{
  "schemaVersion": 1,
  "generatedFrom": "WEBUI_TUI_NATIVE_FEATURE_PLAN.md + WEBUI_TUI_NATIVE_FEATURE_GRILL_RESULTS.md",
  "statusTaxonomy": ["implemented", "degraded", "unsupported"],
  "guardTaxonomy": ["none", "confirmation", "localhost", "trusted-context", "feature-flag", "upstream-rpc", "read-only"],
  "surfaces": [
    {
      "id": "/settings",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Settings selector/editor",
      "command": { "name": "settings", "description": "Open settings menu" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Browser dialog exposes native TUI settings in concise sections with runtime/browser/reload/TUI badges; reload-needed settings can restart the active tab after saving.",
      "targetBehavior": "Keep native TUI setting coverage current; project/global source editing can be added as an advanced enhancement."
    },
    {
      "id": "/safety-guard-setup",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Safety guard setup",
      "command": { "name": "safety-guard-setup", "description": "Configure command categories, protected-path checks, and preview context" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser-native dialog and Pi TUI settings list edit the same persisted global guard schema, including independent context lines before and after matches.",
      "targetBehavior": "Keep browser and TUI setup controls aligned with the canonical safety-guard config module and fail-safe defaults."
    },
    {
      "id": "/git-workflow-setup",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Guided Git workflow setup",
      "command": { "name": "git-workflow-setup", "description": "Configure Guided Git model, effort, staging, and delivery preferences" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser-native dialog and Pi TUI wizard edit one persisted global Guided Git profile, including generation model/effort and safety-oriented workflow defaults.",
      "targetBehavior": "Keep the Pi TUI and browser-native setup surfaces aligned with the shared persisted preference schema."
    },
    {
      "id": "/workflow-setup",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Workflow permission ceiling setup",
      "command": { "name": "workflow-setup", "description": "Review and save the global workflow permission ceiling" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": true,
      "guards": ["localhost", "confirmation"],
      "currentBehavior": "Catalog-gated exact command routing and the Options menu open a browser-native reviewed policy editor backed by localhost-only revision-protected GET/POST routes; it never starts an agent turn.",
      "targetBehavior": "Keep browser and Pi TUI setup aligned with the canonical strict policy validator, deny defaults, explicit normalized review, and stale-write protection."
    },
    {
      "id": "/model",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Model selector",
      "command": { "name": "model", "description": "Select model (opens selector UI)" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Browser-native selector uses RPC model data and set-model endpoint.",
      "targetBehavior": "Keep browser-native selector in parity with native model switching."
    },
    {
      "id": "/theme",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Theme selector",
      "command": { "name": "theme", "description": "Select Web UI theme" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Browser theme selection works; Pi terminal theme switching is TUI-only/degraded in RPC mode.",
      "targetBehavior": "Document the browser-vs-terminal theme difference and add native theme API support if upstream RPC exposes it."
    },
    {
      "id": "/scoped-models",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Scoped model editor",
      "command": { "name": "scoped-models", "description": "Enable/disable models for Ctrl+P cycling" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Informational dialog plus footer scoped picker.",
      "targetBehavior": "Searchable model table, provider toggles, ordered explicit provider/model IDs, advanced patterns, and safe global/project persistence."
    },
    {
      "id": "/tools",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Tool enable/disable selector",
      "command": { "name": "tools", "description": "Enable/disable tools for the active tab" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser-native selector uses a hidden Web UI RPC helper extension to read all tools, set active tools, and persist selection on the session branch.",
      "targetBehavior": "Keep browser-native runtime tool toggles in parity with Pi's TUI tools extension while exposing provenance and branch-persistent state."
    },
    {
      "id": "/skills",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Skill enable/disable selector",
      "command": { "name": "skills", "description": "Enable/disable skills for automatic model invocation" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser-native selector uses a hidden Web UI RPC helper extension to filter disabled skills out of the system prompt, block disabled /skill:name invocations, and persist selection on the session branch.",
      "targetBehavior": "Keep browser-native skill toggles runtime-scoped with clear distinction from package-level pi config enable/disable."
