feat(tui): add a Vim-style terminal workspace

AGENTS.md

@@ -93,7 +93,7 @@ attachment and optional App-control MCP tools are separate user choices.
   transport, never the caller's Origin. Uvicorn trusts forwarded transport
   metadata only from loopback Caddy. Never put tokens in URLs or protocol
   message bodies; logging redacts token/password fields.
-- **Protocol version gate**: current wire protocol v66 is declared by
+- **Protocol version gate**: current wire protocol v67 is declared by
   `PROTOCOL_VERSION` in both `protocol.py` and `web/src/protocol.ts`.
   `deserialize` hard-rejects a version mismatch, and
   `_Base` is `extra="forbid"`, so ANY protocol change must be deployed to all

CHANGELOG.md

@@ -13,6 +13,10 @@
   Claude-branded observations keep working, including Vertex/enterprise forms
   such as `claude-sonnet-4-5@20250929`. Official `claude-*` selections and
   native takeover are unchanged.
+- Add atomic server-owned queue reordering (protocol v67), with configurable
+  TUI editing, cancellation and ordering controls. Reject stale queue snapshots
+  and changes while a message is starting. Deploy Relay, Web, Wrapper and TUI
+  together; protocol v66 clients cannot connect to protocol v67 services.
 - Backport shared improvements from the DSH branch without adding a third
   engine (protocol v66): rounded Claude/Codex Goal dialogs with native save
   confirmation and mobile keyboard recovery; directory links open `/open`, and

CHANGELOG_zh.md

@@ -10,6 +10,9 @@
   不能覆盖显式选择，网关的原始上游名称不会冒充用户选定的模型。带 Claude 品牌
   的观测值依旧可用，包括 Vertex/企业版形式如 `claude-sonnet-4-5@20250929`。
   官方 `claude-*` 选择与原生接管行为保持不变。
+- 新增服务端队列原子排序（protocol v67），TUI 编辑、取消及排序操作支持配置
+  快捷键。拒绝基于过期队列的排序和消息启动期间的调整。Relay、Web、Wrapper
+  与 TUI 必须一起升级；protocol v66 客户端不能连接 protocol v67 服务。
 - 整合 DSH 分支中的通用改进，保留 Claude/Codex 双引擎（protocol v66）：圆角
   Goal 小窗等待原生保存确认，恢复手机键盘收起后的布局；目录链接接入 `/open`，
   XLSX 可预览已保存的单元格、切换工作表并下载原文件。

CLAUDE.md

@@ -88,7 +88,7 @@ a separate choice; sharing alone does not authorize them.
   `useLayoutEffect` is deliberately dependency-free — late virtualizer/image
   measurements settle without a React render, and constraining it to its read
   set reintroduces a full-viewport jump on touch release.
-- **Protocol version gate**: current wire protocol v66 is declared by
+- **Protocol version gate**: current wire protocol v67 is declared by
   `PROTOCOL_VERSION` in both `protocol.py` and `web/src/protocol.ts`.
   `deserialize` hard-rejects a version mismatch, and
   `_Base` is `extra="forbid"`, so ANY protocol change must be deployed to all

README.md

@@ -4,7 +4,7 @@
 
 自托管 · 多会话 · 多设备 · 实时工具过程 · Code / Work · PWA
 
-**产品版本：v3.0.0** · Wire protocol v66
+**产品版本：v3.0.0** · Wire protocol v67
 
 [English](README_en.md) · [功能对照](#引擎与功能) · [快速开始](#快速开始) ·
 [安装与升级](#安装与升级) · [文档](#文档) · [更新记录](CHANGELOG_zh.md)
@@ -267,6 +267,17 @@ Code 默认权限较宽；Work 的私有目录策略不能替代独立系统用
 | [Codex App 工具](docs/codex-app-tools.md) | 可选 App-control MCP |
 | [更新记录](CHANGELOG_zh.md) | 版本变化与迁移记录 |
 
+## 终端工作台（预览）
+
+不习惯网页时，可以使用内置的 Python/Textual 全屏 TUI。它与网页共享
+relay/wrapper 会话，提供会话标签、Space e 目录树及搜索、Vim 风格阅读与输入
+模式、消息跳转，以及不改变阅读位置的复制和引用。
+支持思考/工具/进程详情、运行计时、Goal/Plan、
+用量、队列编辑及共享会话控制；支持 Markdown 预览和兼容终端的图片显示，
+其他图形内容保留明确的网页入口。
+安装、快捷键及终端边界见
+[终端工作台中文指南](docs/tui_zh.md)。原逐行客户端可用 `--line-mode` 启动。
+
 ## 开发
 
 前端使用 Node 24；Python 依赖按仓库锁文件安装。常用零模型测试：

README_en.md

@@ -4,7 +4,7 @@
 
 Self-hosted · Multiple sessions and devices · Live tool activity · Code / Work · PWA
 
-**Product version: v3.0.0** · Wire protocol v66
+**Product version: v3.0.0** · Wire protocol v67
 
