯片,名字+价格并排 */}
+      <div className="flex flex-wrap gap-1">
+        {models.map(m => (
+          <span
+            className="inline-flex items-baseline gap-1 rounded border border-input bg-background px-1.5 py-0.5 text-[11px] leading-4"
+            key={m}
+          >
+            <span className="text-foreground" title={m}>
+              {m}
+            </span>
+            <span className="font-mono text-muted-foreground">{priceLabel(pricing[m])}</span>
+          </span>
+        ))}
+      </div>
+    </div>
+  )
+}
+
+// FreeModel2API is a first-class provider (plugins/model-providers/freemodel2api/), so its
+// credentials live in their own .env slots instead of a providers: entry.
+const API_KEY_EV = 'FREEMODEL2API_API_KEY'
+const BASE_URL_EV = 'FREEMODEL2API_BASE_URL'
+const PROVIDER_SLUG = 'freemodel2api'
+
+/** The `providers.freemodel2api` block this panel owns — a bookmark for the saved key, nothing more:
+ *  the model list belongs to the provider itself, so there is no allow-list any more. */
+interface TestResult {
+  /** 结果属于哪把 key:换 key 后不许冒充 */
+  keyId: number
+  models: string[]
+  pricing: Record<string, ModelPricing>
+  /** 生效倍率,0 = 后端没取到。 */
+  rateMultiplier: number
+}
+
+type ProviderEntry = { key_id?: unknown }
+
+function providerEntry(cfg: unknown): ProviderEntry | undefined {
+  return (cfg as { providers?: Record<string, ProviderEntry> } | null)?.providers?.[PROVIDER_SLUG]
+}
+
+interface FreeModel2ApiSettingsProps {
+  onConfigSaved?: () => void
+  onMainModelChanged?: (provider: string, model: string) => void
+  /** Shared settings "Applies to" scope: write to a concrete profile instead of the app's
+   *  active one (undefined follows the active profile). */
+  scopeProfile?: string
+}
+
+export function FreeModel2ApiSettings({
+  onConfigSaved,
+  onMainModelChanged,
+  scopeProfile
+}: FreeModel2ApiSettingsProps) {
   const [loading, setLoading] = useState(true)
   const [status, setStatus] = useState<FreeModel2ApiStatus>({ configured: false })
   const [keys, setKeys] = useState<FreeModel2ApiKey[]>([])
@@ -22,26 +146,88 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
   const [baseUrl, setBaseUrl] = useState('')
   const [email, setEmail] = useState('')
   const [password, setPassword] = useState('')
-  const [connecting, setConnecting] = useState(false)
+  // 记住的登录信息。密码只留在 state 里做「留空登录」的兜底,输入框永不回显明文
+  const [remembered, setRemembered] = useState<FreeModel2ApiRememberedLogin | null>(null)
   const [remember, setRemember] = useState(true)
+  const [connecting, setConnecting] = useState(false)
   const [testing, setTesting] = useState(false)
+  // 「测试所选 key」那次探测:模型 + 价格 + 这把 key 的分组倍率。跟自动探测分开存,免得
+  // 面板上那两处模型清单互相覆盖。
+  const [testResult, setTestResult] = useState<TestResult | null>(null)
+  const [testingKey, setTestingKey] = useState(false)
   const [writing, setWriting] = useState(false)
   const [refreshing, setRefreshing] = useState(false)
   const [models, setModels] = useState<string[]>([])
+  // 模型价格来自模型选择器同源的目录(/api/model/options 按 provider 行挂 pricing),
+  // 面板自己不去算钱:换 base_url / 换 key 的倍率都在后端那份实现里。
+  const [pricing, setPricing] = useState<Record<string, ModelPricing>>({})
+  // 已保存进 config 的那把 key(providers.<slug>.key_id)。只读记录:前面换把 key 看看模型,
+  // 不该改写这块「当前 Key」。
+  const [savedKeyId, setSavedKeyId] = useState<number | null>(null)
+  // 未登录时那块读数的数据源:env 里已保存的 key(掩码)与 base url。
+  // 登录后有 keys 列表 + status.baseUrl,用不到这份。
+  const [savedEnv, setSavedEnv] = useState<{ keyMask: null | string; baseUrl: null | string }>({ keyMask: null, baseUrl: null })
+  // Disconnect 后「测试」还得能打:那是 env 里保存的那把 key 的全值(reveal 回来,只用于探测,不上屏)
+  const [savedEnvKey, setSavedEnvKey] = useState<string | null>(null)
+  // 未登录的余额读数:sub2api 凭 API key 直查(/v1/sub2api/balance),不需要会话
+  const [keyBalance, setKeyBalance] = useState<number | null>(null)
+  // 明文只看不存:key 本来就在 keys 列表里,展开只是把它显示出来,不写任何地方
+  const [revealed, setRevealed] = useState(false)
+  const [passwordVisible, setPasswordVisible] = useState(false)
+  // 自增即重拉模型:刷新按钮是探测失败后的重试入口
+  const [modelsToken, setModelsToken] = useState(0)
 
-  const loadKeys = useCallback(async () => {
+  // preferId = 上次保存进 config 的那把 key(providers.<slug>.key_id)。只在「当前选中的 key
+  // 已不在列表里」时兜底 —— 刷新/重连不该把用户没保存的选择弹回上一次保存的那把。
+  const loadKeys = useCallback(async (preferId?: number | null) => {
     const data = await fm2Keys()
     setKeys(data.keys)
-    setSelectedKeyId(current => (current !== null && data.keys.some(k => k.id === current) ? current : (data.keys[0]?.id ?? null)))
+    setSelectedKeyId(current => {
+      if (current !== null && data.keys.some(k => k.id === current)) {
+        return current
+      }
+
+      const has = (id: number | null | undefined): id is number => id != null && data.keys.some(k => k.id === id)
+
+      return has(preferId) ? preferId : (data.keys[0]?.id ?? null)
+    })
   }, [])
 
+  // 读目录里 FM2 那一行的价格表。目录读不到就只是没有价格,不影响模型清单 ——
+  // 所以这里吞掉失败,也不进 notify。
+  const loadPricing = useCallback(async () => {
+    const readRow = async () => {
+      const options = await getGlobalModelOptions({}, scopeProfile)
+
+      return options.providers?.find(p => p.slug === PROVIDER_SLUG)
+    }
+
+    try {
+      let row = await readRow()
+
+      // 冷缓存(刚启动 / 刚换 key)第一次只有 pricing_pending:真实价格由后台预热补齐。
+      // 不等这一下,面板上的价格列会一直是空的,只有手动 Refresh 才补得回来。
+      if (row?.pricing_pending) {
+        await new Promise(resolve => setTimeout(resolve, 4000))
+        row = await readRow()
+      }
+
+      setPricing(row?.pricing ?? {})
+    } catch {
+      setPricing({})
+    }
+  }, [scopeProfile])
+
   async function handleRefresh() {
     try {
       setRefreshing(true)
-      setModels([])
+      // 不清 models:刷新只是「再看一眼」,失败时清空会把刚拉到手的模型整个从面板上抹掉
       const s = await fm2Status()
       setStatus(s)
       await loadKeys()
+      setModelsToken(token => token + 1)
+      setTestResult(null)
+      await loadPricing()
       triggerHaptic('success')
     } catch (err) {
       notifyError(err, 'FreeModel2api refresh failed')
@@ -55,29 +241,78 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
 
     async function load() {
       try {
-        const s = await fm2Status()
+        // config 先到手才 loadKeys:两把 key 重名时靠 key_id 认出上次保存的那把,读晚了就只能
+        // 退回第一把。取不到 config 不该拖垮整个面板,所以这里吞掉它自己的失败。
+        const [s, cfg, env] = await Promise.all([
+          fm2Status(),
+          getHermesConfig(scopeProfile).catch(() => null),
+          getEnvVars(scopeProfile).catch(() => null)
+        ])
 
         if (cancelled) {
           return
         }
 
-        setStatus(s)
+        const savedKey = providerEntry(cfg)?.key_id
 
-        if (s.configured) {
-          await loadKeys()
-        } else {
-          const remembered = await fm2RememberedLoad()
-          if (!cancelled && remembered) {
-            setBaseUrl(remembered.baseUrl)
-            setEmail(remembered.email)
-            setPassword(remembered.password)
-            setRemember(true)
+        setSavedKeyId(typeof savedKey === 'number' ? savedKey : null)
+
+        // 已保存的凭据读数(key 掩码 + base url)。两枚都 reveal 全值 —— 登录态下也要:
+        // 退会话后这块读数直接顶上,不能再退回「http...0/v1」这种掩码。
+        // key 的全值只进 state 供探测/查余额,不上屏;base url 本来就不是机密。
+        if (env) {
+          const keyRow = env[API_KEY_EV]
+          const urlRow = env[BASE_URL_EV]
+
+          const savedKeyFull = keyRow?.is_set
+            ? (await revealEnvVar(API_KEY_EV, scopeProfile).catch(() => null))?.value ?? null
+            : null
+
+          const savedBaseUrl = urlRow?.is_set
+            ? (await revealEnvVar(BASE_URL_EV, scopeProfile).catch(() => null))?.value ?? urlRow.redacted_value ?? null
+            : null
+
+          if (!cancelled) {
+            setSavedEnv({
+              keyMask: keyRow?.is_set ? keyRow.redacted_value ?? '已配置' : null,
+              baseUrl: savedBaseUrl
+            })
+            setSavedEnvKey(savedKeyFull)
           }
         }
+
+        setStatus(s)
+
+        // 记住的登录信息两种状态都要:已配置时它是「留空登录」的密码兜底,
+        // 未配置时它把 URL/邮箱填进表单(密码不回显,页面不留明文)。
+        // URL/邮箱两种状态都回填 —— 登录框空着会让用户以为没记住。
+        const rememberedLogin = await fm2RememberedLoad()
+
+        if (cancelled) {
+          return
+        }
+
+        setRemembered(rememberedLogin)
+
+        if (rememberedLogin) {
+          setBaseUrl(rememberedLogin.baseUrl)
+          setEmail(rememberedLogin.email)
+        }
+
+        if (s.configured) {
+          await loadKeys(typeof savedKey === 'number' ? savedKey : null)
+          // 价格是给「已配置」那块看的;没登录连 provider 行都不存在,读了也是空。
+          // 不 await:冷缓存要等预热,面板不该为价格多转几秒骨架屏。
+          void loadPricing()
+        }
       } catch (err) {
-        if (!cancelled) notifyError(err, 'FreeModel2api status failed')
+        if (!cancelled) {
+          notifyError(err, 'FreeModel2api status failed')
+        }
       } finally {
-        if (!cancelled) setLoading(false)
+        if (!cancelled) {
+          setLoading(false)
+        }
       }
     }
 
@@ -86,14 +321,30 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
     return () => {
       cancelled = true
     }
-  }, [loadKeys])
+  }, [loadKeys, loadPricing, scopeProfile])
 
   async function handleConnect() {
+    // 密码留空 = 沿用上次记住的那份(输入框不回显明文,只能这样取)
+    const pw = password || remembered?.password || ''
+
     try {
       setConnecting(true)
-      const result = await fm2Login({ baseUrl, email, password })
-      await fm2RememberedSave(remember ? { baseUrl: baseUrl.trim(), email: email.trim(), password } : null)
-      setStatus({ configured: true, baseUrl: baseUrl.trim().replace(/\/+$/, ''), email: result.email, balance: result.balance })
+      const result = await fm2Login({ baseUrl: baseUrl.trim(), email: email.trim(), password: pw })
+
+      // 「记住用户名密码」勾着才写;不勾只是这次不存,不负责抹掉旧记录
+      if (remember) {
+        await fm2RememberedSave({ baseUrl: baseUrl.trim(), email: email.trim(), password: pw })
+        setRemembered({ baseUrl: baseUrl.trim(), email: email.trim(), password: pw })
+      }
+
+      setStatus({
+        configured: true,
+        baseUrl: baseUrl.trim().replace(/\/+$/, ''),
+        email: result.email,
+        balance: result.balance,
+        username: result.username,
+        frozenBalance: result.frozenBalance
+      })
       setPassword('')
       await loadKeys()
       triggerHaptic('success')
@@ -104,26 +355,177 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
     }
   }
 
-  async function handleDisconnect() {
+  // 「已登录」点一下 = 退会话。env 里的 key / config 里的 key_id 都不动(删凭据走
+  // 「删除当前 Key」),退完仍能看选中的 key、跑测试。
+  async function handleLogout() {
     await fm2Logout()
     setStatus({ configured: false })
     setKeys([])
     setSelectedKeyId(null)
     setModels([])
+    setTestResult(null)
+    // 忘掉已拉组合,否则重连到同一个 base + 同一把 key 会被判成「已拉过」而不再拉
+    loadedStamp.current = ''
+    // 余额读数退会话后改走 key 直查,同一组合也要重拉一次
+    setModelsToken(token => token + 1)
   }
 
-  function gatewayUrl(): string | null {
-    if (!status.baseUrl) {
-      return null
+  // 抹掉「已保存的那把 key」:两枚 env 槽 + config 里的 key_id。
+  // key_id 也要归零 —— 留着它,下次打开面板会把一把已经不存在的 key 显示成「当前 Key」。
+  async function clearSavedKey() {
+    await deleteEnvVar(API_KEY_EV, scopeProfile)
+    await deleteEnvVar(BASE_URL_EV, scopeProfile)
+    // 顺带清掉前面几轮留下的白名单(models 数组是整体替换,写空数组就抹了)
+    await saveHermesConfig(
+      { providers: { [PROVIDER_SLUG]: { key_id: null, models: [] } } },
+      scopeProfile
+    )
+    setSavedKeyId(null)
+    setPricing({})
+    // 未登录读数用的那份也一并抹掉,否则删完后那块还举着旧掩码
+    setSavedEnv({ keyMask: null, baseUrl: null })
+    setSavedEnvKey(null)
+  }
+
+  async function handleDeleteSavedKey() {
+    if (!(await confirm({ destructive: true, title: '删除当前 FreeModel2API Key?' }))) {
+      return
     }
-    return `${status.baseUrl.replace(/\/+$/, '')}/v1`
+
+    try {
+      await clearSavedKey()
+      triggerHaptic('success')
+      onConfigSaved?.()
+      notify({ kind: 'success', message: 'FreeModel2API api key removed.' })
+    } catch (err) {
+      notifyError(err, 'Delete FreeModel2API api key failed')
+    }
+  }
+
+  function gatewayUrl(): string {
+    // 断开后 status.baseUrl 是空的,退回 env 里保存的那条(可能带 /v1,剥掉再统一补)
+    const raw = status.baseUrl || savedEnv.baseUrl || ''
+
+    if (!raw) {
+      return ''
+    }
+
+    return `${raw.replace(/\/+$/, '').replace(/\/v1$/, '')}/v1`
   }
 
   function selectedKey(): FreeModel2ApiKey | undefined {
     return keys.find(k => k.id === selectedKeyId)
   }
 
-  async function handleTestModels() {
+  // 当前 Key 卡片上那行名字。列表里找不到(已被删 / 还没连上)就退回 id ——
+  // 记录区宁可显示得少,也不能凭空顶出另一把 key 的名字。
+  function savedKeyLabel(): string {
+    if (savedKeyId == null) {
+      return '—'
+    }
+
+    const key = keys.find(k => k.id === savedKeyId)
+
+    return key ? key.name || `key-${key.id}` : `key #${savedKeyId}`
+  }
+
+  // 连点两把 key 时,先发的那次可能后到:用序号把过期结果丢掉,否则会「选中 B、显示 A 的模型」
+  const loadSeq = useRef(0)
+
+  // 拉某把 key 在 FM2 网关下能用的模型(探测用该 key,所以结果就是这把 key 对应的模型集)
+  const loadModelsFor = useCallback(async (key: FreeModel2ApiKey, url: string) => {
+    const seq = (loadSeq.current += 1)
+
+    try {
+      setTesting(true)
+
+      const validation = await validateCustomEndpoint({
+        id: 'FreeModel2API',
+        name: 'FreeModel2API',
+        base_url: url,
+        model: '',
+        api_key: key.key,
+        discover_models: true
+      })
+
+      if (seq !== loadSeq.current) {
+        return
+      }
+
+      if (!validation.ok) {
+        setModels([])
+        notify({ kind: 'error', message: validation.message || 'Gateway validation failed.' })
+
+        return
+      }
+
+      setModels(validation.models)
+      triggerHaptic('success')
+    } catch (err) {
+      if (seq === loadSeq.current) {
+        notifyError(err, 'Model test failed')
+      }
+    } finally {
+      if (seq === loadSeq.current) {
+        setTesting(false)
+      }
+    }
+  }, [])
+
+  const gatewayBase = gatewayUrl()
+
+  // 未登录也要看余额/充值:凭 env 里那把 key 直查,不走会话。modelsToken 在 deps 里,
+  // 退会话/刷新后同一组合也会重拉一次(余额可能已变)。
+  useEffect(() => {
+    if (status.configured || !savedEnvKey || !gatewayBase) {
+      return
+    }
+
+    let cancelled = false
+
+    // try/catch 而非只 .catch:main 进程比 renderer 旧时 preload 里还没有 keyBalance,
+    // 同步调用直接 throw,不接住会炸掉整个设置页
+    try {
+      fm2KeyBalance(gatewayBase, savedEnvKey)
+        .then(result => {
+          if (!cancelled) {
+            setKeyBalance(result.balance)
+          }
+        })
+        .catch(() => {})
+    } catch {
+      // preload 版本错位(开发期 HMR 先到):余额格保持 —
+    }
+
+    return () => {
+      cancelled = true
+    }
+  }, [gatewayBase, modelsToken, savedEnvKey, status.configured])
+
+  // 选中 key 就位即自动拉模型,不必手点。用 ref 记「已拉过的 (key, base, token) 组合」而不是
+  // 布尔首挂标记:StrictMode 会重放 mount effect,布尔量会被第一遍消费掉、第二遍空拉一次
+  // (同 use-on-profile-switch.ts)。组合没变就跳过,省掉 keys 重载带来的重复请求。
+  const loadedStamp = useRef('')
+
+  // eslint-disable-next-line no-restricted-syntax -- 请求令牌式 ref(非 atom 镜像):只记录已请求的组合去重,没有任何地方读它当渲染值
+  useEffect(() => {
+    const key = keys.find(k => k.id === selectedKeyId)
+
+    if (!key || !gatewayBase) {
+      return
+    }
+
+    const stamp = `${key.id}@${gatewayBase}@${modelsToken}`
+
+    if (loadedStamp.current === stamp) {
+      return
+    }
+
+    loadedStamp.current = stamp
+    void loadModelsFor(key, gatewayBase)
+  }, [gatewayBase, keys, loadModelsFor, modelsToken, selectedKeyId])
+
+  async function handleWrite() {
     const selected = selectedKey()
     const url = gatewayUrl()
 
@@ -132,61 +534,118 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
     }
 
     try {
-      setTesting(true)
-      setModels([])
+      setWriting(true)
+      // 只写凭据:模型清单不落盘,交给模型选择器按这把 key 实时拉。
+      // 后端解析该 provider 的 base_url/key 就是从这两枚 env 读的。
+      await setEnvVar(API_KEY_EV, selected.key, scopeProfile)
+      await setEnvVar(BASE_URL_EV, url, scopeProfile)
+
+      // config 里只留「保存的是哪把 key」。models 写空数组是要抹掉前面几轮留下的白名单
+      // (数组是整体替换),discover_models 必须回 true —— 旧条目里的 false 会把这行钉死在空清单上。
+      await saveHermesConfig(
+        { providers: { [PROVIDER_SLUG]: { discover_models: true, key_id: selected.id, models: [] } } },
+        scopeProfile
+      )
+
+      // A saved FreeModel2API key is not merely another credential: this is the product's default
+      // inference route. Refresh the key-scoped catalog, pick its recommended/default model, and
+      // persist the main assignment before reporting success.
+      const options = await getGlobalModelOptions({ refresh: true }, scopeProfile)
+      const providerRow = options.providers?.find(row => row.slug === PROVIDER_SLUG)
+      const availableModels = providerRow?.models?.length ? providerRow.models : models
+      let defaultModel = availableModels[0] ?? ''
+
+      try {
+        const recommended = await getRecommendedDefaultModel(PROVIDER_SLUG, scopeProfile)
+
+        if (recommended.model && availableModels.includes(recommended.model)) {
+          defaultModel = recommended.model
+        }
+      } catch {
+        // The refreshed live catalog remains authoritative when recommendation is unavailable.
+      }
+
+      if (!defaultModel) {
+        throw new Error('The selected FreeModel2API key did not return any models.')
+      }
+
+      const assignment = await setMainModelAssignment(
+        {
+          provider: PROVIDER_SLUG,
+          model: defaultModel,
+          ...(providerRow?.api_url ? { base_url: providerRow.api_url } : {})
+        },
+        scopeProfile
+      )
+
+      setSavedKeyId(selected.id)
+      // 读数那份跟着同步,这样同一会话里 Disconnect 后看到的还是刚保存的这把
+      setSavedEnv({ keyMask: maskKey(selected.key), baseUrl: url })
+      setSavedEnvKey(selected.key)
+      // 刚写完凭据,目录那行现在才有价格。不 await:冷缓存要等预热,别让按钮多转几秒
+      void loadPricing()
+
+      triggerHaptic('success')
+      onConfigSaved?.()
+
+      if (scopeProfile == null) {
+        onMainModelChanged?.(assignment.provider || PROVIDER_SLUG, assignment.model || defaultModel)
+      }
+
+      notify({
+        kind: 'success',
+        message: `FreeModel2API — saved ${maskKey(selected.key)} and set ${assignment.model || defaultModel} as default.`
+      })
+    } catch (err) {
+      notifyError(err, 'Save FreeModel2API api key failed')
+    } finally {
+      setWriting(false)
+    }
+  }
+
+  // 「测试」面板按钮。登录时探测下拉选中的那把 key;断开后退回 env 里保存的那把 ——
+  // 探测只用 base_url + key,不需要会话,价格/倍率照常回来。带 with_pricing:后端在
+  // 这一次请求里顺带取该 key 自己的 sub2api 价格与组倍率,不必再等模型选择器的预热。
+  async function handleTestKey() {
+    const apiKey = selectedKey()?.key ?? savedEnvKey
+    const keyId = selectedKeyId ?? savedKeyId
+    const url = gatewayUrl()
+
+    if (!apiKey || !url) {
+      return
+    }
+
+    try {
+      setTestingKey(true)
+
       const validation = await validateCustomEndpoint({
         id: 'FreeModel2API',
         name: 'FreeModel2API',
         base_url: url,
         model: '',
-        api_key: selected.key,
-        discover_models: true
+        api_key: apiKey,
+        discover_models: true,
+        with_pricing: true
       })
 
       if (!validation.ok) {
+        setTestResult(null)
         notify({ kind: 'error', message: validation.message || 'Gateway validation failed.' })
+
         return
       }
 
-      setModels(validation.models)
-      triggerHaptic('success')
-    } catch (err) {
-      notifyError(err, 'Model test failed')
-    } finally {
-      setTesting(false)
-    }
-  }
-
-  async function handleWrite() {
-    const selected = selectedKey()
-    const url = gatewayUrl()
-
-    if (!selected || !url || models.length === 0) {
-      return
-    }
-
-    try {
-      setWriting(true)
-      const model = models[0] ?? ''
-
-      await saveCustomEndpoint({
-        id: 'FreeModel2API',
-        name: 'FreeModel2API',
-        base_url: url,
-        model,
-        api_key: selected.key,
-        discover_models: true,
-        make_default: false,
-        models
+      setTestResult({
+        keyId: keyId ?? -1,
+        models: validation.models,
+        pricing: validation.pricing ?? {},
+        rateMultiplier: validation.rate_multiplier ?? 0
       })
-
       triggerHaptic('success')
-      onConfigSaved?.()
-      notify({ kind: 'success', message: `FreeModel2API provider saved (default model: ${model || 'unset'}).` })
     } catch (err) {
-      notifyError(err, 'Write provider failed')
+      notifyError(err, 'Key test failed')
     } finally {
-      setWriting(false)
+      setTestingKey(false)
     }
   }
 
@@ -194,110 +653,292 @@ export function FreeModel2ApiSettings({ onConfigSaved }: { onConfigSaved?: () =>
     return <SettingsSkeleton sections={[{ heading: true, rows: 3 }]} />
   }
 
-  if (!status.configured) {
-    return (
-      <SettingsContent>
-        <section>
-          <SectionHeading icon={Globe} title="FreeModel2API" />
-          <div className="grid gap-3 rounded-md border border-border/50 p-3">
-            <label className="grid gap-1.5 text-xs text-muted-foreground">
-              Base URL
-              <Input onChange={e => setBaseUrl(e.target.value)} placeholder="https://sub2api.example.com" value={baseUrl} />
-            </label>
-            <label className="grid gap-1.5 text-xs text-muted-foreground">
-              Email
-              <Input onChange={e => setEmail(e.target.value)} type="email" value={email} />
-            </label>
-            <label className="grid gap-1.5 text-xs text-muted-foreground">
-              Password
-              <Input onChange={e => setPassword(e.target.value)} type="password" value={password} />
-            </label>
-            <label className="flex items-center gap-2 text-xs text-muted-foreground">
-              <input checked={remember} onChange={e => setRemember(e.target.checked)} type="checkbox" />
-              Remember login
-            </label>
-            <Button disabled={connecting || !baseUrl.trim() || !email.trim() || !password} onClick={() => void handleConnect()}>
-              {connecting ? <Loader2 className="animate-spin" /> : <Zap />}
-              Connect
-            </Button>
-          </div>
-        </section>
-      </SettingsContent>
-    )
-  }
+  // 充值入口 = 网关的控制台地址(剥掉模型接口的 /v1 后缀);未登录时 gatewayBase 退回
+  // env 里存的 base_url,充值照样能指
+  const rechargeUrl = gatewayBase ? gatewayBase.replace(/\/v1$/, '') : undefined
 
   return (
     <SettingsContent>
       <div className="space-y-6">
         <section>
-          <SectionHeading icon={Globe} title="FreeModel2API" />
-          <div className="flex items-center justify-between rounded-md border border-border/50 p-3 text-xs text-muted-foreground">
-            <span>{status.email}</span>
-            <Button onClick={() => void handleDisconnect()} size="sm" variant="ghost">
-              <X />
-              Disconnect
-            </Button>
+          <SectionHeading icon={Globe} title="FreeModelAPI" />
+          <div className="grid gap-3 rounded-md border border-border/50 p-3">
+            <p className="text-xs text-muted-foreground">登录后获取用户令牌与 API Key,凭所选 Key 获取可用模型。</p>
+            <div className="flex flex-wrap items-end gap-3">
+              <label className="grid min-w-0 flex-1 basis-52 gap-1.5 text-xs text-muted-foreground">
+                FreeModelAPI URL
+                <Input onChange={e => setBaseUrl(e.target.value)} placeholder="https://sub2api.example.com" value={baseUrl} />
+              </label>
+              <label className="grid min-w-0 flex-1 basis-52 gap-1.5 text-xs text-muted-foreground">
+                FreeModelAPI 用户(邮箱)
+                <Input onChange={e => setEmail(e.target.value)} type="email" value={email} />
+              </label>
+              <label className="grid min-w-0 flex-1 basis-52 gap-1.5 text-xs text-muted-foreground">
+                FreeModelAPI 密码
+                <div className="relative">
+                  <Input
+                    className="pr-9"
+                    onChange={e => setPassword(e.target.value)}
+                    placeholder={remembered ? '已保存，留空即不修改' : undefined}
+                    type={passwordVisible ? 'text' : 'password'}
+                    value={password}
+                  />
+                  <Button
+                    aria-label={passwordVisible ? 'Hide password' : 'Show password'}
+                    className="absolute right-1 top-1/2 -translate-y-1/2"
+                    onClick={() => setPasswordVisible(visible => !visible)}
+                    size="icon-xs"
+                    variant="ghost"
+                  >
+                    {passwordVisible ? <EyeOff /> : <Eye />}
+                  </Button>
+                </div>
+              </label>
+              {status.configured ? (
+                // 已登录:按钮换成绿色状态章,点一下退会话(env 凭据不动)
+                <Button
+                  className="shrink-0 border-emerald-500/40 bg-emerald-500/10 text-emerald-600 hover:bg-emerald-500/20 hover:text-emerald-600 dark:text-emerald-400 dark:hover:text-emerald-400"
+                  onClick={() => void handleLogout()}
+                  variant="outline"
+                >
+                  <CheckCircle2 />
+                  已登录
+                </Button>
+              ) : (
+                <Button
+                  className="shrink-0"
+                  disabled={connecting || !baseUrl.trim() || !email.trim() || (!password && !remembered?.password)}
+                  onClick={() => void handleConnect()}
+                  variant="outline"
+                >
+                  {connecting ? <Loader2 className="animate-spin" /> : <Zap />}
+                  登录 FreeModelAPI
+                </Button>
+              )}
+            </div>
+            <div className="flex flex-wrap items-center gap-4 text-xs text-muted-foreground">
+              <label className="flex items-center gap-2">
+                <Checkbox checked={remember} onCheckedChange={checked => setRemember(checked === true)} />
+                记住用户名密码
+              </label>
+              <span>密码由 Gateway 加密保存,保存后不会在此页显示明文。</span>
+            </div>
           </div>
         </section>
+        {/* 账户 + API Key 合排一块(Image #2 布局):登录后左读数右管 key;
+            未登录但存过凭据时,这块降级成「选中的 API Key」读数。 */}
+        {(status.configured || savedEnv.keyMask) && (
         <section>
           <SectionHeading
-            aside={
+            aside={status.configured ? (
               <Button aria-label="Refresh" disabled={refreshing} onClick={() => void handleRefresh()} size="icon-xs" variant="ghost">
                 {refreshing ? <Loader2 className="animate-spin" /> : <RefreshCw />}
               </Button>
-            }
-            icon={KeyRound}
-            meta={`${keys.length}`}
-            title="API Keys"
+            ) : undefined}
+            icon={status.configured ? CreditCard : KeyRound}
+            title={status.configured ? '账户' : '选中的 API Key'}
           />
-          <div className="mb-3 flex items-center justify-between text-xs text-muted-foreground">
-            Balance
-            <span className="text-sm font-medium text-foreground">${(status.balance ?? 0).toFixed(2)}</span>
-          </div>
-          {keys.length ? (
-            <div className="grid gap-3 rounded-md border border-border/50 p-3">
-              <label className="grid gap-1.5 text-xs text-muted-foreground">
-                API key
-                <select
-                  aria-label="API key"
-                  className="h-9 rounded-md border border-input bg-background px-3 text-sm text-foreground"
-                  onChange={e => {
-                    setSelectedKeyId(Number(e.target.value))
-                    setModels([])
-                  }}
-                  value={selectedKeyId ?? ''}
-                >
-                  {keys.map(k => (
-                    <option key={k.id} value={k.id}>
-                      {(k.name || `key-${k.id}`) + '  ' + maskKey(k.key)}
-                    </option>
-                  ))}
-                </select>
-              </label>
-              <div className="flex gap-2">
-                <Button disabled={testing || selectedKeyId === null} onClick={() => void handleTestModels()} variant="outline">
-                  {testing ? <Loader2 className="animate-spin" /> : <Zap />}
-                  Test models
-                </Button>
-                <Button disabled={writing || models.length === 0} onClick={() => void handleWrite()}>
-                  {writing ? <Loader2 className="animate-spin" /> : <Save />}
-                  Write provider
-                </Button>
+          {/* 2:3 —— 右边 key 管理(下拉/掩码行/模型芯片云)要更宽 */}
+          <div className="grid gap-4 rounded-md border border-border/50 p-3 lg:grid-cols-5">
+            {status.configured ? (
+            <div className="grid content-start gap-3 text-xs sm:grid-cols-2 lg:col-span-2">
+              <div className="grid gap-0.5">
+                <span className="text-muted-foreground">账号</span>
+                <span className="truncate font-medium text-foreground">{status.username || status.email}</span>
+              </div>
+              <div className="grid gap-0.5">
+                <span className="text-muted-foreground">可用余额</span>
+                <span className="flex items-center gap-2 font-medium text-foreground">
+                  ${(status.balance ?? 0).toFixed(2)}
+                  {rechargeUrl && (
+                    <a className="text-destructive hover:underline" href={rechargeUrl} rel="noreferrer" target="_blank">
+                      充值
+                    </a>
+                  )}
+                </span>
+              </div>
+              <div className="grid gap-0.5">
+                <span className="text-muted-foreground">冻结金额</span>
+                <span className="font-medium text-foreground">${(status.frozenBalance ?? 0).toFixed(2)}</span>
+              </div>
+              <div className="grid gap-0.5">
+                <span className="text-muted-foreground">API 地址</span>
+                <span className="truncate font-mono text-foreground" title={status.baseUrl}>
+                  {status.baseUrl}
+                </span>
               </div>
-              {models.length > 0 && (
-                <div className="flex flex-wrap gap-1.5">
-                  {models.map(m => (
-                    <span className="rounded-md bg-muted px-2 py-0.5 text-xs text-muted-foreground" key={m}>
-                      {m}
-                    </span>
-                  ))}
-                </div>
-              )}
             </div>
-          ) : (
-            <EmptyState description="Create an API key in the sub2api web console first." title="No API keys" />
-          )}
+            ) : (
+              /* 未登录:账户读数靠 key 直查(sub2api /v1/sub2api/balance),凭据读数来自 env */
+              <div className="grid content-start gap-3 text-xs sm:grid-cols-2 lg:col-span-5">
+                <ReadonlyField label="API Key" mono value={`已配置 ${savedEnv.keyMask ?? ''}`} />
+                <ReadonlyField label="模型组 Base URL" mono value={savedEnv.baseUrl ?? '—'} />
+                <ReadonlyField label="余额" value={keyBalance == null ? '—' : `$${keyBalance.toFixed(2)}`}>
+                  {rechargeUrl && (
+                    <a className="ml-2 shrink-0 text-destructive hover:underline" href={rechargeUrl} rel="noreferrer" target="_blank">
+                      充值
+                    </a>
+                  )}
+                </ReadonlyField>
+                <p className="text-xs text-muted-foreground sm:col-span-2">未登录 —— 余额凭已保存的 Key 直查;登录后可管理 API Keys。</p>
+              </div>
+            )}
+            {status.configured && (
+            keys.length ? (
+              <div className="grid content-start gap-3 rounded-md border border-border/50 p-3 text-xs lg:col-span-3">
+                <label className="grid gap-1.5 text-xs text-muted-foreground">
+                  API Key
+                  <select
+                    aria-label="API key"
+                    className="h-9 rounded-md border border-input bg-background px-3 text-sm text-foreground"
+                    onChange={e => {
+                      setSelectedKeyId(Number(e.target.value))
+                      setModels([])
+                      setTestResult(null)
+                    }}
+                    value={selectedKeyId ?? ''}
+                  >
+                    {keys.map(k => (
+                      <option key={k.id} value={k.id}>
+                        {(k.name || `key-${k.id}`) + ' · ' + statusLabel(k.status)}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+                <div className="flex items-center justify-between gap-2 rounded-md border border-border/50 px-2 py-1 text-xs text-muted-foreground">
+                  <span className="truncate font-mono text-foreground">
+                    {revealed ? selectedKey()?.key ?? '' : maskKey(selectedKey()?.key ?? '')}
+                  </span>
+                  <span className="flex shrink-0">
+                    <Button
+                      aria-label="Copy API key"
+                      onClick={async () => {
+                        try {
+                          await navigator.clipboard?.writeText(selectedKey()?.key ?? '')
+                          notify({ kind: 'success', message: '已复制 API Key。' })
+                        } catch {
+                          notify({ kind: 'error', message: '复制 API Key 失败。' })
+                        }
+                      }}
+                      size="icon-xs"
+                      variant="ghost"
+                    >
+                      <Copy />
+                    </Button>
+                    <Button
+                      aria-label={revealed ? 'Hide API key' : 'Reveal API key'}
+                      onClick={() => setRevealed(value => !value)}
+                      size="icon-xs"
+                      variant="ghost"
+                    >
+                      {revealed ? <EyeOff /> : <Eye />}
+                    </Button>
+                  </span>
+                </div>
+                {models.length > 0 && (
+                  <ModelPriceList busy={testing} models={models} pricing={pricing} />
+                )}
+                <div className="flex flex-wrap gap-2">
+                  <Button disabled={writing || !gatewayBase} onClick={() => void handleWrite()}>
+                    {writing ? <Loader2 className="animate-spin" /> : <Save />}
+                    保存并设为默认
+                  </Button>
+                </div>
+              </div>
+            ) : (
+              <EmptyState description="Create an API key in the sub2api web console first." title="No API keys" />
+            )
+            )}
+          </div>
         </section>
+        )}
+        {status.configured && (
+          <>
+        <section>
+          <div className="grid gap-3 rounded-md border border-border/50 p-3 sm:grid-cols-2">
+            <ReadonlyField label="绑定 FreeModelAPI Key" value={savedKeyId == null ? '—' : savedKeyLabel()} />
+            <ReadonlyField
+              label="API Key"
+              mono
+              value={savedKeyId == null ? '—' : `已配置 ${maskKey(keys.find(k => k.id === savedKeyId)?.key ?? '')}`}
+            />
+            <ReadonlyField className="sm:col-span-2" label="模型组 Base URL" mono value={gatewayBase || '—'} />
+            {/* key 没有独立额度(sub2api 按账户余额计费),这里显示的就是这把 key 花的钱 */}
+            <ReadonlyField label="余额" value={`$${(status.balance ?? 0).toFixed(2)}`}>
+              {rechargeUrl && (
+                <a className="ml-2 shrink-0 text-destructive hover:underline" href={rechargeUrl} rel="noreferrer" target="_blank">
+                  充值
+                </a>
+              )}
+            </ReadonlyField>
+            {savedKeyId == null ? (
+              <p className="text-xs text-muted-foreground sm:col-span-2">
+                还没有保存 key —— 选中一把 key,点「保存 api key」。
+              </p>
+            ) : (
+              <>
+                <p className="text-xs text-muted-foreground sm:col-span-2">
+                  创建于 {keys.find(k => k.id === savedKeyId)?.createdAt.slice(0, 10) ?? '—'} · 生效倍率{' '}
+                  {testResult?.keyId === savedKeyId ? rateLabel(testResult.rateMultiplier) : '—'} ·{' '}
+                  {selectedKeyId === savedKeyId ? models.length : '—'} 个模型
+                </p>
+                <div className="sm:col-span-2">
+                  <Button
+                    className="border-destructive/40 text-destructive hover:bg-destructive/10 hover:text-destructive"
+                    onClick={() => void handleDeleteSavedKey()}
+                    size="sm"
+                    variant="outline"
+                  >
+                    <Trash2 />
+                    删除当前 Key
+                  </Button>
+                </div>
+              </>
+            )}
+          </div>
+        </section>
+          </>
+        )}
+        {/* 测试断开后仍可用:探测只要 base_url + key,不需要会话 */}
+        {(status.configured || savedEnv.keyMask) && (
+        <section>
+          <SectionHeading
+            aside={
+              <Button
+                disabled={!(selectedKey() || savedEnvKey) || !gatewayBase || testingKey}
+                onClick={() => void handleTestKey()}
+                size="sm"
+                variant="outline"
+              >
+                {testingKey ? <Loader2 className="animate-spin" /> : <Activity />}
+                测试所选 Key
+              </Button>
+            }
+            icon={Activity}
+            title="测试"
+          />
+          <div className="grid gap-3 rounded-md border border-border/50 p-3">
+            {testResult == null ? (
+              <p className="text-xs text-muted-foreground">
+                测试当前选中的 key:{gatewayBase ? `打一次 ${gatewayBase}` : '先保存一把 key'} 拿它实际能用的模型和价格,
+                并显示这把 key 的分组倍率。
+              </p>
+            ) : (
+              <>
+                <div className="grid gap-3 sm:grid-cols-2">
+                  <ReadonlyField label="分组倍率(价格已含)" value={rateLabel(testResult.rateMultiplier)} />
+                  <ReadonlyField label="模型数" value={`${testResult.models.length}`} />
+                </div>
+                {testResult.models.length > 0 ? (
+                  <ModelPriceList models={testResult.models} pricing={testResult.pricing} />
+                ) : (
+                  <p className="text-xs text-muted-foreground">这把 key 没报出任何模型。</p>
+                )}
+              </>
+            )}
+          </div>
+        </section>
+        )}
       </div>
     </SettingsContent>
   )
diff --git a/apps/desktop/src/app/settings/index.tsx b/apps/desktop/src/app/settings/index.tsx
index dab9bac011..0d47226f1a 100644
--- a/apps/desktop/src/app/settings/index.tsx
+++ b/apps/desktop/src/app/settings/index.tsx
@@ -22,6 +22,7 @@ import {
   Settings2,
   ShieldLock,
   Upload,
+  Users,
   Wrench,
   Zap
 } from '@/lib/icons'
@@ -101,7 +102,7 @@ export function SettingsView({ onClose, onConfigSaved, onMainModelChanged }: Set
   }, [activeView, setActiveView])
   // Providers subnav (Accounts vs API keys) lives in its own param so each
   // sub-view is deep-linkable and survives a refresh.
-  const [providerView, setProviderView] = useRouteEnumParam<ProviderView>('pview', PROVIDER_VIEWS, 'custom-endpoints')
+  const [providerView, setProviderView] = useRouteEnumParam<ProviderView>('pview', PROVIDER_VIEWS, 'freemodel2api')
   const [keysView] = useRouteEnumParam<KeysView>('kview', KEYS_VIEWS, 'tools')
 
   // Jump to a section + its sub-view in one navigate. Two sequential setters
@@ -125,7 +126,7 @@ export function SettingsView({ onClose, onConfigSaved, onMainModelChanged }: Set
   )
 
   const openProviderView = useCallback(
-    (view: ProviderView) => openSubView('providers', 'pview', view, 'custom-endpoints'),
+    (view: ProviderView) => openSubView('providers', 'pview', view, 'freemodel2api'),
     [openSubView]
   )
 
@@ -216,6 +217,13 @@ export function SettingsView({ onClose, onConfigSaved, onMainModelChanged }: Set
       {
         active: activeView === 'providers',
         children: [
+          {
+            active: activeView === 'providers' && providerView === 'accounts',
+            icon: Users,
+            id: 'pview:accounts',
+            label: t.settings.nav.providerAccounts,
+            onSelect: () => openProviderView('accounts')
+          },
           {
             active: activeView === 'providers' && providerView === 'custom-endpoints',
             icon: Globe,
diff --git a/apps/desktop/src/app/settings/model-settings.test.tsx b/apps/desktop/src/app/settings/model-settings.test.tsx
index 457c8b0ac4..c6411b1e9f 100644
--- a/apps/desktop/src/app/settings/model-settings.test.tsx
+++ b/apps/desktop/src/app/settings/model-settings.test.tsx
@@ -34,10 +34,11 @@ vi.mock('@/hermes', () => ({
   getApiRequestProfile: () => 'default',
   getMoaModels: (profile?: null | string) => getMoaModels(profile),
   profileScopeKey: (scope?: null | string) => (scope ?? '').trim() || 'default',
-  setModelAssignment: (body: unknown) => setModelAssignment(body),
-  getRecommendedDefaultModel: (slug: string) => getRecommendedDefaultModel(slug),
+  setModelAssignment: (body: unknown, profile?: null | string) =>
+    profile == null ? setModelAssignment(body) : setModelAssignment(body, profile),
+  getRecommendedDefaultModel: (slug: string, profile?: null | string) => getRecommendedDefaultModel(slug, profile),
   saveMoaModels: (body: unknown) => saveMoaModels(body),
-  setEnvVar: (key: string, value: string) => setEnvVar(key, value),
+  setEnvVar: (key: string, value: string, profile?: null | string) => setEnvVar(key, value, profile),
   getHermesConfigRecord: () => getHermesConfigRecord(),
   saveHermesConfig: (config: unknown) => saveHermesConfig(config),
   setApiRequestProfile: () => {}
@@ -199,6 +200,69 @@ describe('ModelSettings', () => {
     expect(startManualOnboarding).not.toHaveBeenCalled()
   })
 
