diff --git a/CHANGELOG.md b/CHANGELOG.md
index a1a8866..954c4d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,25 @@
 
 本项目所有值得注意的变更都记录在此文件中。
 
+## 3.8.1-32 - 2026-09-06
+
+### 新增（回归防护网补缺：6 个测试文件 46 条用例 + 1 个缺陷锁定）
+
+- **补齐「源码有、测试无」的六个真实覆盖缺口**（test/tool-group-view.test.ts、test/command.test.ts、test/protocol-part-view.test.ts、test/renderable.test.ts、test/plugin-protocol.test.ts、test/clipboard-text.test.ts，由 Hopper（TestEngineerAgent）按回归防护职责补写；版本号 bump 留待发版流程统一处理）。
+  - 为什么改：用户要求为 zcode-cli 织回归防护网、防止新功能改坏已有功能。全量源码 ↔ 测试映射摸底发现：80 个既有测试已覆盖绝大多数模块（含经其它测试文件间接覆盖的 bigmodel-users / color-scheme / update-available-view / login-flow 导出函数），但六个模块零直接测试——tool-group-view（工具分组折叠摘要，TUI 高频视觉路径）、command（captureCommand 子进程捕获，zai-oauth / darwin-oauth-callback / update 三处依赖的基础工具）、protocol-part-view（五类协议 part 渲染，仅被 registry 测试顺带 import）、renderable（三个组件类型守卫）、plugin-protocol（插件方法名协议契约表）、clipboard-text（Ctrl+V 智能粘贴，3.8.1-23 新增功能）。
+  - 改了什么：六个新测试文件共 46 条用例，全部锁定当前行为契约——tool-group-view 10 条（成员增删、展开传播、隐藏内容、搜索文本拼接、折叠摘要的单复数 / read-search 分组 / 进行中失败中断的图标优先级、展开时空行分隔）；command 5 条（stdout/stderr 分离捕获、非零退出码、多行输出、启动失败契约）；protocol-part-view 14 条（可见性过滤、file 的 url 藏于展开态、retry/compaction/subagent/agent 渲染、搜索文本、update() 换装）；renderable 6 条（三守卫正反分支）；plugin-protocol 4 条（11 个方法名逐字锁定 + workspace 路径归一）；clipboard-text 2 条（跨平台返回契约 + darwin pbpaste 专项，linux CI 无剪贴板工具走 undefined 路径）。
+  - 缺陷发现（先红后绿纪律，未修实现——修复归开发侧，已记 TODO T5）：command.test.ts 一条用例以 `test.failing` 锁定——captureCommand 在目标二进制不存在时设计意图是返回 `{ code: 1, stderr: 启动错误 }`，实测抛 `ERR_STREAM_PREMATURE_CLOSE`（error 事件后子进程流提前关闭，readText 的异步迭代先于 Promise.all reject）；影响 update（用户未装 gh）与 zai-oauth 打开浏览器的降级路径。修复后去掉 .failing 标记即可，若实现先达标 bun 会反向报错提醒。
+  - 验证：全量 `bun test` 746 pass / 0 fail（84 files，含新增 6 文件 46 条）；`tsc --noEmit` 通过。
+  - 配套治理（2026-09-06 同日，Hopper 配置）：main 分支保护已启用——required status check `validate`（strict）、Require pull request before merging（0 approvals，单人可自合并）、enforce_admins、禁 force push、禁删分支。此后所有改动必须走 feature 分支 + PR、CI 绿灯才能进 main，直接 push main 会被拒绝（按 GitHub 官方文档语义：required checks 拦未验证 commit、Require PR 完全禁直接 push）。注意：本仓库是 fork（上游 kingsword09/zcode-cli），GitHub 对 fork 的 workflow 默认不随 push 自动运行——首次走 PR 前先在 Actions 页签确认 workflows 已启用，否则 PR 会等不到 `validate` 检查。
+
+### 修复
+
+- **未登录时 `/model` 列表选官方条目（如 `bigmodel/glm-5.3`）完全不能用：模型切换现在把无凭证的官方槽位引用解析到同 provider 的 env 槽（custom-provider）**（src/identity.ts、packages/zcode-tui/src/selectors.ts、packages/zcode-tui/src/index.ts、test/identity.test.ts、test/selectors.test.ts，版本号 bump 至 3.8.1-32：VERSION、package.json、test/update.test.ts、三版 README 徽章与安装 URL）。
+  - 为什么改：用户报告 3.8.1-31 的列表去重有 bug——`env-` 前缀条目被剔除后，未登录（无 vault 登录、官方槽无 key）时选中官方条目 `bigmodel/glm-5.3` 完全不能用，而它已是该模型在列表里的唯一路径；用户要求列表里剩下的所有模型选项不管登录与否都能用、未登录走 custom-provider 逻辑。根因：去重保留官方条目、删掉 env 槽条目，但官方 `bigmodel` 槽位归 `/login` 管、未登录时没有凭证，`setModel("bigmodel/glm-5.3")` 发给 runtime 后无 key 可用；真正带 key 的 `env-bigmodel` 槽位条目恰好被去重删掉了。
+  - 改了什么：① src/identity.ts 新增 `resolveModelSlotRef()`：官方槽引用（`<provider>/<model>`）在该 provider 有 vault 登录或官方槽 key 时原样返回；两者皆无而 `env-<provider>` 槽位带 key 且声明了该模型时回退为 env 槽引用（按 provider 独立判定——登录 zai 不影响选 bigmodel 模型时的回退）；已是 env 槽引用、env 槽未声明该模型或无带 key 的 env 槽则原样返回。② TUI 三个模型切换入口——`/model` 选择列表与快捷循环切换共用的 `switchTransientModel`（手输 `/model <provider/model>` 也汇入此处）、`/settings → Model providers` 保存后的会话应用——发桥前一律过 `resolveModelSlotRef()`；`/settings` 持久化写进 config.json 的 main/lite 同样写解析后的槽位引用，未登录时保存的块直接指向可用的 env 槽（登录后的 `switchModelBlockToOfficialProvider` 迁移语义不变）。③ selectors.ts 的 current 标注改为双形式匹配（内部槽位形式 `env-<provider>/<model>` 与显示形式 `<provider>/<model>`），修复去重后 config 保存值（env 槽形式）与列表条目（官方形式）对不上导致「current」标记与 `/settings` 预选丢失的显示回归（3.8.1-31 引入）；`/settings` 的 main/lite 预选查找同步双形式匹配。
+  - 溯源与防回归评估：3.8.1-31 的去重方向（每个模型只显示一次、官方条目胜出）保持不变——修复不动 `withoutEnvSlotTwins()` 的取舍，只把「未登录时 env 槽是唯一可用路径」的事实从显示层（保留 env 独有条目）补到切换层（官方条目在运行时解析回 env 槽）；env 独有条目（无官方孪生）原样保留、原样可用；登录态（vault token 或官方槽 key）行为与 3.8.1-31 完全一致（原样走官方槽）；3.8.1-26 的「未登录时 env 文件是 model block 权威」语义不受影响——`/settings` 未登录保存写 env 槽引用，与 launcher 启动同步写的方向一致。
+  - 验证：`tsc --noEmit` 通过；identity 单测新增 7 用例（未登录回退、env 槽未声明该模型原样、无带 key env 槽原样、官方槽 key 原样、vault token 原样、跨 provider 独立判定、env 引用与无斜杠别名原样），selectors 单测新增 2 用例（current 标注以 env 槽形式匹配官方孪生：flat picker 与 provider 级联）；全量 `bun test` 746 pass / 0 fail（84 files）；TUI 冒烟 5 项全过（`build:tui` 重建后 vendor 内 `@zcode/tui` 副本按 `installLocalTui` 同步骤手动同步）。
+
 ## 3.8.1-31 - 2026-09-06
 
 ### 变更
diff --git a/README.md b/README.md
index 09d68e1..236c4f1 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 ![ZCode CLI](./assets/logo.svg)
 
 [![License](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
-[![Version](https://img.shields.io/badge/Version-3.8.1--31-blue.svg)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-3.8.1--32-blue.svg)](./CHANGELOG.md)
 [![Type](https://img.shields.io/badge/Type-CLI_Tool-blue.svg)]()
 
 English | [简体中文](README_zh_hans.md) | [繁體中文](README_zh_hant.md)
@@ -29,7 +29,7 @@ redistribute the extracted runtime before publishing a release.