    },
    {
      "id": "/export",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session export",
      "command": { "name": "export", "description": "Export session (HTML default, or specify path: .html/.jsonl)" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": true,
      "guards": ["localhost", "confirmation", "feature-flag"],
      "currentBehavior": "No-path HTML browser download and explicit new .html/.jsonl server paths are implemented; overwrite confirmation UI is still pending.",
      "targetBehavior": "No-path browser download via short-lived opaque token; explicit server paths only from trusted context with overwrite confirmation."
    },
    {
      "id": "/import",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session import",
      "command": { "name": "import", "description": "Import and resume a session from a JSONL file" },
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": true,
      "guards": ["confirmation", "feature-flag"],
      "currentBehavior": "No upload/import command flow exists yet.",
      "targetBehavior": "Validate JSONL before copying, copy into configured session directory, preserve cwd metadata, warn on cwd mismatch, then switch."
    },
    {
      "id": "/share",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session share/preview",
      "command": { "name": "share", "description": "Share session as a local preview or configured remote provider" },
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": true,
      "guards": ["localhost", "confirmation", "feature-flag"],
      "currentBehavior": "Missing in Web UI.",
      "targetBehavior": "Local redacted preview first; remote publishing remains unavailable until explicit provider/config/confirmation exists."
    },
    {
      "id": "/copy",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Copy last assistant message",
      "command": { "name": "copy", "description": "Copy last agent message to clipboard" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Server retrieves last assistant text; browser copies returned text.",
      "targetBehavior": "Keep clipboard response shape in native-command adapter."
    },
    {
      "id": "/name",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Name session/tab",
      "command": { "name": "name", "description": "Set session display name" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "RPC set_session_name also renames the browser tab.",
      "targetBehavior": "Preserve append-only session metadata behavior and tab refresh."
    },
    {
      "id": "/session",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session info",
      "command": { "name": "session", "description": "Show session info and stats" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["read-only"],
      "currentBehavior": "Shows state, tab metadata, cwd, model, queue, session file, and stats.",
      "targetBehavior": "Keep read-only transcript card output stable."
    },
    {
      "id": "/changelog",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Changelog viewer",
      "command": { "name": "changelog", "description": "Show changelog entries" },
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": false,
      "guards": ["read-only"],
      "currentBehavior": "Missing in Web UI.",
      "targetBehavior": "Read Pi's canonical changelog source and render new/current entries first with full-history search/toggle."
    },
    {
      "id": "/hotkeys",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Hotkey table",
      "command": { "name": "hotkeys", "description": "Show all keyboard shortcuts" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["read-only"],
      "currentBehavior": "Returns Web UI-specific help only.",
      "targetBehavior": "Show native action IDs/effective bindings plus separate Web/browser-specific section and TUI-only labels."
    },
    {
      "id": "/fork",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Fork from user message",
      "command": { "name": "fork", "description": "Create a new fork from a previous user message" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser selector can choose fork points and run backend helper.",
      "targetBehavior": "Keep selector parity and document any native branch-summary differences."
    },
    {
      "id": "/clone",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Clone current session",
      "command": { "name": "clone", "description": "Duplicate the current session at the current position" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Browser command runs backend clone helper and refreshes tab metadata.",
      "targetBehavior": "Keep tab-scoped clone semantics and visible native command result."
    },
    {
      "id": "/tree",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session tree navigation",
      "command": { "name": "tree", "description": "Navigate session tree (switch branches)" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Partial browser selector lists tree entries and navigates through Web UI helper command.",
      "targetBehavior": "Add all native filters, fold state, append-only labels, composer restore, and explicit summarization opt-in."
    },
    {
      "id": "/login",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Provider login",
      "command": { "name": "login", "description": "Configure provider authentication" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": true,
      "guards": ["trusted-context", "confirmation", "feature-flag"],
      "currentBehavior": "Browser selector lists provider auth status from GET /api/auth-providers but still directs OAuth/API-key login to the Pi TUI.",
      "targetBehavior": "Support OAuth/device-code/API-key providers through server AuthStorage; API keys only over trusted contexts and never browser storage/logs/transcripts."