+  it('activates FreeModel2API with its endpoint and makes its live model the main default', async () => {
+    getGlobalModelInfo.mockResolvedValueOnce({ provider: 'freemodel2api', model: '' })
+    getGlobalModelOptions
+      .mockResolvedValueOnce({
+        providers: [
+          {
+            name: 'FreeModel2API',
+            slug: 'freemodel2api',
+            models: [],
+            authenticated: false,
+            auth_type: 'api_key',
+            key_env: 'FREEMODEL2API_API_KEY',
+            base_url_env: 'FREEMODEL2API_BASE_URL'
+          }
+        ]
+      })
+      .mockResolvedValueOnce({
+        providers: [
+          {
+            name: 'FreeModel2API',
+            slug: 'freemodel2api',
+            models: ['gpt-5.4'],
+            authenticated: true,
+            auth_type: 'api_key',
+            key_env: 'FREEMODEL2API_API_KEY',
+            base_url_env: 'FREEMODEL2API_BASE_URL'
+          }
+        ]
+      })
+    getRecommendedDefaultModel.mockResolvedValueOnce({
+      provider: 'freemodel2api',
+      model: 'gpt-5.4',
+      free_tier: null
+    })
+    setModelAssignment.mockResolvedValueOnce({
+      ok: true,
+      provider: 'freemodel2api',
+      model: 'gpt-5.4',
+      gateway_tools: []
+    })
+
+    await renderModelSettings('research')
+
+    fireEvent.change(await screen.findByPlaceholderText('Paste FREEMODEL2API_API_KEY'), {
+      target: { value: 'sk-fm2' }
+    })
+    fireEvent.change(screen.getByPlaceholderText('Enter FREEMODEL2API_BASE_URL'), {
+      target: { value: 'http://fm2.example/v1' }
+    })
+    fireEvent.click(screen.getByRole('button', { name: 'Activate' }))
+
+    await waitFor(() => {
+      expect(setEnvVar).toHaveBeenNthCalledWith(1, 'FREEMODEL2API_API_KEY', 'sk-fm2', 'research')
+      expect(setEnvVar).toHaveBeenNthCalledWith(2, 'FREEMODEL2API_BASE_URL', 'http://fm2.example/v1', 'research')
+    })
+    await waitFor(() =>
+      expect(setModelAssignment).toHaveBeenCalledWith(
+        { provider: 'freemodel2api', model: 'gpt-5.4', scope: 'main' },
+        'research'
+      )
+    )
+  })
+
   it('replaces the selected provider and model when the active profile changes', async () => {
     getGlobalModelInfo
       .mockResolvedValueOnce({ provider: 'custom', model: 'local-a' })
diff --git a/apps/desktop/src/app/settings/model-settings.tsx b/apps/desktop/src/app/settings/model-settings.tsx
index 9a11624c46..af8f038e31 100644
--- a/apps/desktop/src/app/settings/model-settings.tsx
+++ b/apps/desktop/src/app/settings/model-settings.tsx
@@ -261,6 +261,7 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
   // Inline API-key entry for picking an unconfigured `api_key` provider in
   // place — mirrors the onboarding ApiKeyForm but scoped to the model picker.
   const [apiKeyDraft, setApiKeyDraft] = useState('')
+  const [apiBaseUrlDraft, setApiBaseUrlDraft] = useState('')
   const [activating, setActivating] = useState(false)
 
   // Deep link from the vision Capabilities detail (?tab=config:model&aux=vision):
@@ -381,6 +382,7 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
     setSelectedProvider('')
     setSelectedModel('')
     setApiKeyDraft('')
+    setApiBaseUrlDraft('')
     void refresh({ replaceSelection: true })
   })
 
@@ -417,9 +419,13 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
   const needsSetup = optionsLoaded && !!selectedProvider && !isProviderReady(selectedProviderRow)
   const setupIsApiKey = needsSetup && selectedProviderRow?.auth_type === 'api_key' && !!selectedProviderRow?.key_env
 
+  const setupBaseUrlEnv =
+    typeof selectedProviderRow?.base_url_env === 'string' ? selectedProviderRow.base_url_env.trim() : ''
+
   // Clear any half-typed key when switching provider so it can't leak across.
   useEffect(() => {
     setApiKeyDraft('')
+    setApiBaseUrlDraft('')
   }, [selectedProvider])
 
   const auxDraftProviderModels = useMemo(
@@ -634,7 +640,10 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
     const keyEnv = selectedProviderRow?.key_env
     const slug = selectedProviderRow?.slug
 
-    if (!keyEnv || !slug || !apiKeyDraft.trim()) {
+    const baseUrlEnv =
+      typeof selectedProviderRow?.base_url_env === 'string' ? selectedProviderRow.base_url_env.trim() : ''
+
+    if (!keyEnv || !slug || !apiKeyDraft.trim() || (baseUrlEnv && !apiBaseUrlDraft.trim())) {
       return
     }
 
@@ -644,7 +653,13 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
 
     try {
       await setEnvVar(keyEnv, apiKeyDraft.trim(), scopeProfile)
+
+      if (baseUrlEnv) {
+        await setEnvVar(baseUrlEnv, apiBaseUrlDraft.trim(), scopeProfile)
+      }
+
       setApiKeyDraft('')
+      setApiBaseUrlDraft('')
 
       // Pick a sensible default for the freshly-activated provider (mirrors
       // `hermes model` curation). Best-effort — fall through to the refreshed
@@ -658,7 +673,7 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
         nextModel = ''
       }
 
-      const options = await getGlobalModelOptions(undefined, scopeProfile)
+      const options = await getGlobalModelOptions({ refresh: true }, scopeProfile)
 
       if (profileEpoch.current !== epoch) {
         return
@@ -667,13 +682,50 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
       setProviders(options.providers || [])
       const refreshedRow = options.providers?.find(p => p.slug === slug)
       const fallbackModel = refreshedRow?.models?.[0] ?? ''
-      setSelectedModel(nextModel || fallbackModel)
+      const selectedDefault = nextModel || fallbackModel
+
+      setSelectedModel(selectedDefault)
+
+      // FreeModel2API is the product default route: once its profile-scoped endpoint/key are
+      // available, persist the provider and a concrete live-catalog model in one setup action.
+      if (slug === 'freemodel2api' && selectedDefault) {
+        const result = await setMainModelAssignment(
+          {
+            provider: slug,
+            model: selectedDefault,
+            ...(refreshedRow?.api_url ? { base_url: refreshedRow.api_url } : {})
+          },
+          scopeProfile
+        )
+
+        if (profileEpoch.current !== epoch) {
+          return
+        }
+
+        const provider = result.provider || slug
+        const model = result.model || selectedDefault
+
+        setMainModel({ provider, model })
+        setSwitchStaleAux(result.stale_aux ?? [])
+
+        if (scopeProfile == null) {
+          onMainModelChanged?.(provider, model)
+        }
+      }
     } catch (err) {
       setCaughtError(err, m.loadFailed)
     } finally {
       setActivating(false)
     }
-  }, [apiKeyDraft, m.loadFailed, scopeProfile, selectedProviderRow, setCaughtError])
+  }, [
+    apiBaseUrlDraft,
+    apiKeyDraft,
+    m.loadFailed,
+    onMainModelChanged,
+    scopeProfile,
+    selectedProviderRow,
+    setCaughtError
+  ])
 
   // OAuth / external providers can't be activated with a pasted key — hand off
   // to the shared onboarding flow scoped to this provider's real sign-in. The
@@ -922,8 +974,23 @@ export function ModelSettings({ onMainModelChanged, scopeProfile }: ModelSetting
                   type="password"
                   value={apiKeyDraft}
                 />
+                {setupBaseUrlEnv ? (
+                  <Input
+                    autoComplete="off"
+                    className={cn('min-w-60 flex-1', CONTROL_TEXT)}
+                    onChange={event => setApiBaseUrlDraft(event.target.value)}
+                    onKeyDown={event => {
+                      if (isSubmitEnter(event)) {
+                        void activateApiKeyProvider()
+                      }
+                    }}
+                    placeholder={`Enter ${setupBaseUrlEnv}`}
+                    type="url"
+                    value={apiBaseUrlDraft}
+                  />
+                ) : null}
                 <Button
-                  disabled={!apiKeyDraft.trim() || activating}
+                  disabled={!apiKeyDraft.trim() || (setupBaseUrlEnv ? !apiBaseUrlDraft.trim() : false) || activating}
                   onClick={() => void activateApiKeyProvider()}
                   size="sm"
                 >
diff --git a/apps/desktop/src/app/settings/providers-settings.tsx b/apps/desktop/src/app/settings/providers-settings.tsx
index 397330c89d..59d3bedba0 100644
--- a/apps/desktop/src/app/settings/providers-settings.tsx
+++ b/apps/desktop/src/app/settings/providers-settings.tsx
@@ -30,8 +30,8 @@ import type { EnvVarInfo, OAuthProvider } from '@/types/hermes'
 
 import { isKeyVar, ProviderKeyRows } from './credential-key-ui'
 import { CustomEndpointsSettings } from './custom-endpoints-settings'
-import { FreeModel2ApiSettings } from './freemodel2api-settings'
 import { SettingsCategoryHeading, useEnvCredentials } from './env-credentials'
+import { FreeModel2ApiSettings } from './freemodel2api-settings'
 import { providerGroup, providerMeta, providerPriority } from './helpers'
 import { LocalModelsSettings } from './local-models-settings'
 import { SettingsContent, SettingsSkeleton } from './primitives'
@@ -356,7 +356,7 @@ export function ProvidersSettings({
 }: ProvidersSettingsProps) {
   const { t } = useI18n()
   const scopeProfile = useStore($settingsRequestProfile)
-  const { rowProps, vars } = useEnvCredentials(scopeProfile)
+  const { refresh: refreshEnvVars, rowProps, vars } = useEnvCredentials(scopeProfile)
   const [oauthProviders, setOauthProviders] = useState<OAuthProvider[]>([])
   const [openProvider, setOpenProvider] = useState<null | string>(null)
   const [disconnecting, setDisconnecting] = useState<null | string>(null)
@@ -525,7 +525,18 @@ export function ProvidersSettings({
   }
 
   if (view === 'freemodel2api') {
-    return <FreeModel2ApiSettings onConfigSaved={onConfigSaved} />
+    // That panel writes its two env slots itself, so `vars` here would keep
+    // showing them as unset until the scope changed — re-read on its signal.
+    return (
+      <FreeModel2ApiSettings
+        onConfigSaved={() => {
+          onConfigSaved?.()
+          void refreshEnvVars()
+        }}
+        onMainModelChanged={onMainModelChanged}
+        scopeProfile={scopeProfile}
+      />
+    )
   }
 
   if (view === 'local') {
diff --git a/apps/desktop/src/app/shell/hooks/use-statusbar-items.test.tsx b/apps/desktop/src/app/shell/hooks/use-statusbar-items.test.tsx
new file mode 100644
index 0000000000..9a2bb53744
--- /dev/null
+++ b/apps/desktop/src/app/shell/hooks/use-statusbar-items.test.tsx
@@ -0,0 +1,69 @@
+import { cleanup, renderHook } from '@testing-library/react'
+import { MemoryRouter } from 'react-router'
+import { afterEach, expect, it, vi } from 'vitest'
+
+import { $connection } from '@/store/session'
+import { $desktopVersion, $updateStatus } from '@/store/updates'
+
+import { useStatusbarItems } from './use-statusbar-items'
+
+vi.mock('./use-context-breakdown', () => ({ useContextBreakdown: () => ({ breakdown: null, loading: false }) }))
+vi.mock('../system-resources-statusbar', () => ({
+  useSystemResourcesStatusbarItem: () => ({ id: 'system-resources', variant: 'text', label: 'Resources' })
+}))
+
+afterEach(() => {
+  cleanup()
+  $connection.set(null)
+  $desktopVersion.set(null)
+  $updateStatus.set(null)
+})
+
+it('keeps statusbar tools but never duplicates the sidebar update entry, including remote mode', () => {
+  $desktopVersion.set({
+    appVersion: '0.77.3',
+    electronVersion: '0',
+    nodeVersion: '0',
+    platform: 'test',
+    hermesRoot: '/tmp'
+  })
+  $updateStatus.set({ supported: true, updateAvailable: true, currentSha: 'build-sha' })
+  $connection.set({
+    mode: 'remote',
+    connectionId: 'remote',
+    baseUrl: 'https://gateway.example',
+    wsUrl: 'wss://gateway.example/ws',
+    isFullscreen: false,
+    nativeOverlayWidth: 0,
+    token: '',
+    logs: [],
+    windowButtonPosition: null
+  })
+
+  const { result } = renderHook(
+    () =>
+      useStatusbarItems({
+        agentsOpen: false,
+        changeWorkspace: vi.fn(),
+        chatOpen: true,
+        commandCenterOpen: false,
+        extraLeftItems: [],
+        extraRightItems: [],
+        gatewayState: 'open',
+        inferenceStatus: null,
+        openAgents: vi.fn(),
+        openCommandCenterSection: vi.fn(),
+        freshDraftReady: true,
+        requestGateway: vi.fn(),
+        statusSnapshot: null,
+        toggleCommandCenter: vi.fn()
+      }),
+    { wrapper: MemoryRouter }
+  )
+
+  const ids = result.current.statusbarItems.map(item => item.id)
+  expect(ids).not.toContain('version-client')
+  expect(ids).not.toContain('version-backend')
+  expect(ids).toContain('system-resources')
+  expect(ids).toContain('terminal')
+})
diff --git a/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx b/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
index d771863a85..48aeb0e353 100644
--- a/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
+++ b/apps/desktop/src/app/shell/hooks/use-statusbar-items.tsx
@@ -3,7 +3,6 @@ import { useMemo } from 'react'
 import { useNavigate } from 'react-router'
 
 import { ConnectionSwitcher } from '@/app/chat/sidebar/connection-switcher'
-import { ProfileSwitcher } from '@/app/chat/sidebar/profile-dropdown-switcher'
 import type { CommandCenterSection } from '@/app/command-center'
 import { ContextUsagePanel } from '@/app/shell/context-usage-panel'
 import { GatewayMenuPanel } from '@/app/shell/gateway-menu-panel'
@@ -22,7 +21,6 @@ import {
   Command,
   FolderOpen,
   Globe,
-  Hash,
   Layers3,
   Loader2,
   Terminal,
@@ -32,18 +30,15 @@ import { runtimeReadinessDisplay, type RuntimeReadinessResult } from '@/lib/runt
 import { cacheHitLabel, contextBarLabel, LiveDuration, tokensPerSecondLabel, usageContextLabel } from '@/lib/statusbar'
 import { useStoreSelector } from '@/lib/use-session-slice'
 import { cn } from '@/lib/utils'
-import { resolveVersionStatus } from '@/lib/version-status'
 import { copyFilePath, revealFile } from '@/store/file-actions'
 import { $freeTierStatus, FREE_TIER_MODEL } from '@/store/free-tier'
 import { openFreeTierSignIn } from '@/store/free-tier-sign-in'
 import { revealFileInTree } from '@/store/layout'
 import { $onboardingGate, guidedOnboardingActive } from '@/store/onboarding-gate'
-import { $profileRailVisible } from '@/store/profile-rail-prefs'
 import { $projectTree, projectNameForCwd } from '@/store/projects'
 import {
   $activeSessionId,
   $busy,
-  $connection,
   $currentCwd,
   $currentUsage,
   $selectedStoredSessionId,
@@ -57,14 +52,6 @@ import { $focusedRuntimeId, $focusedSessionState, $focusedStoredSessionId } from
 import { $statusbarHiddenIds } from '@/store/statusbar-prefs'
 import { $subagentsBySession, activeSubagentCount, failedSubagentCount } from '@/store/subagents'
 import { $gatewayRestarting } from '@/store/system-actions'
-import {
-  $backendUpdateApply,
-  $backendUpdateStatus,
-  $desktopVersion,
-  $updateApply,
-  $updateStatus,
-  openUpdateOverlayFor
-} from '@/store/updates'
 import type { StatusResponse, UsageStats } from '@/types/hermes'
 
 import { CRON_ROUTE, SETTINGS_ROUTE, WEBHOOKS_ROUTE } from '../../routes'
@@ -115,7 +102,6 @@ export function useStatusbarItems({
   // minimized zone, which lit the button for a pane the user couldn't see.
   const terminalShowing = useStore($paneVisible('terminal'))
   const sessionsShowing = useStore($paneVisible('sessions'))
-  const profileRailVisible = useStore($profileRailVisible)
   const botsShowing = useStore($paneVisible('hermes-bots:pane'))
   const primaryBusy = useStore($busy)
   // Draft / primary composer atom — used only while the focused surface is the
@@ -149,12 +135,6 @@ export function useStatusbarItems({
   // subscription is what makes the check reactive.
   useStore($onboardingGate)
   const guideOwnsSignIn = guidedOnboardingActive()
-  const updateStatus = useStore($updateStatus)
-  const updateApply = useStore($updateApply)
-  const backendUpdateStatus = useStore($backendUpdateStatus)
-  const backendUpdateApply = useStore($backendUpdateApply)
-  const desktopVersion = useStore($desktopVersion)
-  const connection = useStore($connection)
 
   // The FOCUSED session (interacted tile, else the primary — the same
   // derivation the titlebar title follows): every session-scoped readout
@@ -341,93 +321,6 @@ export function useStatusbarItems({
       ? 'text-amber-600 hover:text-amber-600'
       : 'text-destructive hover:text-destructive'
 
-  const clientVersionItem = useMemo<StatusbarItem>(() => {
-    const applying = updateApply.applying || updateApply.stage === 'restart'
-
-    const status = resolveVersionStatus({
-      applying,
-      applyMessage: updateApply.message,
-      behind: updateStatus?.behind ?? 0,
-      branch: updateStatus?.branch,
-      copy,
-      remote: connection?.mode === 'remote',
-      restarting: updateApply.stage === 'restart',
-      sha: updateStatus?.currentSha?.slice(0, 7) ?? null,
-      target: 'client',
-      updateAvailable: updateStatus?.updateAvailable,
-      version: desktopVersion?.appVersion
-    })
-
-    return {
-      className: status.hasUpdate ? 'text-primary hover:text-primary' : undefined,
-      detail: status.detail,
-      hidden: status.unknown,
-      icon: applying ? <Loader2 className="size-3 animate-spin" /> : <Hash className="size-3" />,
-      id: 'version-client',
-      label: status.label,
-      // Update state is not a preference: hiding it is how a user misses that
-      // their client is behind. Listed in the menu, but locked on.
-      lockedVisible: true,
-      onSelect: () => openUpdateOverlayFor('client'),
-      title: status.tooltip,
-      toggleLabel: copy.toggleVersion,
-      variant: 'action'
-    }
-  }, [
-    desktopVersion?.appVersion,
-    connection?.mode,
-    copy,
-    updateApply.applying,
-    updateApply.message,
-    updateApply.stage,
-    updateStatus?.behind,
-    updateStatus?.branch,
-    updateStatus?.currentSha,
-    updateStatus?.updateAvailable
-  ])
-
-  const backendVersionItem = useMemo<StatusbarItem | null>(() => {
-    if (connection?.mode !== 'remote') {
-      return null
-    }
-
-    const applying = backendUpdateApply.applying || backendUpdateApply.stage === 'restart'
-
-    const status = resolveVersionStatus({
-      applying,
-      applyMessage: backendUpdateApply.message,
-      behind: backendUpdateStatus?.behind ?? 0,
-      copy,
-      remote: true,
-      restarting: backendUpdateApply.stage === 'restart',
-      target: 'backend',
-      updateAvailable: backendUpdateStatus?.updateAvailable,
-      version: statusSnapshot?.version
-    })
-
-    return {
-      className: status.hasUpdate ? 'text-primary hover:text-primary' : undefined,
-      hidden: status.unknown,
-      icon: applying ? <Loader2 className="size-3 animate-spin" /> : <Hash className="size-3" />,
-      id: 'version-backend',
-      label: status.label,
-      lockedVisible: true,
-      onSelect: () => openUpdateOverlayFor('backend'),
-      title: status.tooltip,
-      toggleLabel: copy.toggleBackendVersion,
-      variant: 'action'
-    }
-  }, [
-    connection?.mode,
-    statusSnapshot?.version,
-    backendUpdateStatus?.behind,
-    backendUpdateStatus?.updateAvailable,
-    backendUpdateApply.applying,
-    backendUpdateApply.message,
-    backendUpdateApply.stage,
-    copy
-  ])
-
   const coreLeftStatusbarItems = useMemo<readonly StatusbarItem[]>(
     () => [
       {
@@ -448,14 +341,6 @@ export function useStatusbarItems({
         lockedVisible: true,
         render: () => <StatusbarGatewaySwitcher />
       },
-      {
-        // The rail's stand-in: the profile picker moves down here while the
-        // colored strip is hidden, so switching profiles always has a door.
-        hidden: !sessionsShowing || profileRailVisible,
-        id: 'profile-switcher',
-        lockedVisible: true,
-        render: () => <ProfileSwitcher compact />
-      },
       {
         className: gatewayRestarting ? undefined : gatewayClassName,
         detail: gatewayRestarting ? copy.gatewayRestarting : gatewayDetail,
@@ -609,7 +494,6 @@ export function useStatusbarItems({
       inferenceReady,
       inferenceStatus?.reason,
       openAgents,
-      profileRailVisible,
       projectName,
       sessionsShowing,
       subagentsFailed,
@@ -682,16 +566,12 @@ export function useStatusbarItems({
         title: terminalShowing ? copy.hideTerminal : copy.showTerminal,
         toggleLabel: copy.toggleTerminal,
         variant: 'action'
-      },
-      clientVersionItem,
-      ...(backendVersionItem ? [backendVersionItem] : [])
+      }
     ],
     [
-      backendVersionItem,
       busy,
       cacheHit,
       chatOpen,
-      clientVersionItem,
       contextBar,
       contextBreakdown,
       contextBreakdownLoading,
diff --git a/apps/desktop/src/app/shell/titlebar-controls.test.tsx b/apps/desktop/src/app/shell/titlebar-controls.test.tsx
index 6dbda5030d..fa8773d1c9 100644
--- a/apps/desktop/src/app/shell/titlebar-controls.test.tsx
+++ b/apps/desktop/src/app/shell/titlebar-controls.test.tsx
@@ -17,7 +17,7 @@ function renderControls(pathname: string, props?: { leftTools?: TitlebarTool[];
   return render(
     <MemoryRouter initialEntries={[pathname]}>
       <I18nProvider configClient={null} initialLocale="en">
-        <TitlebarControls leftTools={props?.leftTools} onOpenSettings={() => {}} tools={props?.tools} />
+        <TitlebarControls leftTools={props?.leftTools} tools={props?.tools} />
       </I18nProvider>
     </MemoryRouter>
   )
@@ -140,32 +140,36 @@ describe('titlebar app-action cluster', () => {
     cleanup()
   })
 
-  it('defaults settings, layout, and HUD to the right so the left titlebar stays free for tabs', () => {
+  it('keeps the sidebar and swap controls on the left and omits settings', () => {
     renderControls('/')
 
     const left = screen.getByLabelText('Window controls')
     const right = screen.getByLabelText('App controls')
 
-    expect(within(right).getByLabelText('Open settings')).toBeTruthy()
     expect(within(right).getByLabelText('Layout editor')).toBeTruthy()
     expect(within(right).getByLabelText('HUD mode')).toBeTruthy()
 
+    expect(within(right).queryByLabelText('Open settings')).toBeNull()
     expect(within(left).queryByLabelText('Open settings')).toBeNull()
     expect(within(left).queryByLabelText('Layout editor')).toBeNull()
     expect(within(left).queryByLabelText('HUD mode')).toBeNull()
-    expect(within(left).getByLabelText(/Hide sidebar|Show sidebar/)).toBeTruthy()
+    expect(within(left).getByLabelText(/Collapse sidebar|Expand sidebar/)).toBeTruthy()
+    expect(within(left).getByLabelText('Swap sidebar sides')).toBeTruthy()
+    expect(within(right).queryByLabelText('Swap sidebar sides')).toBeNull()
   })
 
-  it('moves settings, layout, and HUD to the left when the appearance setting says left', () => {
+  it('moves layout and HUD to the left when the appearance setting says left', () => {
     setTitlebarAppActionsSide('left')
     renderControls('/')
 
     const left = screen.getByLabelText('Window controls')
     const right = screen.getByLabelText('App controls')
 
-    expect(within(left).getByLabelText('Open settings')).toBeTruthy()
     expect(within(left).getByLabelText('Layout editor')).toBeTruthy()
     expect(within(left).getByLabelText('HUD mode')).toBeTruthy()
+    expect(within(left).getByLabelText('Swap sidebar sides')).toBeTruthy()
+    expect(within(left).queryByLabelText('Open settings')).toBeNull()
     expect(within(right).queryByLabelText('Open settings')).toBeNull()
+    expect(within(right).queryByLabelText('Swap sidebar sides')).toBeNull()
   })
 })
diff --git a/apps/desktop/src/app/shell/titlebar-controls.tsx b/apps/desktop/src/app/shell/titlebar-controls.tsx
index 203cef0923..d8569e2d58 100644
--- a/apps/desktop/src/app/shell/titlebar-controls.tsx
+++ b/apps/desktop/src/app/shell/titlebar-controls.tsx
@@ -64,7 +64,6 @@ export type SetTitlebarToolGroup = (id: string, tools: readonly TitlebarTool[],
 interface TitlebarControlsProps extends ComponentProps<'div'> {
   leftTools?: readonly TitlebarTool[]
   tools?: readonly TitlebarTool[]
-  onOpenSettings: () => void
 }
 
 /**
@@ -131,7 +130,7 @@ function useModifierHeld(): boolean {
   return held
 }
 
-export function TitlebarControls({ leftTools = [], tools = [], onOpenSettings }: TitlebarControlsProps) {
+export function TitlebarControls({ leftTools = [], tools = [] }: TitlebarControlsProps) {
   const { t } = useI18n()
   const navigate = useNavigate()
   const location = useLocation()
@@ -152,14 +151,14 @@ export function TitlebarControls({ leftTools = [], tools = [], onOpenSettings }:
   const titleBarRight = useContributions('titleBar.right')
   const pageOwnsTitlebar = titleBarLeft.length + titleBarCenter.length + titleBarRight.length > 0
 
-  // POSITIONAL toggles: each button shows/hides everything on its physical
+  // POSITIONAL toggles: each edge button shows/hides everything on its physical
   // side of the main zone (the layout tree collapses the whole side), so they
   // stay correct through flips and rearranges. $sidebarOpen ≙ left side,
-  // $fileBrowserOpen ≙ right side. Never an active highlight — plain
-  // show/hide affordances.
+  // $fileBrowserOpen ≙ right side. The pane-swap action is fixed in the left
+  // titlebar cluster and is handled separately below.
   const leftEdge = { open: sidebarOpen, toggle: toggleSidebarOpen }
   const rightEdge = { open: fileBrowserOpen, toggle: toggleFileBrowserOpen }
-  const leftLabel = leftEdge.open ? t.titlebar.hideSidebar : t.titlebar.showSidebar
+  const leftLabel = leftEdge.open ? t.titlebar.collapseSidebar : t.titlebar.expandSidebar
   const rightLabel = rightEdge.open ? t.titlebar.hideRightSidebar : t.titlebar.showRightSidebar
 
   const sidebarTool: TitlebarTool = {
@@ -198,19 +197,10 @@ export function TitlebarControls({ leftTools = [], tools = [], onOpenSettings }:
     tour: 'right-pane-toggle'
   }
 
-  // Static system tools — always pinned to the screen's right edge so the
-  // left titlebar stays free for tabs (#107351).
+  // Static system tools follow the configured app-action side. The pane-swap
+  // control remains left-fixed so the titlebar keeps one stable navigation
+  // cluster regardless of that preference.
   const systemTools: TitlebarTool[] = [
-    {
-      actionId: 'nav.settings',
-      icon: <TitlebarIcon name="settings-gear" />,
-      id: 'settings',
-      label: t.titlebar.openSettings,
-      onSelect: () => {
-        triggerHaptic('open')
-        onOpenSettings()
-      }
-    },
     {
       className: 'group/tool',
       // Hover + held ⌘/Ctrl morphs the glyph into its reset form (see
@@ -289,7 +279,9 @@ export function TitlebarControls({ leftTools = [], tools = [], onOpenSettings }:
   }
 
   const visibleLeftTools = (
-    appActionsSide === 'left' ? [sidebarTool, ...systemTools, ...leftTools] : [sidebarTool, ...leftTools]
+    appActionsSide === 'left'
+      ? [sidebarTool, flipTool, ...systemTools, ...leftTools]
+      : [sidebarTool, flipTool, ...leftTools]
   ).filter(tool => !tool.hidden)
 
   const visibleSystemTools = appActionsSide === 'right' ? systemTools.filter(tool => !tool.hidden) : []
@@ -327,7 +319,6 @@ export function TitlebarControls({ leftTools = [], tools = [], onOpenSettings }:
         {visibleSystemTools.map(tool => (
           <TitlebarToolButton key={tool.id} navigate={navigate} tool={tool} />
         ))}
-        <TitlebarToolButton navigate={navigate} tool={flipTool} />
         <TitlebarToolButton navigate={navigate} tool={rightSidebarTool} />
         <Slot area="titleBar.right" />
       </div>
diff --git a/apps/desktop/src/components/Backdrop.tsx b/apps/desktop/src/components/Backdrop.tsx
index 342f3d9169..2ab66d7807 100644
--- a/apps/desktop/src/components/Backdrop.tsx
+++ b/apps/desktop/src/components/Backdrop.tsx
@@ -12,7 +12,7 @@ export function Backdrop() {
   }
 
   return (
-    <div aria-hidden className="pointer-events-none absolute inset-0 z-2 opacity-[0.025] mix-blend-difference">
+    <div aria-hidden className="pointer-events-none absolute inset-0 z-2 opacity-[0.01] mix-blend-difference">
       <img
         alt=""
         className="h-[160dvh] w-auto min-w-dvw object-cover object-left-top [filter:invert(var(--backdrop-invert-mul,1))]"
diff --git a/apps/desktop/src/components/assistant-ui/embeds/listing-embed.tsx b/apps/desktop/src/components/assistant-ui/embeds/listing-embed.tsx
index ecc2e6565e..bd9934d233 100644
--- a/apps/desktop/src/components/assistant-ui/embeds/listing-embed.tsx
+++ b/apps/desktop/src/components/assistant-ui/embeds/listing-embed.tsx
@@ -202,7 +202,6 @@ function ListingGallery({ address, images }: { address: string; images: string[]
 
       <ImageLightbox
         alt={address}
-        copy={t.desktop}
         onClick={download}
         onOpenChange={open => setOpenAt(open ? position : null)}
         open={openAt !== null}
diff --git a/apps/desktop/src/components/chat/generated-image-result.tsx b/apps/desktop/src/components/chat/generated-image-result.tsx
index f5fe3d2865..77d4bff90e 100644
--- a/apps/desktop/src/components/chat/generated-image-result.tsx
+++ b/apps/desktop/src/components/chat/generated-image-result.tsx
@@ -4,6 +4,7 @@ import { type FC, useEffect, useState } from 'react'
 
 import { DiffusionCanvas } from '@/components/chat/image-generation-placeholder'
 import { ImageActionButton, ImageLightbox } from '@/components/chat/zoomable-image'
+import { Tip } from '@/components/ui/tooltip'
 import { useImageDownload } from '@/hooks/use-image-download'
 import { useI18n } from '@/i18n'
 import { generatedImageFromResult } from '@/lib/generated-images'
@@ -133,32 +134,34 @@ export const GeneratedImage: FC<{ aspectRatio?: string; result?: unknown }> = ({
           </div>
         )}
         {src && (
-          <button
-            className="absolute inset-0 block size-full cursor-zoom-in"
-            onClick={() => setLightboxOpen(true)}
-            title={copy.openImage}
-            type="button"
-          >
-            <img
-              alt="Generated image"
-              className={cn(
-                'absolute inset-0 size-full object-contain opacity-0 transition-opacity duration-500 ease-out',
-                loaded && 'opacity-100'
-              )}
-              draggable={false}
-              onError={() => setFailed(true)}
-              onLoad={event => {
-                const { naturalHeight, naturalWidth } = event.currentTarget
+          <Tip label={copy.openImage}>
+            <button
+              aria-label={copy.openImage}
+              className="absolute inset-0 block size-full cursor-zoom-in"
+              onClick={() => setLightboxOpen(true)}
+              type="button"
+            >
+              <img
+                alt="Generated image"
+                className={cn(
+                  'absolute inset-0 size-full object-contain opacity-0 transition-opacity duration-500 ease-out',
+                  loaded && 'opacity-100'
+                )}
+                draggable={false}
+                onError={() => setFailed(true)}
+                onLoad={event => {
+                  const { naturalHeight, naturalWidth } = event.currentTarget
 
-                if (naturalWidth && naturalHeight) {
-                  setRatio(naturalWidth / naturalHeight)
-                }
+                  if (naturalWidth && naturalHeight) {
+                    setRatio(naturalWidth / naturalHeight)
+                  }
 
-                setLoaded(true)
-              }}
-              src={src}
-            />
-          </button>
+                  setLoaded(true)
+                }}
+                src={src}
+              />
+            </button>
+          </Tip>
         )}
         {loaded && src && (
           <ImageActionButton className="group-hover/image:opacity-100" copy={copy} onClick={download} saving={saving} />
@@ -167,7 +170,6 @@ export const GeneratedImage: FC<{ aspectRatio?: string; result?: unknown }> = ({
       {src && (
         <ImageLightbox
           alt="Generated image"
-          copy={copy}
           onClick={download}
           onOpenChange={setLightboxOpen}
           open={lightboxOpen}
diff --git a/apps/desktop/src/components/chat/image-viewer.test.tsx b/apps/desktop/src/components/chat/image-viewer.test.tsx
new file mode 100644
index 0000000000..b14727094a
--- /dev/null
+++ b/apps/desktop/src/components/chat/image-viewer.test.tsx
@@ -0,0 +1,170 @@
+import { act, cleanup, fireEvent, render, screen, waitFor, within } from '@testing-library/react'
+import { afterEach, beforeAll, beforeEach, expect, it, vi } from 'vitest'
+
+import { LocalFilePreview } from '@/app/chat/right-rail/preview-file'
+import { $connection } from '@/store/session'
+import { stubMenuDomApis } from '@/test/jsdom'
+
+import { GeneratedImage } from './generated-image-result'
+
+vi.mock('./image-generation-placeholder', () => ({ DiffusionCanvas: () => null }))
+
+let deliverResize: ResizeObserverCallback
+const source = 'data:image/png;base64,fixture'
+const save = vi.fn(async () => false)
+const read = vi.fn(async () => source)
+const api = vi.fn(async () => ({ dataUrl: source }))
+
+beforeAll(() => {
+  stubMenuDomApis()
+  vi.stubGlobal(
+    'ResizeObserver',
+    class {
+      constructor(callback: ResizeObserverCallback) {
+        deliverResize = callback
+      }
+      observe() {}
+      unobserve() {}
+      disconnect() {}
+    }
+  )
+})
+
+beforeEach(() => {
+  $connection.set(null)
+  vi.stubGlobal('hermesDesktop', { readFileDataUrl: read, api, saveImageFromUrl: save })
+  vi.clearAllMocks()
+})
+
+afterEach(() => {
+  cleanup()
+  $connection.set(null)
+  Reflect.deleteProperty(window, 'hermesDesktop')
+})
+
+function resize(stage: HTMLElement, width: number, height: number) {
+  act(() =>
+    deliverResize(
+      [{ target: stage, contentRect: { width, height } } as unknown as ResizeObserverEntry],
+      {} as ResizeObserver
+    )
+  )
+}
+
+function loadImage(image: HTMLElement) {
+  Object.defineProperties(image, {
+    naturalWidth: { configurable: true, value: 2000 },
+    naturalHeight: { configurable: true, value: 1000 }
+  })
+  fireEvent.load(image)
+}
+
+function scale(image: HTMLElement) {
+  return Number(image.style.transform.match(/scale\(([^)]+)\)/)?.[1])
+}
+
+it('gives generated images fit/native sizing, cancellable wheel zoom, drag and download without dismissing the viewer', async () => {
+  render(<GeneratedImage result={{ success: true, image: source }} />)
+  fireEvent.click(screen.getByRole('button', { name: 'Open image' }))
+  const dialog = screen.getByRole('dialog')
+  const image = within(dialog).getByAltText('Generated image')
+  const stage = dialog.querySelector('[data-slot="image-stage"]') as HTMLElement
+  loadImage(image)
+  resize(stage, 400, 300)
+  const fitScale = scale(image)
+  expect(fitScale).toBeGreaterThan(0)
+  expect(fitScale).toBeLessThan(1)
+
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Zoom in' }))
+  expect(scale(image)).toBeGreaterThan(fitScale)
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Zoom out' }))
+  expect(scale(image)).toBeCloseTo(fitScale)
+  const wheel = new WheelEvent('wheel', { bubbles: true, cancelable: true, ctrlKey: true, deltaY: -1 })
+  act(() => stage.dispatchEvent(wheel))
+  expect(wheel.defaultPrevented).toBe(true)
+  expect(scale(image)).toBeGreaterThan(fitScale)
+
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Actual size' }))
+  expect(scale(image)).toBe(1)
+  resize(stage, 700, 400)
+  expect(scale(image)).toBe(1)
+  fireEvent.pointerDown(stage, { button: 0, pointerId: 1, clientX: 10, clientY: 20 })
+  fireEvent.pointerMove(stage, { pointerId: 1, clientX: 60, clientY: 50 })
+  expect(image.style.transform).toContain('translate(50px, 30px)')
+  fireEvent.pointerCancel(stage, { pointerId: 1 })
+  const position = image.style.transform
+  fireEvent.pointerMove(stage, { pointerId: 1, clientX: 90, clientY: 90 })
+  expect(image.style.transform).toBe(position)
+  fireEvent.click(image)
+  expect(screen.getByRole('dialog')).toBe(dialog)
+
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Fit to window' }))
+  expect(scale(image)).toBeLessThan(1)
+  expect(image.style.transform).toContain('translate(0px, 0px)')
+  resize(stage, 800, 400)
+  expect(scale(image)).toBeGreaterThan(fitScale)
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Download image' }))
+  await waitFor(() => expect(save).toHaveBeenCalledWith(source))
+  fireEvent.click(within(dialog).getByRole('button', { name: 'Close' }))
+  await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+})
+
+it('keeps local/remote file reads on their real adapters and exposes the same viewer inside the pane and expanded', async () => {
+  const path = '/work/generated.png'
+
+  const target = {
+    kind: 'file' as const,
+    label: 'generated.png',
+    previewKind: 'image' as const,
+    source: path,
+    path,
+    url: `file://${path}`
+  }
+
+  for (const remote of [false, true]) {
+    if (remote) {
+      $connection.set({
+        mode: 'remote',
+        profile: 'image-profile',
+        connectionId: 'remote',
+        baseUrl: 'https://gateway.example',
+        wsUrl: 'wss://gateway.example/ws',
+        token: '',
+        logs: [],
+        isFullscreen: false,
+        nativeOverlayWidth: 0,
+        windowButtonPosition: null
+      })
+    }
+
+    const { container, unmount } = render(<LocalFilePreview reloadKey={0} target={target} />)
+    const image = await screen.findByAltText(target.label)
+    expect(image.getAttribute('src')).toBe(source)
+
+    if (remote) {
+      expect(api).toHaveBeenCalledWith(
+        expect.objectContaining({
+          path: `/api/fs/read-data-url?path=${encodeURIComponent(path)}`,
+          profile: 'image-profile'
+        })
+      )
+    } else {
+      expect(read).toHaveBeenCalledWith(path)
+      expect(api).not.toHaveBeenCalled()
+    }
+
+    const stage = container.querySelector('[data-slot="image-stage"]') as HTMLElement
+    loadImage(image)
+    resize(stage, 352, 450)
+    fireEvent.click(screen.getByRole('button', { name: 'Zoom in' }))
+    expect(scale(image)).toBeGreaterThan(352 / 2000)
+    fireEvent.click(screen.getByRole('button', { name: 'Open image' }))
+    const dialog = screen.getByRole('dialog')
+    expect(within(dialog).getByAltText(target.label).getAttribute('src')).toBe(source)
+    expect(within(dialog).getByRole('button', { name: 'Fit to window' })).toBeTruthy()
+    fireEvent.keyDown(dialog, { key: 'Escape' })
+    await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull())
+    expect(container.querySelector('[data-slot="image-viewer"]')).toBeTruthy()
+    unmount()
+  }
+})
diff --git a/apps/desktop/src/components/chat/image-viewer.tsx b/apps/desktop/src/components/chat/image-viewer.tsx
new file mode 100644
index 0000000000..84bbed34c7
--- /dev/null
+++ b/apps/desktop/src/components/chat/image-viewer.tsx
@@ -0,0 +1,210 @@
+import { type ComponentProps, useCallback, useEffect, useRef, useState } from 'react'
+
+import { PageLoader } from '@/components/page-loader'
+import { Button } from '@/components/ui/button'
+import { ErrorState } from '@/components/ui/error-state'
+import { Tip } from '@/components/ui/tooltip'
+import { useZoomPan } from '@/components/ui/use-zoom-pan'
+import { useResizeObserver } from '@/hooks/use-resize-observer'
+import { useI18n } from '@/i18n'
+import { Download, Maximize, RefreshCw, Square, X, ZoomIn, ZoomOut } from '@/lib/icons'
+import { isSmartZoomWheel } from '@/lib/trackpad-gestures'
+import { cn } from '@/lib/utils'
+
+interface ImageSize {
+  width: number
+  height: number
+}
+
+export interface ImageViewerProps {
+  alt?: string
+  src: string
+  onDownload: () => void
+  saving?: boolean
+  onExpand?: () => void
+  onClose?: () => void
+}
+
+/** Shared image surface for file previews and transcript lightboxes. */
+export function ImageViewer({ alt, src, onDownload, saving = false, onExpand, onClose }: ImageViewerProps) {
+  const { t } = useI18n()
+  const copy = t.desktop
+  const stageRef = useRef<HTMLDivElement>(null)
+  const [imageSize, setImageSize] = useState<ImageSize>({ width: 0, height: 0 })
+  const [stageSize, setStageSize] = useState<ImageSize>({ width: 0, height: 0 })
+  const [fit, setFit] = useState(true)
+  const [failed, setFailed] = useState(false)
+  const ready = imageSize.width > 0 && stageSize.width > 0 && stageSize.height > 0
+  const fitScale = ready ? Math.min(1, stageSize.width / imageSize.width, stageSize.height / imageSize.height) : 1
+
+  const { panning, reset, scale, setScale, stageProps, style, zoomIn, zoomOut } = useZoomPan({
+    minScale: Math.min(0.05, fitScale),
+    resetScale: fitScale
+  })
+
+  const { onWheel, ...pointerProps } = stageProps
+
+  const measureStage = useCallback((entries: readonly ResizeObserverEntry[]) => {
+    const rect = entries[0]?.contentRect ?? stageRef.current?.getBoundingClientRect()
+
+    if (rect) {
+      setStageSize(prev =>
+        prev.width === rect.width && prev.height === rect.height ? prev : { width: rect.width, height: rect.height }
+      )
+    }
+  }, [])
+
+  useResizeObserver(measureStage, stageRef)
+
+  useEffect(() => {
+    if (fit && ready) {
+      reset()
+    }
+  }, [fit, ready, reset])
+
+  // React wheel listeners are passive; image zoom must not scroll or zoom the app.
+  useEffect(() => {
+    const stage = stageRef.current!
+
+    const handleWheel = (event: WheelEvent) => {
+      if (!ready || failed) {
+        return
+      }
+
+      setFit(isSmartZoomWheel(event))
+      onWheel(event)
+    }
+
+    stage.addEventListener('wheel', handleWheel, { passive: false })
+
+    return () => stage.removeEventListener('wheel', handleWheel)
+  }, [failed, onWheel, ready])
+
+  const fitImage = () => {
+    setFit(true)
+    reset()
+  }
+
+  const actualSize = () => {
+    setFit(false)
+    setScale(1)
+  }
+
+  return (
+    <div className="flex h-full min-h-0 w-full min-w-0 flex-col" data-slot="image-viewer">
+      <div
+        aria-label={copy.openImage}
+        className="flex h-11 shrink-0 items-center justify-between gap-1 border-b border-(--ui-stroke-tertiary) px-2"
+        role="toolbar"
+      >
+        <div className="flex items-center gap-1">
+          <ImageToolButton
+            disabled={!ready || failed || scale <= Math.min(0.05, fitScale)}
+            label={copy.imageZoomOut}
+            onClick={() => {
+              setFit(false)
+              zoomOut()
+            }}
+          >
+            <ZoomOut />
+          </ImageToolButton>
+          <span
+            className="w-12 shrink-0 text-center text-[0.6875rem] tabular-nums text-(--ui-text-secondary)"
+            data-slot="image-scale"
+          >
+            {Math.round(scale * 100)}%
+          </span>
+          <ImageToolButton
+            disabled={!ready || failed || scale >= 8}
+            label={copy.imageZoomIn}
+            onClick={() => {
+              setFit(false)
+              zoomIn()
+            }}
+          >
+            <ZoomIn />
+          </ImageToolButton>
+          <ImageToolButton aria-pressed={fit} disabled={!ready || failed} label={copy.imageFit} onClick={fitImage}>
+            <RefreshCw />
+          </ImageToolButton>
+          <ImageToolButton
+            aria-pressed={!fit && scale === 1}
+            disabled={!ready || failed}
+            label={copy.imageActualSize}
+            onClick={actualSize}
+          >
+            <Square />
+          </ImageToolButton>
+        </div>
+        <div className="flex items-center gap-1">
+          <ImageToolButton
+            disabled={saving}
+            label={saving ? copy.savingImage : copy.downloadImage}
+            onClick={onDownload}
+          >
+            <Download />
+          </ImageToolButton>
+          {onExpand && (
+            <ImageToolButton label={copy.openImage} onClick={onExpand}>
+              <Maximize />
+            </ImageToolButton>
+          )}
+          {onClose && (
+            <Button aria-label={t.common.close} onClick={onClose} size="icon-sm" variant="ghost">
+              <X />
+            </Button>
+          )}
+        </div>
+      </div>
+      <div
+        {...pointerProps}
+        className={cn(
+          'relative min-h-0 flex-1 touch-none overflow-hidden',
+          panning ? 'cursor-grabbing' : 'cursor-grab'
+        )}
+        data-slot="image-stage"
+        onDoubleClick={() => (scale === 1 ? fitImage() : actualSize())}
+        ref={stageRef}
+      >
+        {!ready && !failed && <PageLoader className="absolute inset-0" label={t.preview.loading} />}
+        {failed && (
+          <div className="absolute inset-0 grid place-items-center p-4">
+            <ErrorState title={copy.imagePreviewFailed} />
+          </div>
+        )}
+        <div className="pointer-events-none absolute inset-0 flex items-center justify-center">
+          <img
+            alt={alt ?? ''}
+            className="block max-h-none max-w-none shrink-0 select-none"
+            draggable={false}
+            onError={() => setFailed(true)}
+            onLoad={event => {
+              const { naturalWidth, naturalHeight } = event.currentTarget
+              setImageSize({ width: naturalWidth, height: naturalHeight })
+              setFailed(false)
+            }}
+            src={src}
+            style={{
+              ...style,
+              width: imageSize.width || undefined,
+              height: imageSize.height || undefined,
+              visibility: ready && !failed ? 'visible' : 'hidden'
+            }}
+          />
+        </div>
+      </div>
+    </div>
+  )
+}
+
+interface ImageToolButtonProps extends ComponentProps<typeof Button> {
+  label: string
+}
+
+function ImageToolButton({ label, ...props }: ImageToolButtonProps) {
+  return (
+    <Tip label={label}>
+      <Button aria-label={label} size="icon-sm" variant="ghost" {...props} />
+    </Tip>
+  )
+}
diff --git a/apps/desktop/src/components/chat/intro-copy.jsonl b/apps/desktop/src/components/chat/intro-copy.jsonl
index 2fe1db9607..713123ea68 100644
--- a/apps/desktop/src/components/chat/intro-copy.jsonl
+++ b/apps/desktop/src/components/chat/intro-copy.jsonl
@@ -68,7 +68,7 @@
 {"personality":"hype","headline":"New session, infinite W's","body":"Bring the gnarliest bug you've got. I'll read, patch, test, commit like my life depends on it. LET'S GO."}
 {"personality":"hype","headline":"ABSOLUTELY DIALED IN","body":"Describe the task. I'll blitz through files, crush failing tests, and leave a commit that SLAPS. Go go go."}
 {"personality":"hype","headline":"Ready. So ready. Too ready.","body":"Tiny typo or huge refactor - doesn't matter. I'm shipping clean code today. Name the task and let's WORK."}
-{"personality":"none","headline":"Hermes Agent is ready.","body":"Ask a question, paste an error, or point me at a repo. I can read code, run tools, and help you ship."}
+{"personality":"none","headline":"Digital Assistant is ready.","body":"Ask a question, paste an error, or point me at a repo. I can read code, run tools, and help you ship."}
 {"personality":"none","headline":"What are we building today?","body":"Describe the task in your own words. I'll pick the right tools, explain my plan, and check in before risky steps."}
 {"personality":"none","headline":"Start anywhere.","body":"Drop a file path, a traceback, or a rough idea. I'll investigate, suggest next steps, and keep things reversible."}
 {"personality":"none","headline":"Your workspace, one prompt away.","body":"Search the repo, edit files, run tests, open PRs. Tell me the goal and I'll handle the mechanical parts."}
diff --git a/apps/desktop/src/components/chat/intro.tsx b/apps/desktop/src/components/chat/intro.tsx
index dd675e32db..f0d3d0eeda 100644
--- a/apps/desktop/src/components/chat/intro.tsx
+++ b/apps/desktop/src/components/chat/intro.tsx
@@ -145,7 +145,7 @@ function pickCopy(copies: IntroCopy[], seed = 0): IntroCopy {
   return copies[Math.abs(seed) % copies.length] || FALLBACK_COPY[0]
 }
 