 ## Quick start
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 zcode
 ```
 
@@ -59,9 +59,9 @@ Reopen it anytime with `/setup`; press Esc to skip.
 ## Install and update
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 # or
-bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 ```
 
 GitHub Releases are the only distribution channel; the project does not
diff --git a/README_zh_hans.md b/README_zh_hans.md
index 41e2bb1..e922c1c 100644
--- a/README_zh_hans.md
+++ b/README_zh_hans.md
@@ -5,7 +5,7 @@
 ![ZCode CLI](./assets/logo.svg)
 
 [![License](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
-[![Version](https://img.shields.io/badge/Version-3.8.1--31-blue.svg)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-3.8.1--32-blue.svg)](./CHANGELOG.md)
 [![Type](https://img.shields.io/badge/Type-CLI_Tool-blue.svg)]()
 
 [English](README.md) | 简体中文 | [繁體中文](README_zh_hant.md)
@@ -26,7 +26,7 @@
 ## 快速开始
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 zcode
 ```
 
@@ -54,9 +54,9 @@ zcode
 ## 安装与更新
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 # 或
-bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 ```
 
 GitHub Release 是唯一的分发渠道，本项目不发布到 npm。包装名为
diff --git a/README_zh_hant.md b/README_zh_hant.md
index 51c0414..c56859a 100644
--- a/README_zh_hant.md
+++ b/README_zh_hant.md
@@ -5,7 +5,7 @@
 ![ZCode CLI](./assets/logo.svg)
 
 [![License](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE.md)
-[![Version](https://img.shields.io/badge/Version-3.8.1--31-blue.svg)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-3.8.1--32-blue.svg)](./CHANGELOG.md)
 [![Type](https://img.shields.io/badge/Type-CLI_Tool-blue.svg)]()
 
 [English](README.md) | [简体中文](README_zh_hans.md) | 繁體中文
@@ -26,7 +26,7 @@
 ## 快速開始
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 zcode
 ```
 
@@ -54,9 +54,9 @@ zcode
 ## 安裝與更新
 
 ```bash
-npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+npm install -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 # 或
-bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-31.tgz
+bun add -g https://github.com/xhqing/zcode-cli/releases/latest/download/zcode-cli-3.8.1-32.tgz
 ```
 
 GitHub Release 是唯一的分發渠道，本項目不發布到 npm。包名為
diff --git a/TODO.md b/TODO.md
index c2e8621..dd83cd8 100644
--- a/TODO.md
+++ b/TODO.md
@@ -8,6 +8,7 @@
 ## 🟠 橙色紧急度（边界情况出错 / 防护缺口 / 口径不一致，排在红色紧急度之后计划处理）
 
 - [ ] **T2** **客户端设置保存改为「读盘合并」写入，防止用进程内存旧配置快照整体重写 `~/.zcode/cli/config.json`、冲掉外部对配置的修改（含 hooks 挂载）**。**为什么**：2026-09-04 实测事故（T1 转登材料）——一次客户端设置保存把进程内存中的旧配置快照整体写回用户级 config.json，把外部对 hooks 段的修改（DayTradingAgent 上移到用户级的两条安全 hook）静默冲掉；不修的话，任何经客户端保存设置的时点都可能无声丢配置。T1 落地后项目级 hooks 走 trust store 单源、DayTradingAgent 也将撤回用户级挂载，敞口收窄，但用户级 hooks 段及其它外部工具对 config.json 的修改仍会被冲。**做什么**：定位设置保存路径（TUI 侧 `/config` 类命令或 runtime 侧 config 写入点），把「内存快照整体写回」改为「写前读盘 → 只合并本次编辑目标字段 → 写回」，或至少保留非编辑目标的段（hooks 等）。**验证口径**：外部修改 config.json 的 hooks 段 → 经 TUI 保存任一设置 → hooks 段原样保留。（记录：2026-09-04 13:10，由 T1 同源风险提示裁定立项）
+- [ ] **T5** **修复 `captureCommand`（src/command.ts）启动失败路径抛 `ERR_STREAM_PREMATURE_CLOSE`，实现设计意图的 `{ code: 1, stderr: 启动错误 }` 降级返回**。**为什么**：2026-09-06 Hopper 补回归用例时发现（test/command.test.ts 已用 `test.failing` 锁定契约）——spawn 的 error 事件触发后子进程 stdout/stderr 流提前关闭，`readText()` 的异步迭代先于 `Promise.all` reject，整个调用抛异常而非返回结果；`launchError` 分支（`stderr || launchError`）实际永远不可达。受影响调用方：update.ts 调 `gh`（用户未装 gh 时本应优雅报 code 1 + 提示，实际未捕获异常）、zai-oauth.ts / darwin-oauth-callback.ts 打开浏览器。**做什么**（实现归开发侧）：error 路径下不迭代已关闭的流（如 readText 捕获 premature close 返回已收内容、或 error 事件后直接短路读取）。**验证口径**：`captureCommand("/nonexistent-binary", [])` 返回 `{ code: 1, stderr: 非空 }` 不抛异常；修复后去掉 test/command.test.ts 里该用例的 `.failing` 标记（bun 会先反向报错提醒）。（记录：2026-09-06 13:26，Hopper 回归防护网补缺时发现立项）
 
 ## 🟢 绿色紧急度（计划类新功能实现 / 改造方案落地，按计划排期推进）
 
diff --git a/VERSION b/VERSION
index acaf4e6..4c3f491 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.8.1-31
+3.8.1-32
diff --git a/package.json b/package.json
index f5f7791..4deffdd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zcode-cli",
-  "version": "3.8.1-31",
+  "version": "3.8.1-32",
   "description": "Unofficial terminal client for the ZCode agent runtime",
   "keywords": [
     "agent",
diff --git a/packages/zcode-tui/src/index.ts b/packages/zcode-tui/src/index.ts
index 62d83b6..b906277 100644
--- a/packages/zcode-tui/src/index.ts
+++ b/packages/zcode-tui/src/index.ts
@@ -27,7 +27,8 @@ import {
   clearIdentitiesWithChangedKeys,
   clearOAuthLoginCredentials,
   readBigModelKeyNameHint,
-  readProviderApiKeySnapshot
+  readProviderApiKeySnapshot,
+  resolveModelSlotRef
 } from "../../../src/identity.ts";
 import { displayModelRef } from "../../../src/env-config.ts";
 import { resolveBigmodelUserName, writeBigmodelUserName } from "../../../src/bigmodel-users.ts";
@@ -3345,7 +3346,11 @@ class ZCodeTui {
     this.settingSwitchInFlight = true;
     try {
       const previousModel = this.model;
-      const result = await this.options.setTransientModel(modelId);
+      // The picked id may be the official-slot twin of a custom-provider slot
+      // (the deduplicated picker keeps only the official entry). While that
+      // provider has no stored login, the official slot has no credential, so
+      // the switch targets the credentialed env slot instead.