    },
    {
      "id": "/logout",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Provider logout",
      "command": { "name": "logout", "description": "Remove provider authentication" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": true,
      "guards": ["confirmation", "feature-flag"],
      "currentBehavior": "Browser selector lists auth.json credentials only, confirms per provider, and removes them through localhost-only POST /api/auth-logout.",
      "targetBehavior": "Keep auth.json-only removal with env/config credentials labeled as not removable from the Web UI."
    },
    {
      "id": "/new",
      "kind": "slash-command",
      "category": "native-command",
      "title": "New session",
      "command": { "name": "new", "description": "Start a new session" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "RPC new_session starts a new session in the active tab.",
      "targetBehavior": "Keep tab-scoped new-session behavior and visible command output."
    },
    {
      "id": "/compact",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Manual compaction",
      "command": { "name": "compact", "description": "Manually compact the session context" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "RPC compact runs optional custom instructions and returns visible output.",
      "targetBehavior": "Keep visible command card and idle/compaction guards."
    },
    {
      "id": "/resume",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Session resume selector",
      "command": { "name": "resume", "description": "Resume a different session" },
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": true,
      "guards": ["confirmation", "feature-flag"],
      "currentBehavior": "Browser selector supports current/all scope, switch, metadata rename, and localhost-only safe delete with open-tab/active-session guards.",
      "targetBehavior": "Add sort/path/named toggles and compact path default."
    },
    {
      "id": "/reload",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Reload Pi resources",
      "command": { "name": "reload", "description": "Reload keybindings, extensions, skills, prompts, and themes" },
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Restarts active RPC tab and resumes same session when possible.",
      "targetBehavior": "Keep tab-scoped reload behavior and refresh state/events."
    },
    {
      "id": "/quit",
      "kind": "slash-command",
      "category": "native-command",
      "title": "Quit active tab",
      "command": { "name": "quit", "description": "Quit Pi tab" },
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": true,
      "guards": ["confirmation", "feature-flag"],
      "currentBehavior": "Missing/ambiguous in Web UI.",
      "targetBehavior": "Stop/close only active Pi tab, create a fresh idle tab when closing the last tab, and keep whole-server shutdown separate."
    },
    {
      "id": "bash.include-context",
      "kind": "editor-feature",
      "category": "bash",
      "title": "Leading ! shell command",
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": true,
      "guards": ["trusted-context", "feature-flag"],
      "currentBehavior": "Composer intercepts leading ! commands, runs queued RPC bash one at a time, displays transient bash cards, and keeps output included in the next LLM context; per-item queue cancellation/confirmation UI is still pending.",
      "targetBehavior": "Run RPC bash with output included in next LLM context, visible/abortable bash card, FIFO queue, per-item cancellation, and LAN shell warning."
    },
    {
      "id": "bash.exclude-context",
      "kind": "editor-feature",
      "category": "bash",
      "title": "Leading !! shell command",
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": true,
      "guards": ["trusted-context", "feature-flag"],
      "currentBehavior": "Composer intercepts leading !! commands, runs queued RPC bash one at a time with excludeFromContext true, and displays transient bash cards; per-item queue cancellation/confirmation UI is still pending.",
      "targetBehavior": "Run RPC bash with excludeFromContext true, visible/abortable card, FIFO queue, per-item cancellation, and LAN shell warning."
    },
    {
      "id": "shortcut.model.selector",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Ctrl+L model selector",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Global Web UI shortcut manager opens the browser-native /model selector with Ctrl/Cmd+L when the app is focused.",
      "targetBehavior": "Open browser-native /model selector through action-ID-based shortcut manager."
    },
    {
      "id": "shortcut.model.cycle-forward",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Ctrl+P scoped model cycle forward",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI intercepts Ctrl/Cmd+P while app-focused and cycles forward through scoped models or all models via server helper.",
      "targetBehavior": "Cycle forward through scoped/all models with server helper and browser focus guard."
    },
    {
      "id": "shortcut.model.cycle-backward",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Shift+Ctrl+P scoped model cycle backward",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI intercepts Shift+Ctrl/Cmd+P while app-focused and cycles backward through scoped models or all models via server helper.",
      "targetBehavior": "Cycle backward through scoped/all models with server helper and browser focus guard."