-const WORDMARK = 'HERMES AGENT'
+const WORDMARK = 'Digital Assistant'
 
 function resolveCopy(personality?: string, seed?: number): IntroCopy {
   const personalityKey = normalizeKey(personality)
diff --git a/apps/desktop/src/components/chat/wordmark.tsx b/apps/desktop/src/components/chat/wordmark.tsx
index 6be1230e8c..2c72b02143 100644
--- a/apps/desktop/src/components/chat/wordmark.tsx
+++ b/apps/desktop/src/components/chat/wordmark.tsx
@@ -4,7 +4,7 @@ import { cn } from '@/lib/utils'
 
 /**
  * The oversized display lettering of an empty chat — the Collapse face that
- * writes "HERMES AGENT" across a fresh draft, and a bot's name across its own
+ * writes the welcome name across a fresh draft, and a bot's name across its own
  * empty chat.
  *
  * The doubled children are load-bearing, not a typo: `.fit-text` sizes the
diff --git a/apps/desktop/src/components/chat/zoomable-image.tsx b/apps/desktop/src/components/chat/zoomable-image.tsx
index e11ad3cb63..326b26b6fa 100644
--- a/apps/desktop/src/components/chat/zoomable-image.tsx
+++ b/apps/desktop/src/components/chat/zoomable-image.tsx
@@ -2,12 +2,15 @@
 
 import { type ComponentProps, useState } from 'react'
 
-import { Dialog, DialogContent } from '@/components/ui/dialog'
+import { Dialog, DialogContent, DialogTitle } from '@/components/ui/dialog'
+import { Tip } from '@/components/ui/tooltip'
 import { useImageDownload } from '@/hooks/use-image-download'
 import { useI18n } from '@/i18n'
 import { Download } from '@/lib/icons'
 import { cn } from '@/lib/utils'
 
+import { ImageViewer } from './image-viewer'
+
 export interface ZoomableImageProps extends ComponentProps<'img'> {
   containerClassName?: string
   slot?: string
@@ -31,15 +34,17 @@ export function ZoomableImage({ className, containerClassName, src, alt, slot, .
         className={cn('group/image relative inline-block max-w-full align-top', containerClassName)}
         data-slot={slot ?? 'aui_zoomable-image'}
       >
-        <button
-          className="contents"
-          disabled={!canOpen}
-          onClick={() => canOpen && setLightboxOpen(true)}
-          title={canOpen ? copy.openImage : undefined}
-          type="button"
-        >
-          <img alt={alt ?? ''} className={className} src={src} {...props} />
-        </button>
+        <Tip label={canOpen ? copy.openImage : undefined}>
+          <button
+            aria-label={copy.openImage}
+            className="contents"
+            disabled={!canOpen}
+            onClick={() => canOpen && setLightboxOpen(true)}
+            type="button"
+          >
+            <img alt={alt ?? ''} className={className} src={src} {...props} />
+          </button>
+        </Tip>
         {src && (
           <ImageActionButton className="group-hover/image:opacity-100" copy={copy} onClick={download} saving={saving} />
         )}
@@ -47,7 +52,6 @@ export function ZoomableImage({ className, containerClassName, src, alt, slot, .
       {src && (
         <ImageLightbox
           alt={alt}
-          copy={copy}
           onClick={download}
           onOpenChange={setLightboxOpen}
           open={lightboxOpen}
@@ -59,44 +63,35 @@ export function ZoomableImage({ className, containerClassName, src, alt, slot, .
   )
 }
 
-export function ImageLightbox({
-  alt,
-  copy,
-  onClick,
-  onOpenChange,
-  open,
-  saving,
-  src
-}: {
+export interface ImageLightboxProps {
   alt?: string
-  copy: ImageActionCopy
   onClick: () => void
   onOpenChange: (open: boolean) => void
   open: boolean
   saving: boolean
   src: string
-}) {
+}
+
+export function ImageLightbox({ alt, onClick, onOpenChange, open, saving, src }: ImageLightboxProps) {
+  const { t } = useI18n()
+
   return (
     <Dialog onOpenChange={onOpenChange} open={open}>
       <DialogContent
-        bodyClassName="block overflow-visible p-0"
-        className="w-auto max-h-[calc(100vh-12rem)] max-w-[calc(100vw-12rem)] border-0 bg-transparent shadow-none"
+        aria-describedby={undefined}
+        bodyClassName="flex min-h-0 flex-1 flex-col gap-0 overflow-hidden p-0"
+        className="h-[90dvh] w-[96vw] max-h-[90dvh] max-w-[96vw]"
         showCloseButton={false}
       >
-        <div className="group/lightbox relative inline-block">
-          <img
-            alt={alt ?? ''}
-            className="block max-h-[calc(100vh-12rem)] max-w-[calc(100vw-12rem)] cursor-zoom-out select-auto rounded-lg object-contain shadow-2xl"
-            onClick={() => onOpenChange(false)}
-            src={src}
-          />
-          <ImageActionButton
-            className="group-hover/lightbox:opacity-100"
-            copy={copy}
-            onClick={onClick}
-            saving={saving}
-          />
-        </div>
+        <DialogTitle className="sr-only">{alt || t.desktop.openImage}</DialogTitle>
+        <ImageViewer
+          alt={alt}
+          key={src}
+          onClose={() => onOpenChange(false)}
+          onDownload={onClick}
+          saving={saving}
+          src={src}
+        />
       </DialogContent>
     </Dialog>
   )
@@ -114,21 +109,22 @@ export function ImageActionButton({
   saving: boolean
 }) {
   return (
-    <button
-      aria-label={saving ? copy.savingImage : copy.downloadImage}
-      className={cn(
-        'absolute right-2 top-2 grid size-8 place-items-center rounded-full border border-border/70 bg-background/80 text-muted-foreground opacity-0 shadow-sm backdrop-blur transition-opacity hover:bg-accent hover:text-foreground focus-visible:opacity-100 disabled:opacity-50',
-        className
-      )}
-      disabled={saving}
-      onClick={event => {
-        event.stopPropagation()
-        void onClick()
-      }}
-      title={saving ? copy.savingImage : copy.downloadImage}
-      type="button"
-    >
-      <Download className={cn('size-4', saving && 'animate-pulse')} />
-    </button>
+    <Tip label={saving ? copy.savingImage : copy.downloadImage}>
+      <button
+        aria-label={saving ? copy.savingImage : copy.downloadImage}
+        className={cn(
+          'absolute right-2 top-2 grid size-8 place-items-center rounded-full border border-border/70 bg-background/80 text-muted-foreground opacity-0 shadow-sm backdrop-blur transition-opacity hover:bg-accent hover:text-foreground focus-visible:opacity-100 disabled:opacity-50',
+          className
+        )}
+        disabled={saving}
+        onClick={event => {
+          event.stopPropagation()
+          void onClick()
+        }}
+        type="button"
+      >
+        <Download className={cn('size-4', saving && 'animate-pulse')} />
+      </button>
+    </Tip>
   )
 }
diff --git a/apps/desktop/src/components/onboarding-chat/setup-profile.ts b/apps/desktop/src/components/onboarding-chat/setup-profile.ts
index c3ab17e2d9..8a9c138815 100644
--- a/apps/desktop/src/components/onboarding-chat/setup-profile.ts
+++ b/apps/desktop/src/components/onboarding-chat/setup-profile.ts
@@ -265,7 +265,7 @@ export async function buildFirstTaskSeedMessages(
 /** The hidden note sent to the welcome chat once the build session is live. The check-ins after it come from the
  *  build's own progress, in first-build.ts. */
 export function buildHandoffCompleteNote(task: string): string {
-  return `[setup] handoff complete — "${task.trim()}" is now building in its own session on the default profile, and the user is watching it there. The app is showing them a short tour of the profile rail and the sessions list right now, so do not describe either. Say ONE short line and then stop: you're around if they want a hand, and this chat stays where it is. Do not ask a question, do not offer a list, do not schedule anything.`
+  return `[setup] handoff complete — "${task.trim()}" is now building in its own session on the default profile, and the user is watching it there. The app is showing them a short tour of the account menu's profiles and the sessions list right now, so do not describe either. Say ONE short line and then stop: you're around if they want a hand, and this chat stays where it is. Do not ask a question, do not offer a list, do not schedule anything.`
 }
 
 /** Creates the guide profile. The catch treats an already-existing profile as success, so kickoff can call this on
diff --git a/apps/desktop/src/components/onboarding-chat/signpost.ts b/apps/desktop/src/components/onboarding-chat/signpost.ts
index d71122ffb6..6ae5c2baa5 100644
--- a/apps/desktop/src/components/onboarding-chat/signpost.ts
+++ b/apps/desktop/src/components/onboarding-chat/signpost.ts
@@ -13,10 +13,10 @@ import { translateNow } from '@/i18n'
 
 /** Tour handles (`data-tour`). A targets scan returns these same selectors, so a curated step and a
  *  model-driven step point at the same node. */
-const RAIL = '[data-tour="profile-rail"]'
+const PROFILE_MENU = '[data-tour="profile-menu"]'
 const SESSIONS = '[data-tour="sessions-sidebar"]'
 
-/** Waits for a visible node. The profile rail mounts a render or two after the handoff switches profiles, and
+/** Waits for a visible node. Sidebar chrome can mount after the handoff switches profiles, and
  *  the tour engine returns a no-match for a selector that is not in the DOM yet. Returns false on timeout. */
 async function waitFor(selector: string, timeoutMs = 6000): Promise<boolean> {
   const deadline = Date.now() + timeoutMs
@@ -40,7 +40,7 @@ async function waitFor(selector: string, timeoutMs = 6000): Promise<boolean> {
 
 /** The caller does not await this, so the tour does not delay the handoff. */
 export async function showHandoffTour(): Promise<void> {
-  if (!(await waitFor(RAIL))) {
+  if (!(await waitFor(PROFILE_MENU))) {
     return
   }
 
@@ -51,10 +51,10 @@ export async function showHandoffTour(): Promise<void> {
   const { startTour } = await import('@/lib/tour')
 
   await startTour([
-    { accent: true, selector: RAIL, side: 'right', text: copy('profileText'), title: copy('profileTitle') },
+    { accent: true, selector: PROFILE_MENU, side: 'right', text: copy('profileText'), title: copy('profileTitle') },
     ...(sessionsVisible
       ? [{ selector: SESSIONS, side: 'right' as const, text: copy('sessionsText'), title: copy('sessionsTitle') }]
       : []),
-    { accent: true, selector: RAIL, side: 'right', text: copy('stayText'), title: copy('stayTitle') }
+    { accent: true, selector: PROFILE_MENU, side: 'right', text: copy('stayText'), title: copy('stayTitle') }
   ])
 }
diff --git a/apps/desktop/src/components/onboarding/index.test.tsx b/apps/desktop/src/components/onboarding/index.test.tsx
index 5f8b27df0e..03f44b70ee 100644
--- a/apps/desktop/src/components/onboarding/index.test.tsx
+++ b/apps/desktop/src/components/onboarding/index.test.tsx
@@ -1,11 +1,11 @@
 import { cleanup, fireEvent, render, screen } from '@testing-library/react'
-import { afterEach, describe, expect, it } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { $desktopOnboarding, type DesktopOnboardingState, type OnboardingContext } from '@/store/onboarding'
 import { makeOAuthProvider } from '@/test/oauth-provider'
 import type { OAuthProvider } from '@/types/hermes'
 
-import { Picker } from '.'
+import { ApiKeyForm, Picker } from '.'
 
 function setProviders(providers: OAuthProvider[]) {
   $desktopOnboarding.set({
@@ -121,3 +121,52 @@ describe('onboarding Picker', () => {
     expect(screen.queryByRole('button', { name: "I'll choose a provider later" })).toBeNull()
   })
 })
+
+describe('ApiKeyForm per-install base URL slot', () => {
+  const perInstall = {
+    id: 'freemodel2api',
+    name: 'FreeModel2API',
+    envKey: 'FREEMODEL2API_API_KEY',
+    baseUrlEnvKey: 'FREEMODEL2API_BASE_URL',
+    docsUrl: ''
+  }
+
+  it('requires the base URL before connecting and reports both env writes', async () => {
+    const onSave = vi.fn().mockResolvedValue({ ok: true })
+    render(<ApiKeyForm canGoBack={false} onBack={() => {}} onSave={onSave} options={[perInstall]} />)
+
+    const key = screen.getByPlaceholderText('Paste API key')
+    const url = screen.getByPlaceholderText('Base URL, e.g. http://127.0.0.1:8000/v1')
+    const connect = screen.getByRole('button', { name: 'Connect' })
+
+    fireEvent.change(key, { target: { value: 'sk-test' } })
+    expect(connect.hasAttribute('disabled')).toBe(true)
+
+    fireEvent.change(url, { target: { value: 'http://h:3020/v1' } })
+    expect(connect.hasAttribute('disabled')).toBe(false)
+    fireEvent.click(connect)
+
+    await vi.waitFor(() =>
+      expect(onSave).toHaveBeenCalledWith(
+        'FREEMODEL2API_API_KEY',
+        'sk-test',
+        'FreeModel2API',
+        undefined,
+        { envKey: 'FREEMODEL2API_BASE_URL', value: 'http://h:3020/v1' }
+      )
+    )
+  })
+
+  it('renders no second field for plain API-key options', () => {
+    render(
+      <ApiKeyForm
+        canGoBack={false}
+        onBack={() => {}}
+        onSave={vi.fn().mockResolvedValue({ ok: true })}
+        options={[{ id: 'fireworks', name: 'Fireworks AI', envKey: 'FIREWORKS_API_KEY', docsUrl: '' }]}
+      />
+    )
+
+    expect(screen.queryByPlaceholderText('Base URL, e.g. http://127.0.0.1:8000/v1')).toBeNull()
+  })
+})
diff --git a/apps/desktop/src/components/onboarding/index.tsx b/apps/desktop/src/components/onboarding/index.tsx
index 42482347a0..f53e8fe446 100644
--- a/apps/desktop/src/components/onboarding/index.tsx
+++ b/apps/desktop/src/components/onboarding/index.tsx
@@ -73,6 +73,9 @@ interface DesktopOnboardingOverlayProps {
 }
 
 export interface ApiKeyOption {
+  /** Second, required env slot for per-install gateways (freemodel2api): the
+   *  provider ships no default base URL, so the form asks for it explicitly. */
+  baseUrlEnvKey?: string
   description?: string
   docsUrl: string
   envKey: string
@@ -82,9 +85,16 @@ export interface ApiKeyOption {
   short?: string
 }
 
-// Curated order mirrors CANONICAL_PROVIDERS: Fireworks sits #2 overall (after
-// Nous Portal OAuth), ahead of OpenRouter and the rest of the key catalog.
+// FreeModel2API is the default inference route. Keep it first so the direct-key setup path lands
+// on the product default even before the dynamic provider catalog finishes loading.
 const API_KEY_OPTIONS: ApiKeyOption[] = [
+  {
+    id: 'freemodel2api',
+    name: 'FreeModel2API',
+    envKey: 'FREEMODEL2API_API_KEY',
+    baseUrlEnvKey: 'FREEMODEL2API_BASE_URL',
+    docsUrl: ''
+  },
   {
     id: 'fireworks',
     name: 'Fireworks AI',
@@ -179,6 +189,7 @@ function useApiKeyCatalog(): ApiKeyOption[] {
         id: row.slug,
         name: row.name,
         envKey,
+        baseUrlEnvKey: (row.base_url_env as string | undefined) || undefined,
         description: `Direct API access to ${row.name}.`,
         docsUrl: ''
       })
@@ -357,7 +368,10 @@ export function DesktopOnboardingOverlay({
   // do we know whether to dismiss (true) or surface the picker (false).
   // EXCEPTION: manual mode (user opened the selector from a working app to
   // add/switch a provider) shows the overlay regardless of configured state.
-  if (onboarding.configured === true && !onboarding.manual && !onboarding.freeTierReady) {
+  // An UNCONFIGURED install no longer gets the blocking first-run wizard — the
+  // composer status stack shows a setup hint instead, and the overlay opens
+  // only on demand (startManualOnboarding) or for the free-tier intro.
+  if (onboarding.configured !== null && !onboarding.manual && !onboarding.freeTierReady) {
     return null
   }
 
@@ -596,7 +610,7 @@ export function Picker({ ctx }: { ctx: OnboardingContext }) {
   const { localEndpoint, manual, mode, providers } = useStore($desktopOnboarding)
   const [showAll, setShowAll] = useState(readShowAll)
   // Which key-form option to preselect when we flip to 'apikey' mode. The
-  // OpenRouter row selects its key; the generic link lands on the first option.
+  // OpenRouter row selects its key; the generic link lands on FreeModel2API, the first option.
   const [apiKeyInitialEnv, setApiKeyInitialEnv] = useState<string | undefined>(undefined)
 
   const openKeyForm = (envKey?: string) => {
@@ -619,7 +633,9 @@ export function Picker({ ctx }: { ctx: OnboardingContext }) {
           canGoBack={hasOauth && !localEndpoint}
           initialEnvKey={localEndpoint ? 'OPENAI_BASE_URL' : apiKeyInitialEnv}
           onBack={() => setOnboardingMode('oauth')}
-          onSave={(envKey, value, name, apiKey) => saveOnboardingApiKey(envKey, value, name, ctx, apiKey)}
+          onSave={(envKey, value, name, apiKey, extraEnv) =>
+            saveOnboardingApiKey(envKey, value, name, ctx, apiKey, extraEnv)
+          }
           options={apiKeyOptions}
         />
         {manual ? null : (
@@ -740,7 +756,13 @@ export function ApiKeyForm({
   isSet?: (envKey: string) => boolean
   onBack: () => void
   onClear?: (envKey: string) => void
-  onSave: (envKey: string, value: string, name: string, apiKey?: string) => Promise<{ message?: string; ok: boolean }>
+  onSave: (
+    envKey: string,
+    value: string,
+    name: string,
+    apiKey?: string,
+    extraEnv?: { envKey: string; value: string }
+  ) => Promise<{ message?: string; ok: boolean }>
   options?: ApiKeyOption[]
   redactedValue?: (envKey: string) => null | string | undefined
 }) {
@@ -752,6 +774,9 @@ export function ApiKeyForm({
   // Optional endpoint API key, only used by the local / custom endpoint option
   // (whose `value` is the base URL). Cleared whenever the option changes.
   const [localKey, setLocalKey] = useState('')
+  // Required base URL for per-install gateway options (freemodel2api) — the
+  // provider has no default endpoint, without it the live catalog cannot probe.
+  const [baseUrl, setBaseUrl] = useState('')
   const [saving, setSaving] = useState(false)
   const [error, setError] = useState<null | string>(null)
   // `options` can change at runtime when callers filter the catalog (e.g. the
@@ -762,6 +787,7 @@ export function ApiKeyForm({
       setOption(options[0])
       setValue('')
       setLocalKey('')
+      setBaseUrl('')
       setError(null)
     }
   }, [option.envKey, options])
@@ -774,6 +800,7 @@ export function ApiKeyForm({
     setOption(o)
     setValue('')
     setLocalKey('')
+    setBaseUrl('')
     setError(null)
     requestAnimationFrame(() => {
       entryRef.current?.scrollIntoView({ behavior: 'smooth', block: 'center' })
@@ -782,13 +809,16 @@ export function ApiKeyForm({
   }
 
   const isLocal = option.envKey === 'OPENAI_BASE_URL'
+  const baseUrlEnvKey = option.baseUrlEnvKey
   const alreadySet = isSet?.(option.envKey) ?? false
   // When set, surface the backend's redacted value (e.g. "sk-12…wxyz") as the
   // placeholder so users can eyeball that the right key is in place.
   const currentRedacted = alreadySet ? (redactedValue?.(option.envKey) ?? null) : null
   // Only require a non-empty value — no length/format validation, so a short
-  // or unusual key can't block the user from continuing.
-  const canSave = value.trim().length >= 1
+  // or unusual key can't block the user from continuing. EXCEPTION: a
+  // per-install gateway option also needs its base URL; without one there is
+  // no endpoint to probe and the provider would sit silently broken.
+  const canSave = value.trim().length >= 1 && (!baseUrlEnvKey || baseUrl.trim().length >= 1)
   const optionCopy = t.onboarding.apiKeyOptions[option.id]
   const optionDescription = optionCopy?.description ?? option.description
 
@@ -799,11 +829,19 @@ export function ApiKeyForm({
 
     setSaving(true)
     setError(null)
-    const result = await onSave(option.envKey, value, option.name, isLocal ? localKey : undefined)
+
+    const result = await onSave(
+      option.envKey,
+      value,
+      option.name,
+      isLocal ? localKey : undefined,
+      baseUrlEnvKey ? { envKey: baseUrlEnvKey, value: baseUrl } : undefined
+    )
 
     if (result.ok) {
       setValue('')
       setLocalKey('')
+      setBaseUrl('')
     } else {
       setError(result.message ?? t.onboarding.couldNotSave)
     }
@@ -871,6 +909,17 @@ export function ApiKeyForm({
             value={localKey}
           />
         ) : null}
+        {baseUrlEnvKey ? (
+          <Input
+            autoComplete="off"
+            className="font-mono"
+            onChange={e => setBaseUrl(e.target.value)}
+            onKeyDown={e => isSubmitEnter(e) && void submit()}
+            placeholder={t.onboarding.baseApiUrlPlaceholder}
+            type="text"
+            value={baseUrl}
+          />
+        ) : null}
         {error ? <p className="text-xs text-destructive">{error}</p> : null}
       </div>
 
diff --git a/apps/desktop/src/components/pane-shell/tree/lone-chat-sibling-zone.test.ts b/apps/desktop/src/components/pane-shell/tree/lone-chat-sibling-zone.test.ts
index aadb3303a3..dd31de3021 100644
--- a/apps/desktop/src/components/pane-shell/tree/lone-chat-sibling-zone.test.ts
+++ b/apps/desktop/src/components/pane-shell/tree/lone-chat-sibling-zone.test.ts
@@ -7,6 +7,8 @@ import {
   $dismissedPanes,
   $hiddenTreePanes,
   $layoutTree,
+  $userPlacedPanes,
+  moveTreePaneBeside,
   moveTreePane,
   removeTreePane,
   tabStripVisibleForGroup
@@ -24,6 +26,7 @@ beforeEach(() => {
   window.localStorage.clear()
   $dismissedPanes.set(new Set())
   $hiddenTreePanes.set(new Set())
+  $userPlacedPanes.set(new Set())
 
   for (const [id, data] of [
     ['workspace', { placement: 'main', uncloseable: true }],
@@ -55,4 +58,11 @@ describe('dragging a session tab into its own zone', () => {
 
     expect(tabStripVisibleForGroup(zoneOf('workspace'))).toBe(false)
   })
+
+  it('moves a pane beside Workspace and remembers the explicit placement', () => {
+    moveTreePaneBeside('session-tile:b', 'workspace')
+
+    expect(zoneOf('workspace').id).not.toBe(zoneOf('session-tile:b').id)
+    expect($userPlacedPanes.get()).toEqual(new Set(['session-tile:b']))
+  })
 })
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/left-sidebar-rail.test.tsx b/apps/desktop/src/components/pane-shell/tree/renderer/left-sidebar-rail.test.tsx
new file mode 100644
index 0000000000..a2301d64e8
--- /dev/null
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/left-sidebar-rail.test.tsx
@@ -0,0 +1,113 @@
+import { act, cleanup, fireEvent, render, screen } from '@testing-library/react'
+import { afterEach, beforeAll, beforeEach, expect, it, vi } from 'vitest'
+
+import { TITLEBAR_HEIGHT } from '@/app/shell/titlebar'
+import { registry } from '@/contrib/registry'
+import { $sidebarOpen, setSidebarOpen } from '@/store/layout'
+import { stubResizeObserver } from '@/test/jsdom'
+
+import { group, split } from '../model'
+import { $collapsedTreeSides, $hiddenTreePanes, $layoutTree, $narrowViewport, bindTreeSideVisibility } from '../store'
+
+import { TreeSplit } from './tree-split'
+
+const disposers: (() => void)[] = []
+
+beforeAll(() => {
+  stubResizeObserver()
+  vi.stubGlobal('CSS', { ...globalThis.CSS, escape: (value: string) => value })
+  HTMLElement.prototype.scrollIntoView ??= () => undefined
+  bindTreeSideVisibility('left', $sidebarOpen, setSidebarOpen)
+})
+
+beforeEach(() => {
+  window.localStorage.clear()
+  $hiddenTreePanes.set(new Set())
+  $narrowViewport.set(false)
+  setSidebarOpen(true)
+  $collapsedTreeSides.set(new Set())
+
+  for (const [id, placement] of [
+    ['sessions', 'left'],
+    ['bots', 'left'],
+    ['workspace', 'main'],
+    ['files', 'right']
+  ] as const) {
+    disposers.push(
+      registry.register({
+        area: 'panes',
+        data: {
+          placement,
+          width: placement === 'main' ? undefined : '237px',
+          ...(id === 'sessions'
+            ? { zoneLead: (compact?: boolean) => (compact ? <button type="button">Updates</button> : null) }
+            : {})
+        },
+        id,
+        render: () => <div data-testid={`${id}-body`}>{id}</div>,
+        title: id
+      })
+    )
+  }
+
+  $layoutTree.set(
+    split('row', [
+      group(['sessions'], { id: 'sessions-zone' }),
+      group(['bots'], { id: 'bots-zone' }),
+      group(['workspace'], { id: 'main-zone' }),
+      group(['files'], { id: 'files-zone' })
+    ])
+  )
+})
+
+afterEach(() => {
+  cleanup()
+  $layoutTree.set(null)
+  $narrowViewport.set(false)
+  setSidebarOpen(true)
+  disposers.splice(0).forEach(dispose => dispose())
+})
+
+function renderLayout() {
+  const tree = $layoutTree.get()!
+
+  if (tree.type !== 'split') {
+    throw new Error('expected row layout')
+  }
+
+  return render(<TreeSplit node={tree} root rootRow topEdge />)
+}
+
+it('collapses every left zone into one restore rail without unmounting panes or changing the right side', () => {
+  renderLayout()
+  const sessions = screen.getByTestId('sessions-body')
+  const bots = screen.getByTestId('bots-body')
+
+  act(() => setSidebarOpen(false))
+
+  expect(globalThis.document.querySelectorAll('[data-collapsed-side-rail="left"]')).toHaveLength(1)
+  expect(
+    (globalThis.document.querySelector('[data-collapsed-side-rail="left"]')?.firstElementChild as HTMLElement).style
+      .height
+  ).toBe(`${TITLEBAR_HEIGHT}px`)
+  expect(globalThis.document.querySelector('[data-tree-split]')?.children).toHaveLength(4)
+  expect(sessions.parentElement?.closest('[data-tree-split] > div')?.getAttribute('style')).toContain('flex: 0 0 36px')
+  expect(bots.parentElement?.closest('[data-tree-split] > div')?.getAttribute('style')).toContain('display: none')
+  expect(screen.getByTestId('files-body')).toBeTruthy()
+  expect(screen.getByRole('button', { name: 'Updates' }).closest('[data-collapsed-side-rail="left"]')).not.toBeNull()
+
+  fireEvent.click(screen.getByRole('button', { name: 'Expand sidebar' }))
+
+  expect($sidebarOpen.get()).toBe(true)
+  expect(globalThis.document.querySelector('[data-collapsed-side-rail="left"]')).toBeNull()
+  expect(screen.getByTestId('sessions-body')).toBe(sessions)
+  expect(screen.getByTestId('bots-body')).toBe(bots)
+})
+
+it('keeps the existing narrow-window overlay instead of docking a restore rail', () => {
+  $narrowViewport.set(true)
+  act(() => setSidebarOpen(false))
+  renderLayout()
+
+  expect(globalThis.document.querySelector('[data-collapsed-side-rail="left"]')).toBeNull()
+})
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/narrow-overlays.tsx b/apps/desktop/src/components/pane-shell/tree/renderer/narrow-overlays.tsx
index 7dea362904..61a2c751f8 100644
--- a/apps/desktop/src/components/pane-shell/tree/renderer/narrow-overlays.tsx
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/narrow-overlays.tsx
@@ -129,6 +129,9 @@ export function NarrowOverlays() {
     return shown.length > 0 ? shown : [revealed]
   })()
 
+  const zoneLead = zonePanes.map(pane => paneChrome(pane).zoneLead).find(lead => lead !== undefined)
+  const zoneFooter = zonePanes.map(pane => paneChrome(pane).zoneFooter).find(footer => footer !== undefined)
+
   return (
     <>
       {/* Hover-intent strips on each edge that has a collapsed pane. */}
@@ -163,6 +166,11 @@ export function NarrowOverlays() {
           // width) instead of a fat fixed 20rem — capped for tiny screens.
           style={{ width: `min(${(revealed.data as { width?: string } | undefined)?.width ?? '18rem'}, 85vw)` }}
         >
+          {zoneLead && (
+            <div className="shrink-0 self-start" data-zone-lead="">
+              {zoneLead(true)}
+            </div>
+          )}
           {/* Zone-mates share the overlay through the zone's own tab strip
               (SESSIONS | BOTS) — a lone pane keeps the stripless form. */}
           {zonePanes.length > 1 && (
@@ -185,9 +193,16 @@ export function NarrowOverlays() {
               ))}
             </PaneTabStrip>
           )}
-          <ContribBoundary id={revealed.id}>
-            {revealed.render && <ContribRender render={revealed.render} />}
-          </ContribBoundary>
+          <div className="min-h-0 flex-1 overflow-hidden">
+            <ContribBoundary id={revealed.id}>
+              {revealed.render && <ContribRender render={revealed.render} />}
+            </ContribBoundary>
+          </div>
+          {zoneFooter && (
+            <div className="shrink-0" data-zone-footer="">
+              {zoneFooter(false)}
+            </div>
+          )}
         </div>
       )}
     </>
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/track-model.test.ts b/apps/desktop/src/components/pane-shell/tree/renderer/track-model.test.ts
new file mode 100644
index 0000000000..239a2f26d7
--- /dev/null
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/track-model.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from 'vitest'
+
+import { group, split } from '../model'
+
+import { fixedTrackSize } from './track-model'
+
+const context = (sizes: Record<string, Record<string, string>>) => ({
+  paneFor: (id: string) => ({ id, area: 'panes', data: sizes[id] }),
+  paneGone: () => false,
+  overrides: {}
+})
+
+describe('fixedTrackSize', () => {
+  it('keeps an outer cross-axis split flexible beside a minimized child', () => {
+    const rightRail = split(
+      'column',
+      [group(['preview'], { id: 'preview-zone' }), group(['terminal'], { id: 'terminal-zone', minimized: true })],
+      [1, 1],
+      'right-rail'
+    )
+
+    expect(
+      fixedTrackSize(
+        rightRail,
+        'row',
+        context({
+          preview: { minWidth: '22rem' },
+          terminal: { height: '20vh' }
+        })
+      )
+    ).toBeNull()
+  })
+
+  it('keeps a cross-axis split fixed when every visible child has a width', () => {
+    const rightRail = split(
+      'column',
+      [group(['files'], { id: 'files-zone' }), group(['terminal'], { id: 'terminal-zone', minimized: true })],
+      [1, 1],
+      'right-rail'
+    )
+
+    expect(
+      fixedTrackSize(
+        rightRail,
+        'row',
+        context({
+          files: { width: '237px' },
+          terminal: { height: '20vh' }
+        })
+      )
+    ).toBe('max(237px, 1.75rem)')
+  })
+})
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/track-model.ts b/apps/desktop/src/components/pane-shell/tree/renderer/track-model.ts
index a6be611dd8..39dc92e89e 100644
--- a/apps/desktop/src/components/pane-shell/tree/renderer/track-model.ts
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/track-model.ts
@@ -95,6 +95,30 @@ interface PaneChrome extends PaneSizing {
    *  (artifacts/skills/plugin pages) are not tab-able surfaces. The flag is
    *  live: the workspace contribution re-registers it on route changes. */
   headerVeto?: boolean
+  /** When a zone reaches the window top, place its tab strip in the content
+   *  area instead of the native titlebar. A zone can opt into this only when
+   *  all of its visible panes agree; mixed zones keep the window titlebar. */
+  titlebar?: 'content' | 'window'
+  /** Surface for a zone made entirely of this pane kind. Conversation panes
+   *  use the chat field; tool panes retain the sidebar chrome. Mixed zones
+   *  fall back to the sidebar surface. */
+  headerSurface?: 'chat' | 'sidebar'
+  /** A lead NODE for this pane's whole ZONE, rendered between the zone header
+   *  and the body — so it stands above every tab and survives switching
+   *  between them. It belongs to the zone, not to the surface currently in it:
+   *  the sidebar declares its brand row here, and the row stays put while the
+   *  user flips between the surfaces stacked beside it. `compact` renders
+   *  the same entry in the collapsed rail and narrow viewport overlay. */
+  zoneLead?: (compact?: boolean) => React.ReactNode
+  /** Fixed chrome below the zone's pane body, shared across its tabs.
+   *  `compact` renders the same entry on the side's collapsed restore rail. */
+  zoneFooter?: (compact: boolean) => React.ReactNode
+  /** Chrome at the LEFT of the zone's window-top titlebar band, ahead of the
+   *  tab strip / drag handle. The workspace pane's session back/forward
+   *  cluster lives here: the chat's own header band is display:none'd inside
+   *  zones (renderer/index.tsx), so this band is the only home that shows in
+   *  every layout — strip or no strip. */
+  stripLead?: () => React.ReactNode
   /** A lead NODE for this pane's TAB, rendered before the label. A session
    *  pane (main workspace + tiles) passes its live `SessionStatusDot` here so
    *  the tab and the sidebar row render status/color from the ONE primitive
@@ -284,7 +308,17 @@ export function fixedTrackSize(node: LayoutNode, axis: 'row' | 'column', ctx: Tr
     return sizes.length === 1 ? sizes[0] : `calc(${sizes.join(' + ')})`
   }
 
-  // Across the axis a flex child just stretches; the fixed ones set the size.
+  // Across the axis a flex child stretches only AFTER its parent receives a
+  // width. When this split is itself a child of another split, a fixed sibling
+  // must not make the whole subtree fixed: a minimized terminal (28px) beside
+  // a flexible preview rail would otherwise collapse the outer right sidebar
+  // to the terminal strip and leave the preview content overflowing outside
+  // its track. Keep the parent flexible so its outer sibling can allocate the
+  // space and the inner flex child can fill it.
+  if (sizes.some(size => size === null)) {
+    return null
+  }
+
   return cssMax(sizes) ?? null
 }
 
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.test.tsx b/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.test.tsx
index 663d771625..3d77259a21 100644
--- a/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.test.tsx
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.test.tsx
@@ -87,6 +87,67 @@ describe('TreeGroup', () => {
     expect(strip.style).toHaveProperty('WebkitAppRegion', '')
   })
 
+  it('places a content-header strip below the native titlebar band', () => {
+    disposePane = registry.register({
+      area: 'panes',
+      data: { placement: 'right', titlebar: 'content' },
+      id: 'terminal',
+      title: 'Workspace tools',
+      render: () => <div>Files</div>
+    })
+    vi.stubGlobal('CSS', { escape: (value: string) => value })
+    vi.stubGlobal(
+      'ResizeObserver',
+      class {
+        observe() {}
+        unobserve() {}
+        disconnect() {}
+      }
+    )
+
+    render(<TreeGroup node={terminalGroup(false)} topEdge />)
+
+    const zone = container!.querySelector('[data-tree-group]')!
+    const strip = zone.querySelector<HTMLElement>('[data-zone-tabstrip]')!
+    const spacer = zone.querySelector('[data-content-titlebar-spacer]')
+    const header = zone.querySelector('[data-panel-header]')
+
+    expect(zone.hasAttribute('data-content-header')).toBe(true)
+    expect(zone.hasAttribute('data-window-top')).toBe(false)
+    expect(spacer).not.toBeNull()
+    expect(spacer?.nextElementSibling).toBe(header)
+    expect(header?.contains(strip)).toBe(true)
+  })
+
+  it('uses the chat surface for a conversation-only zone header', () => {
+    disposePane = registry.register({
+      area: 'panes',
+      data: { headerSurface: 'chat', placement: 'main' },
+      id: 'terminal',
+      title: 'Conversation',
+      render: () => <div>Chat</div>
+    })
+    vi.stubGlobal('CSS', { escape: (value: string) => value })
+    vi.stubGlobal(
+      'ResizeObserver',
+      class {
+        observe() {}
+        unobserve() {}
+        disconnect() {}
+      }
+    )
+
+    render(<TreeGroup node={terminalGroup(false)} topEdge />)
+
+    const zone = container!.querySelector('[data-tree-group]')!
+    const header = zone.querySelector<HTMLElement>('[data-panel-header]')!
+    const strip = zone.querySelector<HTMLElement>('[data-zone-tabstrip]')!
+
+    expect(zone.getAttribute('data-pane-surface')).toBe('chat')
+    expect(header.className).toContain('bg-(--ui-chat-surface-background)')
+    expect(strip.className).toContain('bg-(--ui-chat-surface-background)')
+  })
+
   it('points the docked-zone chevron in the collapse or restore action direction', () => {
     disposePane = registry.register({
       area: 'panes',
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.tsx b/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.tsx
index 469f129df5..ed64280245 100644
--- a/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.tsx
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/tree-group.tsx
@@ -239,8 +239,6 @@ export function TreeGroup({
   // The scrolling tab list inside the header (the strip also holds the
   // minimize chevron, which must not scroll away).
   const tabsRef = useRef<HTMLDivElement>(null)
-  const tabsBelowControls = usePanelTitlebar(ref, topEdge, Boolean(node.minimized))
-  const tabsInTitlebar = topEdge && !tabsBelowControls
   // The chip under the last right-click — the pane the zone menu's Split
   // actions carry into the new zone (header background = the active pane).
   // STATE, not a ref: the menu items (incl. Close's visibility) are JSX
@@ -255,7 +253,6 @@ export function TreeGroup({
   // overlay, not every zone's header/body (and not the menuDirections walk).
   const dragging = useStore($treeDragging)
   const editMode = useStore($layoutEditMode)
-  const wcOverlap = useWindowControlsOverlap(ref, !topEdge)
 
   const hiddenPanes = useStore($hiddenTreePanes)
   const narrow = useStore($narrowViewport)
@@ -292,6 +289,21 @@ export function TreeGroup({
 
   const active = paneFor(activeId)
   const isEmpty = shown.length === 0
+  // A content-header zone still starts at the window edge, but reserves the
+  // native titlebar as a blank drag band and renders its own tabs underneath.
+  // Require every visible pane to agree so a mixed zone (for example Focus's
+  // workspace + files stack) keeps the established titlebar behavior.
+  const contentHeader =
+    topEdge && shown.length > 0 && shown.every(paneId => paneChrome(paneFor(paneId)).titlebar === 'content')
+  // Conversation-only zones keep their titlebar and tab strip on the same
+  // surface as the ChatView below. A mixed zone deliberately remains tool
+  // chrome so stacking files beside chat does not recolor the whole header.
+  const chatSurfaceGroup =
+    shown.length > 0 && shown.every(paneId => paneChrome(paneFor(paneId)).headerSurface === 'chat')
+  const paneTopEdge = topEdge && !contentHeader
+  const tabsBelowControls = usePanelTitlebar(ref, paneTopEdge, Boolean(node.minimized))
+  const tabsInTitlebar = paneTopEdge && !tabsBelowControls
+  const wcOverlap = useWindowControlsOverlap(ref, !paneTopEdge)
 