+      const result = await this.options.setTransientModel(await resolveModelSlotRef(modelId));
       await this.handleResult(result, false, "model");
       const status = this.model === previousModel ? "already active" : "now";
       this.addNotice(
@@ -3389,12 +3394,17 @@ class ZCodeTui {
 
     // Preselect from the saved config value only: it keeps the internal
     // `<slot>/<model>` form this.model no longer carries (the display form
-    // has the env- prefix stripped).
+    // has the env- prefix stripped). Match either form — after the
+    // env-slot-twin dedup the listed value is the official id while the saved
+    // block may still point at the env slot, and env-only entries keep the
+    // prefixed id.
     const cascade = providerModelPicker(this.modelOptions, savedModel);
     if (!cascade || cascade.providers.items.length === 0) {
       this.addNotice("No model providers available to configure.", "muted");
       return;
     }
+    const savedModelIds = new Set(savedModel ? [savedModel, displayModelRef(savedModel)] : []);
+    const savedLiteIds = new Set(savedLite ? [savedLite, displayModelRef(savedLite)] : []);
 
     let providerIndex = cascade.providers.selectedIndex;
     while (!this.stopped) {
@@ -3417,7 +3427,7 @@ class ZCodeTui {
       let confirmed = false;
       // Track the in-progress main selection so Esc at lite returns to the
       // model the user just chose, not the saved default.
-      let mainIndex = group.models.items.findIndex((item) => item.value === savedModel);
+      let mainIndex = group.models.items.findIndex((item) => savedModelIds.has(item.value));
       if (mainIndex < 0) mainIndex = group.models.selectedIndex;
       while (!this.stopped && !confirmed) {
         // Level 2 — main model
@@ -3444,7 +3454,7 @@ class ZCodeTui {
         };
         const liteItems = [...liteCandidates, sameAsMainItem];
         const savedLiteIndex = liteItems.findIndex(
-          (item) => item.value === savedLite && item.value !== mainChoice.value
+          (item) => savedLiteIds.has(item.value) && item.value !== mainChoice.value
         );
         const liteChoice = await this.showChoice({
           title: `Select lite model · ${group.label}`,
@@ -3455,13 +3465,18 @@ class ZCodeTui {
         });
         if (!liteChoice) continue; // Esc → back to main selection (this while)
 
-        // Persist to config.json. A write failure surfaces as a notice and
-        // skips the session switch — the user can retry.
+        // Persist to config.json as the slot reference the switch actually
+        // targets: while signed out the official-slot twin resolves to the
+        // credentialed env slot (resolveModelSlotRef), keeping the saved block
+        // and the session application below on a usable slot. A write failure
+        // surfaces as a notice and skips the session switch — the user can retry.
+        const mainSlotRef = await resolveModelSlotRef(mainChoice.value);
+        const liteSlotRef = await resolveModelSlotRef(liteChoice.value);
         try {
           await updateUserConfig((config) => {
             const model = isRecord(config.model) ? config.model : {};
-            model.main = mainChoice.value;
-            model.lite = liteChoice.value;
+            model.main = mainSlotRef;
+            model.lite = liteSlotRef;
             config.model = model;
           });
         } catch (error) {
@@ -3477,7 +3492,7 @@ class ZCodeTui {
         );
 
         // Apply main model to the current session
-        await this.applySettingCommand(`/model ${mainChoice.value}`, "model");
+        await this.applySettingCommand(`/model ${mainSlotRef}`, "model");
         confirmed = true;
       }
       // Return to the settings menu after a successful cascade instead of
diff --git a/packages/zcode-tui/src/selectors.ts b/packages/zcode-tui/src/selectors.ts
index 5213076..f99fefd 100644
--- a/packages/zcode-tui/src/selectors.ts
+++ b/packages/zcode-tui/src/selectors.ts
@@ -1,4 +1,4 @@
-import { displayProviderId, envProviderSlotPrefix } from "../../../src/env-config.ts";
+import { displayModelRef, displayProviderId, envProviderSlotPrefix } from "../../../src/env-config.ts";
 
 import { asString, isRecord } from "./types.ts";
 
@@ -112,12 +112,13 @@ function officialTwinId(id: string): string | undefined {
 
 /**
  * Filters out env-file slot entries whose official-slot twin is also listed.
- * While signed in, a provider also configured through custom-provider.env
- * lists its models in both the official slot and the env-file slot — the
- * runtime reports both, and pickers must show each model once (the official
- * entry wins; its id matches the displayed current model). Env-only entries
- * without an official twin stay: they are the only access path while signed
- * out.
+ * A provider also configured through custom-provider.env lists its models in
+ * both the official slot and the env-file slot — the runtime reports both, and
+ * pickers show each model once (the official entry wins; its id matches the
+ * displayed current model). Env-only entries without an official twin stay.
+ * Usability is not decided here: while signed out the official slot carries no
+ * credential, and the switch path resolves the credentialed env slot instead
+ * (`resolveModelSlotRef`), so every listed model works signed in or not.