 [中文](README.md) · [Engine comparison](#engines-and-features) · [Quick start](#quick-start) ·
 [Install and upgrade](#install-and-upgrade) · [Documentation](#documentation) · [Changelog](CHANGELOG.md)
@@ -306,6 +306,18 @@ policy is not a replacement for separate OS users, containers or virtual machine
 | [Codex App tools](docs/codex-app-tools.md) | Optional App-control MCP |
 | [Changelog](CHANGELOG.md) | Version changes and migrations |
 
+## Terminal workspace (preview)
+
+The built-in Python/Textual TUI shares relay/wrapper sessions with Web. It
+provides session tabs, a Space e directory tree with search, Vim-style reading
+and input modes, message jumps, and copy/quote actions that retain the reading
+position. Thinking/tool/process
+details, elapsed time, Goal/Plan, usage, queue editing and shared session
+controls are available. Markdown and compatible-terminal image previews are
+built in; other graphical content has an explicit Web handoff.
+See the [terminal workspace guide](docs/tui.md) for installation, keys and
+terminal boundaries. Use `--line-mode` for the original line-oriented client.
+
 ## Development
 
 Use Node 24 for the web client and the repository's Python dependency locks.

cc_remote/protocol.py

@@ -28,7 +28,7 @@
     MAX_SINGLE_ATTACHMENT_BYTES,
 )
 
-PROTOCOL_VERSION = 66
+PROTOCOL_VERSION = 67
 
 # Codex Desktop renders a 53-week daily token-activity calendar. Keep the wire
 # payload to that same bounded window so an account response can never turn a
@@ -376,6 +376,25 @@ class CancelQueuedQuery(_Command):
     client_id: WireId
 
 
+class ReorderQueuedQueries(_Command):
+    """Compare-and-swap the server queue order without resubmitting prompts."""
+
+    type: Literal["reorder_queued_queries"] = "reorder_queued_queries"
+    sid: WireId
+    cmd_id: WireId
+    client_id: WireId
+    expected: list[WireId] = Field(max_length=MAX_QUERY_QUEUE_ITEMS)
+    order: list[WireId] = Field(max_length=MAX_QUERY_QUEUE_ITEMS)
+
+    @model_validator(mode="after")
+    def permutation(self):
+        if (len(set(self.expected)) != len(self.expected)
+                or len(set(self.order)) != len(self.order)
+                or set(self.expected) != set(self.order)):
+            raise ValueError("queue order must be a unique permutation")
+        return self
+
+
 class GetQueuedQuery(_Command):
     """Read one wrapper-owned query without putting its payload in the ring."""
 
@@ -436,7 +455,7 @@ class QueuedQueryInfo(BaseModel):
 
 
 class QueryQueueState(_Base):
-    """Authoritative per-session wrapper queue, newest replacement first."""
+    """Authoritative per-session wrapper queue in execution order."""
 
     type: Literal["query_queue"] = "query_queue"
     items: list[QueuedQueryInfo] = Field(
@@ -2806,6 +2825,7 @@ def unread_requires_identity(self):
 
 
 AnyMessage = Union[
+    ReorderQueuedQueries,
     BrowseFiles, FilesListed, SetCodexContext, CodexContext,
     GetTurnFileChanges, TurnFileChangesPage,
     Hello, Query, CancelQueuedQuery, GetQueuedQuery, QueuedQueryDetail, UpdateQueuedQuery, QueuedQueryUpdated, QueryQueueState, Steer, Interrupt, Takeover, TakeoverState, SessionControl, SetModel, SetEffort, SetAutoCompact, SetServiceTier, SetCollaborationMode, SetPerm, GetPermissionProfiles, SetPermissionProfile, SetWebSearch, Fast, CollaborationMode, OpenBtw, CloseBtw, SyncBtw, BtwOpened, BtwSync, BtwClosed, GetContext, GetStatus, ConsumeRateLimitResetCredit, GetDiff, GetFilePreview, SaveMarkdown, GetPreviewAsset, AuthorizePreview, GetHistory, GetTurnDetail, GetAgentDetail, GetHistoryImage, GetModels, GetEngineCapabilities, ManageEnginePlugin, ManageEngineSkill, ManageEngineHook, ListSessions, SwitchSession, NewSession, DeleteWorkSession, DeleteSession, RollbackSession, RollbackResult, CompactSession, StartReview, GetWorkDashboard, CreateWorkProject, DeleteWorkProject, AddWorkSource, DeleteWorkSource, CreateWorkPlugin, DeleteWorkPlugin, CreateWorkSchedule, DeleteWorkSchedule, GetWorkArtifacts, ListDir, Ping, Pong, CommandAck,
@@ -2842,6 +2862,7 @@ def unread_requires_identity(self):
     "hello": Hello,
     "query": Query,
     "cancel_queued_query": CancelQueuedQuery,
+    "reorder_queued_queries": ReorderQueuedQueries,
     "get_queued_query": GetQueuedQuery,
     "queued_query_detail": QueuedQueryDetail,
     "update_queued_query": UpdateQueuedQuery,