   // What the strip's "+" makes. The pane you are LOOKING AT answers first (a
   // Browser tab makes another Browser, even stacked into the chat strip), then
@@ -362,6 +374,14 @@ export function TreeGroup({
   // A minimized group IS its header, so it shows one regardless.
   const headerVisible = !isEmpty && !verticalCollapse && (Boolean(node.minimized) || stripVisible)
 
+  // The zone's lead row, from the first pane in it that claims one. Read off
+  // the ZONE's panes rather than the active one: it is the zone's own chrome,
+  // and the whole point is that switching tabs does not take it away.
+  const zoneLead = shown.map(paneId => paneChrome(paneFor(paneId)).zoneLead).find(lead => lead !== undefined)
+  const zoneFooter = shown.map(paneId => paneChrome(paneFor(paneId)).zoneFooter).find(footer => footer !== undefined)
+  // Same claim rule as zoneLead: first pane in the zone that provides one.
+  const stripLead = shown.map(paneId => paneChrome(paneFor(paneId)).stripLead).find(lead => lead !== undefined)
+
   // Keep the activated tab — and, on the last one, the trailing "+" — inside
   // the strip's scroll window. Opening a tab past the right edge otherwise
   // left both the new tab and the button that made it out of view.
@@ -429,9 +449,14 @@ export function TreeGroup({
 
   return (
     <div
-      className="relative flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden bg-(--ui-editor-surface-background)"
+      className={cn(
+        'relative flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden',
+        chatSurfaceGroup ? 'bg-(--ui-chat-surface-background)' : 'bg-(--ui-editor-surface-background)'
+      )}
       data-tree-group={node.id}
-      data-window-top={topEdge || undefined}
+      data-pane-surface={chatSurfaceGroup ? 'chat' : undefined}
+      data-content-header={contentHeader || undefined}
+      data-window-top={paneTopEdge || undefined}
       // Advertises the visible tab strip so panes can drop their own
       // self-naming labels (see [data-pane-self-label] in styles.css).
       data-zone-header={headerVisible || undefined}
@@ -447,7 +472,7 @@ export function TreeGroup({
       style={
         wcOverlap
           ? { paddingTop: wcOverlap.y + wcOverlap.height }
-          : topEdge && verticalCollapse
+          : paneTopEdge && verticalCollapse
             ? { paddingTop: TITLEBAR_HEIGHT }
             : undefined
       }
@@ -460,6 +485,15 @@ export function TreeGroup({
         />
       )}
 
+      {contentHeader && (
+        <div
+          aria-hidden="true"
+          className="shrink-0 bg-(--ui-bg-chrome) [-webkit-app-region:drag]"
+          data-content-titlebar-spacer=""
+          style={{ height: TITLEBAR_HEIGHT }}
+        />
+      )}
+
       {/* Minimized in a ROW: a narrow vertical rail — same PaneTab shell as
           the horizontal strip, just `vertical`. Click a tab to restore +
           activate; click anywhere else on the rail to restore. */}
@@ -467,7 +501,8 @@ export function TreeGroup({
         <ZoneMenu {...zoneMenu}>
           <div
             className={cn(
-              'flex h-full min-h-7 w-7 min-w-7 shrink-0 cursor-pointer select-none flex-col items-stretch bg-(--ui-sidebar-surface-background)',
+              'flex h-full min-h-7 w-7 min-w-7 shrink-0 cursor-pointer select-none flex-col items-stretch',
+              chatSurfaceGroup ? 'bg-(--ui-chat-surface-background)' : 'bg-(--ui-sidebar-surface-background)',
               // Strip line faces the content the zone collapsed away from.
               railSide === 'right' ? PANE_TAB_STRIP_LINE_LEFT : PANE_TAB_STRIP_LINE_RIGHT
             )}
@@ -508,15 +543,23 @@ export function TreeGroup({
 
       {/* Keep the header INSIDE its zone: titlebar drops use the same panel
           bounds, strip refs, focus ownership and split geometry as the body. */}
-      {(headerVisible || (topEdge && !verticalCollapse)) && (
+      {(headerVisible || (paneTopEdge && !verticalCollapse)) && (
         <div
-          className="relative flex min-w-0 shrink-0 bg-(--ui-sidebar-surface-background)"
+          className={cn(
+            'relative flex min-w-0 shrink-0',
+            chatSurfaceGroup ? 'bg-(--ui-chat-surface-background)' : 'bg-(--ui-sidebar-surface-background)'
+          )}
           data-panel-header=""
-          style={topEdge ? { height: TITLEBAR_HEIGHT + (tabsBelowControls && headerVisible ? 28 : 0) } : undefined}
+          style={paneTopEdge ? { height: TITLEBAR_HEIGHT + (tabsBelowControls && headerVisible ? 28 : 0) } : undefined}
         >
-          {topEdge && (
+          {paneTopEdge && (
             <div aria-hidden="true" className="shrink-0" style={{ width: 'var(--panel-titlebar-left, 100%)' }} />
           )}
+          {paneTopEdge && stripLead && (
+            <div className="relative z-1 flex shrink-0 items-center self-center [-webkit-app-region:no-drag]">
+              {stripLead()}
+            </div>
+          )}
           {headerVisible ? (
             <ZoneMenu {...zoneMenu}>
               <PaneTabStrip
@@ -538,6 +581,7 @@ export function TreeGroup({
                 }}
                 ref={stripRef}
                 style={{ cursor: 'grab', WebkitAppRegion: dragging ? 'no-drag' : undefined } as CSSProperties}
+                surface={chatSurfaceGroup ? 'chat' : 'sidebar'}
                 titlebar={tabsInTitlebar}
                 trailing={
                   <>
@@ -696,19 +740,27 @@ export function TreeGroup({
               </PaneTabStrip>
             </ZoneMenu>
           ) : null}
-          {topEdge && (!headerVisible || tabsBelowControls) && (
+          {paneTopEdge && (!headerVisible || tabsBelowControls) && (
             <div
               className="min-w-0 flex-1 self-start [-webkit-app-region:drag]"
               data-window-drag-handle=""
               style={{ height: TITLEBAR_HEIGHT }}
             />
           )}
-          {topEdge && (
+          {paneTopEdge && (
             <div aria-hidden="true" className="shrink-0" style={{ width: 'var(--panel-titlebar-right, 0px)' }} />
           )}
         </div>
       )}
 
+      {/* The zone's lead, between its header and its body: outside every pane's
+          own layer, so every tab in the zone shows it. */}
+      {!node.minimized && !verticalCollapse && zoneLead ? (
+        <div className="shrink-0" data-zone-lead="">
+          {zoneLead()}
+        </div>
+      ) : null}
+
       {/* Body: the zone's pane content — the active pane and bounded hot-hidden
           cache stay mounted in absolute layers; parked panes are unmounted.
           `visibility` (not display) keeps the hidden pane's layout box, so
@@ -765,6 +817,12 @@ export function TreeGroup({
         </div>
       )}
 
+      {!node.minimized && zoneFooter ? (
+        <div className="shrink-0" data-zone-footer="">
+          {zoneFooter(false)}
+        </div>
+      ) : null}
+
       {/* Edit-mode veil: the BODY is a drag handle for the active pane. It
           starts below the header so tabs/headers stay directly interactive
           (drag any tab, right-click for the zone menu). */}
@@ -780,7 +838,13 @@ export function TreeGroup({
             className="absolute inset-x-0 bottom-0 z-50 flex cursor-grab items-center justify-center outline-1 -outline-offset-2 outline-dashed backdrop-blur-[2px]"
             onPointerDown={e => startPaneDrag(activeId, e, undefined, undefined, active?.title ?? activeId)}
             style={{
-              top: topEdge ? TITLEBAR_HEIGHT + (tabsBelowControls && headerVisible ? 28 : 0) : headerVisible ? 28 : 0,
+              top: contentHeader
+                ? TITLEBAR_HEIGHT + (headerVisible ? 28 : 0)
+                : paneTopEdge
+                  ? TITLEBAR_HEIGHT + (tabsBelowControls && headerVisible ? 28 : 0)
+                  : headerVisible
+                    ? 28
+                    : 0,
               background:
                 'color-mix(in srgb, var(--ui-accent) 6%, color-mix(in srgb, var(--ui-bg-chrome) 55%, transparent))',
               outlineColor: 'color-mix(in srgb, var(--ui-accent) 55%, transparent)'
diff --git a/apps/desktop/src/components/pane-shell/tree/renderer/tree-split.tsx b/apps/desktop/src/components/pane-shell/tree/renderer/tree-split.tsx
index 149929b4ce..6dce57ed1e 100644
--- a/apps/desktop/src/components/pane-shell/tree/renderer/tree-split.tsx
+++ b/apps/desktop/src/components/pane-shell/tree/renderer/tree-split.tsx
@@ -9,8 +9,11 @@
 import { useStore } from '@nanostores/react'
 import { type PointerEvent as ReactPointerEvent, useCallback, useMemo, useRef, useSyncExternalStore } from 'react'
 
+import { TITLEBAR_HEIGHT } from '@/app/shell/titlebar'
 import { beginSashDrag, endSashDrag } from '@/components/pane-shell/geometry'
+import { Codicon } from '@/components/ui/codicon'
 import { useContributions } from '@/contrib/react/use-contributions'
+import { useI18n } from '@/i18n'
 import { guardGuestPointers } from '@/lib/guest-pointer-guard'
 import { rafCoalesce } from '@/lib/raf-coalesce'
 import { cn } from '@/lib/utils'
@@ -27,6 +30,7 @@ import {
   paneRootSide,
   persistTree,
   presetSplitWeights,
+  restoreTreeSide,
   setTreeGroupMinimized,
   setTreeSplitWeights
 } from '../store'
@@ -102,6 +106,7 @@ export function TreeSplit({
   leftEdge?: boolean
   rightEdge?: boolean
 }) {
+  const { t } = useI18n()
   const containerRef = useRef<HTMLDivElement>(null)
   const panes = useContributions('panes')
   const hiddenPanes = useStore($hiddenTreePanes)
@@ -626,22 +631,40 @@ export function TreeSplit({
     return side !== null && collapsedSides.has(side)
   }
 
+  const leftRailIndex = semanticSides && !narrow && collapsedSides.has('left')
+    ? node.children.findIndex(child => paneRootSide(allPaneIds(child)[0]) === 'left')
+    : -1
+
+  // A side can contain several zones; its single rail keeps the first lead/footer
+  // supplied by any of them, not just the zone occupying the rail's track.
+  const leftRailChrome = leftRailIndex < 0
+    ? []
+    : node.children
+        .filter(child => paneRootSide(allPaneIds(child)[0]) === 'left')
+        .flatMap(allPaneIds)
+        .filter(id => !hiddenPanes.has(id))
+        .map(id => paneChrome(paneFor(id)))
+
+  const leftRailLead = leftRailChrome.find(chrome => chrome.zoneLead)?.zoneLead
+  const leftRailFooter = leftRailChrome.find(chrome => chrome.zoneFooter)?.zoneFooter
+
   // One pass per child: collapse/minimize state, resolved fixed track, clamps,
   // and narrow-unmount flag. fixedTrackSize + subtreeGone each re-walk the
   // subtree, so resolve them ONCE here instead of per read below.
   const tracks = node.children.map((child, i) => {
+    const leftRail = i === leftRailIndex
     const minimized = isMinimized(child)
-    const collapsed = isCollapsed(child) || sideGone(i)
-    const track = minimized || collapsed ? null : fixedTrackSize(child, axis, trackCtx)
-    const sizing = minimized || collapsed ? null : sizingFor(child, track)
+    const collapsed = !leftRail && (isCollapsed(child) || sideGone(i))
+    const track = leftRail || minimized || collapsed ? null : fixedTrackSize(child, axis, trackCtx)
+    const sizing = leftRail || minimized || collapsed ? null : sizingFor(child, track)
     // Narrow-collapse UNMOUNTS (the edge overlay owns the live instance) — but
     // only for panes the breakpoint collapsed, not ones a chrome toggle hid.
     const narrowCollapsed = narrow && collapsed && allPaneIds(child).some(id => !hiddenPanes.has(id))
 
-    return { child, collapsed, minimized, narrowCollapsed, sizing, track }
+    return { child, collapsed, leftRail, minimized, narrowCollapsed, sizing, track }
   })
 
-  const growable = tracks.map((_, i) => i).filter(i => !tracks[i].collapsed && !tracks[i].minimized)
+  const growable = tracks.map((_, i) => i).filter(i => !tracks[i].collapsed && !tracks[i].leftRail && !tracks[i].minimized)
   const allFixed = growable.length > 0 && growable.every(i => tracks[i].track !== null)
 
   // Only an uncapped fixed track may absorb leftover. A maxWidth/maxHeight
@@ -690,19 +713,22 @@ export function TreeSplit({
       data-tree-split={node.id}
       ref={containerRef}
     >
-      {tracks.map(({ child, collapsed, minimized, narrowCollapsed, sizing, track }, i) => {
+      {tracks.map(({ child, collapsed, leftRail, minimized, narrowCollapsed, sizing, track }, i) => {
         const partner = collapsed ? -1 : seamPartner(i)
         const absorbs = i === absorberIndex
 
         return (
           <div
-            className="relative flex min-h-0 min-w-0"
+            className={cn(
+              'relative flex min-h-0 min-w-0',
+              leftRail && 'overflow-hidden [&>[data-tree-group]]:hidden [&>[data-tree-split]]:hidden'
+            )}
             key={child.id}
             style={
               collapsed
                 ? { display: 'none' }
-                : minimized
-                  ? { flex: `0 0 ${horizontal ? MINIMIZED_TRACK : 'auto'}` }
+                : leftRail || minimized
+                  ? { flex: `0 0 ${leftRail ? '36px' : horizontal ? MINIMIZED_TRACK : 'auto'}` }
                   : {
                       // One flexbox formula for everything: a sized zone is
                       // grow-0 shrink-1 from its preferred basis (it yields
@@ -722,7 +748,7 @@ export function TreeSplit({
                     }
             }
           >
-            {partner >= 0 && (
+            {partner >= 0 && !leftRail && !tracks[partner].leftRail && (
               <Sash
                 disabled={minimized || tracks[partner].minimized}
                 horizontal={horizontal}
@@ -741,6 +767,29 @@ export function TreeSplit({
                 topEdge={topEdge && (horizontal || i === visibleOrder[0])}
               />
             )}
+            {leftRail && (
+              <div
+                className="absolute inset-0 flex flex-col bg-(--ui-sidebar-surface-background)"
+                data-collapsed-side-rail="left"
+              >
+                {topEdge && (
+                  <div aria-hidden="true" className="shrink-0 [-webkit-app-region:drag]" style={{ height: TITLEBAR_HEIGHT }} />
+                )}
+                <div className="flex min-h-0 flex-1 flex-col border-r border-(--ui-stroke-secondary)">
+                  <button
+                    aria-label={t.titlebar.expandSidebar}
+                    className="grid h-7 w-full shrink-0 place-items-center text-(--ui-text-tertiary) [-webkit-app-region:no-drag] hover:bg-(--ui-control-hover-background) hover:text-foreground focus-visible:outline-2 focus-visible:outline-offset-[-2px]"
+                    onClick={() => restoreTreeSide('left')}
+                    title={t.titlebar.expandSidebar}
+                    type="button"
+                  >
+                    <Codicon name="layout-sidebar-left" size="0.875rem" />
+                  </button>
+                  {leftRailLead && <div className="shrink-0">{leftRailLead(true)}</div>}
+                  {leftRailFooter && <div className="mt-auto shrink-0">{leftRailFooter(true)}</div>}
+                </div>
+              </div>
+            )}
           </div>
         )
       })}
diff --git a/apps/desktop/src/components/pane-shell/tree/store.ts b/apps/desktop/src/components/pane-shell/tree/store.ts
index 170e3a0e66..5e3a324221 100644
--- a/apps/desktop/src/components/pane-shell/tree/store.ts
+++ b/apps/desktop/src/components/pane-shell/tree/store.ts
@@ -1000,6 +1000,10 @@ export const $collapsedTreeSides = atom<ReadonlySet<TreeSide>>(new Set())
 // side through its setter, because there the toggles SHOULD move.
 const sideOpeners: Partial<Record<TreeSide, (open: boolean) => void>> = {}
 
+export function restoreTreeSide(side: TreeSide): void {
+  sideOpeners[side]?.(true)
+}
+
 export function setTreeSideCollapsed(side: TreeSide, collapsed: boolean) {
   const next = toggledSet($collapsedTreeSides.get(), side, collapsed)
 
@@ -1579,7 +1583,11 @@ export function dockPaneBeside(paneId: string, anchorPaneId: string) {
   const anchor = findGroupOfPane(tree, anchorPaneId)
 
   // Anchor must be a live, shown pane — never dock beside a hidden file tree.
-  if (!anchor || $hiddenTreePanes.get().has(anchorPaneId) || !panes.some(c => c.id === anchorPaneId)) {
+  if (
+    !anchor ||
+    $hiddenTreePanes.get().has(anchorPaneId) ||
+    !panes.some(c => c.id === anchorPaneId)
+  ) {
     return
   }
 
@@ -1613,6 +1621,63 @@ export function dockPaneBeside(paneId: string, anchorPaneId: string) {
   }
 }
 
+/** Move a pane beside an anchor as an explicit user action.
+ *
+ * This is deliberately separate from `dockPaneBeside`: automatic docking must
+ * respect the user's placement pin, while an explicit move should create that
+ * pin and make the new relationship survive future adoption/reloads.
+ */
+export function moveTreePaneBeside(paneId: string, anchorPaneId: string) {
+  const tree = $layoutTree.get()
+
+  if (!tree || paneId === anchorPaneId) {
+    return
+  }
+
+  const panes = registry.getArea('panes')
+  const anchor = findGroupOfPane(tree, anchorPaneId)
+
+  if (
+    !anchor ||
+    $hiddenTreePanes.get().has(anchorPaneId) ||
+    !panes.some(c => c.id === anchorPaneId) ||
+    !panes.some(c => c.id === paneId)
+  ) {
+    return
+  }
+
+  const mainId = panes.find(c => {
+    const data = c.data as { placement?: string; uncloseable?: boolean } | undefined
+
+    return data?.placement === 'main' && data.uncloseable
+  })?.id
+
+  const order = allPaneIds(tree)
+  const anchorRightOfMain =
+    !!mainId && !anchor.panes.includes(mainId) && order.indexOf(anchorPaneId) > order.indexOf(mainId)
+  const pos: DropPosition = anchorRightOfMain ? 'left' : 'right'
+
+  if ($dismissedPanes.get().has(paneId)) {
+    setDismissed(paneId, false)
+  }
+
+  const next = findGroupOfPane(tree, paneId)
+    ? movePaneOp(tree, paneId, { groupId: anchor.id, pos })
+    : insertAtGroup(tree, anchor.id, paneId, pos, undefined, true, recalledEdgeWeights(paneId))
+
+  if (!next) {
+    return
+  }
+
+  if (next !== tree) {
+    commit(next)
+  }
+
+  markActivePreset('custom')
+  markPaneUserPlaced(paneId)
+  revealTreePane(paneId)
+}
+
 export function moveTreePane(paneId: string, target: { groupId: string; pos: DropPosition; before?: null | string }) {
   const tree = $layoutTree.get()
 
diff --git a/apps/desktop/src/components/ui/pane-tab.tsx b/apps/desktop/src/components/ui/pane-tab.tsx
index f6d74c253e..0c434a36ab 100644
--- a/apps/desktop/src/components/ui/pane-tab.tsx
+++ b/apps/desktop/src/components/ui/pane-tab.tsx
@@ -242,6 +242,8 @@ interface PaneTabStripProps extends React.ComponentProps<'div'> {
   trailing?: React.ReactNode
   /** Top-edge panel header shares the native window-control band. */
   titlebar?: boolean
+  /** Background surface for a pure conversation strip. */
+  surface?: 'chat' | 'sidebar'
 }
 
 /**
@@ -254,16 +256,19 @@ interface PaneTabStripProps extends React.ComponentProps<'div'> {
  * `data-zone-tabstrip`, drop carets) ride on the usual div props.
  */
 export const PaneTabStrip = React.forwardRef<HTMLDivElement, PaneTabStripProps>(function PaneTabStrip(
-  { children, className, listRef, trailing, titlebar = false, ...props },
+  { children, className, listRef, surface = 'sidebar', titlebar = false, trailing, ...props },
   ref
 ) {
   return (
     <div
-      // Strip and active tab both sit on the sidebar surface, so the bar reads
-      // as one piece of chrome with the titlebar above it. No bottom rule — the
+      // Strip and active tab share the selected surface, so the bar reads as
+      // one piece of chrome with the titlebar above it. No bottom rule — the
       // active tab's primary underline is the only seam.
       className={cn(
-        'group/pane-header relative flex min-w-0 shrink-0 select-none bg-(--ui-sidebar-surface-background) [--pane-tab-active-bg:var(--ui-sidebar-surface-background)]',
+        'group/pane-header relative flex min-w-0 shrink-0 select-none',
+        surface === 'chat'
+          ? 'bg-(--ui-chat-surface-background) [--pane-tab-active-bg:var(--ui-chat-surface-background)] [--pane-tab-strip-bg:var(--ui-chat-surface-background)]'
+          : 'bg-(--ui-sidebar-surface-background) [--pane-tab-active-bg:var(--ui-sidebar-surface-background)]',
         titlebar ? 'h-full flex-1 [-webkit-app-region:drag]' : 'h-7 [-webkit-app-region:no-drag]',
         className
       )}
diff --git a/apps/desktop/src/components/ui/use-zoom-pan.ts b/apps/desktop/src/components/ui/use-zoom-pan.ts
index db95c5bc71..af63f5d406 100644
--- a/apps/desktop/src/components/ui/use-zoom-pan.ts
+++ b/apps/desktop/src/components/ui/use-zoom-pan.ts
@@ -15,54 +15,78 @@ interface Transform {
   y: number
 }
 
+export interface ZoomPanOptions {
+  minScale?: number
+  maxScale?: number
+  resetScale?: number
+}
+
 const MIN_SCALE = 0.25
 const MAX_SCALE = 8
 const WHEEL_STEP = 1.1
 const BUTTON_STEP = 1.25
 
-const clamp = (scale: number) => Math.min(MAX_SCALE, Math.max(MIN_SCALE, scale))
+const clamp = (scale: number, minScale: number, maxScale: number) => Math.min(maxScale, Math.max(minScale, scale))
 
 /**
  * Headless pan/zoom transform. Wheel zooms toward the cursor, drag pans, buttons
  * zoom toward centre. Returns the transform style plus the surface handlers, so
  * any content (SVG, image, canvas) can be made pan/zoomable.
  */
-export function useZoomPan() {
-  const [transform, setTransform] = useState<Transform>({ scale: 1, x: 0, y: 0 })
+export function useZoomPan({ minScale = MIN_SCALE, maxScale = MAX_SCALE, resetScale = 1 }: ZoomPanOptions = {}) {
+  const [transform, setTransform] = useState<Transform>({ scale: resetScale, x: 0, y: 0 })
   const drag = useRef<{ x: number; y: number } | null>(null)
   const [panning, setPanning] = useState(false)
 
   // Zoom toward (cx, cy), measured from the surface centre, keeping that point fixed.
-  const zoomAt = useCallback((factor: number, cx = 0, cy = 0) => {
-    setTransform(prev => {
-      const scale = clamp(prev.scale * factor)
-      const k = scale / prev.scale
+  const zoomAt = useCallback(
+    (factor: number, cx = 0, cy = 0) => {
+      setTransform(prev => {
+        const scale = clamp(prev.scale * factor, minScale, maxScale)
+        const k = scale / prev.scale
 
-      return { scale, x: cx - k * (cx - prev.x), y: cy - k * (cy - prev.y) }
-    })
-  }, [])
+        return { scale, x: cx - k * (cx - prev.x), y: cy - k * (cy - prev.y) }
+      })
+    },
+    [minScale, maxScale]
+  )
+
+  const setScale = useCallback(
+    (scale: number) => {
+      drag.current = null
+      setPanning(false)
+      setTransform({ scale: clamp(scale, minScale, maxScale), x: 0, y: 0 })
+    },
+    [minScale, maxScale]
+  )
+
+  const reset = useCallback(() => setScale(resetScale), [resetScale, setScale])
 
   const onWheel = useCallback(
-    (event: ReactWheelEvent) => {
+    (event: ReactWheelEvent<HTMLElement> | WheelEvent) => {
       event.preventDefault()
 
       // macOS smart zoom (two-finger double-tap) → reset, not zoom-in.
       if (isSmartZoomWheel(event)) {
-        setTransform({ scale: 1, x: 0, y: 0 })
+        reset()
 
         return
       }
 
-      const rect = event.currentTarget.getBoundingClientRect()
+      const rect = (event.currentTarget as HTMLElement).getBoundingClientRect()
       const cx = event.clientX - rect.left - rect.width / 2
       const cy = event.clientY - rect.top - rect.height / 2
 
       zoomAt(event.deltaY < 0 ? WHEEL_STEP : 1 / WHEEL_STEP, cx, cy)
     },
-    [zoomAt]
+    [reset, zoomAt]
   )
 
   const onPointerDown = useCallback((event: ReactPointerEvent) => {
+    if (event.button !== 0) {
+      return
+    }
+
     event.currentTarget.setPointerCapture(event.pointerId)
     setTransform(prev => {
       drag.current = { x: event.clientX - prev.x, y: event.clientY - prev.y }
@@ -87,7 +111,6 @@ export function useZoomPan() {
     setPanning(false)
   }, [])
 
-  const reset = useCallback(() => setTransform({ scale: 1, x: 0, y: 0 }), [])
   const zoomIn = useCallback(() => zoomAt(BUTTON_STEP), [zoomAt])
   const zoomOut = useCallback(() => zoomAt(1 / BUTTON_STEP), [zoomAt])
 
@@ -99,7 +122,15 @@ export function useZoomPan() {
     panning,
     reset,
     scale: transform.scale,
-    stageProps: { onPointerDown, onPointerLeave: endPan, onPointerMove, onPointerUp: endPan, onWheel },
+    setScale,
+    stageProps: {
+      onPointerDown,
+      onLostPointerCapture: endPan,
+      onPointerCancel: endPan,
+      onPointerMove,
+      onPointerUp: endPan,
+      onWheel
+    },
     style,
     zoomIn,
     zoomOut
diff --git a/apps/desktop/src/components/user-account-gate.tsx b/apps/desktop/src/components/user-account-gate.tsx
index c8b7e5b7ac..c28f6a9a30 100644
--- a/apps/desktop/src/components/user-account-gate.tsx
+++ b/apps/desktop/src/components/user-account-gate.tsx
@@ -3,7 +3,8 @@
  *
  * $userAccount 为 signed_out 时全屏盖住整个 app：登录/注册/找回三页。
  * U-3：无会话 + relay 不可达 = 停留在登录页带 network 文案（等待，不砖）；
- * 有会话 + 不可达在 DB-T1 status 层已标离线放行，门根本不出现。
+ * 有会话 + 不可达在 DB-T1 status 层已标离线放行，门根本不出现。断网时登录本身
+ * 也能过——main 侧回落到本地记住的凭据校验（前提是盘上还有会话）。
  * U-5：machine_bound_to_other → 锁态页，显示绑定者邮箱（用户裁定容许）。
  *
  * 门只盖 UI：机器通道（agent 宿主连接）由 hermes_cli 独立供能，与门的
@@ -17,8 +18,8 @@ import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
 import { Loader } from '@/components/ui/loader'
 import { useI18n } from '@/i18n'
-import type { Translations } from '@/i18n/types'
 import { readKey, writeKey } from '@/lib/storage'
+import { userAccountErrorText as errorText } from '@/lib/user-account-errors'
 import {
   $userAccount,
   UserAccountFailure,
@@ -35,35 +36,6 @@ const SITE_KEY = 'hermes-user-account-site'
 
 type Page = 'login' | 'register' | 'reset'
 
-function errorText(t: Translations['userAccount'], failure: UserAccountFailure): string {
-  switch (failure.code) {
-    case 'invalid_credentials':
-      return t.errorInvalidCredentials
-
-    case 'account_locked':
-
-    case 'login_rate_limited':
-
-    case 'registration_rate_limited':
-      return t.errorRateLimited
-
-    case 'network':
-      return t.errorNetwork
-
-    case 'weak_password':
-      return t.errorWeakPassword
-
-    case 'reset_code_invalid_or_expired':
-      return t.errorResetCode
-
-    case 'invalid_site':
-      return t.errorInvalidSite
-
-    default:
-      return t.errorServer
-  }
-}
-
 export function UserAccountGate() {
   const { t } = useI18n()
   const copy = t.userAccount
diff --git a/apps/desktop/src/global.d.ts b/apps/desktop/src/global.d.ts
index 6d37e9ebf1..a242af85ab 100644
--- a/apps/desktop/src/global.d.ts
+++ b/apps/desktop/src/global.d.ts
@@ -38,17 +38,19 @@ declare global {
       // FreeModel2api (sub2api) provider onboarding. Password stays in the
       // main process; the renderer only ever sees email/balance/key list.
       freemodel2api: {
-        login: (payload: { baseUrl: string; email: string; password: string }) => Promise<{ ok: boolean; email: string; balance: number }>
-        status: () => Promise<{ configured: boolean; baseUrl?: string; email?: string; balance?: number }>
+        login: (payload: { baseUrl: string; email: string; password: string }) => Promise<{ ok: boolean; email: string; balance: number; username: string; frozenBalance: number }>
+        status: () => Promise<{ configured: boolean; baseUrl?: string; email?: string; balance?: number; username?: string; frozenBalance?: number }>
         keys: () => Promise<{ keys: { id: number; name: string; key: string; status: string; quota: number; quotaUsed: number; createdAt: string; lastUsedAt: string | null }[] }>
         logout: () => Promise<{ ok: boolean }>
         rememberedLoad: () => Promise<{ baseUrl: string; email: string; password: string } | null>
         rememberedSave: (payload: { baseUrl: string; email: string; password: string } | null) => Promise<{ ok: boolean }>
+        keyBalance: (payload: { baseUrl: string; apiKey: string }) => Promise<{ balance: number | null }>
       }
       // Hermes user account (§21). Tokens never cross into the renderer —
       // login returns only the profile; status/me read through the main
-      // process, which auto-refreshes on 401 and wipes the local session on
-      // refresh expiry (sessionExpired).
+      // process, which auto-refreshes on 401. Refresh expiry reports
+      // sessionExpired WITHOUT wiping the local session, so a disconnected
+      // desktop can still sign in locally off the remembered credentials.
       userAccount: {
         login: (payload: { site: string; email: string; password: string }) => Promise<HermesUserAccountLoginResult>
         status: () => Promise<HermesUserAccountStatus>
diff --git a/apps/desktop/src/i18n/ar.ts b/apps/desktop/src/i18n/ar.ts
index ca163734f5..1f2ae8ddb4 100644
--- a/apps/desktop/src/i18n/ar.ts
+++ b/apps/desktop/src/i18n/ar.ts
@@ -240,8 +240,8 @@ export const ar = defineLocale({
     message: reason => `العرض البرمجي نشط — تم اكتشاف شاشة بعيدة (${reason}). تم تعطيل تسريع GPU لمنع الوميض.`
   },
   titlebar: {
-    hideSidebar: 'إخفاء الشريط الجانبي',
-    showSidebar: 'إظهار الشريط الجانبي',
+    collapseSidebar: 'طي الشريط الجانبي',
+    expandSidebar: 'توسيع الشريط الجانبي',
     search: 'بحث',
     searchTitle: 'البحث في الجلسات والعروض والإجراءات',
     swapSidebarSides: 'تبديل جانبي الأشرطة',
@@ -1937,6 +1937,9 @@ export const ar = defineLocale({
       noColor: 'بلا لون',
       menuAddFolder: 'إضافة مجلد',
       menuSetActive: 'تعيين كنشط',
+      menuPin: 'تثبيت في الأعلى',
+      menuUnpin: 'إلغاء التثبيت',
+      pinned: 'مثبّت',
       menuDelete: 'حذف',
       reveal: 'إظهار في المجلد',
       copyPath: 'نسخ المسار',
@@ -2634,6 +2637,10 @@ export const ar = defineLocale({
     terminalHide: 'إخفاء الطرفية',
     addToChat: 'إضافة للمحادثة'
   },
+  chatNav: {
+    back: 'رجوع',
+    forward: 'تقدّم'
+  },
   preview: {
     tab: 'معاينة',
     closePane: 'إغلاق جزء المعاينة',
@@ -2654,6 +2661,7 @@ export const ar = defineLocale({
     unknownSize: 'حجم غير معروف',
     binaryTitle: 'يبدو هذا ملفا ثنائيا',
     binaryBody: label => `قد تعرض معاينة ${label} نصا غير قابل للقراءة.`,
+    officeFailed: label => `تعذر عرض ${label} هنا.`,
     largeTitle: 'هذا الملف كبير',
     largeBody: (label, size) => `حجم ${label} هو ${size}. سيعرض Hermes أول 512 KB فقط.`,
     previewAnyway: 'معاينة على أي حال',
@@ -3086,7 +3094,8 @@ export const ar = defineLocale({
     sudoSendFailed: 'فشل إرسال كلمة مرور sudo',
     secretSendFailed: 'فشل إرسال السر',
     sudoTitle: 'مطلوب sudo',
-    sudoDesc: 'راجع الأمر قبل إدخال كلمة مرور sudo. تُرسل كلمة المرور إلى الوكيل الذي ينفّذه وتُحفظ مؤقتًا لهذه الجلسة.',
+    sudoDesc:
+      'راجع الأمر قبل إدخال كلمة مرور sudo. تُرسل كلمة المرور إلى الوكيل الذي ينفّذه وتُحفظ مؤقتًا لهذه الجلسة.',
     sudoCommandUnavailable: 'لم يقدّم هذا الوكيل الأمر. ألغِ الطلب إذا لم تتمكن من التحقق منه في المحادثة.',
     sudoPlaceholder: 'كلمة المرور',
     secretTitle: 'مطلوب سر',
@@ -3181,6 +3190,10 @@ export const ar = defineLocale({
     openImage: 'فتح الصورة',
     downloadImage: 'تنزيل الصورة',
     savingImage: 'جار حفظ الصورة',
+    imageZoomIn: 'تكبير',
+    imageZoomOut: 'تصغير',
+    imageFit: 'ملاءمة النافذة',
+    imageActualSize: 'الحجم الأصلي',
     imagePreviewFailed: 'فشلت معاينة الصورة',
     imageAttach: 'إرفاق الصورة',
     imageWriteFailed: 'فشل كتابة الصورة',
@@ -3326,6 +3339,10 @@ export const ar = defineLocale({
     bindingInvalidBody: 'بيانات ارتباط الجهاز تالفة. أصلح تثبيت Hermes agent قبل تسجيل الدخول.',
     me: {
       cardAria: 'فتح صفحة الحساب',
+      menuAria: 'قائمة الحساب',
+      details: 'تفاصيل المستخدم',
+      changePassword: 'تغيير كلمة المرور',
+      passwordChangeDescription: 'يتطلب تغيير كلمة المرور التحقق عبر البريد الإلكتروني وتسجيل الدخول مجدداً.',
       cardOffline: 'غير متصل — تُعرض بيانات مخزنة',
       cardBindIssue: 'ربط الجهاز يحتاج إلى متابعة — انقر للعرض',
       unavailable: 'بيانات الحساب غير متاحة.',
@@ -3363,7 +3380,8 @@ export const ar = defineLocale({
         unbindConfirm: 'إلغاء الربط والمسح',
         unbinding: 'جارٍ إلغاء الربط…',
         pendingTitle: 'يتطلب التأكيد على جهاز آخر',
-        pendingBody: (code, expiresAt) => `أدخل الرمز ${code} على جهاز مرتبط بحسابك بالفعل للموافقة على هذا الجهاز. تنتهي صلاحية الرمز في ${expiresAt}.`,
+        pendingBody: (code, expiresAt) =>
+          `أدخل الرمز ${code} على جهاز مرتبط بحسابك بالفعل للموافقة على هذا الجهاز. تنتهي صلاحية الرمز في ${expiresAt}.`,
         stateInvalidBody: 'سجل الربط المحلي تالف. ألغِ الربط ثم اربط مجددًا، أو تواصل مع الدعم.',
         errorNetwork: 'تعذّر الوصول إلى الخادم. تحقق من الشبكة وأعد المحاولة.',
         errorPluginUnreachable: 'قناة الجهاز المحلية غير متاحة. أعد تشغيل Hermes وحاول مجددًا.',
@@ -3371,4 +3389,4 @@ export const ar = defineLocale({
       }
     }
   }
-})
\ No newline at end of file
+})
diff --git a/apps/desktop/src/i18n/en.ts b/apps/desktop/src/i18n/en.ts
index d00247ea90..9fe9fd5b96 100644
--- a/apps/desktop/src/i18n/en.ts
+++ b/apps/desktop/src/i18n/en.ts
@@ -143,7 +143,8 @@ export const en: Translations = {
       startingHermesDesktop: 'Starting Hermes Desktop…'
     },
     errors: {
-      backgroundExited: 'The service that runs your chats closed unexpectedly. Restart it to keep going — your chats and settings are safe.',
+      backgroundExited:
+        'The service that runs your chats closed unexpectedly. Restart it to keep going — your chats and settings are safe.',
       backgroundExitedDuringStartup: 'Hermes stopped right after it started.',
       backendStopped: 'Hermes stopped working in the background',
       restartHermes: 'Restart Hermes',
@@ -245,11 +246,13 @@ export const en: Translations = {
       storageFailure: "Hermes couldn't save to its data folder. Open Maintenance to check and repair it.",
       gatewayAuthFailed:
         'This Hermes no longer accepts your saved sign-in. Open Gateways and sign in again (or paste a new access token), then retry.',
-      methodNotAllowed: "Hermes' background service is out of step with the app, probably after an update. Restart it to fix this.",
+      methodNotAllowed:
+        "Hermes' background service is out of step with the app, probably after an update. Restart it to fix this.",
       microphonePermission: 'Microphone permission was denied.',
       openaiRejectedApiKey: "OpenAI didn't accept your API key. Update it in Settings → Keys, then try again.",
       openaiTtsNeedsKey: 'Voice needs an OpenAI key. Add one in Settings → Keys.',
-      codeSkewRestartRequired: 'Hermes was updated but is still running the old version. Restart it to finish the update.',
+      codeSkewRestartRequired:
+        'Hermes was updated but is still running the old version. Restart it to finish the update.',
       restartHermesFailed: "Couldn't restart Hermes"
     },
     actions: {
@@ -338,8 +341,8 @@ export const en: Translations = {
   },
 
   titlebar: {
-    hideSidebar: 'Hide sidebar',
-    showSidebar: 'Show sidebar',
+    collapseSidebar: 'Collapse sidebar',
+    expandSidebar: 'Expand sidebar',
     search: 'Search',
     searchTitle: 'Search sessions, views, and actions',
     swapSidebarSides: 'Swap sidebar sides',
@@ -412,7 +415,6 @@ export const en: Translations = {
       'view.toggleReview': 'Toggle review pane',
       'view.toggleStatusbar': 'Toggle status bar',
       'view.toggleTabStrip': 'Toggle tabs',
-      'view.toggleProfileRail': 'Toggle profile rail',
       'view.showFiles': 'Show file browser',
       'view.showBrowser': 'Open browser',
       'view.toggleHud': 'Toggle HUD mode',
@@ -575,7 +577,8 @@ export const en: Translations = {
         desktopSuccess: name => `Desktop plugin ${name} installed`,
         agentFailed: 'Agent plugin install failed',
         desktopFailed: 'Desktop plugin install failed',
-        missingEnv: (name, vars) => `${name} is installed but needs a key before it can work: ${vars}. Add it now, or the plugin's tools will fail.`
+        missingEnv: (name, vars) =>
+          `${name} is installed but needs a key before it can work: ${vars}. Add it now, or the plugin's tools will fail.`
       }
     },
     vault: {
@@ -739,7 +742,8 @@ export const en: Translations = {
       sessionDensityComfortable: 'Comfortable',
       sessionDensityDetailed: 'Detailed',
       tabStripTitle: 'Tab Strip',
-      tabStripDesc: 'Show tabs above a zone. Auto hides them for a single pane unless another chat or tile zone is open.',
+      tabStripDesc:
+        'Show tabs above a zone. Auto hides them for a single pane unless another chat or tile zone is open.',
       tabStripAuto: 'Auto',
       tabStripAlways: 'Always',
       tabStripNever: 'Never',
@@ -1074,7 +1078,8 @@ export const en: Translations = {
     gateway: {
       loading: 'Loading gateway settings...',
       unavailableTitle: 'Gateway settings unavailable',
-      unavailableDesc: 'Connection settings can only be changed from the Hermes Desktop app on the computer running it.',
+      unavailableDesc:
+        'Connection settings can only be changed from the Hermes Desktop app on the computer running it.',
       title: 'Gateway Connection',
       envOverride: 'env override',
       intro:
@@ -1127,7 +1132,8 @@ export const en: Translations = {
       remoteUrlTitle: 'Remote URL',
       remoteUrlDesc: 'Base URL for the remote dashboard backend. Path prefixes are supported, for example /hermes.',
       probing: 'Checking how this gateway authenticates…',
-      probeError: "Hermes can't reach that address. Check the URL and that the other computer is running Hermes — sign-in options appear once it answers.",
+      probeError:
+        "Hermes can't reach that address. Check the URL and that the other computer is running Hermes — sign-in options appear once it answers.",
       signedIn: 'Signed in',
       signIn: 'Sign in',
       signOut: 'Sign out',
@@ -1570,7 +1576,8 @@ export const en: Translations = {
       useBackend: 'Use this backend',
       nousIncluded: 'Included with a Nous subscription — sign in with your Nous account to activate.',
       nousAuthNeededTitle: 'Sign in with your Nous account',
-      nousAuthNeededMessage: provider => `${provider} is saved but will only work once you sign in with your Nous account.`,
+      nousAuthNeededMessage: provider =>
+        `${provider} is saved but will only work once you sign in with your Nous account.`,
       nousAuthSignIn: 'Sign in',
       nousAuthDoneTitle: 'Nous account connected',
       nousAuthDoneMessage: 'Your subscription backends are now active.',
@@ -1589,7 +1596,8 @@ export const en: Translations = {
       postSetupCompleteTitle: 'Setup complete',
       postSetupCompleteMessage: step => `${step} installed.`,
       postSetupErrorTitle: 'Setup finished with errors',
-      postSetupErrorMessage: step => `Setting up ${step} did not finish. Open the logs to see why, then run setup again.`,
+      postSetupErrorMessage: step =>
+        `Setting up ${step} did not finish. Open the logs to see why, then run setup again.`,
       postSetupOpenLogs: 'Open logs',
       postSetupRunAgain: 'Run again',
       postSetupFailed: step => `Failed to run ${step} setup`,
@@ -2742,6 +2750,9 @@ export const en: Translations = {
       noColor: 'No color',
       menuAddFolder: 'Add folder',
       menuSetActive: 'Set active',
+      menuPin: 'Pin to top',
+      menuUnpin: 'Unpin',
+      pinned: 'Pinned',
       menuDelete: 'Delete',
       moveToProject: 'Move to project',
       movedTo: name => `Moved to ${name}`,
@@ -3051,6 +3062,8 @@ export const en: Translations = {
     goalPaused: 'Goal paused',
     goalWaiting: 'Goal waiting',
     subagents: count => `${count} Subagent${count === 1 ? '' : 's'}`,
+    setupPendingTitle: 'No model provider configured yet — set one up to start chatting.',
+    setupPendingAction: 'Set up now',
     todos: (done, total) => `Tasks ${done}/${total}`,
     running: 'Running',
     stop: 'Stop',
@@ -3280,10 +3293,10 @@ export const en: Translations = {
   handoffTour: {
     profileTitle: 'Your first task runs on the default profile',
     profileText:
-      'This rail switches profiles. The one lit up now is default, where the task session lives. The other one is the setup profile, where the welcome chat lives.',
+      'Profiles are in your account menu. The current profile is default, where the task session lives. The setup profile keeps the welcome chat.',
     sessionsTitle: 'Each profile keeps its own sessions',
     sessionsText:
-      'This list belongs to the default profile. New session starts one on whichever profile is selected. Switch profiles on the rail and the list changes with it.',
+      'This list belongs to the default profile. New session starts one on whichever profile is selected. Switch profiles in the account menu and the list changes with it.',
     stayTitle: 'Hermes is one click away',
     stayText: 'Switch to the setup profile and open Welcome to Hermes whenever you want a hand. It stays there.'
   },
@@ -3322,7 +3335,8 @@ export const en: Translations = {
     remoteUrlDesc: 'Use the base URL of the Hermes gateway, including https:// when remote.',
     remoteUrlPlaceholder: 'https://gateway.example.com/hermes',
     probing: 'Detecting gateway authentication...',
-    probeError: "Hermes can't reach that address. Check the URL and that the other computer is running Hermes — sign-in options appear once it answers.",
+    probeError:
+      "Hermes can't reach that address. Check the URL and that the other computer is running Hermes — sign-in options appear once it answers.",
     probeErrorDetails: 'Details',
     identityProvider: 'your identity provider',
     authTitle: 'Authentication',
@@ -3405,6 +3419,7 @@ export const en: Translations = {
     replaceCurrent: 'Replace current value',
     pasteApiKey: 'Paste API key',
     localApiKeyPlaceholder: 'API key (optional — only if your endpoint requires one)',
+    baseApiUrlPlaceholder: 'Base URL, e.g. http://127.0.0.1:8000/v1',
     couldNotSave: 'Could not save credential.',
     connecting: 'Connecting',
     update: 'Update',
@@ -3490,7 +3505,7 @@ export const en: Translations = {
     timedOutHeading: 'That sign-in link has expired',
     timedOutBody: "Start again whenever you're ready. You're still on the free Nous service.",
     retiredBody:
-      'Your session ended before the sign-in finished. Hermes will start a new one; then sign in again whenever you\'re ready.',
+      "Your session ended before the sign-in finished. Hermes will start a new one; then sign in again whenever you're ready.",
     errorBody: "Sign-in didn't finish. Try again whenever you're ready.",
     busyHeading: 'Almost there',
     busyBody: wait =>
@@ -3512,7 +3527,8 @@ export const en: Translations = {
       powRequired:
         "The Nous server asked for a proof of work, but that isn't implemented in your Agent yet. Sign in or create a free Nous account to continue.",
       locked: "This session can't continue without signing in. Sign in or create a free Nous account to keep going.",
-      generic: "Hermes couldn't set up free access without signing in. Signing in is free, or connect another provider.",
+      generic:
+        "Hermes couldn't set up free access without signing in. Signing in is free, or connect another provider.",
       signInBelow: 'Signing in is free. Pick Nous below.',
       tryAgain: 'Try again',
       retrying: 'Trying again…'
@@ -3738,6 +3754,10 @@ export const en: Translations = {
     addToChat: 'Add to chat'
   },
 