  */
 function withoutEnvSlotTwins<T>(entries: T[], idOf: (entry: T) => string): T[] {
   const officialIds = new Set(
@@ -129,6 +130,17 @@ function withoutEnvSlotTwins<T>(entries: T[], idOf: (entry: T) => string): T[] {
   });
 }
 
+/**
+ * Both the internal slot form (`env-<provider>/<model>`) and the display form
+ * (`<provider>/<model>`) of the current model reference. The saved config
+ * keeps the internal form — which after the env-slot-twin dedup may not match
+ * any listed id — so current-model marking matches either form.
+ */
+function currentModelIds(currentModel?: string): Set<string> {
+  if (!currentModel) return new Set();
+  return new Set([currentModel, displayModelRef(currentModel)]);
+}
+
 function extractModelOption(option: unknown): ModelOption | undefined {
   const record = isRecord(option) ? option : undefined;
   const id = extractModelId(record, option);
@@ -150,10 +162,10 @@ function modelLabel(option: ModelOption): string {
     : option.modelId;
 }
 
-function describeModel(option: ModelOption, currentModel?: string): string | undefined {
+function describeModel(option: ModelOption, currentIds: ReadonlySet<string>): string | undefined {
   const details = [
     option.name && option.name !== option.modelId ? option.name : undefined,
-    option.id === currentModel ? "current" : undefined
+    currentIds.has(option.id) ? "current" : undefined
   ].filter((value): value is string => Boolean(value));
   return details.length > 0 ? details.join(" · ") : undefined;
 }
@@ -181,6 +193,7 @@ export function providerModelPicker(options: unknown[], currentModel?: string):
     parsed.push(candidate);
   }
 
+  const currentIds = currentModelIds(currentModel);
   const byProvider = new Map<string, ModelOption[]>();
   for (const candidate of withoutEnvSlotTwins(parsed, (option) => option.id)) {
     const group = byProvider.get(candidate.providerId) ?? [];
@@ -196,10 +209,10 @@ export function providerModelPicker(options: unknown[], currentModel?: string):
     const items: PickerItem[] = models.map((model) => ({
       value: model.id,
       label: modelLabel(model),
-      description: describeModel(model, currentModel),
+      description: describeModel(model, currentIds),
       command: `/model ${model.id}`
     }));
-    const currentIndex = items.findIndex((item) => item.value === currentModel);
+    const currentIndex = items.findIndex((item) => currentIds.has(item.value));
     groups.push({
       providerId,
       label,
@@ -208,8 +221,8 @@ export function providerModelPicker(options: unknown[], currentModel?: string):
   }
 
   const providerItems: PickerItem[] = groups.map((group) => {
-    const currentInGroup = group.models.items.some((item) => item.value === currentModel);
-    const currentModelId = group.models.items.find((item) => item.value === currentModel)?.label;
+    const currentInGroup = group.models.items.some((item) => currentIds.has(item.value));
+    const currentModelId = group.models.items.find((item) => currentIds.has(item.value))?.label;
     return {
       value: group.providerId,
       label: group.label,
@@ -225,7 +238,7 @@ export function providerModelPicker(options: unknown[], currentModel?: string):
     providers: {
       items: providerItems,
       selectedIndex: providerItems.findIndex((item) =>
-        groups[providerItems.indexOf(item)]!.models.items.some((m) => m.value === currentModel)
+        groups[providerItems.indexOf(item)]!.models.items.some((m) => currentIds.has(m.value))
       )
     },
     groups
@@ -241,12 +254,13 @@ export function modelPicker(options: unknown[], currentModel?: string): PickerSp
     records.set(id, record);
   }
 
+  const currentIds = currentModelIds(currentModel);
   const items: PickerItem[] = withoutEnvSlotTwins([...records.keys()], (id) => id).map((id) => {
     const record = records.get(id);
     const details = [
       asString(record?.name) !== id ? asString(record?.name) : undefined,
       asString(record?.alias),
-      id === currentModel ? "current" : undefined
+      currentIds.has(id) ? "current" : undefined
     ].filter((value): value is string => Boolean(value));
     return {
       value: id,
@@ -256,7 +270,7 @@ export function modelPicker(options: unknown[], currentModel?: string): PickerSp
     };
   });
 
-  const currentIndex = items.findIndex((item) => item.value === currentModel);
+  const currentIndex = items.findIndex((item) => currentIds.has(item.value));
   return { items, selectedIndex: currentIndex >= 0 ? currentIndex : 0 };
 }
 
diff --git a/src/identity.ts b/src/identity.ts
index 0931399..277b696 100644
--- a/src/identity.ts
+++ b/src/identity.ts
@@ -2,7 +2,7 @@ import { readFile, writeFile } from "node:fs/promises";
 import type { Writable } from "node:stream";
 
 import { bigmodelUsersPath, resolveBigmodelUserName } from "./bigmodel-users.ts";
-import { displayProviderId } from "./env-config.ts";
+import { displayProviderId, envProviderSlotPrefix } from "./env-config.ts";
 import { updateUserConfig, userConfigPath } from "./model-access.ts";
 import { credentialsFilePath, decryptCredential, encryptCredential, maskApiKey } from "./usage.ts";
 
@@ -16,7 +16,7 @@ const maxNameLength = 64;
 
 interface UserConfigShape {
   model?: { main?: unknown };
-  provider?: Record<string, { options?: { apiKey?: unknown } } | undefined>;
+  provider?: Record<string, { models?: Record<string, unknown>; options?: { apiKey?: unknown } } | undefined>;
 }
 
 interface StoredUserInfo {
@@ -141,6 +141,47 @@ export async function readSignedInProvider(
   }
 }
 
+/**
+ * The config-slot model reference a switch should actually target. An
+ * official-slot reference (`<provider>/<model>` for zai/bigmodel) stays as-is
+ * while that provider has a stored login — a vault token or a key pasted into
+ * the official slot. With neither, the official slot has no credential and the
+ * same provider's custom-provider slot (`env-<provider>`) is the only working
+ * path, so the reference falls back to it. This is what keeps every entry of
+ * the deduplicated /model picker usable while signed out: the picker shows the
+ * official twin, the switch targets the env slot. References already pointing
+ * at an env slot, naming a provider without a credentialed env slot, or naming
+ * a model the env slot does not declare are returned unchanged.