    },
    {
      "id": "shortcut.thinking.cycle",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Shift+Tab thinking level cycle",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI intercepts Shift+Tab while app-focused and uses RPC cycle_thinking_level.",
      "targetBehavior": "Use RPC cycle_thinking_level outside autocomplete contexts."
    },
    {
      "id": "shortcut.thinking.toggle",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Ctrl+T thinking visibility toggle",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI maps Ctrl/Cmd+T to the browser-local thinking visibility toggle.",
      "targetBehavior": "Map Ctrl+T to existing browser thinking visibility state."
    },
    {
      "id": "shortcut.tools.expand-toggle",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Ctrl+O global tool expansion toggle",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI maps Ctrl/Cmd+O to a browser-local global expansion preference for tool output/details and bash cards.",
      "targetBehavior": "Global browser-local toggle for tool results/executions/user bash cards with per-card override until next global toggle."
    },
    {
      "id": "shortcut.queue.follow-up",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Alt+Enter follow-up queue",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI maps Alt+Enter to send the composer as a follow-up when a composer payload exists.",
      "targetBehavior": "Queue follow-up via shortcut with mobile-accessible fallback."
    },
    {
      "id": "shortcut.queue.restore",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Alt+Up restore queued messages",
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["upstream-rpc"],
      "currentBehavior": "Alt+Up restores the latest observed steering/follow-up queue snapshot into the composer with blank-line separators, but RPC queue clearing and attachment restore are pending upstream support.",
      "targetBehavior": "Restore queued steering/follow-up FIFO into composer with separators and best-effort attachment restore."
    },
    {
      "id": "shortcut.abort.escape",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Escape abort/cancel",
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Holding Escape for 3 seconds aborts active user bash first, then active agent runs, and closes UI surfaces with tab scoping before arming abort.",
      "targetBehavior": "Abort active bash first where applicable; keep agent/tab scoping and clear UI cancellation rules with a guarded hold-to-abort affordance."
    },
    {
      "id": "shortcut.editor.clear",
      "kind": "keyboard-shortcut",
      "category": "shortcut",
      "title": "Ctrl+C clear editor",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Web UI clears the prompt on Ctrl/Cmd+C only when the prompt is focused and no text is selected.",
      "targetBehavior": "Clear prompt only when no text is selected; no double-Ctrl+C quit initially."
    },
    {
      "id": "editor.external-expanded-modal",
      "kind": "editor-feature",
      "category": "editor",
      "title": "External editor parity",
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "No Ctrl+G/$VISUAL/$EDITOR browser equivalent.",
      "targetBehavior": "Use browser-native expanded editor modal; Save replaces composer draft only and never sends automatically."
    },
    {
      "id": "editor.attachments",
      "kind": "editor-feature",
      "category": "editor",
      "title": "File/image attachments",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "Picker, drag/drop, paste, and RPC image support exist for supported types.",
      "targetBehavior": "Keep attachment flows covered by browser/mobile tests."
    },
    {
      "id": "editor.slash-autocomplete",
      "kind": "editor-feature",
      "category": "editor",
      "title": "Slash command autocomplete",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Composer shows slash-command suggestions from native and RPC-visible commands.",
      "targetBehavior": "Keep native matrix commands discoverable and label guarded/degraded states."
    },
    {
      "id": "editor.path-suggestions",
      "kind": "editor-feature",
      "category": "editor",
      "title": "@ path suggestions",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Server computes @ file/path suggestions from active tab cwd and fast picks.",
      "targetBehavior": "Keep path suggestions tab-scoped and capped."
    },
    {
      "id": "session.resume.switch",
      "kind": "session-action",
      "category": "session",
      "title": "Resume/switch session",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": true,
      "guards": ["confirmation"],
      "currentBehavior": "Switch endpoint validates .jsonl path, confines it to the configured Pi session directory, opens SessionManager, and sends RPC switch_session.",
      "targetBehavior": "Preserve tab-scoped switch and add richer selector metadata."