+  chatNav: {
+    back: 'Back',
+    forward: 'Forward'
+  },
   preview: {
     tab: 'Preview',
     closePane: 'Close preview pane',
@@ -3748,6 +3768,7 @@ export const en: Translations = {
     openPreview: 'Open preview',
     openInBrowser: 'Open in browser',
     openInExternal: 'Open in external',
+    moveToWorkspace: 'Move beside Workspace',
     popIn: 'Pop in',
     popOut: 'Pop out',
     linkHint: '⌘/Ctrl-click for preview pane',
@@ -3758,6 +3779,7 @@ export const en: Translations = {
     unknownSize: 'unknown size',
     binaryTitle: 'This looks like a binary file',
     binaryBody: label => `Previewing ${label} may show unreadable text.`,
+    officeFailed: label => `${label} could not be rendered here.`,
     largeTitle: 'This file is large',
     largeBody: (label, size) => `${label} is ${size}. Hermes will only show the first 512 KB.`,
     previewAnyway: 'Preview anyway',
@@ -3970,17 +3992,21 @@ export const en: Translations = {
         auth: 'The AI service rejected your sign-in. Check the credentials for this provider, then send your message again.',
         billing: 'Your account has no credits left for this provider. Top up or switch provider, then send again.',
         disk: 'Your disk is full, so Hermes could not save this conversation. Free some space, then retry.',
-        endpoint: "Hermes can't reach your custom model server. Check that it is running, then send your message again.",
-        gateway: 'Hermes hit an internal problem starting this reply. Send your message again; if it keeps happening, send diagnostics.',
+        endpoint:
+          "Hermes can't reach your custom model server. Check that it is running, then send your message again.",
+        gateway:
+          'Hermes hit an internal problem starting this reply. Send your message again; if it keeps happening, send diagnostics.',
         generic: 'Something went wrong while Hermes was replying. Retry, or copy the details if it keeps happening.',
         provider: 'The AI service could not complete this request. Retry in a moment or switch provider.',
-        runtime: 'Hermes hit an internal problem starting this reply. Send your message again; if it keeps happening, send diagnostics.',
+        runtime:
+          'Hermes hit an internal problem starting this reply. Send your message again; if it keeps happening, send diagnostics.',
         streaming: 'The connection dropped before the reply finished. Retry to send it again.'
       },
       errorCodes: {
         auth: {
           title: provider => `${provider} rejected your sign-in`,
-          body: provider => `The credentials saved for ${provider} were not accepted. Fix them in Settings or switch provider, then send your message again.`
+          body: provider =>
+            `The credentials saved for ${provider} were not accepted. Fix them in Settings or switch provider, then send your message again.`
         },
         auth_permanent: {
           title: provider => `${provider} rejected your sign-in`,
@@ -4030,7 +4056,8 @@ export const en: Translations = {
         },
         model_not_found: {
           title: 'This model is not available',
-          body: provider => `${provider} does not offer this model on your account. Choose another model, then send your message again.`
+          body: provider =>
+            `${provider} does not offer this model on your account. Choose another model, then send your message again.`
         },
         provider_policy_blocked: {
           title: 'This model is blocked by your account settings',
@@ -4319,8 +4346,10 @@ export const en: Translations = {
     sudoSendFailed: 'Could not send sudo password',
     secretSendFailed: 'Could not send secret',
     sudoTitle: 'Administrator password',
-    sudoDesc: 'Review the command before entering your sudo password. Your password is sent to the agent running it and cached for this session.',
-    sudoCommandUnavailable: 'This agent did not provide the command. Cancel if you cannot verify it in the conversation.',
+    sudoDesc:
+      'Review the command before entering your sudo password. Your password is sent to the agent running it and cached for this session.',
+    sudoCommandUnavailable:
+      'This agent did not provide the command. Cancel if you cannot verify it in the conversation.',
     sudoPlaceholder: 'sudo password',
     secretTitle: 'Secret required',
     secretDesc: 'Hermes needs a credential to continue.',
@@ -4416,6 +4445,10 @@ export const en: Translations = {
     openImage: 'Open image',
     downloadImage: 'Download image',
     savingImage: 'Saving image',
+    imageZoomIn: 'Zoom in',
+    imageZoomOut: 'Zoom out',
+    imageFit: 'Fit to window',
+    imageActualSize: 'Actual size',
     imagePreviewFailed: 'Image preview failed',
     imageAttach: 'Image attach',
     imageWriteFailed: 'Failed to write image to disk.',
@@ -4432,7 +4465,8 @@ export const en: Translations = {
       success: platform => `Handed off to ${platform}. Resume here anytime.`,
       systemNote: platform => `↻ Handed off to ${platform} — resume here anytime.`,
       failed: error => `Handoff failed: ${error}`,
-      timedOut: "Hermes couldn't reach your messaging connection. Start it from Settings → Messaging, then try the handoff again.",
+      timedOut:
+        "Hermes couldn't reach your messaging connection. Start it from Settings → Messaging, then try the handoff again.",
       startMessaging: 'Start messaging'
     }
   },
@@ -4538,7 +4572,8 @@ export const en: Translations = {
     registerSubmit: 'Sign up',
     registering: 'Signing up…',
     registerSentTitle: 'Check your inbox',
-    registerSentBody: 'We sent a verification email. Open the link to finish confirming your account (it opens in the console), then come back and sign in.',
+    registerSentBody:
+      'We sent a verification email. Open the link to finish confirming your account (it opens in the console), then come back and sign in.',
     resend: 'Resend email',
     resending: 'Resending…',
     resent: 'Sent again.',
@@ -4562,11 +4597,16 @@ export const en: Translations = {
     errorResetCode: 'The reset code is invalid or has expired.',
     errorInvalidSite: 'The server address is invalid (https required).',
     lockedTitle: 'This machine is bound to another account',
-    lockedBody: email => `This machine is bound to ${email}. Unbind it there before signing in with a different account.`,
+    lockedBody: email =>
+      `This machine is bound to ${email}. Unbind it there before signing in with a different account.`,
     lockedBodyUnknown: 'This machine is bound to another account. Unbind it before signing in.',
     bindingInvalidBody: 'The machine binding data is damaged. Repair the Hermes agent installation before signing in.',
     me: {
       cardAria: 'Open your account page',
+      menuAria: 'Account menu',
+      details: 'User details',
+      changePassword: 'Change password',
+      passwordChangeDescription: 'Password changes require email verification and a new sign-in.',
       cardOffline: 'Offline — showing cached data',
       cardBindIssue: 'Machine binding needs attention — open to review',
       unavailable: 'Account details are unavailable.',
@@ -4607,11 +4647,12 @@ export const en: Translations = {
         pendingTitle: 'Confirm on another device',
         pendingBody: (code, expiresAt) =>
           `Enter code ${code} on a device already bound to your account to approve this machine. The code expires at ${expiresAt}.`,
-        stateInvalidBody: 'The local binding record is corrupted. Unbind this machine and bind again, or contact support.',
+        stateInvalidBody:
+          'The local binding record is corrupted. Unbind this machine and bind again, or contact support.',
         errorNetwork: 'Cannot reach the server. Check the network and try again.',
         errorPluginUnreachable: 'The local machine channel is unavailable. Restart Hermes and try again.',
         errorServer: 'Server error. Please try again later.'
       }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/apps/desktop/src/i18n/ja.ts b/apps/desktop/src/i18n/ja.ts
index 2e891080f0..6a5ee4df95 100644
--- a/apps/desktop/src/i18n/ja.ts
+++ b/apps/desktop/src/i18n/ja.ts
@@ -275,8 +275,8 @@ export const ja = defineLocale({
   },
 
   titlebar: {
-    hideSidebar: 'サイドバーを非表示',
-    showSidebar: 'サイドバーを表示',
+    collapseSidebar: 'サイドバーを折りたたむ',
+    expandSidebar: 'サイドバーを展開',
     search: '検索',
     searchTitle: 'セッション、ビュー、アクションを検索',
     swapSidebarSides: 'サイドバーの向きを切り替え',
@@ -498,7 +498,8 @@ export const ja = defineLocale({
       sessionDensityComfortable: '標準',
       sessionDensityDetailed: '詳細',
       tabStripTitle: 'タブバー',
-      tabStripDesc: 'ゾーンの上にタブを表示します。自動では、他にチャットやタイルのゾーンがない限り、ペインが1つのときに隠します。',
+      tabStripDesc:
+        'ゾーンの上にタブを表示します。自動では、他にチャットやタイルのゾーンがない限り、ペインが1つのときに隠します。',
       tabStripAuto: '自動',
       tabStripAlways: '常に表示',
       tabStripNever: '表示しない',
@@ -2254,6 +2255,9 @@ export const ja = defineLocale({
       noColor: '色なし',
       menuAddFolder: 'フォルダを追加',
       menuSetActive: 'アクティブに設定',
+      menuPin: '先頭に固定',
+      menuUnpin: '固定を解除',
+      pinned: '固定済み',
       menuDelete: '削除',
       reveal: 'フォルダで表示',
       copyPath: 'パスをコピー',
@@ -3090,6 +3094,10 @@ export const ja = defineLocale({
     addToChat: 'チャットに追加'
   },
 
+  chatNav: {
+    back: '戻る',
+    forward: '進む'
+  },
   preview: {
     tab: 'プレビュー',
     closePane: 'プレビューペインを閉じる',
@@ -3110,6 +3118,7 @@ export const ja = defineLocale({
     unknownSize: 'サイズ不明',
     binaryTitle: 'これはバイナリファイルのようです',
     binaryBody: label => `${label} をプレビューすると読み取り不能なテキストが表示される場合があります。`,
+    officeFailed: label => `${label} をここに表示できませんでした。`,
     largeTitle: 'このファイルは大きいです',
     largeBody: (label, size) => `${label} は ${size} です。Hermes は最初の 512 KB のみを表示します。`,
     previewAnyway: 'とにかくプレビュー',
@@ -3495,7 +3504,8 @@ export const ja = defineLocale({
     sudoTitle: '管理者パスワード',
     sudoDesc:
       'sudo パスワードを入力する前にコマンドを確認してください。パスワードは実行するエージェントに送信され、このセッション中キャッシュされます。',
-    sudoCommandUnavailable: 'エージェントからコマンドが提供されていません。会話で確認できない場合はキャンセルしてください。',
+    sudoCommandUnavailable:
+      'エージェントからコマンドが提供されていません。会話で確認できない場合はキャンセルしてください。',
     sudoPlaceholder: 'sudo パスワード',
     secretTitle: 'シークレットが必要です',
     secretDesc: 'Hermes は続行するための認証情報が必要です。',
@@ -3592,6 +3602,10 @@ export const ja = defineLocale({
     openImage: '画像を開く',
     downloadImage: '画像をダウンロード',
     savingImage: '画像を保存中',
+    imageZoomIn: '拡大',
+    imageZoomOut: '縮小',
+    imageFit: 'ウィンドウに合わせる',
+    imageActualSize: '実際のサイズ',
     imagePreviewFailed: '画像のプレビューに失敗しました',
     imageAttach: '画像を添付',
     imageWriteFailed: '画像のディスクへの書き込みに失敗しました。',
@@ -3711,7 +3725,8 @@ export const ja = defineLocale({
     registerSubmit: '登録',
     registering: '登録中…',
     registerSentTitle: '受信ボックスを確認してください',
-    registerSentBody: '確認メールを送信しました。メール内のリンクを開いてアカウント確認を完了し（コンソールで開きます）、戻ってサインインしてください。',
+    registerSentBody:
+      '確認メールを送信しました。メール内のリンクを開いてアカウント確認を完了し（コンソールで開きます）、戻ってサインインしてください。',
     resend: 'メールを再送信',
     resending: '再送信中…',
     resent: '再送信しました。',
@@ -3719,7 +3734,8 @@ export const ja = defineLocale({
     resetSubtitle: 'リセットコードをメールでお送りします。',
     resetSend: 'リセットコードを送信',
     resetSending: '送信中…',
-    resetSentBody: '登録済みのメールアドレスであれば、リセットコードが届きます。コードと新しいパスワードを入力してください。',
+    resetSentBody:
+      '登録済みのメールアドレスであれば、リセットコードが届きます。コードと新しいパスワードを入力してください。',
     codeLabel: 'リセットコード',
     newPasswordLabel: '新しいパスワード',
     resetConfirm: '新しいパスワードを設定',
@@ -3735,11 +3751,17 @@ export const ja = defineLocale({
     errorResetCode: 'リセットコードが無効または期限切れです。',
     errorInvalidSite: 'サーバーアドレスが無効です（https が必要です）。',
     lockedTitle: 'このマシンは別のアカウントにバインドされています',
-    lockedBody: email => `このマシンは ${email} にバインドされています。別のアカウントでサインインする前に、そちらでバインド解除してください。`,
+    lockedBody: email =>
+      `このマシンは ${email} にバインドされています。別のアカウントでサインインする前に、そちらでバインド解除してください。`,
     lockedBodyUnknown: 'このマシンは別のアカウントにバインドされています。先にバインド解除してください。',
-    bindingInvalidBody: 'マシンのバインドデータが壊れています。サインイン前に Hermes エージェントのインストールを修復してください。',
+    bindingInvalidBody:
+      'マシンのバインドデータが壊れています。サインイン前に Hermes エージェントのインストールを修復してください。',
     me: {
       cardAria: 'アカウントページを開く',
+      menuAria: 'アカウントメニュー',
+      details: 'ユーザー情報',
+      changePassword: 'パスワードを変更',
+      passwordChangeDescription: 'パスワードの変更にはメール認証と再サインインが必要です。',
       cardOffline: 'オフライン — キャッシュデータを表示中',
       cardBindIssue: 'マシンバインドに対応が必要です — クリックして確認',
       unavailable: 'アカウント情報を利用できません。',
@@ -3780,11 +3802,12 @@ export const ja = defineLocale({
         pendingTitle: '別のデバイスで確認が必要です',
         pendingBody: (code, expiresAt) =>
           `アカウントにバインド済みのデバイスで確認コード ${code} を入力して、このマシンを承認してください。コードの有効期限は ${expiresAt} です。`,
-        stateInvalidBody: 'ローカルのバインド記録が破損しています。バインド解除して再度バインドするか、サポートにお問い合わせください。',
+        stateInvalidBody:
+          'ローカルのバインド記録が破損しています。バインド解除して再度バインドするか、サポートにお問い合わせください。',
         errorNetwork: 'サーバーに接続できません。ネットワークを確認して再試行してください。',
         errorPluginUnreachable: 'ローカルのマシンチャネルを利用できません。Hermes を再起動して再試行してください。',
         errorServer: 'サーバーエラー。後でもう一度お試しください。'
       }
     }
   }
-})
\ No newline at end of file
+})
diff --git a/apps/desktop/src/i18n/ru.ts b/apps/desktop/src/i18n/ru.ts
index 5507226df6..4e6006fcd2 100644
--- a/apps/desktop/src/i18n/ru.ts
+++ b/apps/desktop/src/i18n/ru.ts
@@ -259,8 +259,8 @@ export const ru = defineLocale({
   },
 
   titlebar: {
-    hideSidebar: 'Скрыть боковую панель',
-    showSidebar: 'Показать боковую панель',
+    collapseSidebar: 'Свернуть боковую панель',
+    expandSidebar: 'Развернуть боковую панель',
     search: 'Поиск',
     searchTitle: 'Поиск сеансов, видов и действий',
     swapSidebarSides: 'Поменять панели местами',
@@ -334,7 +334,6 @@ export const ru = defineLocale({
       'view.toggleReview': 'Показать / скрыть панель ревью',
       'view.toggleStatusbar': 'Показать / скрыть строку состояния',
       'view.toggleTabStrip': 'Показать / скрыть вкладки',
-      'view.toggleProfileRail': 'Показать / скрыть панель профилей',
       'view.showFiles': 'Показать браузер файлов',
       'view.showBrowser': 'Открыть браузер',
       'view.toggleHud': 'Включить / выключить режим HUD',
@@ -568,7 +567,8 @@ export const ru = defineLocale({
       sessionDensityComfortable: 'Комфортно',
       sessionDensityDetailed: 'Подробно',
       tabStripTitle: 'Панель вкладок',
-      tabStripDesc: 'Показывать вкладки над зоной. Автоматически скрываются для одной панели, если не открыта другая зона чата или плитки.',
+      tabStripDesc:
+        'Показывать вкладки над зоной. Автоматически скрываются для одной панели, если не открыта другая зона чата или плитки.',
       tabStripAuto: 'Авто',
       tabStripAlways: 'Всегда',
       tabStripNever: 'Никогда',
@@ -2515,6 +2515,9 @@ export const ru = defineLocale({
       noColor: 'Без цвета',
       menuAddFolder: 'Добавить папку',
       menuSetActive: 'Сделать активным',
+      menuPin: 'Закрепить наверху',
+      menuUnpin: 'Открепить',
+      pinned: 'Закреплено',
       menuDelete: 'Удалить',
       moveToProject: 'Переместить в проект',
       movedTo: name => `Перемещено в ${name}`,
@@ -3395,6 +3398,10 @@ export const ru = defineLocale({
     terminalCloseAll: 'Закрыть все',
     addToChat: 'Добавить в чат'
   },
+  chatNav: {
+    back: 'Назад',
+    forward: 'Вперёд'
+  },
   preview: {
     tab: 'Предпросмотр',
     closePane: 'Закрыть панель предпросмотра',
@@ -3412,6 +3419,7 @@ export const ru = defineLocale({
     unknownSize: 'размер неизвестен',
     binaryTitle: 'Похоже на бинарный файл',
     binaryBody: label => `Предпросмотр ${label} может показать нечитаемый текст.`,
+    officeFailed: label => `Не удалось отобразить ${label}.`,
     largeTitle: 'Этот файл большой',
     largeBody: (label, size) => `${label} — ${size}. Hermes покажет только первые 512 КБ.`,
     previewAnyway: 'Предпросмотр всё равно',
@@ -3854,6 +3862,10 @@ export const ru = defineLocale({
     openImage: 'Открыть изображение',
     downloadImage: 'Скачать изображение',
     savingImage: 'Сохранение изображения',
+    imageZoomIn: 'Увеличить',
+    imageZoomOut: 'Уменьшить',
+    imageFit: 'По размеру окна',
+    imageActualSize: 'Исходный размер',
     imagePreviewFailed: 'Предпросмотр изображения не удался',
     imageAttach: 'Прикрепление изображения',
     imageWriteFailed: 'Не удалось записать изображение на диск.',
@@ -3918,7 +3930,8 @@ export const ru = defineLocale({
     registerSubmit: 'Зарегистрироваться',
     registering: 'Регистрация…',
     registerSentTitle: 'Проверьте почту',
-    registerSentBody: 'Мы отправили письмо с подтверждением. Откройте ссылку, чтобы завершить подтверждение (откроется консоль), затем вернитесь и войдите.',
+    registerSentBody:
+      'Мы отправили письмо с подтверждением. Откройте ссылку, чтобы завершить подтверждение (откроется консоль), затем вернитесь и войдите.',
     resend: 'Отправить письмо ещё раз',
     resending: 'Отправка…',
     resent: 'Отправлено повторно.',
@@ -3947,6 +3960,10 @@ export const ru = defineLocale({
     bindingInvalidBody: 'Данные привязки машины повреждены. Восстановите установку Hermes agent перед входом.',
     me: {
       cardAria: 'Открыть страницу аккаунта',
+      menuAria: 'Меню аккаунта',
+      details: 'Данные пользователя',
+      changePassword: 'Изменить пароль',
+      passwordChangeDescription: 'Для изменения пароля требуется подтверждение по почте и повторный вход.',
       cardOffline: 'Офлайн — показаны кэшированные данные',
       cardBindIssue: 'Привязка машины требует внимания — открыть',
       unavailable: 'Данные аккаунта недоступны.',
@@ -3987,11 +4004,12 @@ export const ru = defineLocale({
         pendingTitle: 'Требуется подтверждение на другом устройстве',
         pendingBody: (code, expiresAt) =>
           `Введите код ${code} на устройстве, уже привязанном к вашему аккаунту, чтобы одобрить эту машину. Код действует до ${expiresAt}.`,
-        stateInvalidBody: 'Локальная запись о привязке повреждена. Отвяжите машину и привяжите заново или обратитесь в поддержку.',
+        stateInvalidBody:
+          'Локальная запись о привязке повреждена. Отвяжите машину и привяжите заново или обратитесь в поддержку.',
         errorNetwork: 'Не удаётся связаться с сервером. Проверьте сеть и повторите.',
         errorPluginUnreachable: 'Локальный канал машины недоступен. Перезапустите Hermes и повторите.',
         errorServer: 'Ошибка сервера. Повторите позже.'
       }
     }
   }
-})
\ No newline at end of file
+})
diff --git a/apps/desktop/src/i18n/types.ts b/apps/desktop/src/i18n/types.ts
index f5bd020e49..453d5cf39a 100644
--- a/apps/desktop/src/i18n/types.ts
+++ b/apps/desktop/src/i18n/types.ts
@@ -380,8 +380,8 @@ export interface Translations {
   }
 
   titlebar: {
-    hideSidebar: string
-    showSidebar: string
+    collapseSidebar: string
+    expandSidebar: string
     search: string
     searchTitle: string
     swapSidebarSides: string
@@ -2367,6 +2367,9 @@ export interface Translations {
       noColor: string
       menuAddFolder: string
       menuSetActive: string
+      menuPin: string
+      menuUnpin: string
+      pinned: string
       menuDelete: string
       moveToProject: string
       movedTo: (name: string) => string
@@ -2625,6 +2628,8 @@ export interface Translations {
     goalPaused: string
     goalWaiting: string
     subagents: (count: number) => string
+    setupPendingTitle: string
+    setupPendingAction: string
     todos: (done: number, total: number) => string
     running: string
     stop: string
@@ -2938,6 +2943,7 @@ export interface Translations {
     replaceCurrent: string
     pasteApiKey: string
     localApiKeyPlaceholder: string
+    baseApiUrlPlaceholder: string
     couldNotSave: string
     connecting: string
     update: string
@@ -3267,6 +3273,10 @@ export interface Translations {
     addToChat: string
   }
 
+  chatNav: {
+    back: string
+    forward: string
+  }
   preview: {
     tab: string
     closePane: string
@@ -3277,6 +3287,7 @@ export interface Translations {
     openPreview: string
     openInBrowser: string
     openInExternal: string
+    moveToWorkspace: string
     popIn: string
     popOut: string
     linkHint: string
@@ -3287,6 +3298,7 @@ export interface Translations {
     unknownSize: string
     binaryTitle: string
     binaryBody: (label: string) => string
+    officeFailed: (label: string) => string
     largeTitle: string
     largeBody: (label: string, size: string) => string
     previewAnyway: string
@@ -3779,6 +3791,10 @@ export interface Translations {
     openImage: string
     downloadImage: string
     savingImage: string
+    imageZoomIn: string
+    imageZoomOut: string
+    imageFit: string
+    imageActualSize: string
     imagePreviewFailed: string
     imageAttach: string
     imageWriteFailed: string
@@ -3889,6 +3905,10 @@ export interface Translations {
     bindingInvalidBody: string
     me: {
       cardAria: string
+      menuAria: string
+      details: string
+      changePassword: string
+      passwordChangeDescription: string
       cardOffline: string
       cardBindIssue: string
       unavailable: string
diff --git a/apps/desktop/src/i18n/zh-hant.ts b/apps/desktop/src/i18n/zh-hant.ts
index 414424cae1..ddacceff13 100644
--- a/apps/desktop/src/i18n/zh-hant.ts
+++ b/apps/desktop/src/i18n/zh-hant.ts
@@ -266,8 +266,8 @@ export const zhHant = defineLocale({
   },
 
   titlebar: {
-    hideSidebar: '隱藏側邊欄',
-    showSidebar: '顯示側邊欄',
+    collapseSidebar: '收起側邊欄',
+    expandSidebar: '展開側邊欄',
     search: '搜尋',
     searchTitle: '搜尋工作階段、檢視和動作',
     swapSidebarSides: '交換側邊欄位置',
@@ -2240,6 +2240,9 @@ export const zhHant = defineLocale({
       noColor: '無顏色',
       menuAddFolder: '新增資料夾',
       menuSetActive: '設為使用中',
+      menuPin: '置頂',
+      menuUnpin: '取消置頂',
+      pinned: '已置頂',
       menuDelete: '刪除',
       reveal: '在資料夾中顯示',
       copyPath: '複製路徑',
@@ -3050,6 +3053,10 @@ export const zhHant = defineLocale({
     addToChat: '新增至聊天'
   },
 
+  chatNav: {
+    back: '後退',
+    forward: '前進'
+  },
   preview: {
     tab: '預覽',
     closePane: '關閉預覽窗格',
@@ -3060,6 +3067,7 @@ export const zhHant = defineLocale({
     openPreview: '開啟預覽',
     openInBrowser: '在瀏覽器中開啟',
     openInExternal: '在外部開啟',
+    moveToWorkspace: '移至工作區旁',
     popIn: '彈回',
     popOut: '彈出',
     linkHint: '⌘/Ctrl+點擊在預覽窗格開啟',
@@ -3070,6 +3078,7 @@ export const zhHant = defineLocale({
     unknownSize: '大小未知',
     binaryTitle: '這看起來像二進位檔案',
     binaryBody: label => `預覽 ${label} 可能會顯示無法讀取的文字。`,
+    officeFailed: label => `無法在此渲染 ${label}。`,
     largeTitle: '此檔案較大',
     largeBody: (label, size) => `${label} 大小為 ${size}。Hermes 只會顯示前 512 KB。`,
     previewAnyway: '仍然預覽',
@@ -3512,6 +3521,10 @@ export const zhHant = defineLocale({
     openImage: '開啟圖片',
     downloadImage: '下載圖片',
     savingImage: '正在儲存圖片',
+    imageZoomIn: '放大',
+    imageZoomOut: '縮小',
+    imageFit: '適應視窗',
+    imageActualSize: '原始尺寸',
     imagePreviewFailed: '圖片預覽失敗',
     imageAttach: '附加圖片',
     imageWriteFailed: '無法將圖片寫入磁碟。',
@@ -3660,6 +3673,10 @@ export const zhHant = defineLocale({
     bindingInvalidBody: '機器綁定資料已損毀，請先修復 Hermes agent 安裝再登入。',
     me: {
       cardAria: '開啟帳號頁',
+      menuAria: '使用者選單',
+      details: '使用者詳情',
+      changePassword: '修改密碼',
+      passwordChangeDescription: '修改密碼需要電子郵件驗證，修改成功後須重新登入。',
       cardOffline: '離線——顯示快取資料',
       cardBindIssue: '機器綁定待處理——點擊查看',
       unavailable: '帳號資料不可用。',
@@ -3696,7 +3713,8 @@ export const zhHant = defineLocale({
         unbindConfirm: '解綁並清空',
         unbinding: '解綁中…',
         pendingTitle: '需在另一台裝置上確認',
-        pendingBody: (code, expiresAt) => `在已綁定你帳號的裝置上輸入確認碼 ${code} 以批准本機。確認碼有效期限至 ${expiresAt}。`,
+        pendingBody: (code, expiresAt) =>
+          `在已綁定你帳號的裝置上輸入確認碼 ${code} 以批准本機。確認碼有效期限至 ${expiresAt}。`,
         stateInvalidBody: '本機綁定記錄已損毀。請解綁後重新綁定，或聯絡支援。',
         errorNetwork: '無法連接伺服器，請檢查網路後重試。',
         errorPluginUnreachable: '本機機器通道不可用，請重新啟動 Hermes 後重試。',
@@ -3704,4 +3722,4 @@ export const zhHant = defineLocale({
       }
     }
   }
-})
\ No newline at end of file
+})
diff --git a/apps/desktop/src/i18n/zh.ts b/apps/desktop/src/i18n/zh.ts
index f251297c4a..c666c97a3d 100644
--- a/apps/desktop/src/i18n/zh.ts
+++ b/apps/desktop/src/i18n/zh.ts
@@ -300,8 +300,8 @@ export const zh = defineLocale({
   },
 
   titlebar: {
-    hideSidebar: '隐藏侧边栏',
-    showSidebar: '显示侧边栏',
+    collapseSidebar: '收起侧边栏',
+    expandSidebar: '展开侧边栏',
     search: '搜索',
     searchTitle: '搜索会话、视图与操作',
     swapSidebarSides: '交换侧边栏位置',
@@ -374,7 +374,6 @@ export const zh = defineLocale({
       'view.toggleReview': '切换审查面板',
       'view.toggleStatusbar': '切换状态栏',
       'view.toggleTabStrip': '切换标签',
-      'view.toggleProfileRail': '切换配置档案栏',
       'view.showFiles': '显示文件浏览器',
       'view.showBrowser': '打开浏览器',
       'view.showTerminal': '显示终端',
@@ -2886,6 +2885,9 @@ export const zh = defineLocale({
       noColor: '无颜色',
       menuAddFolder: '添加文件夹',
       menuSetActive: '设为活动',
+      menuPin: '置顶',
+      menuUnpin: '取消置顶',
+      pinned: '已置顶',
       menuDelete: '删除',
       moveToProject: '移动到项目',
       movedTo: name => `已移动到 ${name}`,
@@ -3192,6 +3194,8 @@ export const zh = defineLocale({
     goalPaused: '目标已暂停',
     goalWaiting: '目标等待中',
     subagents: count => `${count} 个子代理`,
+    setupPendingTitle: '尚未配置模型提供方——设置后即可开始对话。',
+    setupPendingAction: '去设置',
     todos: (done, total) => `任务 ${done}/${total}`,
     running: '运行中',
     stop: '停止',
@@ -3517,6 +3521,7 @@ export const zh = defineLocale({
     replaceCurrent: '替换当前值',
     pasteApiKey: '粘贴 API 密钥',
     localApiKeyPlaceholder: 'API 密钥（可选 — 仅当端点需要时填写）',
+    baseApiUrlPlaceholder: '基础 URL，例如 http://127.0.0.1:8000/v1',
     couldNotSave: '无法保存凭据。',
     connecting: '连接中',
     update: '更新',
@@ -3821,6 +3826,10 @@ export const zh = defineLocale({
     addToChat: '添加到对话'
   },
 
+  chatNav: {
+    back: '后退',
+    forward: '前进'
+  },
   preview: {
     tab: '预览',
     closePane: '关闭预览面板',
@@ -3831,6 +3840,7 @@ export const zh = defineLocale({
     openPreview: '打开预览',
     openInBrowser: '在浏览器中打开',
     openInExternal: '在外部打开',
+    moveToWorkspace: '移到工作区旁',
     popIn: '弹回',
     popOut: '弹出',
     linkHint: '⌘/Ctrl+点击在预览面板打开',
@@ -3841,6 +3851,7 @@ export const zh = defineLocale({
     unknownSize: '大小未知',
     binaryTitle: '这看起来像二进制文件',
     binaryBody: label => `预览 ${label} 可能会显示不可读文本。`,
+    officeFailed: label => `无法在此渲染 ${label}。`,
     largeTitle: '此文件较大',
     largeBody: (label, size) => `${label} 大小为 ${size}。Hermes 只会显示前 512 KB。`,
     previewAnyway: '仍然预览',
@@ -4317,6 +4328,10 @@ export const zh = defineLocale({
     openImage: '打开图片',
     downloadImage: '下载图片',
     savingImage: '正在保存图片',
+    imageZoomIn: '放大',
+    imageZoomOut: '缩小',
+    imageFit: '适应窗口',
+    imageActualSize: '原始尺寸',
     imagePreviewFailed: '图片预览失败',
     imageAttach: '附加图片',
     imageWriteFailed: '无法将图片写入磁盘。',
@@ -4465,6 +4480,10 @@ export const zh = defineLocale({
     bindingInvalidBody: '机器绑定数据已损坏，请先修复 Hermes agent 安装再登录。',
     me: {
       cardAria: '打开账号页',
+      menuAria: '用户菜单',
+      details: '用户详情',
+      changePassword: '修改密码',
+      passwordChangeDescription: '修改密码需要邮箱验证，修改成功后需重新登录。',
       cardOffline: '离线——展示缓存数据',
       cardBindIssue: '机器绑定待处理——点击查看',
       unavailable: '账号资料不可用。',
@@ -4501,7 +4520,8 @@ export const zh = defineLocale({
         unbindConfirm: '解绑并清空',
         unbinding: '解绑中…',
         pendingTitle: '需在另一台设备上确认',
-        pendingBody: (code, expiresAt) => `在已绑定你账号的设备上输入确认码 ${code} 以批准本机。确认码有效期至 ${expiresAt}。`,
+        pendingBody: (code, expiresAt) =>
+          `在已绑定你账号的设备上输入确认码 ${code} 以批准本机。确认码有效期至 ${expiresAt}。`,
         stateInvalidBody: '本地绑定记录已损坏。请解绑后重新绑定，或联系支持。',
         errorNetwork: '无法连接服务器，请检查网络后重试。',
         errorPluginUnreachable: '本地机器通道不可用，请重启 Hermes 后重试。',
@@ -4509,4 +4529,4 @@ export const zh = defineLocale({
       }
     }
   }
-})
\ No newline at end of file
+})
diff --git a/apps/desktop/src/lib/keybinds/actions.ts b/apps/desktop/src/lib/keybinds/actions.ts
index 264edb7b8a..230bc54da6 100644
--- a/apps/desktop/src/lib/keybinds/actions.ts
+++ b/apps/desktop/src/lib/keybinds/actions.ts
@@ -129,8 +129,6 @@ export const KEYBIND_ACTIONS: readonly KeybindActionMeta[] = [
   // way back has to already exist. (⌥+letter emits a symbol on macOS; the
   // binding resolves through KeyT via comboFromEvent's `event.code` fallback.)
   { id: 'view.toggleTabStrip', category: 'view', defaults: ['mod+alt+t'] },
-  // Unbound: the rail is a one-time preference, not something to flip mid-chat.
-  { id: 'view.toggleProfileRail', category: 'view', defaults: [] },
   // ⌘G — "g" for git; the review pane is the source-control view.
   { id: 'view.toggleReview', category: 'view', defaults: ['mod+g'] },
   { id: 'view.showFiles', category: 'view', defaults: [] },
diff --git a/apps/desktop/src/lib/office-files.test.ts b/apps/desktop/src/lib/office-files.test.ts
index d935fd2239..efed9a261f 100644
--- a/apps/desktop/src/lib/office-files.test.ts
+++ b/apps/desktop/src/lib/office-files.test.ts
@@ -13,7 +13,7 @@ vi.mock('@/lib/desktop-fs', () => ({
 vi.mock('@/store/notifications', () => ({ notifyError }))
 vi.mock('@/i18n', () => ({ translateNow: (key: string) => key }))
 
-import { isOfficeFilePath, OFFICE_FILE_EXTENSIONS, openFileWithSystemApp } from './office-files'
+import { inlineOfficeFormat, isOfficeFilePath, OFFICE_FILE_EXTENSIONS, openFileWithSystemApp } from './office-files'
 
 const openExternalFile = vi.fn()
 
@@ -61,6 +61,26 @@ describe('isOfficeFilePath', () => {
   })
 })
 
+describe('inlineOfficeFormat', () => {
+  it.each([
+    ['a.docx', 'docx'],
+    ['/w/Report.DOCX', 'docx'],
+    ['C:\\w\\deck.pptx', 'pptx'],
+    ['/w/DECK.PPTX', 'pptx']
+  ])('renders %s as %s', (value, expected) => {
+    expect(inlineOfficeFormat(value)).toBe(expected)
+  })
+
+  // The remaining Office formats stay on the system-app path until the inline
+  // renderer is proven on them.
+  it.each(['a.doc', 'a.xlsx', 'a.rtf', 'a.pptm', 'a.odt', 'notes.md', 'noext'])(
+    'leaves %s to the system app',
+    value => {
+      expect(inlineOfficeFormat(value)).toBeNull()
+    }
+  )
+})
+
 describe('openFileWithSystemApp (local mode)', () => {
   it('hands the bare path to the bridge', async () => {
     openExternalFile.mockResolvedValue({ ok: true, path: '/w/a.docx' })
diff --git a/apps/desktop/src/lib/office-files.ts b/apps/desktop/src/lib/office-files.ts
index 3b924f2566..1f9cba9a80 100644
--- a/apps/desktop/src/lib/office-files.ts
+++ b/apps/desktop/src/lib/office-files.ts
@@ -1,6 +1,7 @@
-// Double-clicking an Office document can't render inline (no office renderer),
-// so it opens in the OS default application instead. Remote sessions download
-// bounded bytes first (16MB gateway cap) and open a staged local copy.
+// Word and PowerPoint render inline through @silurus/ooxml (see
+// inlineOfficeFormat); every other Office format is opened in the OS default
+// application instead. Remote sessions download bounded bytes first (16MB
+// gateway cap) and open a staged local copy.
 import { translateNow } from '@/i18n'
 import { isDesktopFsRemoteMode, readDesktopFileDataUrl } from '@/lib/desktop-fs'
 import { notifyError } from '@/store/notifications'
@@ -41,7 +42,17 @@ export function isOfficeFilePath(value: string): boolean {
   return OFFICE_FILE_EXTENSIONS.has(extensionOf(value))
 }
 