+ */
+export async function resolveModelSlotRef(
+  model: string,
+  env: NodeJS.ProcessEnv = process.env
+): Promise<string> {
+  const separator = model.indexOf("/");
+  if (separator <= 0 || separator === model.length - 1) return model;
+  const providerId = model.slice(0, separator);
+  if (providerId.startsWith(envProviderSlotPrefix)) return model;
+  if (await readStoredOAuthLogin(env) === providerId) return model;
+
+  let config: UserConfigShape;
+  try {
+    config = JSON.parse(await readFile(userConfigPath(env), "utf8")) as UserConfigShape;
+  } catch {
+    return model;
+  }
+  const slotApiKey = (slot: { options?: { apiKey?: unknown } } | undefined): string | undefined => {
+    const apiKey = slot?.options?.apiKey;
+    return typeof apiKey === "string" && apiKey.trim() ? apiKey : undefined;
+  };
+  if (slotApiKey(config.provider?.[providerId])) return model;
+
+  const envSlot = config.provider?.[envProviderSlotPrefix + providerId];
+  if (!slotApiKey(envSlot)) return model;
+  const modelId = model.slice(separator + 1);
+  if (!envSlot?.models || !(modelId in envSlot.models)) return model;
+  return `${envProviderSlotPrefix}${providerId}/${modelId}`;
+}
+
 export interface LoginIdentitySnapshot {
   /** Display-facing provider id: the `env-` slot prefix is already stripped. */
   providerId: string;
diff --git a/test/clipboard-text.test.ts b/test/clipboard-text.test.ts
new file mode 100644
index 0000000..717622c
--- /dev/null
+++ b/test/clipboard-text.test.ts
@@ -0,0 +1,18 @@
+import { describe, expect, test } from "bun:test";
+
+import { defaultReadClipboardText } from "../packages/zcode-tui/src/clipboard-text.ts";
+
+describe("clipboard text reading contract", () => {
+  test("never throws and resolves to a string or undefined", async () => {
+    const text = await defaultReadClipboardText();
+    expect(["string", "undefined"]).toContain(typeof text);
+  });
+
+  // darwin always ships pbpaste, so the read resolves (an empty clipboard is
+  // the valid "" result). Linux CI runners have neither wl-paste nor xclip,
+  // which exercises the undefined path instead.
+  test.skipIf(process.platform !== "darwin")("darwin resolves through pbpaste", async () => {
+    const text = await defaultReadClipboardText();
+    expect(typeof text).toBe("string");
+  });
+});
diff --git a/test/command.test.ts b/test/command.test.ts
new file mode 100644
index 0000000..a00f013
--- /dev/null
+++ b/test/command.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, test } from "bun:test";
+
+import { captureCommand } from "../src/command.ts";
+
+describe("captureCommand", () => {
+  test("captures stdout with a zero exit code", async () => {
+    const result = await captureCommand("/bin/echo", ["hello"]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toBe("hello\n");
+    expect(result.stderr).toBe("");
+  });
+
+  test("captures stderr separately from stdout", async () => {
+    const result = await captureCommand("/bin/sh", ["-c", "echo out; echo err >&2"]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toBe("out\n");
+    expect(result.stderr).toBe("err\n");
+  });
+
+  test("reports the child's non-zero exit code", async () => {
+    const result = await captureCommand("/bin/sh", ["-c", "exit 3"]);
+    expect(result.code).toBe(3);
+    expect(result.stdout).toBe("");
+  });
+
+  // Known defect (reported to the owner, fix belongs to the developing agent):
+  // on a launch failure the child streams close before the async iterators in
+  // readText finish, so the whole call rejects with ERR_STREAM_PREMATURE_CLOSE
+  // instead of resolving to { code: 1, stderr: launchError }. The case stays
+  // as test.failing so the expected contract is locked while CI stays actionable;
+  // drop the .failing marker once the implementation handles the error path.
+  test.failing("a missing binary resolves to code 1 with the launch error in stderr", async () => {
+    const result = await captureCommand("/nonexistent-zcode-test-binary", ["--flag"]);
+    expect(result.code).toBe(1);
+    expect(result.stderr).not.toBe("");
+  });
+
+  test("keeps stdout and stderr intact for multi-line output", async () => {
+    const result = await captureCommand("/bin/sh", ["-c", "printf 'a\\nb\\n'; printf 'c\\nd\\n' >&2"]);
+    expect(result.code).toBe(0);
+    expect(result.stdout).toBe("a\nb\n");
+    expect(result.stderr).toBe("c\nd\n");
+  });
+});
diff --git a/test/identity.test.ts b/test/identity.test.ts
index 06327a1..cdb8564 100644
--- a/test/identity.test.ts
+++ b/test/identity.test.ts
@@ -23,6 +23,7 @@ import {
   readProviderApiKeySnapshot,
   readSignedInProvider,
   readStoredOAuthLogin,
+  resolveModelSlotRef,
   runIdentityCommand,
   runLogoutCommand
 } from "../src/identity.ts";
@@ -189,6 +190,100 @@ describe("sign-in provider detection", () => {
   });
 });
 
+describe("model slot resolution", () => {
+  // The signed-out custom-provider shape: no vault login, no official-slot
+  // key, and the credentialed env slot declaring the picked model.