-function bytesFromDataUrl(dataUrl: string): Uint8Array {
+/** The subset of Office files the preview pane renders inline. Everything else
+ *  in OFFICE_FILE_EXTENSIONS still opens in the system app. */
+export function inlineOfficeFormat(value: string): 'docx' | 'pptx' | null {
+  const ext = extensionOf(value)
+
+  return ext === '.docx' ? 'docx' : ext === '.pptx' ? 'pptx' : null
+}
+
+// `Uint8Array<ArrayBuffer>` rather than a bare `Uint8Array`: callers hand
+// `.buffer` straight to APIs that want a real ArrayBuffer (the Office viewers).
+export function bytesFromDataUrl(dataUrl: string): Uint8Array<ArrayBuffer> {
   const comma = dataUrl.indexOf(',')
 
   if (comma < 0 || !dataUrl.startsWith('data:') || !dataUrl.slice(5, comma).includes(';base64')) {
diff --git a/apps/desktop/src/lib/tips/catalog.ts b/apps/desktop/src/lib/tips/catalog.ts
index 157968c85e..5e7526e386 100644
--- a/apps/desktop/src/lib/tips/catalog.ts
+++ b/apps/desktop/src/lib/tips/catalog.ts
@@ -50,7 +50,7 @@ export const TIP_CATALOG: readonly TipDef[] = [
   { id: 'artifacts', keybind: 'nav.artifacts', side: 'right', targets: ['[data-tour="sidebar-nav-artifacts"]'] },
   { id: 'cron', keybind: 'nav.cron', side: 'right', targets: ['[data-tour="sidebar-nav-cron"]'] },
   { id: 'command-palette', keybind: 'nav.commandPalette', side: 'right', targets: ['[data-tour="sessions-sidebar"]'] },
-  { id: 'profiles', keybind: 'profile.next', side: 'right', targets: ['[data-tour="profile-rail"]'] },
+  { id: 'profiles', keybind: 'profile.next', side: 'right', targets: ['[data-tour="profile-menu"]'] },
   { id: 'composer-mentions', side: 'top', targets: ['[data-tour="composer"]'] },
   { id: 'right-pane', keybind: 'view.toggleRightSidebar', side: 'bottom', targets: ['[data-tour="right-pane-toggle"]'] }
 ]
diff --git a/apps/desktop/src/lib/user-account-errors.ts b/apps/desktop/src/lib/user-account-errors.ts
new file mode 100644
index 0000000000..a68db0c6d0
--- /dev/null
+++ b/apps/desktop/src/lib/user-account-errors.ts
@@ -0,0 +1,17 @@
+import type { Translations } from '@/i18n/types'
+import { UserAccountFailure } from '@/store/user-account'
+
+export function userAccountErrorText(copy: Translations['userAccount'], error: unknown): string {
+  const messages: Record<string, string> = {
+    invalid_credentials: copy.errorInvalidCredentials,
+    account_locked: copy.errorRateLimited,
+    login_rate_limited: copy.errorRateLimited,
+    registration_rate_limited: copy.errorRateLimited,
+    network: copy.errorNetwork,
+    weak_password: copy.errorWeakPassword,
+    reset_code_invalid_or_expired: copy.errorResetCode,
+    invalid_site: copy.errorInvalidSite
+  }
+
+  return error instanceof UserAccountFailure ? (messages[error.code] ?? copy.errorServer) : copy.errorServer
+}
diff --git a/apps/desktop/src/lib/version-status.ts b/apps/desktop/src/lib/version-status.ts
index 0b292c9f31..e036dcf159 100644
--- a/apps/desktop/src/lib/version-status.ts
+++ b/apps/desktop/src/lib/version-status.ts
@@ -3,8 +3,8 @@
  * (`v0.4.2`, `backend v0.4.2 (+12)`, `v0.4.2 · update`), its tooltip, and
  * whether an update is waiting.
  *
- * The statusbar and the command palette both name the same two targets, so the
- * wording lives here once — a palette row and its statusbar item can't drift
+ * The sidebar menu and the command palette both name the same two targets, so the
+ * wording lives here once — a palette row and its version menu can't drift
  * into describing the same install differently.
  */
 
diff --git a/apps/desktop/src/store/onboarding.test.ts b/apps/desktop/src/store/onboarding.test.ts
index f41cbbad76..3604ae3cfd 100644
--- a/apps/desktop/src/store/onboarding.test.ts
+++ b/apps/desktop/src/store/onboarding.test.ts
@@ -81,6 +81,22 @@ function fallbackTimeoutGateway(): OnboardingContext['requestGateway'] {
 }
 
 describe('refreshOnboarding', () => {
+  it('keeps the first-run FreeModel2API key route while OAuth choices load', async () => {
+    $desktopOnboarding.set(baseState({ mode: 'apikey' }))
+    installApiMock(async ({ path }: { path: string }) => {
+      if (path === '/api/providers/oauth') {
+        return { providers: [makeOAuthProvider('nous', 'Nous Portal')] }
+      }
+
+      throw new Error(`unexpected api path: ${path}`)
+    })
+
+    await refreshOnboarding(onboardingContext(emptyOpenRouterGateway()))
+
+    expect($desktopOnboarding.get().mode).toBe('apikey')
+    expect($desktopOnboarding.get().providers?.[0]?.id).toBe('nous')
+  })
+
   it('keeps onboarding work in its initiating lifetime and profile', async () => {
     const { startManualOnboarding, startProviderOAuth, saveOnboardingApiKey, closeManualOnboarding } =
       await import('./onboarding')
@@ -138,6 +154,7 @@ describe('refreshOnboarding', () => {
 
     try {
       startManualOnboarding(null, 'beta')
+      expect($desktopOnboarding.get().mode).toBe('apikey')
       const pending = saveOnboardingApiKey('FIREWORKS_API_KEY', 'fake-key', 'Fireworks', ctx)
       await vi.waitFor(() => expect(release).toBeTypeOf('function'))
       closeManualOnboarding()
diff --git a/apps/desktop/src/store/onboarding.ts b/apps/desktop/src/store/onboarding.ts
index 8225d3c23d..2e5b006f6b 100644
--- a/apps/desktop/src/store/onboarding.ts
+++ b/apps/desktop/src/store/onboarding.ts
@@ -158,7 +158,8 @@ function writeCachedSkipped(value: boolean) {
 const INITIAL: DesktopOnboardingState = {
   configured: readCachedConfigured(),
   flow: { status: 'idle' },
-  mode: 'oauth',
+  // New installs begin on the default FreeModel2API API-key route. OAuth remains one Back click away.
+  mode: 'apikey',
   providers: null,
   reason: null,
   requested: false,
@@ -476,7 +477,9 @@ async function refreshProviders() {
         return
       }
 
-      patch({ mode: providers.length > 0 ? 'oauth' : 'apikey', providers })
+      // Loading OAuth choices must not replace the first-run FreeModel2API API-key route. Preserve
+      // the caller's current mode while OAuth rows exist; an empty list still falls back to keys.
+      patch({ mode: providers.length > 0 ? $desktopOnboarding.get().mode : 'apikey', providers })
     } catch {
       if (generation !== flowGeneration) {
         return
@@ -554,6 +557,9 @@ export function startManualOnboarding(reason: null | string = DEFAULT_MANUAL_ONB
     providers: null,
     requested: true,
     localEndpoint: false,
+    // FreeModel2API is the default route for generic setup as well as first run. The picker keeps
+    // OAuth one Back click away; dedicated OAuth actions still auto-start their requested provider.
+    mode: 'apikey',
     // The picker replaces the free-tier ready screen when the user asked for it.
     freeTierReady: false,
     // `null` opts out of the prompt banner entirely (e.g. when the user already
@@ -1022,7 +1028,10 @@ export async function saveOnboardingApiKey(
   // Optional endpoint key — only meaningful for the "Local / custom endpoint"
   // option, whose primary `value` is the base URL. Ignored for plain API-key
   // providers (their key IS `value`).
-  endpointApiKey?: string
+  endpointApiKey?: string,
+  // Per-install gateways (freemodel2api) carry a second required slot: the
+  // base URL env var the live catalog probes. Written alongside the key.
+  extraEnv?: { envKey: string; value: string }
 ) {
   ctx = { ...ctx }
   const generation = flowGeneration
@@ -1049,6 +1058,10 @@ export async function saveOnboardingApiKey(
   try {
     await setEnvVar(envKey, trimmed, ctx.profile)
 
+    if (extraEnv?.value.trim()) {
+      await setEnvVar(extraEnv.envKey, extraEnv.value.trim(), ctx.profile)
+    }
+
     if (generation !== flowGeneration) {
       return { ok: false }
     }
diff --git a/apps/desktop/src/store/profile-rail-prefs.ts b/apps/desktop/src/store/profile-rail-prefs.ts
deleted file mode 100644
index 97ba769bb7..0000000000
--- a/apps/desktop/src/store/profile-rail-prefs.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { Codecs, persistentAtom } from '@/lib/persisted'
-
-// The colored profile strip at the sidebar foot. For someone who runs profiles
-// as bots it duplicates the footer's gateway selector, so it can be switched
-// off; while it is off the statusbar grows a profile dropdown beside the
-// gateway switcher so switching profiles never loses its door. On by default.
-export const $profileRailVisible = persistentAtom('hermes.desktop.profileRailVisible', true, Codecs.bool)
-
-export function toggleProfileRailVisible() {
-  $profileRailVisible.set(!$profileRailVisible.get())
-}
diff --git a/apps/desktop/src/store/profile.ts b/apps/desktop/src/store/profile.ts
index b258528fcb..023ecdef8c 100644
--- a/apps/desktop/src/store/profile.ts
+++ b/apps/desktop/src/store/profile.ts
@@ -1098,8 +1098,7 @@ export function cycleProfile(direction: 1 | -1): void {
   selectProfile(keys[next])
 }
 
-// Bumped to ask the rail to open its "create profile" dialog (the dialog state
-// is local to the rail component; this lets a global hotkey trigger it).
+// Menu commands and hotkeys share the shell-owned create dialog.
 export const $profileCreateRequest = atom(0)
 
 export function requestProfileCreate(): void {
diff --git a/apps/desktop/src/store/project-pins.test.ts b/apps/desktop/src/store/project-pins.test.ts
new file mode 100644
index 0000000000..0eba735fb8
--- /dev/null
+++ b/apps/desktop/src/store/project-pins.test.ts
@@ -0,0 +1,51 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+async function stores() {
+  const pins = await import('./project-pins')
+  const scope = await import('@/lib/connection-scoped')
+
+  return { pins, scope }
+}
+
+describe('project pins', () => {
+  beforeEach(() => {
+    window.localStorage.clear()
+    vi.resetModules()
+  })
+
+  it('persists pins across reloads without mixing local profiles', async () => {
+    const { pins } = await stores()
+
+    pins.toggleProjectPin('default', '/repo/one')
+    pins.toggleProjectPin('research', '/repo/two')
+    expect(pins.pinnedProjectIds('default')).toEqual(['/repo/one'])
+    expect(pins.pinnedProjectIds('research')).toEqual(['/repo/two'])
+
+    vi.resetModules()
+    const reloaded = await stores()
+    expect(reloaded.pins.pinnedProjectIds('default')).toEqual(['/repo/one'])
+    expect(reloaded.pins.pinnedProjectIds('research')).toEqual(['/repo/two'])
+  })
+
+  it('isolates connections and preserves hidden pins when reordering visible projects', async () => {
+    const { pins, scope } = await stores()
+    const first = { mode: 'remote' as const, baseUrl: 'https://first.example', profile: 'default' }
+    const second = { mode: 'remote' as const, baseUrl: 'https://second.example', profile: 'default' }
+
+    scope.rescopeConnectionScopedStores(first)
+    pins.toggleProjectPin('default', 'a')
+    pins.toggleProjectPin('default', 'hidden')
+    pins.toggleProjectPin('default', 'b')
+    pins.reorderPinnedProjects('default', ['a', 'b'])
+    expect(pins.pinnedProjectIds('default')).toEqual(['a', 'hidden', 'b'])
+    pins.transferProjectPin('default', 'hidden', 'p_saved')
+    expect(pins.pinnedProjectIds('default')).toEqual(['a', 'p_saved', 'b'])
+
+    scope.rescopeConnectionScopedStores(second)
+    expect(pins.pinnedProjectIds('default')).toEqual([])
+    pins.toggleProjectPin('default', 'other')
+
+    scope.rescopeConnectionScopedStores(first)
+    expect(pins.pinnedProjectIds('default')).toEqual(['a', 'p_saved', 'b'])
+  })
+})
diff --git a/apps/desktop/src/store/project-pins.ts b/apps/desktop/src/store/project-pins.ts
new file mode 100644
index 0000000000..887db9f453
--- /dev/null
+++ b/apps/desktop/src/store/project-pins.ts
@@ -0,0 +1,75 @@
+import { connectionScopedAtom } from '@/lib/connection-scoped'
+import { Codecs } from '@/lib/persisted'
+
+const PINNED_PROJECTS_KEY = 'hermes.desktop.pinnedProjects'
+
+function sanitizePins(value: unknown): Record<string, string[]> {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return {}
+  }
+
+  return Object.fromEntries(
+    Object.entries(value).filter((entry): entry is [string, string[]] =>
+      Array.isArray(entry[1]) && entry[1].every(id => typeof id === 'string')
+    ).map(([profile, ids]) => [profile, [...new Set(ids.filter(Boolean))]])
+  )
+}
+
+// Project ids belong to a profile's projects.db (auto-project ids are paths).
+// Connection scope separates remote backends; the record also separates local
+// profiles, whose connection-scoped storage key is intentionally shared.
+export const $pinnedProjectIdsByProfile = connectionScopedAtom(
+  PINNED_PROJECTS_KEY,
+  {} as Record<string, string[]>,
+  Codecs.json(sanitizePins)
+)
+
+const profileKey = (profile: string): string => profile.trim() || 'default'
+
+export function pinnedProjectIds(profile: string): string[] {
+  return $pinnedProjectIdsByProfile.get()[profileKey(profile)] ?? []
+}
+
+export function toggleProjectPin(profile: string, id: string): void {
+  const key = profileKey(profile)
+  const current = pinnedProjectIds(key)
+
+  $pinnedProjectIdsByProfile.set({
+    ...$pinnedProjectIdsByProfile.get(),
+    [key]: current.includes(id) ? current.filter(pinned => pinned !== id) : [id, ...current]
+  })
+}
+
+export function transferProjectPin(profile: string, fromId: string, toId: string): void {
+  const key = profileKey(profile)
+  const current = pinnedProjectIds(key)
+
+  if (!current.includes(fromId) || fromId === toId) {
+    return
+  }
+
+  const next = [...new Set(current.map(id => (id === fromId ? toId : id)))]
+
+  $pinnedProjectIdsByProfile.set({ ...$pinnedProjectIdsByProfile.get(), [key]: next })
+}
+
+// A drag only reports visible rows. Re-slot those pins without dropping pins
+// hidden by a filter or temporarily absent from the backend tree.
+export function reorderPinnedProjects(profile: string, visibleOrder: string[]): void {
+  const key = profileKey(profile)
+  const current = pinnedProjectIds(key)
+  const pinned = new Set(current)
+  const moving = visibleOrder.filter(id => pinned.has(id))
+
+  if (moving.length < 2) {
+    return
+  }
+
+  const movingSet = new Set(moving)
+  let index = 0
+  const next = current.map(id => (movingSet.has(id) ? moving[index++] : id))
+
+  if (next.some((id, position) => id !== current[position])) {
+    $pinnedProjectIdsByProfile.set({ ...$pinnedProjectIdsByProfile.get(), [key]: next })
+  }
+}
diff --git a/apps/desktop/src/store/projects.test.ts b/apps/desktop/src/store/projects.test.ts
index 4d49435b46..4e503398f8 100644
--- a/apps/desktop/src/store/projects.test.ts
+++ b/apps/desktop/src/store/projects.test.ts
@@ -4,7 +4,14 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { NO_PROJECT_ID, type SidebarProjectTree } from '@/app/chat/sidebar/projects/workspace-groups'
 import { $sidebarAgentsGrouped, setSidebarAgentsGrouped } from '@/store/layout'
 import { $activeGatewayProfile, $profileScope, ALL_PROFILES, setShowAllProfiles } from '@/store/profile'
-import { $currentCwd, $selectedStoredSessionId, $sessions, applyConfiguredDefaultProjectDir } from '@/store/session'
+import { $pinnedProjectIdsByProfile, pinnedProjectIds, toggleProjectPin } from '@/store/project-pins'
+import {
+  $currentCwd,
+  $selectedStoredSessionId,
+  $sessions,
+  applyConfiguredDefaultProjectDir,
+  commitWorkspaceCwdForSelectedSession
+} from '@/store/session'
 
 import {
   $activeProjectId,
@@ -27,6 +34,7 @@ import {
   refreshWorktrees,
   resolveNewSessionCwd,
   scanAndRecordRepos,
+  setProjectAppearance,
   startWorkInRepo
 } from './projects'
 import {
@@ -184,6 +192,40 @@ describe('projects RPC profile forwarding', () => {
   })
 })
 
+describe('auto project adoption', () => {
+  it('keeps a pin when an appearance change creates a permanent project id', async () => {
+    $activeGatewayProfile.set('default')
+    setShowAllProfiles(false)
+    $projectsRpcAvailable.set(null)
+    $pinnedProjectIdsByProfile.set({})
+
+    const autoId = '/repos/example'
+    const savedId = 'p_example'
+
+    const request = vi.fn(async (method: string) => {
+      if (method === 'projects.create') {
+        return { project: { id: savedId, name: 'Example', primary_path: autoId, folders: [] } }
+      }
+
+      return { active_id: null, projects: [], scoped_session_ids: [] }
+    })
+
+    const gateway = { connectionState: 'open', request }
+    activeGateway.mockReturnValue(gateway as never)
+    gatewayAtom.set(gateway as never)
+    toggleProjectPin('default', autoId)
+
+    await setProjectAppearance(
+      { color: null, icon: null, id: autoId, isAuto: true, label: 'Example', path: autoId },
+      { color: '#c05050' }
+    )
+
+    expect(pinnedProjectIds('default')).toEqual([savedId])
+    expect(request).toHaveBeenCalledWith('projects.create', expect.objectContaining({ profile: 'default' }))
+    $pinnedProjectIdsByProfile.set({})
+  })
+})
+
 describe('resolveNewSessionCwd', () => {
   beforeEach(() => {
     $projectScope.set(ALL_PROJECTS)
@@ -216,6 +258,14 @@ describe('resolveNewSessionCwd', () => {
     expect(resolveNewSessionCwd()).toBe('/home/user/configured')
   })
 
+  it('inherits the selected conversation workspace outside a project scope', () => {
+    $selectedStoredSessionId.set('sess-a')
+    commitWorkspaceCwdForSelectedSession('/home/user/previous-project')
+    applyConfiguredDefaultProjectDir('/home/user/configured')
+
+    expect(resolveNewSessionCwd()).toBe('/home/user/previous-project')
+  })
+
   it('does not inherit the focused session workspace — new chat uses the configured default', () => {
     // Regression for #71873 / #80213: after a restart the focused session is
     // usually the just-resumed one, whose stored cwd can be a stale fallback
diff --git a/apps/desktop/src/store/projects.ts b/apps/desktop/src/store/projects.ts
index 9caab3a116..de449430ff 100644
--- a/apps/desktop/src/store/projects.ts
+++ b/apps/desktop/src/store/projects.ts
@@ -9,6 +9,7 @@ import {
 import type { HermesGitBaseBranch, HermesGitBranch } from '@/global'
 import { getHermesConfig, hermesApi, type HermesGateway } from '@/hermes'
 import { translateNow } from '@/i18n'
+import { activeConnectionScopeSuffix } from '@/lib/connection-scoped'
 import { desktopDefaultCwd, isDesktopFsRemoteMode, selectDesktopPaths, writeDesktopFileText } from '@/lib/desktop-fs'
 import { desktopGit } from '@/lib/desktop-git'
 import { isMissingRestEndpoint, isMissingRpcMethod } from '@/lib/gateway-rpc'
@@ -24,6 +25,7 @@ import {
   normalizeProfileKey,
   requestFreshSession
 } from '@/store/profile'
+import { transferProjectPin } from '@/store/project-pins'
 import {
   $selectedStoredSessionId,
   $sessions,
@@ -138,16 +140,15 @@ export function goToProject(id: string, options?: { newSession?: boolean }): voi
 //
 // Priority (first hit wins):
 //   1. Explicit sidebar project scope (drilled into a project / Home bucket)
-//   2. Configured default project dir (detached otherwise — in BOTH local and
-//      remote mode; a bare new chat never inherits the sticky remembered cwd,
-//      #57911 / #84220)
+//   2. The selected conversation's owned workspace, then the configured
+//      default project dir (detached if neither is available)
 //
 // The "active project" is just an atom ($projectScope) — so inside a project a
 // new session (cmd-n, the trunk "+") starts at that project's root (its primary
-// repo = the default-branch checkout). Outside one it does NOT inherit the chat
-// you were looking at: after a restart that's the just-resumed session, whose
-// stored cwd is often a home-dir fallback, so every new chat landed there
-// instead of the configured default (#71873, #80213, #77496).
+// repo = the default-branch checkout). Outside one it continues in the selected
+// conversation's owned workspace. A detached conversation falls through to the
+// configured default, or to the backend's detached/runtime fallback when that
+// setting is empty.
 export function resolveNewSessionCwd(): string {
   const scope = $projectScope.get()
 
@@ -1014,7 +1015,10 @@ export async function setProjectAppearance(
     return false
   }
 
-  await createProject({
+  const profile = projectProfile()
+  const connectionScope = activeConnectionScopeSuffix()
+
+  const created = await createProject({
     name: project.label,
     folders: [project.path],
     primaryPath: project.path,
@@ -1023,6 +1027,10 @@ export async function setProjectAppearance(
     icon: (patch.icon ?? project.icon) || undefined
   })
 
+  if (created && profile && projectProfile() === profile && activeConnectionScopeSuffix() === connectionScope) {
+    transferProjectPin(profile, project.id, created.id)
+  }
+
   return true
 }
 
diff --git a/apps/desktop/src/store/session-history.test.ts b/apps/desktop/src/store/session-history.test.ts
new file mode 100644
index 0000000000..e8e3ef3f78
--- /dev/null
+++ b/apps/desktop/src/store/session-history.test.ts
@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import type { SessionInfo } from '@/types/hermes'
+
+import { $selectedStoredSessionId, setSessions } from './session'
+import { $sessionHistoryFlags, navigateSessionHistory } from './session-history'
+
+function seedSessions(...ids: string[]): void {
+  setSessions(ids.map(id => ({ id, profile: 'default', title: id }) as unknown as SessionInfo))
+}
+
+function select(id: null | string): void {
+  $selectedStoredSessionId.set(id)
+}
+
+beforeEach(() => {
+  seedSessions('a', 'b', 'c')
+  select(null)
+  select('a')
+  select('b')
+  select('c')
+})
+
+describe('session history stack', () => {
+  /** Real opens change the selection; mirror that so the push-suppression runs. */
+  const open = vi.fn((id: string) => select(id))
+
+  it('tracks back/forward availability', () => {
+    expect($sessionHistoryFlags.get()).toEqual({ canBack: true, canForward: false })
+  })
+
+  it('goes back and forward through visited sessions', () => {
+    navigateSessionHistory(-1, open)
+    expect(open).toHaveBeenCalledWith('b')
+    expect($selectedStoredSessionId.get()).toBe('b')
+    expect($sessionHistoryFlags.get()).toEqual({ canBack: true, canForward: true })
+
+    navigateSessionHistory(1, open)
+    expect(open).toHaveBeenLastCalledWith('c')
+    expect($sessionHistoryFlags.get()).toEqual({ canBack: true, canForward: false })
+  })
+
+  it('does not push when navigation came from the history itself', () => {
+    navigateSessionHistory(-1, open)
+    navigateSessionHistory(1, open)
+
+    // c was reached via forward, not a new visit: no forward entry remains.
+    expect($sessionHistoryFlags.get()).toEqual({ canBack: true, canForward: false })
+  })
+
+  it('truncates the forward tail on a fresh visit', () => {
+    navigateSessionHistory(-2, open)
+    expect(open).toHaveBeenCalledWith('a')
+
+    select('b')
+    expect($sessionHistoryFlags.get()).toEqual({ canBack: true, canForward: false })
+  })
+
+  it('collapses consecutive duplicate selections', () => {
+    select('c')
+    select('c')
+
+    const stackDepth = () => $sessionHistoryFlags.get().canForward
+
+    expect(stackDepth()).toBe(false)
+  })
+
+  it('skips sessions deleted since they were visited', () => {
+    seedSessions('a', 'c')
+    navigateSessionHistory(-1, open)
+    expect(open).toHaveBeenCalledWith('a')
+  })
+})
diff --git a/apps/desktop/src/store/session-history.ts b/apps/desktop/src/store/session-history.ts
new file mode 100644
index 0000000000..e165f53aab
--- /dev/null
+++ b/apps/desktop/src/store/session-history.ts
@@ -0,0 +1,74 @@
+import { atom } from 'nanostores'
+
+import { $selectedStoredSessionId, $sessions, sessionMatchesStoredId } from './session'
+
+// Browser-style back/forward over the main pane's conversation history. Every
+// stored-session switch of the main pane appends to the stack (consecutive
+// dupes collapse; drafts — a null selection — don't enter). Back/forward walks
+// the stack and re-opens through the caller's `open`, suppressed from pushing.
+
+interface SessionHistoryFlags {
+  canBack: boolean
+  canForward: boolean
+}
+
+export const $sessionHistoryFlags = atom<SessionHistoryFlags>({ canBack: false, canForward: false })
+
+// ponytail: hard cap; move to an LRU trim if long-lived sessions ever suffer
+const HISTORY_CAP = 100
+
+let stack: string[] = []
+let index = -1
+let applying = false
+
+function publish(): void {
+  $sessionHistoryFlags.set({ canBack: index > 0, canForward: index < stack.length - 1 })
+}
+
+$selectedStoredSessionId.subscribe(id => {
+  if (applying || !id || stack[index] === id) {
+    return
+  }
+
+  stack = stack.slice(0, index + 1)
+  stack.push(id)
+
+  if (stack.length > HISTORY_CAP) {
+    stack = stack.slice(stack.length - HISTORY_CAP)
+  }
+
+  index = stack.length - 1
+  publish()
+})
+
+/** True while the stored list still knows `id` (deleted rows make dead entries). */
+function sessionLive(id: string): boolean {
+  return $sessions.get().some(session => sessionMatchesStoredId(session, id))
+}
+
+/** Walk `delta` steps (-1 back, +1 forward), skipping sessions deleted since
+ *  they were visited. Opens the first live one through `open`; a no-op when
+ *  nothing live remains in that direction. */
+export function navigateSessionHistory(delta: number, open: (id: string) => void): void {
+  let i = index + delta
+
+  while (i >= 0 && i < stack.length) {
+    const id = stack[i]
+
+    if (sessionLive(id)) {
+      index = i
+      publish()
+      applying = true
+
+      try {
+        open(id)
+      } finally {
+        applying = false
+      }
+
+      return
+    }
+
+    i += delta
+  }
+}
diff --git a/apps/desktop/src/store/session.test.ts b/apps/desktop/src/store/session.test.ts
index 95e436c480..eb990666e3 100644
--- a/apps/desktop/src/store/session.test.ts
+++ b/apps/desktop/src/store/session.test.ts
@@ -815,6 +815,7 @@ describe('workspaceCwdForNewSession', () => {
     applyConfiguredDefaultProjectDir(null)
     $connection.set(null)
     $currentCwd.set('')
+    $selectedStoredSessionId.set(null)
     $activeSessionId.set(null)
     window.localStorage.removeItem('hermes.desktop.workspace-cwd')
     window.localStorage.removeItem('hermes.desktop.workspace-cwd.remote.http%3A%2F%2Fbackend-a.default')
@@ -879,19 +880,19 @@ describe('workspaceCwdForNewSession', () => {
     expect(workspaceCwdForNewSession()).toBe('/home/user/configured')
   })
 
-  it('keeps the configured default separate from a selected workspace', () => {
-    setCurrentCwd('/home/user/repo/.worktrees/feature')
+  it('prefers the selected conversation workspace over the configured default', () => {
+    setSelectedStoredSessionId('session-1')
+    commitWorkspaceCwdForSelectedSession('/home/user/repo/.worktrees/feature')
 
     applyConfiguredDefaultProjectDir('/home/user/configured')
 
-    expect(workspaceCwdForNewSession()).toBe('/home/user/configured')
+    expect(workspaceCwdForNewSession()).toBe('/home/user/repo/.worktrees/feature')
     expect($currentCwd.get()).toBe('/home/user/repo/.worktrees/feature')
   })
 
   it('starts detached (no inherited cwd) when no default project dir is configured', () => {
-    // A bare new chat must NOT inherit the sticky/remembered or live workspace —
-    // that's the "why is my new session already on a branch" bug. Only an
-    // explicit configured default pre-attaches.
+    // A path that is not owned by the selected conversation must not leak into
+    // a new chat. Only an owned previous workspace is inherited.
     window.localStorage.setItem('hermes.desktop.workspace-cwd', '/home/user/sticky')
     $currentCwd.set('/home/user/live')
 
@@ -912,10 +913,8 @@ describe('workspaceCwdForNewSession', () => {
     $currentCwd.set('/live/session/path')
     $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
 
-    // Bare new sessions are intentionally DETACHED across every mode
-    // (#57911): neither sticky local nor sticky remote cwd is an accept-
-    // able bare-default — only an explicit configured default pre-attaches.
-    // The per-backend memory itself stays isolated (asserted directly).
+    // A remembered path alone is not enough to identify the previous
+    // conversation's workspace, so it remains separate from new-chat routing.
     expect(workspaceCwdForNewSession()).toBe('')
 
     setCurrentCwd('/backend/project-a')
@@ -929,8 +928,8 @@ describe('workspaceCwdForNewSession', () => {
     expect(getRememberedWorkspaceCwd()).toBe('/backend/project-b')
     expect(workspaceCwdForNewSession()).toBe('')
 
-    // Back on local with no configured default: a bare new chat is detached and
-    // never reads the remote keys (nor inherits the sticky local workspace).
+    // Back on local with no configured default: an unowned remembered path is
+    // not used as the new-chat workspace.
     $connection.set(null)
     expect(workspaceCwdForNewSession()).toBe('')
   })
@@ -939,9 +938,8 @@ describe('workspaceCwdForNewSession', () => {
     // The reported bug (#77496 / #80213): every session resume used to write
     // the remembered-workspace key — so opening a project chat silently moved
     // the memory. Following a conversation must leave the memory alone.
-    // (Since #57911 a bare new session is detached in remote mode too, so the
-    // memory is asserted directly — its remaining consumer is resume seeding
-    // via ensureDefaultWorkspaceCwd.)
+    // The memory remains separate from the workspace inherited by a selected
+    // conversation; only the latter is eligible for new-chat routing.
     $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
     setCurrentCwd('/backend/picked')
 
@@ -964,16 +962,15 @@ describe('workspaceCwdForNewSession', () => {
     commitWorkspaceCwdForSelectedSession('/backend/last-project')
 
     expect(getRememberedWorkspaceCwd()).toBe('/backend/picked')
-    expect(workspaceCwdForNewSession()).toBe('')
+    expect(workspaceCwdForNewSession()).toBe('/backend/last-project')
   })
 
   it('does not stick a previous remote workspace onto a bare new session (#57911)', () => {
     // Repro: in remote mode the user attaches to project-A so the renderer
     // persists /tradingview as the remembered cwd under the remote key. The
-    // user then presses Cmd+N *without* being scoped into any project. A bare
-    // new session must NOT inherit /tradingview — pre-fix this returned the
-    // sticky remembered cwd and the gateway mapped it back to the wrong
-    // project via project_tree.py.
+    // user then presses Cmd+N *without* being scoped into any project. A
+    // remembered path without an owned selected conversation must not become
+    // the new session workspace.
     $connection.set({ baseUrl: 'http://backend-a', mode: 'remote' } as never)
     setCurrentCwd('/tradingview')
     applyConfiguredDefaultProjectDir(null)
diff --git a/apps/desktop/src/store/session.ts b/apps/desktop/src/store/session.ts
index 6ee99c24af..0d9f75f61d 100644
--- a/apps/desktop/src/store/session.ts
+++ b/apps/desktop/src/store/session.ts
@@ -1509,19 +1509,23 @@ export const setNewChatWorkspaceTarget = (next: NewChatWorkspaceTarget): number
 }
 
 export const workspaceCwdForNewSession = (): string => {
-  // A bare new chat starts DETACHED — no inherited cwd, so the composer's coding
-  // rail (which keys off $currentCwd) shows no branch and the first message runs
-  // in the gateway's default rather than silently in the last repo you touched.
-  // Only an explicit default-project-dir setting pre-attaches. Entering a
-  // project/worktree attaches its cwd directly (startSessionInWorkspace), so the
-  // "remember where I was when I'm in a project" case is unaffected.
-  //
-  // This must behave identically in local and remote mode: the remembered CWD
-  // under the remote-keyed workspaceCwdKey() can be from a *different* project
-  // than the one the user is currently scoped into, and bare-new-session in
-  // the wrong workspace was the #57911 symptom. Resume/restore still reads
-  // the remembered cwd via ensureDefaultWorkspaceCwd (where it remains
-  // remote-keyed and intentionally sticky).
+  // When the user is looking at a conversation with an owned workspace, a bare
+  // new chat should continue in that conversation's directory. The ownership
+  // check matters: a detached conversation can leave the previous path in
+  // `$currentCwd` while its resume is settling, and that path must not leak into
+  // the new session.
+  if ($selectedStoredSessionId.get() && workspaceCwdBelongsToSelectedSession()) {
+    const previousCwd = $currentCwd.get().trim()
+
+    if (previousCwd) {
+      return previousCwd
+    }
+  }
+
+  // No owned workspace is available (for example after opening a detached
+  // conversation or on the first launch), so use the explicit default project
+  // directory. If it is unset, the backend keeps its normal detached/runtime
+  // fallback behavior.
   return getConfiguredDefaultProjectDir()
 }
 
diff --git a/apps/desktop/src/store/titlebar-app-actions.test.ts b/apps/desktop/src/store/titlebar-app-actions.test.ts
index 0ebf92c788..3d6101c49c 100644
--- a/apps/desktop/src/store/titlebar-app-actions.test.ts
+++ b/apps/desktop/src/store/titlebar-app-actions.test.ts
@@ -8,14 +8,14 @@ import {
 } from './titlebar-app-actions'
 
 describe('titlebarAppActionsClusterCounts', () => {
-  it('puts the three app actions on the right by default', () => {
-    expect(titlebarAppActionsClusterCounts('right')).toEqual({ left: 1, right: 5 })
-    expect(titlebarAppActionsClusterCounts('left')).toEqual({ left: 4, right: 2 })
+  it('keeps sidebar and pane-swap left while the two app actions follow the side', () => {
+    expect(titlebarAppActionsClusterCounts('right')).toEqual({ left: 2, right: 3 })
+    expect(titlebarAppActionsClusterCounts('left')).toEqual({ left: 4, right: 1 })
   })
 
   it('adds extras to the cluster they belong to', () => {
-    expect(titlebarAppActionsClusterCounts('right', 1, 2)).toEqual({ left: 2, right: 7 })
-    expect(titlebarAppActionsClusterCounts('left', 1, 2)).toEqual({ left: 5, right: 4 })
+    expect(titlebarAppActionsClusterCounts('right', 1, 2)).toEqual({ left: 3, right: 5 })
+    expect(titlebarAppActionsClusterCounts('left', 1, 2)).toEqual({ left: 5, right: 3 })
   })
 })
 
diff --git a/apps/desktop/src/store/titlebar-app-actions.ts b/apps/desktop/src/store/titlebar-app-actions.ts
index a787549092..2b768a68dd 100644
--- a/apps/desktop/src/store/titlebar-app-actions.ts
+++ b/apps/desktop/src/store/titlebar-app-actions.ts
@@ -4,7 +4,7 @@ export type TitlebarAppActionsSide = 'left' | 'right'
 
 const STORAGE_KEY = 'hermes.desktop.titlebarAppActions'
 
-/** Right is the original titlebar: Settings / Layout / HUD stay off the tab strip. */
+/** Right is the original titlebar: Layout / HUD stay off the tab strip. */
 export const TITLEBAR_APP_ACTIONS_DEFAULT: TitlebarAppActionsSide = 'right'
 
 const codec: Codec<TitlebarAppActionsSide> = {
@@ -22,20 +22,20 @@ export function setTitlebarAppActionsSide(side: TitlebarAppActionsSide) {
   $titlebarAppActionsSide.set(side)
 }
 
-/** Button counts for the two titlebar clusters. Sidebar is always left; flip and
- *  the right-sidebar toggle are always right; the three app actions follow `side`. */
+/** Button counts for the two titlebar clusters. Sidebar and flip are always left;
+ *  the right-sidebar toggle is always right; the two app actions follow `side`. */
 export function titlebarAppActionsClusterCounts(
   side: TitlebarAppActionsSide,
   leftExtras = 0,
   rightExtras = 0
 ): { left: number; right: number } {
-  const sidebar = 1
-  const appActions = 3
-  const rightFixed = 2
+  const leftFixed = 2
+  const appActions = 2
+  const rightFixed = 1
 
   if (side === 'left') {
-    return { left: sidebar + appActions + leftExtras, right: rightFixed + rightExtras }
+    return { left: leftFixed + appActions + leftExtras, right: rightFixed + rightExtras }
   }
 
-  return { left: sidebar + leftExtras, right: appActions + rightFixed + rightExtras }
+  return { left: leftFixed + leftExtras, right: appActions + rightFixed + rightExtras }
 }
diff --git a/apps/desktop/src/store/user-account.test.ts b/apps/desktop/src/store/user-account.test.ts
index 2012005316..24c30a6b01 100644
--- a/apps/desktop/src/store/user-account.test.ts
+++ b/apps/desktop/src/store/user-account.test.ts
@@ -22,7 +22,10 @@ const PROFILE: HermesUserAccountProfile = {
   dataAsOf: 't0'
 }
 
-function installBridge(status: HermesUserAccountStatus) {
+function installBridge(
+  status: HermesUserAccountStatus,
+  loginResult: any = { ok: true, site: 'https://r', profile: PROFILE }
+) {
   const calls = { login: 0, logout: 0, status: 0 }
 
   ;(window as any).hermesDesktop = {
@@ -30,7 +33,7 @@ function installBridge(status: HermesUserAccountStatus) {
       login: vi.fn(async () => {
         calls.login += 1
 
-        return { ok: true, site: 'https://r', profile: PROFILE }
+        return loginResult
       }),
       logout: vi.fn(async () => {
         calls.logout += 1
@@ -84,6 +87,20 @@ test('status 对齐：未登录 / 硬过期 / 在线 / 离线四态', async () =
   void bridge
 })
 
+test('login 离线放行：状态交给 status 的离线分支供（offline + 数据时间）', async () => {
+  const calls = installBridge(
+    { loggedIn: true, site: 'https://r', offline: true, profile: PROFILE, profileAsOf: 't0' },
+    { ok: true, site: 'https://r', profile: PROFILE, offline: true }
+  )
+
+  await userAccountLogin('https://r', 'u@example.com', 'pw')
+  const state = $userAccount.get()
+  assert.equal(state.status, 'signed_in')
+  assert.equal(state.status === 'signed_in' && state.offline, true)
+  assert.equal(state.status === 'signed_in' && state.profileAsOf, 't0')
+  assert.equal(calls.status, 1)
+})
+
 test('logout 回到 signed_out（不带 sessionExpired）', async () => {
   installBridge({ loggedIn: false })
   await userAccountLogin('https://r', 'u@example.com', 'pw')
diff --git a/apps/desktop/src/store/user-account.ts b/apps/desktop/src/store/user-account.ts
index 0eab971ebe..c279adda0d 100644
--- a/apps/desktop/src/store/user-account.ts
+++ b/apps/desktop/src/store/user-account.ts
@@ -3,7 +3,9 @@
  *
  * token 永远在 main 进程；这里只有 profile、登录态与错误码。
  * U-3 离线语义：relay 不可达但本地会话在 → offline:true + 缓存 profile
- * 与数据时间；refresh 过期 = 唯一硬终点 → signed_out(sessionExpired)。
+ * 与数据时间，门放行。服务端判过期**只在在线时**落登录页（离线优先，
+ * 2026-09-24 裁定）：本地会话不再被当场清掉，离线时它仍是放行的凭证。
+ * 离线登入只是把盘上已有的会话解锁回来，不新建会话、不放行登录以外的操作。
  * 登出≠解绑：logout 只清用户会话，机器通道不受这里任何动作影响。
  */
 
@@ -55,7 +57,14 @@ export interface HermesUserAccountProfilePatch {
 export type HermesUserAccountUpdateResult = { ok: true; profile: HermesUserAccountProfile } | { ok: false; code: string }
 
 export type HermesUserAccountLoginResult =
-  | { ok: true; site: string; profile: HermesUserAccountProfile }
+  | {
+      ok: true
+      site: string
+      /** 离线登入回的是盘上会话的缓存资料，可能为 null。 */
+      profile: HermesUserAccountProfile | null
+      /** 断网时用记住的凭据本地校验通过。 */
+      offline?: boolean
+    }
   | { ok: false; code: string; binderEmail?: string | null }
 
 /** 本机绑定状态（§21 DB-T4b/DB-T6）：只含展示字段，凭据绝不出 main。 */
@@ -111,7 +120,7 @@ function bridge() {
   return api
 }
 
-/** 登录表单预填：最近一次成功登录记住的凭据（登出不清；U-6 解绑全清时已抹）。 */
+/** 登录表单预填：最近一次成功登录的凭据（登出保留；对应账号改密及解绑清除）。 */
 export interface RememberedUserAccountLogin {
   site: string
   email: string
@@ -130,6 +139,13 @@ export async function userAccountLogin(site: string, email: string, password: st
     throw new UserAccountFailure(result.code, result.binderEmail ?? null)
   }
 
+  if (result.offline) {
+    // 离线登入：profile/数据时间/离线标记统一由 status 的离线分支供，避免两个真源。
+    await userAccountRefreshStatus()
+
+    return
+  }
+
   $userAccount.set({ status: 'signed_in', site: result.site, offline: false, profile: result.profile, profileAsOf: null })
   // DB-T6：登录后 main 已自动绑定；把绑定态（机器码/pending/失败码）拉进 store 供卡片角标。
   void userAccountBindingStatus().catch(() => {})
diff --git a/apps/desktop/src/styles.css b/apps/desktop/src/styles.css
index 40650454dd..eb14c2877f 100644
--- a/apps/desktop/src/styles.css
+++ b/apps/desktop/src/styles.css
@@ -505,10 +505,9 @@
     --composer-ring-strength: 1;
     --composer-surface-pad-x: 0.5rem;
     --composer-surface-pad-y: 0.3125rem;
-    --composer-input-min-height: 1.625rem;
-    --composer-input-max-height: 9.375rem;
-    --composer-input-inline-min-width: 8rem;
-    --composer-fallback-height: 2.75rem;
+    --composer-input-min-height: 2.25rem;
+    --composer-input-max-height: 12rem;
+    --composer-fallback-height: 4.5rem;
     --composer-measured-height: calc(0.5rem + var(--composer-shell-pad-block-end) + var(--composer-fallback-height));
     --composer-surface-measured-height: var(--composer-fallback-height);
     --thread-viewport-height: max(
diff --git a/apps/desktop/src/types/hermes.ts b/apps/desktop/src/types/hermes.ts
index 30780c322c..5bae6243d3 100644
--- a/apps/desktop/src/types/hermes.ts
+++ b/apps/desktop/src/types/hermes.ts
@@ -1,4 +1,4 @@
-import type { ConnectionRequestPayload } from '@hermes/shared'
+import type { ConnectionRequestPayload, ModelPricing } from '@hermes/shared'
 
 export interface ConfigFieldSchema {
   category?: string
@@ -256,12 +256,20 @@ export interface CustomEndpointUpdate {
   model: string
   models?: string[]
   name: string
+  /** Ask the endpoint what this key's models cost (sub2api's own key-pricing API). */
+  with_pricing?: boolean
 }
 
 export interface CustomEndpointValidationResponse {
   message: string
   models: string[]
   ok: boolean
+  /** Present only when the probe asked for pricing (`with_pricing`): $/Mtok, same formatting
+   *  as the picker's price columns. */
+  pricing?: Record<string, ModelPricing>
+  /** The key's effective group multiplier; the prices above already include it. 0 = unknown
+   *  (not a sub2api endpoint, or one that reports none). */
+  rate_multiplier?: number
   reachable: boolean
 }
 
diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py
index cd7f6136d1..f6eb7e541b 100644
--- a/hermes_cli/auth.py
+++ b/hermes_cli/auth.py
@@ -1226,11 +1226,11 @@ def _get_config_hint_for_unknown_provider(provider_name: str) -> str:
 
 
 def _refuse_env_adoption_if_config_corrupt() -> None:
-    """Refuse env-key/pool auto-adoption of openrouter while config.yaml is corrupt.
+    """Refuse implicit provider selection while config.yaml is corrupt.
 