+  const signedOutConfig = {
+    model: { main: "env-bigmodel/glm-5.3" },
+    provider: {
+      "env-bigmodel": {
+        options: { apiKey: "e984bb0123456789abcdefVM9e" },
+        models: { "glm-5.3": { name: "Glm 5.3" }, "glm-5-turbo": { name: "Glm 5 Turbo" } }
+      }
+    }
+  };
+
+  test("falls back to the credentialed env slot while signed out", async () => {
+    const fx = await createFixture({}, signedOutConfig);
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3", fx.env)).toBe("env-bigmodel/glm-5.3");
+      expect(await resolveModelSlotRef("bigmodel/glm-5-turbo", fx.env)).toBe("env-bigmodel/glm-5-turbo");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("keeps the official reference when the env slot does not declare the model", async () => {
+    const fx = await createFixture({}, signedOutConfig);
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3-air", fx.env)).toBe("bigmodel/glm-5.3-air");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("keeps the official reference when no credentialed env slot exists", async () => {
+    const fx = await createFixture({}, {
+      model: { main: "bigmodel/glm-5.3" },
+      provider: { "env-bigmodel": { options: { apiKey: "  " } } }
+    });
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3", fx.env)).toBe("bigmodel/glm-5.3");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("keeps the official reference when the official slot holds a key", async () => {
+    const fx = await createFixture({}, {
+      model: { main: "bigmodel/glm-5.3" },
+      provider: {
+        bigmodel: { options: { apiKey: "e984bb0123456789abcdefVM9e" } },
+        ...signedOutConfig.provider
+      }
+    });
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3", fx.env)).toBe("bigmodel/glm-5.3");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("keeps the official reference when a vault token names the provider", async () => {
+    const fx = await createFixture({
+      "oauth:bigmodel:access_token": "enc:v1:bm-token"
+    }, signedOutConfig);
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3", fx.env)).toBe("bigmodel/glm-5.3");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("falls back per provider when the login belongs to another provider", async () => {
+    const fx = await createFixture({
+      "oauth:zai:access_token": "enc:v1:zai-token"
+    }, signedOutConfig);
+    try {
+      expect(await resolveModelSlotRef("bigmodel/glm-5.3", fx.env)).toBe("env-bigmodel/glm-5.3");
+      expect(await resolveModelSlotRef("zai/glm-5.2", fx.env)).toBe("zai/glm-5.2");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+
+  test("returns env-slot references and non-reference input unchanged", async () => {
+    const fx = await createFixture({}, signedOutConfig);
+    try {
+      expect(await resolveModelSlotRef("env-bigmodel/glm-5.3", fx.env)).toBe("env-bigmodel/glm-5.3");
+      expect(await resolveModelSlotRef("main", fx.env)).toBe("main");
+      expect(await resolveModelSlotRef("custom/model", fx.env)).toBe("custom/model");
+    } finally {
+      await fx.cleanup();
+    }
+  });
+});
+
 describe("login identity snapshot", () => {
   test("prefers the stored OAuth user_info over the API key", async () => {
     const fx = await createFixture(bigmodelLogin({
diff --git a/test/plugin-protocol.test.ts b/test/plugin-protocol.test.ts
new file mode 100644
index 0000000..ec2c400
--- /dev/null
+++ b/test/plugin-protocol.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, test } from "bun:test";
+import { resolve } from "node:path";
+
+import { pluginProtocolMethods, pluginWorkspace } from "../src/plugin-protocol.ts";
+
+describe("plugin protocol method names", () => {
+  test("locks the app-server plugin method routing table", () => {
+    expect(pluginProtocolMethods).toEqual({
+      configure: "plugins/configure",
+      describe: "plugins/describe",
+      install: "plugins/install",
+      marketplaceAdd: "plugins/marketplace/add",
+      marketplaceRemove: "plugins/marketplace/remove",
+      marketplaceUpdate: "plugins/marketplace/update",
+      overview: "plugins/overview",
+      referenceCatalog: "plugins/referenceCatalog",
+      restoreBuiltin: "plugins/restoreBuiltin",
+      update: "plugins/update",
+      validate: "plugins/validate"
+    });
+  });
+});
+
+describe("plugin workspace resolution", () => {
+  test("resolves relative input to an absolute path used as the key", () => {
+    const workspace = pluginWorkspace(".");
+    expect(workspace.workspacePath).toBe(resolve("."));
+    expect(workspace.workspaceKey).toBe(workspace.workspacePath);
+  });
+
+  test("normalizes trailing separators and inner segments", () => {
+    expect(pluginWorkspace("a/b/").workspacePath).toBe(resolve("a/b"));
+    expect(pluginWorkspace("a/./b").workspacePath).toBe(resolve("a/b"));
+    expect(pluginWorkspace("a/b/").workspaceKey).toBe(pluginWorkspace("a/b").workspaceKey);
+  });
+
+  test("keeps absolute input unchanged apart from normalization", () => {
+    const workspace = pluginWorkspace("/tmp/some workspace");
+    expect(workspace.workspacePath).toBe("/tmp/some workspace");
+    expect(workspace.workspaceKey).toBe("/tmp/some workspace");
+  });
+});
diff --git a/test/protocol-part-view.test.ts b/test/protocol-part-view.test.ts
new file mode 100644
index 0000000..d17ae57
--- /dev/null
+++ b/test/protocol-part-view.test.ts
@@ -0,0 +1,152 @@
+import { describe, expect, test } from "bun:test";
+
+import type { RestoredPart } from "../packages/zcode-tui/src/events.ts";
+import { createTheme } from "../packages/zcode-tui/src/theme.ts";
+import { isVisibleProtocolPart, ProtocolPartView } from "../packages/zcode-tui/src/protocol-part-view.ts";
+
+function view(part: RestoredPart): ProtocolPartView {
+  return new ProtocolPartView(createTheme(false), part);
+}
+
+describe("visible protocol part filter", () => {
+  test("file, retry, compaction, subagent and agent parts are visible", () => {
+    expect(isVisibleProtocolPart({ type: "file", text: "f" })).toBe(true);
+    expect(isVisibleProtocolPart({ type: "retry", text: "r" })).toBe(true);
+    expect(isVisibleProtocolPart({ type: "compaction", text: "c" })).toBe(true);
+    expect(isVisibleProtocolPart({ type: "subagent", text: "s" })).toBe(true);
+    expect(isVisibleProtocolPart({ type: "agent", text: "a" })).toBe(true);
+  });
+
+  test("text, thought and tool parts stay hidden", () => {
+    expect(isVisibleProtocolPart({ type: "text", text: "hello" })).toBe(false);
+    expect(isVisibleProtocolPart({ type: "thought", text: "thinking" })).toBe(false);
+    expect(isVisibleProtocolPart({ type: "tool", toolName: "Read", status: "complete" })).toBe(false);
+  });
+});
+
+describe("file attachment part", () => {
+  const file: RestoredPart = {
+    type: "file",
+    text: "screenshot data",
+    filename: "shot.png",
+    mime: "image/png",
+    url: "https://example.test/shot.png"
+  };
+
+  test("renders the filename and mime, keeping the url behind expansion", () => {
+    const rendered = view(file).render(80).join("\n");
+    expect(rendered).toContain("Attachment");
+    expect(rendered).toContain("shot.png");
+    expect(rendered).toContain("image/png");
+    expect(rendered).not.toContain("https://example.test/shot.png");
+  });
+
+  test("expansion reveals the url and hidden content tracks it", () => {
+    const part = view(file);
+    expect(part.hasHiddenContent()).toBe(true);
+    part.setExpanded(true);
+    expect(part.render(80).join("\n")).toContain("https://example.test/shot.png");
+    expect(part.hasHiddenContent()).toBe(true);
+
+    const urlLess = view({ type: "file", text: "f", mime: "image/png" });
+    expect(urlLess.hasHiddenContent()).toBe(false);
+  });
+
+  test("search text covers the text, url and mime", () => {
+    expect(view(file).getSearchText()).toContain("screenshot data");
+    expect(view(file).getSearchText()).toContain("https://example.test/shot.png");
+    expect(view(file).getSearchText()).toContain("image/png");
+  });
+
+  test("falls back to the url, then a generic label, when no filename", () => {
+    expect(view({ type: "file", text: "f", url: "https://example.test/x.bin" }).render(80).join("\n"))
+      .toContain("https://example.test/x.bin");
+    expect(view({ type: "file", text: "f" }).render(80).join("\n")).toContain("attachment");
+  });
+});
+
+describe("retry and compaction parts", () => {
+  test("retry shows its text beside the headline", () => {
+    const withText = view({ type: "retry", text: "rate limited" }).render(80).join("\n");
+    expect(withText).toContain("Retrying model request");
+    expect(withText).toContain("rate limited");
+
+    const bare = view({ type: "retry", text: "" }).render(80);
+    expect(bare).toHaveLength(1);
+    expect(bare[0]).toContain("Retrying model request");
+  });
+
+  test("compaction appends the reason when present", () => {
+    expect(view({ type: "compaction", text: "c", reason: "context window" }).render(80).join("\n"))
+      .toContain("context window");
+    expect(view({ type: "compaction", text: "c" }).render(80).join("\n"))
+      .not.toContain("·");
+  });
+});
+
+describe("subagent part", () => {
+  const subagent: RestoredPart = {
+    type: "subagent",
+    text: "scan the code",
+    agent: "Explore",
+    prompt: "find all tests",
+    model: "glm-5.3",
+    command: "grep -r test"
+  };
+
+  test("renders agent, description and details, prompt behind expansion", () => {
+    const rendered = view(subagent).render(80).join("\n");
+    expect(rendered).toContain("Explore");
+    expect(rendered).toContain("scan the code");
+    expect(rendered).toContain("glm-5.3");
+    expect(rendered).not.toContain("find all tests");
+
+    const part = view(subagent);
+    part.setExpanded(true);
+    expect(part.render(80).join("\n")).toContain("find all tests");
+  });
+
+  test("falls back to the generic agent label and part text", () => {
+    const rendered = view({ type: "subagent", text: "background work" }).render(80).join("\n");
+    expect(rendered).toContain("Agent");
+    expect(rendered).toContain("background work");
+  });
+
+  test("hidden content and search text include prompt, command and model", () => {
+    expect(view(subagent).hasHiddenContent()).toBe(true);
+    expect(view({ type: "subagent", text: "s" }).hasHiddenContent()).toBe(false);
+
+    const search = view(subagent).getSearchText();
+    expect(search).toContain("scan the code");
+    expect(search).toContain("find all tests");
+    expect(search).toContain("grep -r test");
+    expect(search).toContain("glm-5.3");
+  });
+});
+
+describe("agent part and view updates", () => {
+  test("agent renders its name, falling back to the text", () => {
+    expect(view({ type: "agent", text: "fallback", name: "Hopper" }).render(80).join("\n"))
+      .toContain("Hopper");
+    expect(view({ type: "agent", text: "solo" }).render(80).join("\n")).toContain("solo");
+  });
+
+  test("update() swaps the rendered part", () => {
+    const part = view({ type: "file", text: "f", url: "https://example.test/a.png" });
+    expect(part.hasHiddenContent()).toBe(true);
+    part.update({ type: "file", text: "f" });
+    expect(part.hasHiddenContent()).toBe(false);
+    expect(part.render(80).join("\n")).not.toContain("https://example.test/a.png");
+  });
+
+  test("expansion state survives part updates", () => {
+    const part = view(subagentPart());
+    part.setExpanded(true);
+    part.update({ type: "retry", text: "r" });
+    expect(part.isExpanded()).toBe(true);
+  });
+});
+
+function subagentPart(): RestoredPart {
+  return { type: "subagent", text: "s", prompt: "p" };
+}
diff --git a/test/renderable.test.ts b/test/renderable.test.ts
new file mode 100644
index 0000000..c532d12
--- /dev/null
+++ b/test/renderable.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, test } from "bun:test";
+import type { Component } from "@earendil-works/pi-tui";
+
+import {
+  isExpandableComponent,
+  isSearchableComponent,
+  isWindowedComponent
+} from "../packages/zcode-tui/src/renderable.ts";
+
+function component(extra: Record<string, unknown>): Component {
+  return {
+    render: (_width: number) => [],
+    invalidate: () => {},
+    ...extra
+  } as Component;
+}
+
+describe("expandable component guard", () => {
+  test("accepts an object with the full expandable trio", () => {
+    const expandable = component({
+      setExpanded: (_expanded: boolean) => {},
+      isExpanded: () => false,
+      hasHiddenContent: () => false
+    });
+    expect(isExpandableComponent(expandable)).toBe(true);
+  });
+
+  test("rejects objects missing any of the three methods", () => {
+    expect(isExpandableComponent(component({
+      isExpanded: () => false,
+      hasHiddenContent: () => false
+    }))).toBe(false);
+    expect(isExpandableComponent(component({
+      setExpanded: (_expanded: boolean) => {},
+      hasHiddenContent: () => false
+    }))).toBe(false);
+    expect(isExpandableComponent(component({
+      setExpanded: (_expanded: boolean) => {},
+      isExpanded: () => false
+    }))).toBe(false);
+    expect(isExpandableComponent(component({}))).toBe(false);
+  });
+});
+
+describe("searchable component guard", () => {
+  test("accepts an object with getSearchText only", () => {
+    expect(isSearchableComponent(component({ getSearchText: () => "" }))).toBe(true);
+  });
+
+  test("rejects plain components", () => {
+    expect(isSearchableComponent(component({}))).toBe(false);
+  });
+});
+
+describe("windowed component guard", () => {
+  test("accepts an object with renderWindow", () => {
+    const windowed = component({ renderWindow: (_w: number, _s: number, _c: number) => ({ lines: [], totalLines: 0 }) });
+    expect(isWindowedComponent(windowed)).toBe(true);
+  });
+
+  test("rejects plain components", () => {
+    expect(isWindowedComponent(component({}))).toBe(false);
+  });
+});
diff --git a/test/selectors.test.ts b/test/selectors.test.ts
index c4fad58..b9b8a6e 100644
--- a/test/selectors.test.ts
+++ b/test/selectors.test.ts
@@ -198,6 +198,39 @@ describe("TUI selectors", () => {
     ]);
   });
 
+  test("marks the official twin current when the saved model points at the env slot", () => {
+    // Signed out: config.model.main keeps the internal slot form while the
+    // deduplicated picker lists the official twin — the current marking must
+    // match either form.