-    A corrupt config loads as ``DEFAULT_CONFIG`` (no ``model.provider``), so the env sniff would
-    silently adopt the PAID openrouter provider over whatever the broken config really names.
-    Fires ONLY on the auto path and clears itself once the file parses again."""
+    A corrupt config loads as ``DEFAULT_CONFIG``. Neither that product default nor an env/pool
+    candidate may replace whatever route the broken file really names. Fires only on the auto path
+    and clears itself once the file parses again."""
     try:
         from hermes_cli.config import get_active_config_parse_failure
         err = get_active_config_parse_failure()
@@ -1242,7 +1242,7 @@ def _refuse_env_adoption_if_config_corrupt() -> None:
         return
     raise AuthError(
         f"config.yaml at {path} is corrupt ({err}) — refusing to auto-select "
-        f"an inference provider from environment keys. Fix the YAML (a backup "
+        f"an inference provider. Fix the YAML (a backup "
         f"was saved next to it) or run hermes setup.",
         code="corrupt_config")
 
@@ -1373,6 +1373,30 @@ def _config_model_provider() -> Tuple[Any, Optional[str]]:
         provider = model_cfg.get("provider") if isinstance(model_cfg, dict) else None
         provider = provider.strip().lower() if isinstance(provider, str) else ""
         provider = _plugin_aliases().get(provider, provider)
+
+        # ``resolve_requested_provider()`` owns the product default and passes it to us as an
+        # explicit request. Direct ``resolve_provider("auto")`` callers, however, intentionally
+        # ask for credential discovery. Do not turn DEFAULT_CONFIG's FreeModel2API route into an
+        # explicit pin here unless that same provider was actually written by the user or the
+        # managed scope. This preserves ``model.provider: auto`` and the existing env/pool probes.
+        from hermes_cli.config_defaults import DEFAULT_CONFIG
+        if model_cfg == DEFAULT_CONFIG.get("model"):
+            from hermes_cli.config import read_raw_config
+            from hermes_cli import managed_scope
+
+            raw_configs = (read_raw_config() or {}, managed_scope.load_managed_config() or {})
+
+            def _declared_provider(config: Any) -> str:
+                if not isinstance(config, dict):
+                    return ""
+                raw_model = config.get("model")
+                if isinstance(raw_model, dict):
+                    return str(raw_model.get("provider") or "").strip()
+                return str(config.get("provider") or "").strip()
+
+            if not any(_declared_provider(config) for config in raw_configs):
+                provider = ""
+
         if provider == "custom" or provider.startswith("custom:"):
             return model_cfg, "custom"
         if provider in PROVIDER_REGISTRY:
@@ -1456,12 +1480,14 @@ def resolve_provider(
         return "openrouter"
 
     _model_cfg, cfg_provider = _config_model_provider()
+    # The config read above records parse failures. From this point every choice is implicit, so a
+    # broken file must block the whole auto chain (product default, env keys, pools, OAuth and AWS).
+    _refuse_env_adoption_if_config_corrupt()
     if cfg_provider:
         return cfg_provider
 
     _scoped_key_env = _scoped_key_env_reader()
     if _openrouter_auto_detected(_scoped_key_env):
-        _refuse_env_adoption_if_config_corrupt()
         return "openrouter"
 
     # Determined up front so the env-key tier can warn when an exported key preempts it; the actual
@@ -1836,7 +1862,10 @@ def _provider_env_base_url(pconfig: ProviderConfig) -> str:
             configured_url = str(model.get("base_url") or "").strip()
             if configured_url:
                 return configured_url
-    return os.getenv(pconfig.base_url_env_var, "").strip() if pconfig.base_url_env_var else ""
+    if not pconfig.base_url_env_var:
+        return ""
+    from hermes_cli.config import get_env_value_prefer_dotenv
+    return (get_env_value_prefer_dotenv(pconfig.base_url_env_var) or "").strip()
 
 
 def _provider_is_keyless(provider_id: str) -> bool:
diff --git a/hermes_cli/config_defaults.py b/hermes_cli/config_defaults.py
index 0c8a6f363c..81107fa459 100644
--- a/hermes_cli/config_defaults.py
+++ b/hermes_cli/config_defaults.py
@@ -19,7 +19,10 @@ def _aux(timeout, *, reasoning_effort=True, **extra):
 
 
 DEFAULT_CONFIG = {
-    "model": "",
+    # FreeModel2API is the default inference route. Its endpoint and credential remain profile-scoped
+    # and must be configured before the route is usable; setup selects the concrete model from that
+    # key's live catalog.
+    "model": {"provider": "freemodel2api", "default": ""},
     "providers": {},
     "fallback_providers": [],
     "credential_pool_strategies": {},
diff --git a/hermes_cli/config_providers.py b/hermes_cli/config_providers.py
index 80f07823e4..144ce3bd8c 100644
--- a/hermes_cli/config_providers.py
+++ b/hermes_cli/config_providers.py
@@ -114,6 +114,11 @@ _KNOWN_PROVIDER_KEYS = {
     # ``provider`` duplicates the ``providers.<name>`` mapping key and is unused here, but Hermes'
     # own config writer has historically emitted it. Accept it so self-written configs don't warn.
     "provider",
+    # ``key_id`` is Desktop settings bookkeeping, not runtime config: the FreeModel2API panel
+    # records which of the account's keys it last wrote into that provider's env slot so the
+    # dropdown reopens on the right one (the secret itself stays in ``.env``). Same rationale as
+    # ``provider`` above — written by our own UI, so don't warn.
+    "key_id",
     "name", "api", "url", "base_url", "api_key", "key_env", "api_key_env", "key_cmd",
     "api_mode", "transport", "model", "default_model", "models", "models_discovered",
     "context_length", "rate_limit_delay", "request_timeout_seconds", "stale_timeout_seconds",
diff --git a/hermes_cli/inventory.py b/hermes_cli/inventory.py
index e2b576895d..63366e9091 100644
--- a/hermes_cli/inventory.py
+++ b/hermes_cli/inventory.py
@@ -384,14 +384,19 @@ def _apply_custom_aliases(rows: list[dict]) -> None:
 # ─── Internal: row post-processing ──────────────────────────────────────
 
 
-def _provider_auth_hint(slug: str) -> tuple[str, str]:
-    """``(auth_type, key_env)`` for a canonical provider (``("api_key", "")`` when unregistered)."""
+def _provider_auth_hint(slug: str) -> tuple[str, str, str]:
+    """``(auth_type, key_env, base_url_env)`` for a canonical provider (``("api_key", "", "")``
+    when unregistered). ``base_url_env`` is set only for per-install endpoints — a provider whose
+    registry entry ships no default ``inference_base_url`` (freemodel2api): an optional
+    base-URL override on a provider that already has one is a power-user knob, not a second
+    required form field."""
     from hermes_cli.auth import PROVIDER_REGISTRY
 
     cfg = PROVIDER_REGISTRY.get(slug)
     auth_type = cfg.auth_type if cfg else "api_key"
     key_env = cfg.api_key_env_vars[0] if (cfg and cfg.api_key_env_vars) else ""
-    return auth_type, key_env
+    base_url_env = (cfg.base_url_env_var if cfg and not cfg.inference_base_url else "") or ""
+    return auth_type, key_env, base_url_env
 
 
 def _row(slug: str, name: str, is_current: bool, **extra: Any) -> dict:
@@ -423,7 +428,7 @@ def _append_unconfigured_rows(
             continue
         if entry.slug.lower() == cur:
             saved_model = "" if _model_requires_account_discovery(entry.slug, cur_model) else cur_model
-            auth_type, key_env = _provider_auth_hint(entry.slug)
+            auth_type, key_env, base_url_env = _provider_auth_hint(entry.slug)
             tail = (
                 "Astra requires successful account-scoped model discovery."
                 if cur_model and not saved_model else "Showing the saved model only."
@@ -436,7 +441,7 @@ def _append_unconfigured_rows(
             extras.append(_canonical_row(
                 entry, cur, models=[saved_model] if saved_model else [], total_models=1 if saved_model else 0,
                 source="configured-current", authenticated=False, auth_type=auth_type, key_env=key_env,
-                warning=warning,
+                base_url_env=base_url_env or None, warning=warning,
             ))
             continue
         extras.append(_canonical_row(entry, cur, models=[], total_models=0, source="canonical"))
@@ -444,13 +449,14 @@ def _append_unconfigured_rows(
 
 
 def _anthropic_oauth_credentials_present() -> bool:
-    """True when the user explicitly authenticated Anthropic via OAuth (Hermes device flow or Claude Code
-    login) — those leave no trace in active_provider / model.provider / API-key env vars."""
+    """True when the user explicitly authenticated Anthropic via Hermes' own OAuth (device flow) —
+    it leaves no trace in active_provider / model.provider / API-key env vars. Borrowed Claude Code
+    login state (~/.claude) deliberately does NOT count: desktop pickers show only credentials
+    this project manages."""
     try:
-        from agent.anthropic_credentials import read_claude_code_credentials, read_hermes_oauth_credentials
+        from agent.anthropic_credentials import read_hermes_oauth_credentials
 
-        readers = (read_hermes_oauth_credentials, read_claude_code_credentials)
-        if any((read() or {}).get("accessToken") for read in readers):
+        if (read_hermes_oauth_credentials() or {}).get("accessToken"):
             return True
     except Exception:
         return False
@@ -490,10 +496,10 @@ def _filter_explicit_provider_rows(rows: list[dict], ctx: ConfigContext) -> list
             return _raw_config_has_enabled_moa_preset()
         return (
             _provider_is_keyless(slug)  # zero-setup providers need no configuration at all
-            # Anthropic OAuth (device flow / Claude Code) and external-process CLIs (copilot-acp) are
-            # deliberate sign-ins that leave no trace in config/env; keep the rows discovery accepted.
+            # Project-managed credentials only: Hermes' own Anthropic OAuth (device flow). Borrowed
+            # sign-ins — Claude Code files, external-process CLIs like gh → copilot — are ambient
+            # system state, not this project's config, and must not surface a row.
             or (slug == "anthropic" and _anthropic_oauth_credentials_present())
-            or _external_process_signed_in(slug)
             or is_provider_explicitly_configured(slug)
         )
 
@@ -501,17 +507,6 @@ def _filter_explicit_provider_rows(rows: list[dict], ctx: ConfigContext) -> list
             if (slug := str(row.get("slug", "")).strip().lower()) and _is_explicit(row, slug)]
 
 
-def _external_process_signed_in(slug: str) -> bool:
-    """True when an external-process provider has verified CLI credentials."""
-    try:
-        from hermes_cli.auth import PROVIDER_REGISTRY, get_external_process_provider_status
-        pconfig = PROVIDER_REGISTRY.get(slug)
-        return bool(pconfig and pconfig.auth_type == "external_process"
-                    and get_external_process_provider_status(slug).get("auth_verified"))
-    except Exception:
-        return False
-
-
 def _provider_is_keyless(slug: str) -> bool:
     """True when the provider's Hermes overlay declares it keyless."""
     try:
@@ -558,9 +553,11 @@ def _apply_picker_hints(rows: list[dict]) -> None:
         row["authenticated"] = not is_skeleton
         if not is_skeleton or row.get("is_user_defined"):
             continue
-        auth_type, key_env = _provider_auth_hint(row["slug"])
+        auth_type, key_env, base_url_env = _provider_auth_hint(row["slug"])
         row["auth_type"] = auth_type
         row["key_env"] = key_env
+        if base_url_env:
+            row["base_url_env"] = base_url_env
         row["warning"] = (f"paste {key_env} to activate" if auth_type == "api_key" and key_env
                           else f"run `hermes model` to configure ({auth_type})")
 
@@ -584,6 +581,8 @@ def _apply_pricing(rows: list[dict], *, force_fresh_nous_tier: bool = False, cac
     from hermes_cli.models_pricing import (
         _format_price_per_mtok,
         compute_sale_discount,
+        format_pricing_entry,
+        get_custom_endpoint_pricing,
         get_pricing_for_provider,
     )
     from hermes_cli.models import (
@@ -606,6 +605,12 @@ def _apply_pricing(rows: list[dict], *, force_fresh_nous_tier: bool = False, cac
         try:
             pricing_kwargs = {"cached_only": True} if cached_only else {}
             raw_pricing = get_pricing_for_provider(slug, **pricing_kwargs) or {}
+            # A user-defined endpoint prices itself: no whitelist entry can know its upstream, so
+            # ask the endpoint (sub2api's key-pricing API) rather than a canonical catalog.
+            if not raw_pricing and row.get("is_user_defined") and row.get("api_url"):
+                raw_pricing = get_custom_endpoint_pricing(
+                    str(row.get("slug") or ""), str(row["api_url"]),
+                    force_refresh=not cached_only, cached_only=cached_only) or {}
         except Exception:
             raw_pricing = {}
         cached_nous_tier: Optional[bool] = None
@@ -632,15 +637,8 @@ def _apply_pricing(rows: list[dict], *, force_fresh_nous_tier: bool = False, cac
             p = raw_pricing.get(mid)
             if not p:
                 continue
+            entry: dict = format_pricing_entry(p)
             inp_raw, out_raw = p.get("prompt", ""), p.get("completion", "")
-            cache_raw = p.get("input_cache_read", "")
-            inp = _format_price_per_mtok(inp_raw) if inp_raw != "" else ""
-            out = _format_price_per_mtok(out_raw) if out_raw != "" else ""
-            entry: dict = {
-                "input": inp, "output": out,
-                "cache": _format_price_per_mtok(cache_raw) if cache_raw else None,
-                "free": inp == "free" and out in ("free", ""),  # both input and output cost nothing
-            }
             # Sale chrome is Nous Portal-only (other catalogs' nested pricing.original is ignored); free
             # models get flat -100% chrome, was_* only when the gateway served an original.
             if slug == "nous":
diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 8a81c187ac..f3747042f3 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -1023,9 +1023,15 @@ def _has_any_provider_configured(*, strict_profile_scope: bool = False) -> bool:
             from hermes_cli.config import split_model_config_default
             _model_name, _ = split_model_config_default(_model_name)
     _model_name = str(_model_name).strip()
+    _default_model_cfg = DEFAULT_CONFIG.get("model")
+    _default_model_name = (
+        _default_model_cfg.get("default") or ""
+        if isinstance(_default_model_cfg, dict)
+        else _default_model_cfg or ""
+    )
     # "Explicitly configured" = model differs from the hardcoded default; gates
     # Claude Code credentials so they don't skip setup on a fresh install.
-    _has_hermes_config = _model_name and _model_name != DEFAULT_CONFIG.get("model", "")
+    _has_hermes_config = _model_name and _model_name != str(_default_model_name).strip()
 
     # Env vars (.env or shell). OPENAI_BASE_URL alone counts — local models
     # (vLLM, llama.cpp) often need no API key.
@@ -1056,12 +1062,20 @@ def _has_any_provider_configured(*, strict_profile_scope: bool = False) -> bool:
     if _auth_store_logged_in(get_hermes_home() / "auth.json", PROVIDER_REGISTRY, strict_profile_scope):
         return True
 
-    # model as a dict with provider/base_url/api_key means setup ran (fresh
-    # installs have a plain string); also covers custom endpoints kept in config.
-    if isinstance(model_cfg, dict) and any(
-        (model_cfg.get(k) or "").strip() for k in ("provider", "base_url", "api_key")
-    ):
-        return True
+    # A non-default provider or an inline endpoint/key means setup ran. The product default itself
+    # does not: a fresh install now has ``model.provider: freemodel2api`` but is unusable until its
+    # profile-scoped API key and base URL are saved (the env checks above cover that moment).
+    if isinstance(model_cfg, dict):
+        _provider = str(model_cfg.get("provider") or "").strip()
+        _default_provider = (
+            str(_default_model_cfg.get("provider") or "").strip()
+            if isinstance(_default_model_cfg, dict)
+            else ""
+        )
+        if any(str(model_cfg.get(k) or "").strip() for k in ("base_url", "api_key")):
+            return True
+        if _provider and _provider != _default_provider:
+            return True
 
     # Provider-specific auth fallbacks (e.g. Copilot via gh auth).
     if not strict_profile_scope:
diff --git a/hermes_cli/model_switch_providers.py b/hermes_cli/model_switch_providers.py
index 18cbdcbd84..4ead4396ce 100644
--- a/hermes_cli/model_switch_providers.py
+++ b/hermes_cli/model_switch_providers.py
@@ -674,7 +674,8 @@ class _PickerBuild:
         pcfg = PROVIDER_REGISTRY.get(slug)
         if not pcfg:
             return
-        url = os.environ.get(pcfg.base_url_env_var, "") if getattr(pcfg, "base_url_env_var", "") else ""
+        from hermes_cli.model_switch import _scoped_key_env
+        url = _scoped_key_env(pcfg.base_url_env_var) if getattr(pcfg, "base_url_env_var", "") else ""
         normed = _norm_url(url or getattr(pcfg, "inference_base_url", "") or "")
         if normed:
             self.builtin_endpoints.add(normed)
@@ -852,9 +853,10 @@ def _lap_overlay_rows(b: _PickerBuild, data: dict) -> None:
         b.seen_slugs.add(pid.lower())
 
 
-def _lap_canonical_rows(b: _PickerBuild) -> None:
+def _lap_canonical_rows(b: _PickerBuild, user_providers: dict) -> None:
     """Section 2b: CANONICAL_PROVIDERS missed by sections 1/2."""
     from hermes_cli.auth import PROVIDER_REGISTRY
+    from hermes_cli.model_switch import _declared_model_ids
     from hermes_cli.models import CANONICAL_PROVIDERS
     for cp in CANONICAL_PROVIDERS:
         if _skip(b.seen_slugs, b.excluded, cp.slug):
@@ -862,7 +864,8 @@ def _lap_canonical_rows(b: _PickerBuild) -> None:
         cp_config = PROVIDER_REGISTRY.get(cp.slug)
         has_creds = False
         if cp_config and cp_config.api_key_env_vars:
-            lit = {ev for ev in cp_config.api_key_env_vars if os.environ.get(ev)}
+            from hermes_cli.model_switch import _scoped_key_env
+            lit = {ev for ev in cp_config.api_key_env_vars if _scoped_key_env(ev)}
             has_creds = bool(lit)
             # A regional "-cn" twin lit only by key vars shared with its non-CN sibling is a
             # phantom row: hide it unless it is the current provider, and only when it has a
@@ -879,6 +882,16 @@ def _lap_canonical_rows(b: _PickerBuild) -> None:
             model_ids = _aws_live_or_curated_ids(cp.slug, b.curated)
         else:
             model_ids = _live_or_curated_ids(cp.slug, b.curated, merge_models_dev=False)
+        # A providers.<canonical>.models block owns this row's allow-list: discover_models:false pins
+        # the row to exactly that subset (the FreeModel2API panel's picker whitelist), otherwise the
+        # declared ids extend the discovered catalog. Section 3 cannot do either — seen_slugs.
+        configured = user_providers.get(cp.slug) if isinstance(user_providers, dict) else None
+        if isinstance(configured, dict):
+            declared = _declared_model_ids(configured.get("models"))
+            if not _discover_flag(configured):
+                model_ids = declared
+            else:
+                model_ids = list(dict.fromkeys([*declared, *model_ids]))
         b.add_builtin_row(
             cp.slug, cp.label, cp.slug == b.current_provider, model_ids, "canonical", uncapped_ok=False)
 
@@ -1142,7 +1155,7 @@ def list_authenticated_providers(
 
     _lap_builtin_rows(b, data, user_providers)
     _lap_overlay_rows(b, data)
-    _lap_canonical_rows(b)
+    _lap_canonical_rows(b, user_providers)
     if user_providers and isinstance(user_providers, dict):
         _lap_user_provider_rows(b, user_providers)
     _lap_bare_custom_row(b, custom_providers)
diff --git a/hermes_cli/models.py b/hermes_cli/models.py
index 9ac946d85c..c7d9906d58 100644
--- a/hermes_cli/models.py
+++ b/hermes_cli/models.py
@@ -1428,6 +1428,9 @@ _PROVIDER_CATALOG_FETCHERS: dict[str, Any] = {
     "nous": _nous_catalog,
     "stepfun": _api_key_provider_live,
     "gmi": _api_key_provider_live,
+    # The saved key decides which models exist, so the list is always the live probe — there is no
+    # static catalog to fall back to (the profile ships fallback_models=()).
+    "freemodel2api": _api_key_provider_live,
     "anthropic": _anthropic_catalog,
     "ai-gateway": lambda normalized, force_refresh: _fetch_ai_gateway_models() or None,
     # DeepInfra's generic /models mixes chat, image, video, speech and embedding models; the tagged
diff --git a/hermes_cli/models_pricing.py b/hermes_cli/models_pricing.py
index a87652fea9..5f391afec4 100644
--- a/hermes_cli/models_pricing.py
+++ b/hermes_cli/models_pricing.py
@@ -404,6 +404,39 @@ def _fetch_nous_pricing_for_provider(*, force_refresh: bool = False) -> dict[str
     return _fetch_nous_pricing(api_key, base_url, force_refresh=force_refresh)
 
 
+def _freemodel2api_credentials() -> tuple[str, str]:
+    """``(base_url, api_key)`` for the FreeModel2API provider; ``("", "")`` when unconfigured.
+
+    The provider is registered from ``plugins/model-providers/freemodel2api/``, so both values come
+    from its own env slots rather than a ``providers:`` entry.
+    """
+    from hermes_cli.auth import resolve_api_key_provider_credentials
+
+    try:
+        creds = resolve_api_key_provider_credentials("freemodel2api")
+    except Exception:
+        return "", ""
+    return str(creds.get("base_url") or "").rstrip("/"), str(creds.get("api_key") or "")
+
+
+def _freemodel2api_pricing_scope() -> str:
+    """Endpoint identity for the prewarm single-flight key: a base_url rotation must start a new
+    worker instead of joining the previous endpoint's in-flight fetch."""
+    return _freemodel2api_credentials()[0]
+
+
+def _fetch_freemodel2api_pricing(*, force_refresh: bool = False) -> dict[str, dict[str, str]]:
+    """FreeModel2API is a self-hosted sub2api instance: the row prices itself from the same
+    key-pricing API billing uses (``_fetch_sub2api_endpoint_pricing``), scaled by that key's rate."""
+    base_url, api_key = _freemodel2api_credentials()
+    if not (base_url and api_key):
+        return {}
+    # Must match the cache key _fetch_sub2api_endpoint_pricing computes internally, else the
+    # cached-only read a picker open performs would miss everything the prewarm just fetched.
+    _remember_provider_cache_key("freemodel2api", _sub2api_cache_key(base_url, api_key))
+    return _fetch_sub2api_endpoint_pricing(base_url, api_key, force_refresh=force_refresh)
+
+
 _OPENROUTER_PRICING_BASE = "https://openrouter.ai/api"
 _FIREWORKS_PRICING_KEY = "models.dev/fireworks"
 
@@ -437,6 +470,7 @@ _STATIC_PRICING_SCOPES = {
     "ai-gateway": _ai_gateway_pricing_scope,
     "novita": _novita_pricing_scope,
     "fireworks": lambda: _FIREWORKS_PRICING_KEY,
+    "freemodel2api": _freemodel2api_pricing_scope,
 }
 
 
@@ -581,6 +615,151 @@ def _fetch_deepinfra_pricing(timeout: float = 5.0, *, force_refresh: bool = Fals
     return result
 
 
+def _custom_endpoint_api_key(slug: str) -> str:
+    """The key a user-defined endpoint row authenticates with: its config entry's ``key_env`` read
+    through the profile secret scope (the same chain the model-discovery probe uses), else a legacy
+    inline ``api_key``. Anything unresolvable → ``""`` and the row simply goes unpriced."""
+    from hermes_cli.config import custom_endpoint_key_env, load_config_readonly
+    from hermes_cli.model_switch import _scoped_key_env
+
+    identity = str(slug or "").strip()
+    if identity.lower().startswith("custom:"):
+        identity = identity.split(":", 1)[1]
+    if not identity:
+        return ""
+
+    entry: Any = None
+    try:
+        cfg = load_config_readonly()
+        providers = cfg.get("providers")
+        if isinstance(providers, dict):
+            entry = providers.get(identity)
+        if not isinstance(entry, dict):
+            entry = next(
+                (c for c in cfg.get("custom_providers") or []
+                 if isinstance(c, dict) and str(c.get("name") or "").strip() == identity),
+                None)
+    except Exception:
+        entry = None
+
+    if isinstance(entry, dict):
+        if key := _scoped_key_env(str(entry.get("key_env") or "").strip()):
+            return key
+        # A legacy plaintext key, or an env-var reference config.yaml mirrors (``${...}``).
+        inline = str(entry.get("api_key") or "").strip()
+        if inline and not inline.startswith("$"):
+            return inline
+    return _scoped_key_env(custom_endpoint_key_env(identity))
+
+
+def _sub2api_cache_key(base_url: str, api_key: str) -> str:
+    """One identity per (endpoint, credential) for both the price map and the rate multiplier."""
+    return _strip_v1((base_url or "").rstrip("/")) + "/sub2api/pricing" + _pricing_auth_fingerprint(api_key)
+
+
+# 生效倍率本身不落缓存:价格里已经乘过它,只有面板「测试」那一行要数字。本进程取过才有值。
+_RATE_MULTIPLIERS: dict[str, float] = {}
+
+
+def format_pricing_entry(raw: dict) -> dict:
+    """One provider's raw per-token price row → the $/Mtok entry the picker and the settings panel
+    render. Shared so a probe outside the picker shows the same numbers, formatted the same way."""
+    inp_raw, out_raw = raw.get("prompt", ""), raw.get("completion", "")
+    cache_raw = raw.get("input_cache_read", "")
+    inp = _format_price_per_mtok(inp_raw) if inp_raw != "" else ""
+    out = _format_price_per_mtok(out_raw) if out_raw != "" else ""
+    return {
+        "input": inp, "output": out,
+        "cache": _format_price_per_mtok(cache_raw) if cache_raw else None,
+        "free": inp == "free" and out in ("free", ""),  # both input and output cost nothing
+    }
+
+
+def sub2api_rate_multiplier(base_url: str, api_key: str) -> float:
+    """该 key 的生效组倍率;``0.0`` 表示本进程还没取过这次 (endpoint, key) 的价格 ——
+    刻意不为了一行 UI 再打一次网络,价格里本来就已经乘过它了。"""
+    return _RATE_MULTIPLIERS.get(_sub2api_cache_key(base_url, api_key), 0.0)
+
+
+def sub2api_endpoint_probe_pricing(base_url: str, api_key: str) -> dict:
+    """Settings panel's 「测试所选 key」: this key's models on *base_url*, priced in $/Mtok the same
+    way the picker prices them, plus the effective rate multiplier (``0.0`` = 未知 / 不是 sub2api)。
+    一次性实拉:测试按钮要的就是当下这一个答案,不读缓存。"""
+    try:
+        raw = _fetch_sub2api_endpoint_pricing(base_url, api_key, force_refresh=True)
+    except Exception:
+        raw = {}
+    return {
+        "pricing": {mid: format_pricing_entry(entry) for mid, entry in (raw or {}).items()},
+        "rate_multiplier": sub2api_rate_multiplier(base_url, api_key),
+    }
+
+
+def _fetch_sub2api_endpoint_pricing(
+    base_url: str, api_key: str, timeout: float = 5.0, *, force_refresh: bool = False
+) -> dict[str, dict[str, str]]:
+    """sub2api (FreeModel2API) ``/<root>/v1/sub2api/pricing`` — the key's own group prices, resolved
+    on the same chain billing charges from (group card → channel → LiteLLM → fallback), so what the
+    picker shows is what that key actually pays. Per-token USD, scaled by the key's effective rate
+    multiplier, → the picker's per-token strings. Cached per endpoint + credential; an endpoint that
+    is not a sub2api instance 404s or answers non-JSON, which caches as empty rather than erroring.
+    """
+    from hermes_cli.models import _HERMES_USER_AGENT
+
+    root = _strip_v1((base_url or "").rstrip("/"))
+    if not root or not api_key:
+        return {}
+
+    cache_key = _sub2api_cache_key(base_url, api_key)
+    if not force_refresh:
+        cached = _cached_catalog(cache_key)
+        if cached is not None:
+            return cached
+
+    headers = {"Authorization": f"Bearer {api_key}", "Accept": "application/json", "User-Agent": _HERMES_USER_AGENT}
+    payload = _get_json(root + "/v1/sub2api/pricing", headers, timeout)
+    if not isinstance(payload, dict):
+        # ponytail: one probe per custom endpoint per _FAILED_CATALOG_TTL_SECONDS. Gate on a
+        # sub2api marker if a future config grows many non-sub2api endpoints.
+        return _cache_catalog(cache_key, {})
+
+    rate = 1.0
+    multiplier = payload.get("rate_multiplier")
+    if isinstance(multiplier, dict):
+        rate = _price_float(multiplier.get("effective_rate_multiplier"), positive=False) or 1.0
+    _RATE_MULTIPLIERS[cache_key] = rate
+
+    result: dict[str, dict[str, str]] = {}
+    for item in payload.get("models") or []:
+        name, pricing = (item.get("name"), item.get("pricing")) if isinstance(item, dict) else (None, None)
+        # "unavailable" and per-request modes carry no per-token rate to show.
+        if not name or not isinstance(pricing, dict) or pricing.get("billing_mode") != "token":
+            continue
+        entry: dict[str, str] = {}
+        for theirs, ours in (("input_price", "prompt"), ("output_price", "completion"),
+                             ("cache_read_price", "input_cache_read")):
+            value = _price_float(pricing.get(theirs), positive=False)
+            if value is not None:
+                entry[ours] = str(value * rate)
+        if entry:
+            result[str(name)] = entry
+    return _cache_catalog(cache_key, result)
+
+
+def get_custom_endpoint_pricing(
+    slug: str, base_url: str, *, force_refresh: bool = False, cached_only: bool = False
+) -> dict[str, dict[str, str]]:
+    """Picker pricing for a user-defined endpoint whose upstream speaks sub2api's key-pricing API;
+    ``{}`` for every other endpoint. ``cached_only`` never starts I/O — picker opens read what the
+    background prewarm already fetched."""
+    if not base_url:
+        return {}
+    api_key = _custom_endpoint_api_key(slug)
+    if cached_only:
+        return _cached_catalog(_sub2api_cache_key(base_url, api_key)) or {}
+    return _fetch_sub2api_endpoint_pricing(base_url, api_key, force_refresh=force_refresh)
+
+
 _PRICING_FETCHERS = {
     "openrouter": _fetch_openrouter_pricing,
     "ai-gateway": _fetch_ai_gateway_pricing_for_provider,
@@ -588,4 +767,5 @@ _PRICING_FETCHERS = {
     "deepinfra": _fetch_deepinfra_pricing,
     "fireworks": _fetch_fireworks_pricing_for_provider,
     "nous": _fetch_nous_pricing_for_provider,
+    "freemodel2api": _fetch_freemodel2api_pricing,
 }
diff --git a/hermes_cli/providers.py b/hermes_cli/providers.py
index 54380eb718..022cccb179 100644
--- a/hermes_cli/providers.py
+++ b/hermes_cli/providers.py
@@ -191,6 +191,21 @@ def _overlay_pdef(canonical, ov: HermesOverlay, name, env_vars, base_url, doc, s
                        source=source)
 
 
+def _profile_env_base_url(prof: Any) -> str:
+    """Base URL a plugin profile takes from its own env slot (``*_BASE_URL`` / ``*_URL``).
+
+    Profiles with a per-install endpoint (azure-foundry, freemodel2api) ship ``base_url=""`` and read
+    the real one from the environment. Same ``is_url`` rule ``auth._register_plugin_provider`` uses to
+    pick the profile's ``base_url_env_var``, so the two agree on which slot owns the endpoint."""
+    for var in getattr(prof, "env_vars", ()) or ():
+        if var.endswith("_BASE_URL") or var.endswith("_URL"):
+            from hermes_cli.config import get_env_value_prefer_dotenv
+            value = (get_env_value_prefer_dotenv(var) or "").strip()
+            if value:
+                return value
+    return ""
+
+
 def get_provider(name: str, *, allow_network: bool = True) -> Optional[ProviderDef]:
     """Look up a built-in provider by id or alias: models.dev catalog merged with the Hermes overlay;
     Hermes-only overlay (nous, openai-codex, …); plugin provider profiles with a concrete endpoint."""
@@ -210,18 +225,23 @@ def get_provider(name: str, *, allow_network: bool = True) -> Optional[ProviderD
                              overlay.base_url_override, "", "hermes")
     # Plugin-registered profiles (plugins/model-providers/<name>/) absent from models.dev and
     # HERMES_OVERLAYS would otherwise be "Unknown provider" in /model, --provider and model-switch
-    # even though the picker lists them. Only profiles with a concrete endpoint resolve here:
-    # placeholder profiles like ``custom`` (aliases ollama/local/vllm) ship an empty base_url and
-    # are completed by config.yaml custom_providers — resolving them would preempt
-    # resolve_provider_full's custom step and collapse keyed ``custom:<name>`` ids to bare custom.
+    # even though the picker lists them. A per-install endpoint counts as concrete once the profile's
+    # own base-URL env slot is filled — otherwise `--provider azure-foundry` and Settings → Model
+    # reject a provider the picker happily offers. Placeholder profiles like ``custom`` (aliases
+    # ollama/local/vllm) declare no env_vars at all, so they still fall through to
+    # ``resolve_provider_full``'s custom_providers step instead of collapsing keyed ``custom:<name>``
+    # ids to bare custom.
     try:
         from providers import get_provider_profile as _profile
         _prof = _profile(canonical)
-        if _prof is not None and (_prof.base_url or "").strip():
+        _base = (str(_prof.base_url or "").strip() if _prof is not None else "")
+        if _prof is not None and not _base:
+            _base = _profile_env_base_url(_prof)
+        if _base:
             _api_mode_to_transport = {v: k for k, v in TRANSPORT_TO_API_MODE.items()}
             return ProviderDef(id=canonical, name=_prof.display_name or _prof.name or canonical,
                                transport=_api_mode_to_transport.get(_prof.api_mode, "openai_chat"),
-                               api_key_env_vars=tuple(_prof.env_vars or ()), base_url=_prof.base_url or "",
+                               api_key_env_vars=tuple(_prof.env_vars or ()), base_url=_base,
                                auth_type=_prof.auth_type or "api_key", source="plugin-profile")
     except Exception:
         pass
@@ -387,6 +407,14 @@ def resolve_user_provider(name: str, user_config: Dict[str, Any]) -> Optional[Pr
                       entry.get("transport", "openai_chat") or "openai_chat")
 
 
+def _declares_endpoint(pdef: ProviderDef) -> bool:
+    """Whether a ``providers.<name>`` entry can actually serve traffic on its own: it owns a URL
+    or a credential slot. A metadata-only entry — ``providers.freemodel2api.{models,
+    discover_models}`` (the settings panel's allow-list), ``providers.openai-api.stale_timeout_seconds``
+    — has neither, so it cannot be the endpoint definition for that name."""
+    return bool(str(pdef.base_url or "").strip() or pdef.api_key_env_vars)
+
+
 def custom_provider_slug(display_name: str, provider_key: str = "") -> str:
     """Stable ``custom:`` identity for a configured provider: keyed ``providers:`` entries use their
     config key (survives display-name changes); legacy ``custom_providers:`` entries have no key,
@@ -487,7 +515,7 @@ def resolve_provider_full(name: str, user_providers: Optional[Dict[str, Any]] =
     raw = name.strip().lower()
     if user_providers:
         user_pdef = resolve_user_provider(raw, user_providers)
-        if user_pdef is not None:
+        if user_pdef is not None and _declares_endpoint(user_pdef):
             return user_pdef
     if canonical != raw:
         pdef = _lossy_alias_registry_pdef(raw, canonical)
@@ -499,7 +527,7 @@ def resolve_provider_full(name: str, user_providers: Optional[Dict[str, Any]] =
     if user_providers:
         for candidate in (canonical, raw):
             user_pdef = resolve_user_provider(candidate, user_providers)
-            if user_pdef is not None:
+            if user_pdef is not None and _declares_endpoint(user_pdef):
                 return user_pdef
     custom_pdef = resolve_custom_provider(name, custom_providers)
     if custom_pdef is not None:
diff --git a/hermes_cli/runtime_provider.py b/hermes_cli/runtime_provider.py
index c59a57c738..4584969206 100644
--- a/hermes_cli/runtime_provider.py
+++ b/hermes_cli/runtime_provider.py
@@ -409,6 +409,10 @@ def resolve_requested_provider(requested: Optional[str] = None) -> str:
     if requested and requested.strip():
         return requested.strip().lower()
     cfg_provider = _get_model_config().get("provider")
+    # ``load_config`` falls back to DEFAULT_CONFIG after a parse failure. With a real product
+    # default that fallback now contains a provider, so fail before it can masquerade as the
+    # user's saved route. Explicit function arguments above remain an intentional override.
+    auth_mod._refuse_env_adoption_if_config_corrupt()
     if isinstance(cfg_provider, str) and cfg_provider.strip():
         return cfg_provider.strip().lower()
     return get_secret_str("HERMES_INFERENCE_PROVIDER", "").strip().lower() or "auto"
diff --git a/hermes_cli/web_models.py b/hermes_cli/web_models.py
index 729b44add2..d140855b71 100644
--- a/hermes_cli/web_models.py
+++ b/hermes_cli/web_models.py
@@ -43,6 +43,9 @@ class CustomEndpointUpdate(BaseModel):
     discover_models: bool = True
     make_default: bool = False
     models: Optional[List[str]] = None
+    # 探测时顺带取该端点自己报的 key 价格(sub2api 的 /sub2api/pricing)。默认关:自定义端点
+    # 面板只想知道「通不通、有哪些模型」,不该为每次校验多打一次价格接口。
+    with_pricing: bool = False
 
 class MessagingPlatformUpdate(BaseModel):
     enabled: Optional[bool] = None
diff --git a/hermes_cli/web_routers/config_env.py b/hermes_cli/web_routers/config_env.py
index ad50514065..a2e8297b42 100644
--- a/hermes_cli/web_routers/config_env.py
+++ b/hermes_cli/web_routers/config_env.py
@@ -430,7 +430,10 @@ def _detach_main_model_from_provider(cfg: Dict[str, Any], provider_key: str) ->
         return
     if str(model_cfg.get("provider") or "").strip().lower() != provider_key:
         return
-    for field in ("provider", "base_url", "api_key", "key_env"):
+    # ``apply_model_selection`` also mirrors the endpoint's model and transport. Keeping either
+    # after deletion would route the product default through a model/API mode owned by a provider
+    # that no longer exists.
+    for field in ("provider", "default", "api_mode", "base_url", "api_key", "key_env"):
         model_cfg.pop(field, None)
     cfg["model"] = model_cfg
 
@@ -623,15 +626,18 @@ def delete_custom_endpoint(endpoint_id: str, profile: Optional[str] = None):
 
 @router.post("/api/providers/custom-endpoints/validate")
 async def validate_custom_endpoint(body: CustomEndpointUpdate):
-    """Probe a custom endpoint by calling its OpenAI-compatible /models URL."""
+    """Probe a custom endpoint by calling its OpenAI-compatible /models URL. ``with_pricing`` also
+    asks the endpoint what this key's models cost (sub2api's own key-pricing API) — off by default,
+    since only a panel that shows prices wants to pay for a second request."""
     base_url = (body.base_url or "").strip().rstrip("/")
     if not base_url:
         return {"ok": False, "reachable": True, "message": "Enter an endpoint URL first.", "models": []}
 
+    api_key = (body.api_key or "").strip()
     url = base_url + "/models"
     headers = {"Accept": "application/json"}
-    if body.api_key and body.api_key.strip():
-        headers["Authorization"] = f"Bearer {body.api_key.strip()}"
+    if api_key:
+        headers["Authorization"] = f"Bearer {api_key}"
 
     try:
         async with _endpoint_probe_client(url, 8.0) as client:
@@ -644,7 +650,13 @@ async def validate_custom_endpoint(body: CustomEndpointUpdate):
     if not resp.is_success:
         return {"ok": False, "reachable": True, "message": f"Endpoint returned HTTP {resp.status_code}.", "models": []}
 
-    return {"ok": True, "reachable": True, "message": "", "models": _parse_model_ids(resp)}
+    result = {"ok": True, "reachable": True, "message": "", "models": _parse_model_ids(resp)}
+    if body.with_pricing:
+        from hermes_cli.models_pricing import sub2api_endpoint_probe_pricing
+
+        # 一次真实的取价(含该 key 的组倍率):不是 sub2api 端点就什么都不加,校验本身照旧成功
+        result.update(await scoped_to_thread(None, lambda: sub2api_endpoint_probe_pricing(base_url, api_key)))
+    return result
 
 
 def _endpoint_probe_client(url: str, timeout: float):
diff --git a/hermes_cli/web_server_config.py b/hermes_cli/web_server_config.py
index a51ed2defd..59d9cd6364 100644
--- a/hermes_cli/web_server_config.py
+++ b/hermes_cli/web_server_config.py
@@ -232,9 +232,16 @@ def _build_schema_from_config(config: Dict[str, Any], prefix: str = "") -> Dict[
 
 def _config_schema_with_virtual_fields() -> Dict[str, Dict[str, Any]]:
     """DEFAULT_CONFIG schema plus the virtual ``model_context_length`` field, inserted right
-    after ``model`` so it renders adjacent in the frontend."""
+    after ``model`` so it renders adjacent in the frontend.
+
+    The web editor deliberately exposes ``model`` as one legacy scalar; the dedicated Models panel
+    owns the provider/default mapping. Keep that presentation shape even when DEFAULT_CONFIG carries
+    a structured default route.
+    """
+    schema_defaults = dict(DEFAULT_CONFIG)
+    schema_defaults["model"] = ""
     ordered: Dict[str, Dict[str, Any]] = {}
-    for key, entry in _build_schema_from_config(DEFAULT_CONFIG).items():
+    for key, entry in _build_schema_from_config(schema_defaults).items():
         ordered[key] = entry
         if key == "model":
             ordered["model_context_length"] = _SCHEMA_OVERRIDES["model_context_length"]
@@ -487,9 +494,8 @@ def _apply_main_model_assignment(model_cfg: "Any", result: "ModelSwitchResult",
 
 
 def _normalize_config_for_web(config: Dict[str, Any]) -> Dict[str, Any]:
-    """Flatten a dict-form ``model`` to its string form (the schema is built from
-    DEFAULT_CONFIG where ``model`` is a string) and surface ``model_context_length``
-    as a top-level field (0 = auto-detect)."""
+    """Flatten a dict-form ``model`` to the web editor's legacy string field and surface
+    ``model_context_length`` as a top-level field (0 = auto-detect)."""
     config = dict(config)
     model_val = config.get("model")
     if isinstance(model_val, dict):
diff --git a/package-lock.json b/package-lock.json
index 10a4728ba9..a1ae9c7160 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,7 +31,7 @@
     },
     "apps/bootstrap-installer": {
       "name": "@hermes/bootstrap-installer",
-      "version": "0.0.1",
+      "version": "0.21.1",
       "dependencies": {
         "@nous-research/ui": "0.18.2",
         "@tailwindcss/typography": "0.5.20",
@@ -85,6 +85,7 @@
         "@lezer/highlight": "1.2.3",
         "@nanostores/react": "1.1.0",
         "@nous-research/ui": "0.18.2",
+        "@silurus/ooxml": "0.88.0",
         "@streamdown/code": "1.1.1",
         "@streamdown/math": "1.0.2",
         "@tabler/icons-react": "3.44.0",
@@ -5556,6 +5557,12 @@
       "integrity": "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==",
       "license": "MIT"
     },
+    "node_modules/@silurus/ooxml": {
+      "version": "0.88.0",
+      "resolved": "https://registry.npmjs.org/@silurus/ooxml/-/ooxml-0.88.0.tgz",
+      "integrity": "sha512-dhMs1/U5fB5bh/Hv8BNTgCsHVNOl+qkquohsROblku7jghsmd1BZAE//LR6omB7aCVLGJ3sp4IqzqdkgT5wicQ==",
+      "license": "MIT"
+    },
     "node_modules/@simple-git/args-pathspec": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@simple-git/args-pathspec/-/args-pathspec-1.0.3.tgz",
diff --git a/plugins/image_gen/_common.py b/plugins/image_gen/_common.py
index efc8b8f4ad..bd12945234 100644
--- a/plugins/image_gen/_common.py
+++ b/plugins/image_gen/_common.py
@@ -11,6 +11,7 @@ from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple
 
 from agent.image_gen_provider import (
     ImageGenProvider, error_response, normalize_reference_images, save_b64_image, save_url_image)
+from agent.secret_scope import get_secret
 
 logger = logging.getLogger(__name__)
 
@@ -68,6 +69,42 @@ def load_image_gen_config(sub: Optional[str] = None) -> Dict[str, Any]:
         return {}
 
 
+def configured_image_key_env(config_key: str, default: str) -> str:
+    """Return the credential env-var name configured for one image provider.
+
+    ``image_gen.<config_key>.key_env`` is deliberately data-driven so an image
+    backend can use a credential that is independent from the chat provider's
+    generic OpenAI key. Invalid or empty values keep the provider's legacy
+    default, preserving existing installations until they opt into a separate
+    key.
+    """
+    configured = load_image_gen_config(config_key).get("key_env")
+    return configured.strip() if isinstance(configured, str) and configured.strip() else default
+
+
+def resolve_image_api_credentials(
+    config_key: str, *, default_key_env: str, default_base_url_env: Optional[str] = None,
+) -> Tuple[str, Optional[str], Optional[str]]:
+    """Resolve ``(key_env, api_key, base_url)`` for an OpenAI-compatible image backend.
+
+    Provider-specific config wins over process environment for the endpoint. The
+    environment fallback keeps older configs working, while the key itself is
+    always resolved through ``get_secret`` so profile-scoped credentials remain
+    isolated in multiplexed gateways.
+    """
+    config = load_image_gen_config(config_key)
+    key_env = configured_image_key_env(config_key, default_key_env)
+    api_key = get_secret(key_env)
+    configured_base_url = config.get("base_url")
+    if isinstance(configured_base_url, str) and configured_base_url.strip():
+        base_url = configured_base_url.strip()
+    elif default_base_url_env:
+        base_url = os.getenv(default_base_url_env, "").strip() or None
+    else:
+        base_url = None
+    return key_env, api_key, base_url
+
+
 def resolve_static_model(
     models: Dict[str, Dict[str, Any]], default: str, *, env_var: str, config_key: str,
     explicit: Optional[str] = None, include_top_level: bool = True,
diff --git a/plugins/image_gen/openai/__init__.py b/plugins/image_gen/openai/__init__.py
index 80e495d409..7b11ae0a2a 100644
--- a/plugins/image_gen/openai/__init__.py
+++ b/plugins/image_gen/openai/__init__.py
@@ -1,6 +1,8 @@
 """OpenAI GPT Image 2 and 2.5 Flare/Sunburst quality tiers;
 base64 output → image cache. Selection: ``OPENAI_IMAGE_MODEL`` → ``image_gen.openai.model`` →
-``image_gen.model`` → :data:`DEFAULT_MODEL`."""
+``image_gen.model`` → :data:`DEFAULT_MODEL`. Credentials come from
+``image_gen.openai.key_env`` (legacy default: ``OPENAI_API_KEY``), with
+``image_gen.openai.base_url`` selecting an OpenAI-compatible endpoint."""
 
 from __future__ import annotations
 
@@ -9,12 +11,12 @@ import logging
 import os
 from typing import Any, Dict, List, Optional, Tuple
 
-from agent.secret_scope import get_secret
 from agent.image_gen_provider import DEFAULT_ASPECT_RATIO, resolve_aspect_ratio, success_response
 from plugins.image_gen._common import (
     GPT_IMAGE_2_API_MODEL as API_MODEL, GPT_IMAGE_2_DEFAULT as DEFAULT_MODEL, GPT_IMAGE_2_TIERS,
-    StaticImageGenProvider, collect_source_images, error_factory, import_openai, materialize_image,
-    openai_importable, prompt_required_error, resolve_static_model, size_for)
+    StaticImageGenProvider, api_key_setup_schema, collect_source_images, configured_image_key_env,
+    error_factory, import_openai, materialize_image, openai_importable, prompt_required_error,
+    resolve_image_api_credentials, resolve_static_model, size_for)
 
 logger = logging.getLogger(__name__)
 
@@ -89,8 +91,18 @@ class OpenAIImageGenProvider(StaticImageGenProvider):
         tag="GPT Image 2 / 2.5 Flare / 2.5 Sunburst — text-to-image & image editing",
         key="OPENAI_API_KEY", prompt="OpenAI API key", url="https://platform.openai.com/api-keys")
 
+    def get_setup_schema(self) -> Dict[str, Any]:
+        """Expose the configured image credential instead of the chat key."""
+        key_env = configured_image_key_env("openai", self.setup["key"])
+        setup = dict(self.setup, key=key_env, prompt=f"Image generation API key ({key_env})")
+        if key_env != self.setup["key"]:
+            setup["url"] = ""
+        return api_key_setup_schema(**setup)
+
     def is_available(self) -> bool:
-        return bool(get_secret("OPENAI_API_KEY")) and openai_importable()
+        _, api_key, _ = resolve_image_api_credentials(
+            "openai", default_key_env="OPENAI_API_KEY", default_base_url_env="OPENAI_BASE_URL")
+        return bool(api_key) and openai_importable()
 
     def capabilities(self) -> Dict[str, Any]:
         # images.edit() accepts up to 16 source images.
@@ -105,10 +117,11 @@ class OpenAIImageGenProvider(StaticImageGenProvider):
         aspect = resolve_aspect_ratio(aspect_ratio)
         if not prompt:
             return prompt_required_error("openai", aspect)
-        api_key = get_secret("OPENAI_API_KEY")
+        key_env, api_key, base_url = resolve_image_api_credentials(
+            "openai", default_key_env="OPENAI_API_KEY", default_base_url_env="OPENAI_BASE_URL")
         if not api_key:
             return error_factory("openai", aspect)(
-                "OPENAI_API_KEY not set. Run `hermes tools` → Image "
+                f"{key_env} not set. Run `hermes tools` → Image "
                 "Generation → OpenAI to configure, or `hermes setup` "
                 "to add the key.",
                 "auth_required")
@@ -121,7 +134,9 @@ class OpenAIImageGenProvider(StaticImageGenProvider):
         sources = collect_source_images(image_url, reference_image_urls, limit=16)
         is_edit = bool(sources)
         fail = error_factory("openai", aspect, model=tier_id, prompt=prompt)
-        client = openai.OpenAI(api_key=api_key)
+        # OpenAI-compatible gateways may expose the Images API at a custom base URL.
+        # Provider config wins, with the legacy environment fallback for older users.
+        client = openai.OpenAI(api_key=api_key, base_url=base_url)
 
         # gpt-image-2 returns b64_json unconditionally and REJECTS
         # ``response_format`` as an unknown parameter. Don't send it.
diff --git a/plugins/image_gen/openai/plugin.yaml b/plugins/image_gen/openai/plugin.yaml
index 5e3db55b48..ef7f5a1bcc 100644
--- a/plugins/image_gen/openai/plugin.yaml
+++ b/plugins/image_gen/openai/plugin.yaml
@@ -3,5 +3,7 @@ version: 1.0.0
 description: "OpenAI image generation backend (GPT Image 2 and GPT Image 2.5 Flare/Sunburst). Saves generated images to $HERMES_HOME/cache/images/."
 author: NousResearch
 kind: backend
-requires_env:
-  - OPENAI_API_KEY
+# The credential env-var is selected by image_gen.openai.key_env in config.yaml.
+# Keep this manifest declaration empty so plugin installation does not prompt for
+# the chat provider's generic OPENAI_API_KEY.
+requires_env: []
diff --git a/plugins/model-providers/freemodel2api/__init__.py b/plugins/model-providers/freemodel2api/__init__.py
new file mode 100644
index 0000000000..15e3eb8e18
--- /dev/null
+++ b/plugins/model-providers/freemodel2api/__init__.py
@@ -0,0 +1,21 @@
+"""FreeModel2API (sub2api) provider profile: OpenAI-compatible self-hosted gateway.
+
+Credentials live in this provider's own env slots — ``FREEMODEL2API_API_KEY`` and
+``FREEMODEL2API_BASE_URL`` — never in a ``providers:`` / ``custom_providers:`` entry.
+The endpoint is per-install, so there is no default base URL to ship; the model
+catalog is whatever the saved key may use, read live from ``{base_url}/models``.
+"""
+
+from providers import register_provider
+from providers.base import ProviderProfile
+
+freemodel2api = ProviderProfile(
+    name="freemodel2api", aliases=("sub2api", "free-model-2-api"),
+    display_name="FreeModel2API",
+    description="FreeModel2API - self-hosted sub2api gateway (key-scoped model catalog)",
+    env_vars=("FREEMODEL2API_API_KEY", "FREEMODEL2API_BASE_URL"),
+    base_url="",  # per-install; the user's base URL arrives via FREEMODEL2API_BASE_URL
+    auth_type="api_key",
+)
+
+register_provider(freemodel2api)
diff --git a/plugins/model-providers/freemodel2api/plugin.yaml b/plugins/model-providers/freemodel2api/plugin.yaml
new file mode 100644
index 0000000000..ad987d2a54
--- /dev/null
+++ b/plugins/model-providers/freemodel2api/plugin.yaml
@@ -0,0 +1,5 @@
+name: freemodel2api-provider
+kind: model-provider
+version: 1.0.0
+description: FreeModel2API — self-hosted sub2api gateway (user-supplied base URL)
+author: Nous Research
diff --git a/tests/hermes_cli/test_custom_endpoint_pricing.py b/tests/hermes_cli/test_custom_endpoint_pricing.py
new file mode 100644
index 0000000000..e2669e6419
--- /dev/null
+++ b/tests/hermes_cli/test_custom_endpoint_pricing.py
@@ -0,0 +1,158 @@
+"""A user-defined endpoint prices itself from its own upstream (sub2api's key-pricing API) —
+there is no canonical catalog to whitelist it into.
+"""
+
+import hermes_cli.inventory as inv
+import hermes_cli.models_pricing as mp
+
+
+def _stub_endpoint(monkeypatch, payload, *, calls=None, key="sk-test", reset=True):
+    """Serve *payload* (or raise when it is an Exception) for any upstream GET."""
+    if reset:
+        monkeypatch.setattr(mp, "_pricing_cache", {})
+        monkeypatch.setattr(mp, "_pricing_cache_retry_after", {})
+    monkeypatch.setattr(mp, "_custom_endpoint_api_key", lambda _slug: key)
+    monkeypatch.setattr(mp, "get_pricing_for_provider", lambda *_a, **_kw: {})
+
+    def fake_get_json(url, headers, timeout, *_a, **_kw):
+        if calls is not None:
+            calls.append((url, headers.get("Authorization")))
+        if isinstance(payload, Exception):
+            raise payload
+        return payload
+
+    monkeypatch.setattr(mp, "_get_json", fake_get_json)
+
+
+def _row():
+    return {
+        "slug": "freemodel2api",
+        "name": "FreeModel2API",
+        "is_user_defined": True,
+        "api_url": "http://124.232.163.75:3020/v1",
+        "models": ["deepseek-flash", "glm-5.3", "no-price-model"],
+    }
+
+
+def test_custom_endpoint_prices_reach_the_row_and_scale_by_rate_multiplier(monkeypatch):
+    """Per-token upstream USD → the picker's $/Mtok columns, times the key's rate multiplier."""
+    calls = []
+    _stub_endpoint(
+        monkeypatch,
+        {
+            "models": [
+                {"name": "deepseek-flash", "pricing": {
+                    "billing_mode": "token", "input_price": 1.5e-07,
+                    "output_price": 6e-07, "cache_read_price": 3e-09}},
+                # 2x group multiplier: every rate doubles.
+                {"name": "glm-5.3", "pricing": {
+                    "billing_mode": "token", "input_price": 1e-06, "output_price": 2e-06}},
+                {"name": "no-price-model", "pricing": {"billing_mode": "unavailable", "intervals": []}},
+            ],
+            "rate_multiplier": {"effective_rate_multiplier": 2},
+        },
+        calls=calls,
+    )
+
+    rows = [_row()]
+    inv._apply_pricing(rows)
+
+    pricing = rows[0]["pricing"]
+    assert pricing["deepseek-flash"] == {"input": "$0.30", "output": "$1.20", "cache": "$0.006", "free": False}
+    assert pricing["glm-5.3"] == {"input": "$2.00", "output": "$4.00", "cache": None, "free": False}
+    # "unavailable" carries no per-token rate — the model is simply absent, not zero-priced.
+    assert "no-price-model" not in pricing
+    assert calls == [("http://124.232.163.75:3020/v1/sub2api/pricing", "Bearer sk-test")]
+
+
+def test_non_sub2api_endpoint_goes_unpriced_without_breaking_the_row(monkeypatch):
+    """An endpoint that is not a sub2api instance 404s / answers non-JSON; the row survives."""
+    _stub_endpoint(monkeypatch, ValueError("not JSON"))
+    rows = [_row()]
+    inv._apply_pricing(rows)
+    assert "pricing" not in rows[0]
+    assert rows[0]["models"] == ["deepseek-flash", "glm-5.3", "no-price-model"]
+
+
+def test_custom_endpoint_pricing_is_cached_only_on_the_picker_path(monkeypatch):
+    """Picker opens read the cache; only the prewarm worker may start endpoint I/O."""
+    _stub_endpoint(monkeypatch, RuntimeError("network fetch started"))
+    rows = [_row()]
+    inv._apply_pricing(rows, cached_only=True)
+    assert "pricing" not in rows[0]
+
+
+def test_warm_cache_answers_the_picker_path_without_io(monkeypatch):
+    """The prewarm's result is what a later cached-only open renders."""
+    _stub_endpoint(monkeypatch, {
+        "models": [{"name": "deepseek-flash", "pricing": {
+            "billing_mode": "token", "input_price": 1.5e-07, "output_price": 6e-07}}],
+    })
+    url = _row()["api_url"]
+    assert mp.get_custom_endpoint_pricing("freemodel2api", url)  # fills the cache
+
+    _stub_endpoint(monkeypatch, RuntimeError("network fetch started"), reset=False)
+    assert mp.get_custom_endpoint_pricing("freemodel2api", url, cached_only=True)
+    rows = [_row()]
+    inv._apply_pricing(rows, cached_only=True)
+    assert rows[0]["pricing"]["deepseek-flash"]["input"] == "$0.15"
+
+
+def test_endpoint_probe_returns_formatted_prices_and_the_rate_multiplier(monkeypatch):
+    """面板「测试」那一次:价格格式化成 $/Mtok(和选择器一致),倍率另给一个数 ——
+    价格里已经乘过倍率,但用户要看的就是这个数。"""
+    _stub_endpoint(monkeypatch, {
+        "models": [{"name": "deepseek-flash", "pricing": {
+            "billing_mode": "token", "input_price": 1.5e-07, "output_price": 6e-07,
+            "cache_read_price": 3e-09}}],
+        "rate_multiplier": {"effective_rate_multiplier": 2},
+    })
+    monkeypatch.setattr(mp, "_RATE_MULTIPLIERS", {})
+
+    probe = mp.sub2api_endpoint_probe_pricing("http://h:3020/v1", "sk-test")
+
+    assert probe["pricing"]["deepseek-flash"] == {
+        "input": "$0.30", "output": "$1.20", "cache": "$0.006", "free": False}
+    assert probe["rate_multiplier"] == 2.0
+
+
+def test_endpoint_probe_on_a_non_sub2api_endpoint_is_empty_but_not_fatal(monkeypatch):
+    _stub_endpoint(monkeypatch, ValueError("not JSON"))
+    monkeypatch.setattr(mp, "_RATE_MULTIPLIERS", {})
+
+    probe = mp.sub2api_endpoint_probe_pricing("http://h:3020/v1", "sk-test")
+
+    # 倍率 0 = 不知道,不是「倍率是 0」
+    assert probe == {"pricing": {}, "rate_multiplier": 0.0}
+
+
+def test_provider_form_prices_from_its_own_env_credentials(monkeypatch):
+    """Same endpoint, provider form: FreeModel2API is a provider plugin, so its key and base URL come
+    from its own env slots — no ``providers:`` entry, no custom endpoint row."""
+    from hermes_cli import auth
+
+    calls = []
+    monkeypatch.setattr(mp, "_pricing_cache", {})
+    monkeypatch.setattr(mp, "_pricing_cache_retry_after", {})
+    monkeypatch.setattr(
+        auth, "resolve_api_key_provider_credentials",
+        lambda _pid: {"api_key": "sk-x", "base_url": "http://h:3020/v1"})
+
+    def fake_get_json(url, headers, timeout, *_a, **_kw):
+        calls.append((url, headers.get("Authorization")))
+        return {"models": [{"name": "deepseek-flash", "pricing": {
+            "billing_mode": "token", "input_price": 1.5e-07, "output_price": 6e-07}}]}
+
+    monkeypatch.setattr(mp, "_get_json", fake_get_json)
+    # Per-token USD, the shape _apply_pricing formats into the picker's $/Mtok columns.
+    assert mp.get_pricing_for_provider("freemodel2api")["deepseek-flash"] == {
+        "prompt": "1.5e-07", "completion": "6e-07"}
+    assert calls == [("http://h:3020/v1/sub2api/pricing", "Bearer sk-x")]
+
+    # The fetcher's remembered cache key must be the one cached_only reads back, else a picker open
+    # (which never starts I/O) would show prices only on the second open.
+    def boom(*_a, **_kw):
+        raise RuntimeError("network fetch started")
+
+    monkeypatch.setattr(mp, "_get_json", boom)
+    assert mp.get_pricing_for_provider("freemodel2api", cached_only=True)["deepseek-flash"]["prompt"] == "1.5e-07"
diff --git a/tests/hermes_cli/test_freemodel2api_provider.py b/tests/hermes_cli/test_freemodel2api_provider.py
new file mode 100644
index 0000000000..f3cd45fb4a
--- /dev/null
+++ b/tests/hermes_cli/test_freemodel2api_provider.py
@@ -0,0 +1,135 @@
+"""FreeModel2API is a first-class provider plugin (``plugins/model-providers/freemodel2api/``):
+its credentials live in their own env slots, its model catalog is whatever the saved key may use,
+and nothing about it routes through a ``providers:`` / ``custom_providers:`` entry.
+"""
+
+import hermes_cli.models as models
+import hermes_cli.models_pricing as mp
+from hermes_cli.auth import PROVIDER_REGISTRY, resolve_api_key_provider_credentials
+from hermes_cli.config import invalidate_env_cache
+from hermes_cli.models_catalog_static import CANONICAL_PROVIDERS
+from hermes_cli.provider_catalog import provider_catalog_by_slug
+from hermes_cli.providers import get_provider, normalize_provider
+
+
+def test_freemodel2api_is_registered_as_an_independent_provider():
+    desc = provider_catalog_by_slug()["freemodel2api"]
+    assert desc.label == "FreeModel2API"
+    assert desc.api_key_env_vars == ("FREEMODEL2API_API_KEY",)
+    assert desc.base_url_env_var == "FREEMODEL2API_BASE_URL"
+    assert desc.tab == "keys"
+    # The desktop picker only reaches rows in CANONICAL_PROVIDERS; a plugin profile lands there
+    # automatically, which is what makes this provider selectable at all.
+    assert "freemodel2api" in {e.slug for e in CANONICAL_PROVIDERS}
+    assert normalize_provider("freemodel2api") == "freemodel2api"
+
+
+def test_freemodel2api_is_the_default_route_before_credentials_are_configured():
+    from hermes_cli.config import load_config
+    from hermes_cli.runtime_provider import resolve_requested_provider
+
+    model = load_config()["model"]
+    assert model["provider"] == "freemodel2api"
+    assert model["default"] == ""
+    assert resolve_requested_provider() == "freemodel2api"
+
+
+def test_freemodel2api_has_live_catalog_and_pricing_hooks():
+    # A live probe is the only catalog source: the profile ships fallback_models=(), so a miss
+    # would leave the row with no models and drop it from the picker.
+    assert models._PROVIDER_CATALOG_FETCHERS["freemodel2api"] is models._api_key_provider_live
+    assert mp._PRICING_FETCHERS["freemodel2api"] is mp._fetch_freemodel2api_pricing
+    assert mp._STATIC_PRICING_SCOPES["freemodel2api"] is mp._freemodel2api_pricing_scope
+
+
+def test_credentials_resolve_from_the_provider_env_slots(monkeypatch):
+    """No base URL is shipped (per-install), so an unconfigured provider must resolve to nothing
+    rather than to a wrong default host — the picker then simply omits the row."""
+    assert resolve_api_key_provider_credentials("freemodel2api")["base_url"] == ""
+    assert PROVIDER_REGISTRY["freemodel2api"].base_url_env_var == "FREEMODEL2API_BASE_URL"
+
+    monkeypatch.setenv("FREEMODEL2API_API_KEY", "sk-env")
+    monkeypatch.setenv("FREEMODEL2API_BASE_URL", "http://h:3020/v1")
+    creds = resolve_api_key_provider_credentials("freemodel2api")
+    assert creds["api_key"] == "sk-env"
+    assert creds["base_url"] == "http://h:3020/v1"
+
+
+def test_default_runtime_uses_saved_api_key_without_account_login(tmp_path, monkeypatch):
+    """The account session only manages keys; inference needs no FreeModel2API login once the
+    profile has a key, endpoint and concrete model."""
+    home = tmp_path / "hermes"
+    home.mkdir()
+    (home / "config.yaml").write_text("model:\n  default: gpt-5.4\n", encoding="utf-8")
+    (home / ".env").write_text(
+        "FREEMODEL2API_API_KEY=sk-direct\n"
+        "FREEMODEL2API_BASE_URL=https://fm2.example/v1\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("HERMES_HOME", str(home))
+    monkeypatch.delenv("FREEMODEL2API_API_KEY", raising=False)
+    monkeypatch.delenv("FREEMODEL2API_BASE_URL", raising=False)
+    invalidate_env_cache()
+
+    from hermes_cli.runtime_provider import resolve_runtime_provider
+
+    runtime = resolve_runtime_provider()
+    assert runtime["provider"] == "freemodel2api"
+    assert runtime["requested_provider"] == "freemodel2api"
+    assert runtime["api_key"] == "sk-direct"
+    assert runtime["base_url"] == "https://fm2.example/v1"
+
+
+def test_picker_hint_exposes_base_url_env_only_for_per_install_providers():
+    """The onboarding key form renders a second (required) base-URL field only for providers that
+    ship no default endpoint. freemodel2api qualifies; an override-slot provider like deepseek
+    (default URL exists) must NOT, or every ordinary provider would grow a mandatory URL field."""
+    from hermes_cli.inventory import _provider_auth_hint
+
+    auth_type, key_env, base_url_env = _provider_auth_hint("freemodel2api")
+    assert (auth_type, key_env, base_url_env) == (
+        "api_key", "FREEMODEL2API_API_KEY", "FREEMODEL2API_BASE_URL")
+
+    assert _provider_auth_hint("deepseek")[2] == ""
+
+
+def test_credentials_and_endpoint_follow_profile_scope_a_b_a(tmp_path, monkeypatch):
+    """A multiplexed Desktop backend must never reuse the launch profile's FreeModel2API route."""
+    from agent import secret_scope
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+    home_a = tmp_path / "a"
+    home_b = tmp_path / "b"
+    home_a.mkdir()
+    home_b.mkdir()
+    (home_a / ".env").write_text(
+        "FREEMODEL2API_API_KEY=sk-a\nFREEMODEL2API_BASE_URL=https://a.example/v1\n",
+        encoding="utf-8",
+    )
+    (home_b / ".env").write_text(
+        "FREEMODEL2API_API_KEY=sk-b\nFREEMODEL2API_BASE_URL=https://b.example/v1\n",
+        encoding="utf-8",
+    )
+    monkeypatch.setenv("FREEMODEL2API_API_KEY", "sk-launch")
+    monkeypatch.setenv("FREEMODEL2API_BASE_URL", "https://launch.example/v1")
+
+    def resolve(home):
+        home_token = set_hermes_home_override(str(home))
+        scope_token = secret_scope.set_secret_scope(secret_scope.build_profile_secret_scope(home))
+        try:
+            invalidate_env_cache()
+            creds = resolve_api_key_provider_credentials("freemodel2api")
+            provider = get_provider("freemodel2api", allow_network=False)
+            return creds["api_key"], creds["base_url"], provider.base_url if provider else ""
+        finally:
+            secret_scope.reset_secret_scope(scope_token)
+            reset_hermes_home_override(home_token)
+
+    secret_scope.set_multiplex_active(True)
+    try:
+        assert resolve(home_a) == ("sk-a", "https://a.example/v1", "https://a.example/v1")
+        assert resolve(home_b) == ("sk-b", "https://b.example/v1", "https://b.example/v1")
+        assert resolve(home_a) == ("sk-a", "https://a.example/v1", "https://a.example/v1")
+    finally:
+        secret_scope.set_multiplex_active(False)
+        invalidate_env_cache()
diff --git a/tests/hermes_cli/test_inventory.py b/tests/hermes_cli/test_inventory.py
index 6726c55b3a..a381cc4cd2 100644
--- a/tests/hermes_cli/test_inventory.py
+++ b/tests/hermes_cli/test_inventory.py
@@ -314,10 +314,6 @@ def test_anthropic_oauth_presence_accepts_pool_only_oauth_entry():
             "agent.anthropic_credentials.read_hermes_oauth_credentials",
             return_value=None,
         ),
-        patch(
-            "agent.anthropic_credentials.read_claude_code_credentials",
-            return_value=None,
-        ),
         patch(
             "hermes_cli.auth.read_credential_pool",
             return_value=[
@@ -334,10 +330,6 @@ def test_anthropic_oauth_presence_accepts_pool_only_oauth_entry():
             "agent.anthropic_credentials.read_hermes_oauth_credentials",
             return_value=None,
         ),
-        patch(
-            "agent.anthropic_credentials.read_claude_code_credentials",
-            return_value=None,
-        ),
         patch(
             "hermes_cli.auth.read_credential_pool",
             return_value=[
@@ -348,6 +340,52 @@ def test_anthropic_oauth_presence_accepts_pool_only_oauth_entry():
         assert _anthropic_oauth_credentials_present() is False
 
 
+def test_borrowed_credentials_never_surface_rows():
+    """Project-config-only policy: a Claude Code login (~/.claude) must not keep the Anthropic
+    row, and a verified external-process CLI (gh → copilot) must not keep its row — only
+    credentials Hermes itself manages count for the desktop explicit-only filter."""
+    from hermes_cli.inventory import _anthropic_oauth_credentials_present
+
+    # Claude Code files are no longer read at all: even a live token reads as absent.
+    with (
+        patch(
+            "agent.anthropic_credentials.read_hermes_oauth_credentials",
+            return_value=None,
+        ),
+        patch(
+            "agent.anthropic_credentials.read_claude_code_credentials",
+            return_value={"accessToken": "sk-ant-oat01-borrowed"},
+        ),
+        patch(
+            "hermes_cli.auth.read_credential_pool",
+            return_value=[],
+        ),
+    ):
+        assert _anthropic_oauth_credentials_present() is False
+
+    rows = [
+        {"slug": "copilot", "name": "Copilot", "models": ["gpt-5.4"],
+         "total_models": 1, "is_current": False, "is_user_defined": False,
+         "source": "hermes"},
+    ]
+    ctx = _empty_ctx(provider="opencode-go", model="glm-5.3")
+    with (
+        _list_auth_returning(rows),
+        patch("hermes_cli.config.read_raw_config", return_value={}),
+        patch(
+            "hermes_cli.auth.is_provider_explicitly_configured",
+            return_value=False,
+        ),
+        patch(
+            "hermes_cli.auth.get_external_process_provider_status",
+            return_value={"auth_verified": True},
+        ),
+    ):
+        payload = build_models_payload(ctx, explicit_only=True)
+
+    assert "copilot" not in [row["slug"] for row in payload["providers"]]
+
+
 
 # ─── picker_hints ──────────────────────────────────────────────────────
 
diff --git a/tests/hermes_cli/test_list_picker_providers.py b/tests/hermes_cli/test_list_picker_providers.py
index 21581fd204..5d42ce059d 100644
--- a/tests/hermes_cli/test_list_picker_providers.py
+++ b/tests/hermes_cli/test_list_picker_providers.py
@@ -240,3 +240,47 @@ def test_distinct_kimi_china_credential_still_listed(monkeypatch):
     assert slugs.count("kimi-coding") == 1
     assert "kimi" not in slugs          # alias collapsed into the canonical row
     assert "kimi-coding-cn" in slugs    # distinct China endpoint preserved
+
+
+def _stub_canonical_only_catalog(monkeypatch, model_ids):
+    """Isolate a section-2b row: a canonical provider that is NOT a models.dev
+    built-in, so sections 1/2 cannot claim the slug first."""
+    import hermes_cli.models as hm
+
+    monkeypatch.setattr(hm, "cached_provider_model_ids", lambda *a, **k: list(model_ids))
+    monkeypatch.setattr(hm, "clear_provider_models_cache", lambda *a, **k: None)
+
+
+def test_canonical_row_honours_a_pinned_models_whitelist(monkeypatch):
+    """``providers.<canonical>.models`` + ``discover_models: false`` pins the 2b row.
+
+    The FreeModel2API panel writes this so the picker row offers only the models
+    the user ticked, instead of everything the endpoint reports.
+    """
+    _stub_canonical_only_catalog(monkeypatch, ["fm-1", "fm-2", "fm-3"])
+    monkeypatch.setenv("FREEMODEL2API_API_KEY", "sk-test-fm2")
+
+    rows = model_switch.list_authenticated_providers(
+        max_models=10,
+        user_providers={"freemodel2api": {"discover_models": False, "models": ["fm-2"]}},
+    )
+    fm2_rows = [r for r in rows if r["slug"] == "freemodel2api"]
+
+    assert len(fm2_rows) == 1, f"whitelist must not spawn a second row: {[r['slug'] for r in rows]}"
+    assert fm2_rows[0]["models"] == ["fm-2"]
+    assert fm2_rows[0]["source"] == "canonical"
+    assert fm2_rows[0]["is_user_defined"] is False
+
+
+def test_canonical_row_extends_the_catalog_when_only_models_are_declared(monkeypatch):
+    """Without the opt-out the same block extends discovery, matching section 1."""
+    _stub_canonical_only_catalog(monkeypatch, ["fm-1", "fm-2"])
+    monkeypatch.setenv("FREEMODEL2API_API_KEY", "sk-test-fm2")
+
+    rows = model_switch.list_authenticated_providers(
+        max_models=10,
+        user_providers={"freemodel2api": {"models": ["fm-extra"]}},
+    )
+    fm2 = [r for r in rows if r["slug"] == "freemodel2api"][0]
+
+    assert fm2["models"] == ["fm-extra", "fm-1", "fm-2"]
diff --git a/tests/hermes_cli/test_model_switch_custom_providers.py b/tests/hermes_cli/test_model_switch_custom_providers.py
index 40b87b09a7..7bf85358bc 100644
--- a/tests/hermes_cli/test_model_switch_custom_providers.py
+++ b/tests/hermes_cli/test_model_switch_custom_providers.py
@@ -2240,3 +2240,31 @@ def test_same_provider_switch_on_session_only_custom_endpoint_keeps_endpoint(mon
     assert result.success
     assert result.base_url == "http://10.0.0.5:8000/v1"
     assert result.api_key == "session-secret"
+
+
+def test_metadata_only_user_provider_does_not_shadow_the_real_endpoint():
+    """A ``providers.<name>`` entry with no URL and no credential slot is metadata, not an endpoint.
+
+    The FreeModel2API settings panel writes ``providers.freemodel2api.{discover_models,models}``
+    (its picker allow-list) and users carry flags like ``providers.openai-api.stale_timeout_seconds``;
+    letting either win the chain returned a def with ``base_url=""`` and broke routing.
+    """
+    resolved = resolve_provider_full("freemodel2api", user_providers={
+        "freemodel2api": {"discover_models": False, "models": ["gpt-5.5"]},
+    })
+
+    assert resolved is None or resolved.source != "user-config", (
+        f"metadata-only entry won the chain: {resolved!r}"
+    )
+
+
+def test_user_provider_with_an_endpoint_still_wins_the_chain():
+    """Negative control: the guard must not demote a genuine endpoint entry."""
+    resolved = resolve_provider_full("mine", user_providers={
+        "mine": {"base_url": "http://127.0.0.1:4141/v1", "key_env": "MINE_KEY"},
+    })
+
+    assert resolved is not None
+    assert resolved.source == "user-config"
+    assert resolved.base_url == "http://127.0.0.1:4141/v1"
+    assert resolved.api_key_env_vars == ("MINE_KEY",)
diff --git a/tests/hermes_cli/test_provider_config_validation.py b/tests/hermes_cli/test_provider_config_validation.py
index 892a8876c6..43e4d32f45 100644
--- a/tests/hermes_cli/test_provider_config_validation.py
+++ b/tests/hermes_cli/test_provider_config_validation.py
@@ -53,6 +53,19 @@ class TestNormalizeCustomProviderEntry:
 
 
 
+    def test_desktop_bookkeeping_keys_do_not_warn(self, caplog):
+        """``key_id`` is written by the Desktop FreeModel2API panel (which key it
+        last put in that provider's env slot) and is not runtime config; warning
+        about it on every picker load would be noise our own writer caused."""
+        entry = {
+            "discover_models": False,
+            "key_id": 81,
+            "models": ["gpt-5.5"],
+        }
+        with caplog.at_level(logging.WARNING):
+            _normalize_custom_provider_entry(dict(entry), provider_key="freemodel2api")
+        assert not [r for r in caplog.records if "unknown config keys" in r.message.lower()]
+
     def test_env_var_placeholder_in_base_url_not_rejected(self):
         """A base_url that is an un-expanded ${ENV_VAR} placeholder must not be
         rejected as an invalid URL — it is expanded at runtime, so a caller
diff --git a/tests/hermes_cli/test_resolve_provider_corrupt_config.py b/tests/hermes_cli/test_resolve_provider_corrupt_config.py
index c0a6841f6b..1fc8ebb892 100644
--- a/tests/hermes_cli/test_resolve_provider_corrupt_config.py
+++ b/tests/hermes_cli/test_resolve_provider_corrupt_config.py
@@ -91,12 +91,19 @@ class TestResolveProviderCorruptConfig:
         _load_config_fresh()
 
         from hermes_cli.auth import AuthError, resolve_provider
+        from hermes_cli.runtime_provider import resolve_requested_provider
 
         with pytest.raises(AuthError) as excinfo:
             resolve_provider("auto")
         assert excinfo.value.code == "corrupt_config"
         assert "config.yaml" in str(excinfo.value)
 
+        # The normal chat path resolves the product default before calling resolve_provider; it
+        # must reject the same broken file instead of silently routing to that fallback default.
+        with pytest.raises(AuthError) as runtime_exc:
+            resolve_requested_provider()
+        assert runtime_exc.value.code == "corrupt_config"
+
     def test_corrupt_config_blocks_pool_probe_adoption(self, tmp_path, monkeypatch):
         """Corrupt config + pool-only credential must NOT resolve to openrouter."""
         _setup_home(tmp_path, monkeypatch, CORRUPT_YAML)
diff --git a/tests/hermes_cli/test_web_server.py b/tests/hermes_cli/test_web_server.py
index f035b483b2..af0acdae05 100644
--- a/tests/hermes_cli/test_web_server.py
+++ b/tests/hermes_cli/test_web_server.py
@@ -1801,7 +1801,7 @@ class TestWebServerEndpoints:
         authenticating to the deleted host, and the credential the operator
         just removed through the dashboard survives the delete.
         """
-        from hermes_cli.config import custom_endpoint_key_env, get_env_value, load_config
+        from hermes_cli.config import DEFAULT_CONFIG, custom_endpoint_key_env, get_env_value, load_config
 
         self.client.post(
             "/api/providers/custom-endpoints",
@@ -1832,7 +1832,9 @@ class TestWebServerEndpoints:
         assert not model_cfg.get("api_key"), "deleted endpoint's key still in config.yaml"
         assert not model_cfg.get("key_env"), "deleted endpoint's key ref still in config.yaml"
         assert not model_cfg.get("base_url"), "deleted endpoint's host still routed to"
-        assert not model_cfg.get("provider")
+        assert model_cfg.get("provider") == DEFAULT_CONFIG["model"]["provider"]
+        assert model_cfg.get("default") == DEFAULT_CONFIG["model"]["default"]
+        assert not model_cfg.get("api_mode"), "deleted endpoint's transport still routed to"
         assert not get_env_value(env_var), "deleted endpoint's key still in .env"
 
 
diff --git a/tests/plugins/image_gen/test_openai_provider.py b/tests/plugins/image_gen/test_openai_provider.py
index 93ad401321..f1c0d0c438 100644
--- a/tests/plugins/image_gen/test_openai_provider.py
+++ b/tests/plugins/image_gen/test_openai_provider.py
@@ -68,6 +68,21 @@ class TestMetadata:
             assert entry["speed"]
             assert entry["strengths"]
 
+    def test_setup_schema_uses_configured_image_key(self, provider, tmp_path):
+        import yaml
+
+        (tmp_path / "config.yaml").write_text(yaml.safe_dump({
+            "image_gen": {"openai": {"key_env": "OPENAI_IMAGE_GEN_API_KEY"}}
+        }))
+
+        schema = provider.get_setup_schema()
+
+        assert schema["env_vars"] == [{
+            "key": "OPENAI_IMAGE_GEN_API_KEY",
+            "prompt": "Image generation API key (OPENAI_IMAGE_GEN_API_KEY)",
+            "url": "",
+        }]
+
 
 # ── Availability ────────────────────────────────────────────────────────────
 
@@ -81,6 +96,17 @@ class TestAvailability:
         monkeypatch.setenv("OPENAI_API_KEY", "test")
         assert openai_plugin.OpenAIImageGenProvider().is_available() is True
 
+    def test_configured_key_is_independent_from_generic_openai_key(self, tmp_path, monkeypatch):
+        import yaml
+
+        (tmp_path / "config.yaml").write_text(yaml.safe_dump({
+            "image_gen": {"openai": {"key_env": "OPENAI_IMAGE_GEN_API_KEY"}}
+        }))
+        monkeypatch.setenv("OPENAI_API_KEY", "chat-provider-key")
+        monkeypatch.delenv("OPENAI_IMAGE_GEN_API_KEY", raising=False)
+
+        assert openai_plugin.OpenAIImageGenProvider().is_available() is False
+
 
 # ── Model resolution ────────────────────────────────────────────────────────
 
@@ -172,6 +198,29 @@ class TestGenerate:
         # gpt-image-2 rejects response_format — we must NOT send it.
         assert "response_format" not in call_kwargs
 
+    def test_configured_key_and_base_url_reach_image_client(self, provider, tmp_path, monkeypatch):
+        import yaml
+
+        (tmp_path / "config.yaml").write_text(yaml.safe_dump({
+            "image_gen": {"openai": {
+                "key_env": "OPENAI_IMAGE_GEN_API_KEY",
+                "base_url": "http://image-gateway.test/v1",
+            }}
+        }))
+        monkeypatch.setenv("OPENAI_IMAGE_GEN_API_KEY", "image-key")
+        monkeypatch.setenv("OPENAI_BASE_URL", "http://chat-gateway.test/v1")
+        fake_client = MagicMock()
+        fake_client.images.generate.return_value = _fake_response(b64=_b64_png())
+        fake_openai = MagicMock()
+        fake_openai.OpenAI.return_value = fake_client
+
+        with patch.dict("sys.modules", {"openai": fake_openai}):
+            result = provider.generate("a cat")
+
+        assert result["success"] is True
+        fake_openai.OpenAI.assert_called_once_with(
+            api_key="image-key", base_url="http://image-gateway.test/v1")
+
     @pytest.mark.parametrize("api_model,quality", [
         ("gpt-image-2", quality) for quality in ("low", "medium", "high")
     ] + [
@@ -256,4 +305,3 @@ class TestGenerate:
         assert result["image"].startswith("/")
         assert "example.com" not in result["image"]
         mock_save_url.assert_called_once()
-
diff --git a/website/docs/reference/tools-reference.md b/website/docs/reference/tools-reference.md
index 2ab7502fff..a813cdb713 100644
--- a/website/docs/reference/tools-reference.md
+++ b/website/docs/reference/tools-reference.md
@@ -141,7 +141,7 @@ Scoped to the Feishu document-comment handler. Drives comment read/write operati
 
 | Tool | Description | Requires environment |
 |------|-------------|----------------------|
-| `image_generate` | Generate images from text prompts (text-to-image) or edit/transform an existing image (image-to-image) via the user-configured backend (FAL.ai, OpenAI, OpenAI Codex auth, xAI, Krea). Pass `image_url` to edit an image and `reference_image_urls` for style references; omit both for text-to-image. The model is user-configured and not selectable by the agent. Returns a single image URL or local path. | FAL_KEY / OPENAI_API_KEY / Codex OAuth / xAI OAuth / KREA_API_KEY |
+| `image_generate` | Generate images from text prompts (text-to-image) or edit/transform an existing image (image-to-image) via the user-configured backend (FAL.ai, OpenAI, OpenAI Codex auth, xAI, Krea). Pass `image_url` to edit an image and `reference_image_urls` for style references; omit both for text-to-image. The model is user-configured and not selectable by the agent. Returns a single image URL or local path. | FAL_KEY / configured image key (`image_gen.<provider>.key_env`) / Codex OAuth / xAI OAuth / KREA_API_KEY |
 
 ## `kanban` toolset
 
@@ -396,4 +396,3 @@ Registered only on the `hermes-yuanbao` platform toolset. Yuanbao is Tencent's c
 | `yb_search_sticker` | Search the built-in Yuanbao sticker (TIM face) catalogue by keyword. | Yuanbao credentials |
 | `yb_send_sticker` | Send a built-in sticker to the current Yuanbao chat. | Yuanbao credentials |
 
-
diff --git a/website/docs/user-guide/features/image-generation.md b/website/docs/user-guide/features/image-generation.md
index c5a753eb42..cae6b453c4 100644
--- a/website/docs/user-guide/features/image-generation.md
+++ b/website/docs/user-guide/features/image-generation.md
@@ -160,7 +160,9 @@ Existing provider and model defaults are unchanged.
 ## OpenAI API: GPT Image 2.5
 
 The **OpenAI** provider supports GPT Image 2.5 Flare (fast everyday creation)
-and Sunburst (precision generation and editing), using `OPENAI_API_KEY`.
+and Sunburst (precision generation and editing). By default it uses
+`OPENAI_API_KEY`; set `image_gen.openai.key_env` to use an independent image
+credential, and `image_gen.openai.base_url` for an OpenAI-compatible gateway.
 Select them through `hermes tools` → Image Generation → OpenAI, or set:
 
 ```bash
@@ -168,6 +170,16 @@ hermes config set image_gen.provider openai
 hermes config set image_gen.openai.model gpt-image-2.5-flare
 ```
 
+For example, to keep image access on a separate credential:
+
+```yaml
+image_gen:
+  provider: openai
+  openai:
+    key_env: OPENAI_IMAGE_GEN_API_KEY
+    base_url: http://127.0.0.1:3020/v1
+```
+
 `gpt-image-2.5-flare` and `gpt-image-2.5-sunburst` use automatic quality.
 Append `-low`, `-medium`, `-high`, `-xhigh`, or `-max` to select a fixed quality,
 for example `gpt-image-2.5-sunburst-high`. Both support generation and editing