+    const picker = modelPicker([
+      { id: "env-bigmodel/glm-5.3", name: "Glm 5.3" },
+      { id: "env-bigmodel/glm-5-turbo", name: "Glm 5 Turbo" },
+      { id: "bigmodel/glm-5.3", name: "Glm 5.3" },
+      { id: "bigmodel/glm-5-turbo", name: "Glm 5 Turbo" }
+    ], "env-bigmodel/glm-5.3");
+
+    expect(picker.items.map((item) => item.value)).toEqual([
+      "bigmodel/glm-5.3",
+      "bigmodel/glm-5-turbo"
+    ]);
+    expect(picker.selectedIndex).toBe(0);
+    expect(picker.items[0]?.description).toContain("current");
+  });
+
+  test("provider cascade marks the current model from the env-slot form", () => {
+    const cascade = providerModelPicker([
+      { modelId: "glm-5.3", providerId: "env-bigmodel", name: "Glm 5.3" },
+      { modelId: "glm-5-turbo", providerId: "env-bigmodel", name: "Glm 5 Turbo" },
+      { modelId: "glm-5.3", providerId: "bigmodel", name: "Glm 5.3" },
+      { modelId: "glm-5-turbo", providerId: "bigmodel", name: "Glm 5 Turbo" }
+    ], "env-bigmodel/glm-5-turbo");
+
+    const group = cascade!.groups.find((g) => g.providerId === "bigmodel")!;
+    expect(group.models.items[1]?.description).toContain("current");
+    expect(group.models.selectedIndex).toBe(1);
+    expect(cascade!.providers.items[0]?.description).toContain("current: Glm 5 Turbo");
+  });
+
   test("provider cascade drops the env-file slot group when fully shadowed", () => {
     const cascade = providerModelPicker([
       { modelId: "glm-5.3", providerId: "env-bigmodel", name: "Glm 5.3" },
diff --git a/test/tool-group-view.test.ts b/test/tool-group-view.test.ts
new file mode 100644
index 0000000..2500023
--- /dev/null
+++ b/test/tool-group-view.test.ts
@@ -0,0 +1,141 @@
+import { describe, expect, test } from "bun:test";
+
+import { createTheme } from "../packages/zcode-tui/src/theme.ts";
+import { ToolGroupView } from "../packages/zcode-tui/src/tool-group-view.ts";
+import { ToolExecutionView } from "../packages/zcode-tui/src/tool-view.ts";
+
+interface Fixture {
+  view: ToolGroupView;
+  add: (name: string, state?: string) => ToolExecutionView;
+}
+
+function fixture(): Fixture {
+  const theme = createTheme(false);
+  const view = new ToolGroupView(theme);
+  return {
+    view,
+    add: (name, state = "complete") => {
+      const tool = new ToolExecutionView(theme, { name, state });
+      view.addTool(tool);
+      return tool;
+    }
+  };
+}
+
+describe("TUI tool group membership", () => {
+  test("tracks size and supports removing members", () => {
+    const { view, add } = fixture();
+    expect(view.size).toBe(0);
+    const read = add("Read");
+    add("Grep");
+    expect(view.size).toBe(2);
+
+    expect(view.removeTool(read)).toBe(true);
+    expect(view.size).toBe(1);
+    expect(view.removeTool(read)).toBe(false);
+  });
+
+  test("expansion propagates to existing and later-added tools", () => {
+    const { view, add } = fixture();
+    const early = add("Read");
+    view.setExpanded(true);
+    expect(view.isExpanded()).toBe(true);
+    expect(early.isExpanded()).toBe(true);
+
+    const late = add("Grep");
+    expect(late.isExpanded()).toBe(true);
+
+    view.setExpanded(false);
+    expect(early.isExpanded()).toBe(false);
+    expect(late.isExpanded()).toBe(false);
+  });
+
+  test("hidden content only exists while collapsed with members", () => {
+    const { view, add } = fixture();
+    expect(view.hasHiddenContent()).toBe(false);
+    add("Read");
+    expect(view.hasHiddenContent()).toBe(true);
+    view.setExpanded(true);
+    expect(view.hasHiddenContent()).toBe(false);
+  });
+
+  test("search text joins every member's search text", () => {
+    const { view, add } = fixture();
+    add("Read");
+    add("Grep");
+    expect(view.getSearchText()).toBe("Read\nGrep");
+  });
+});
+
+describe("TUI tool group collapsed summary", () => {
+  test("summarizes completed reads with plural forms", () => {
+    const { view, add } = fixture();
+    add("Read");
+    let line = view.render(80).join("\n");
+    expect(line).toContain("Read 1 file");
+    expect(line).not.toContain("files");
+
+    add("Read");
+    line = view.render(80).join("\n");
+    expect(line).toContain("Read 2 files");
+    expect(line).toContain("Ctrl+O to expand");
+  });
+
+  test("running reads say Reading with an ellipsis", () => {
+    const { view, add } = fixture();
+    add("Read", "running");
+    const line = view.render(80).join("\n");
+    expect(line).toContain("Reading 1 file");
+    expect(line).toContain("…");
+  });
+
+  test("summarizes search tools separately from reads", () => {
+    const { view, add } = fixture();
+    add("Grep", "running");
+    const line = view.render(80).join("\n");
+    expect(line).toContain("searching 1 pattern");
+
+    const done = fixture();
+    done.add("Grep");
+    done.add("Glob");
+    done.add("Glob");
+    const doneLine = done.view.render(80).join("\n");
+    expect(doneLine).toContain("searched 3 patterns");
+    expect(doneLine).not.toContain("file");
+  });
+
+  test("failure wins the icon over interruption and activity", () => {
+    const { view, add } = fixture();
+    add("Read", "running");
+    add("Grep", "failed");
+    let line = view.render(80).join("\n");
+    expect(line).toContain("✗");
+    expect(line).not.toContain("■");
+
+    const second = fixture();
+    second.add("Read", "rejected");
+    line = second.view.render(80).join("\n");
+    expect(line).toContain("■");
+  });
+
+  test("a quiet completed group shows the muted idle icon", () => {
+    const { view, add } = fixture();
+    add("Read");
+    const line = view.render(80).join("\n");
+    expect(line).toContain("○");
+  });
+
+  test("renders each member with a blank separator when expanded", () => {
+    const { view, add } = fixture();
+    add("Read");
+    add("Grep");
+    view.setExpanded(true);
+    const lines = view.render(80);
+    const rendered = lines.join("\n");
+    expect(rendered).toContain("Read");
+    expect(rendered).toContain("Grep");
+    // Two tool cards separated by exactly one blank line.
+    const separators = lines.filter((line) => line === "").length;
+    expect(separators).toBe(1);
+  });
+});
diff --git a/test/update.test.ts b/test/update.test.ts
index 4f58e5f..e831969 100644
--- a/test/update.test.ts
+++ b/test/update.test.ts
@@ -200,7 +200,7 @@ describe("launcher --update dispatch", () => {
       await chmod(fakeGh, 0o755);
       const result = await runLauncher(["--update"], { PATH: `${directory}:${process.env.PATH}` });
       expect(result.stdout).toContain("Checking for zcode-cli updates…");
-      expect(result.stdout).toContain("Current version : 3.8.1-31");
+      expect(result.stdout).toContain("Current version : 3.8.1-32");
       expect(result.stdout).toContain("Latest version  : 99.0.0-1 (xhqing/zcode-cli release)");
     } finally {
       await rm(directory, { recursive: true, force: true });