    },
    {
      "id": "session.resume.rename",
      "kind": "session-action",
      "category": "session",
      "title": "Resume rename metadata",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["feature-flag"],
      "currentBehavior": "POST /api/session-rename appends session_info metadata through SessionManager.appendSessionInfo without renaming the .jsonl file; target paths are confined to the Pi session directory.",
      "targetBehavior": "Keep append-only session_info metadata rename without file rename."
    },
    {
      "id": "session.resume.delete",
      "kind": "session-action",
      "category": "session",
      "title": "Resume safe delete",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": true,
      "guards": ["confirmation", "feature-flag"],
      "currentBehavior": "POST /api/session-delete is localhost-only, requires confirmed: true, blocks active/open-tab sessions, confines targets to the Pi session directory, and prefers trash with unlink fallback.",
      "targetBehavior": "Keep trash/noninvasive delete with active/open-tab guards and confirmation."
    },
    {
      "id": "extension-ui.notify",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension notify",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Non-blocking extension notifications render event/transcript messages.",
      "targetBehavior": "Scope non-blocking state by tab + extension + run and clear stale state."
    },
    {
      "id": "extension-ui.set-status",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension setStatus",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Status entries are rendered in browser status area.",
      "targetBehavior": "Version schema and lifecycle cleanup by tab + extension + run."
    },
    {
      "id": "extension-ui.set-widget",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension setWidget",
      "webStatus": "degraded",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Line-based widgets render in browser, with specialized todo-progress handling.",
      "targetBehavior": "Semantic widget schemas before generic custom rendering."
    },
    {
      "id": "extension-ui.set-title",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension setTitle",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Browser document title updates.",
      "targetBehavior": "Scope title state and restore defaults on run/reload/tab stop."
    },
    {
      "id": "extension-ui.set-editor-text",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension set_editor_text",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Extension request replaces composer text.",
      "targetBehavior": "Keep tab-scoped composer update semantics."
    },
    {
      "id": "extension-ui.select-confirm-input-editor",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Blocking extension dialogs",
      "webStatus": "implemented",
      "priority": "P1",
      "sensitive": false,
      "guards": ["confirmation"],
      "currentBehavior": "select/confirm/input/editor requests queue as browser dialogs and block originating tab.",
      "targetBehavior": "Keep server-side pending blocker state recoverable after reload/reconnect while only originating tab waits."
    },
    {
      "id": "extension-ui.autocomplete-provider",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension autocomplete provider",
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": false,
      "guards": ["upstream-rpc"],
      "currentBehavior": "RPC mode does not expose extension autocomplete providers to Web UI.",
      "targetBehavior": "Add/request semantic RPC autocomplete provider schema."
    },
    {
      "id": "extension-ui.header-footer",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Extension header/footer text lines",
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": false,
      "guards": ["upstream-rpc"],
      "currentBehavior": "RPC mode does not expose native custom header/footer components.",
      "targetBehavior": "Add/request semantic header/footer text-line bridge before arbitrary rendering."
    },
    {
      "id": "extension-ui.custom-component",
      "kind": "extension-ui-method",
      "category": "extension-ui",
      "title": "Generic custom component rendering",
      "webStatus": "unsupported",
      "priority": "P2",
      "sensitive": true,
      "guards": ["upstream-rpc", "feature-flag"],
      "currentBehavior": "Arbitrary TUI custom components are unavailable/degraded in RPC mode.",
      "targetBehavior": "If needed after semantic methods, allow only sandboxed declarative schemas and never extension-supplied browser JavaScript."
    },
    {
      "id": "adapter.native-command-response",
      "kind": "native-command-adapter",
      "category": "foundation",
      "title": "Native command adapter response shape",
      "webStatus": "implemented",
      "priority": "P0",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "Server-native slash commands route through lib/native-command-adapter.mjs with a shared response envelope (status, cards, toasts, warnings, refresh, download, copyText, tab metadata). Frontend applyNativeSlashCommandEffects consumes the adapter shape.",
      "targetBehavior": "Keep the centralized adapter current as new native slash commands and selector flows are added."
    },
    {
      "id": "security.trust-boundaries",
      "kind": "security-guard",
      "category": "foundation",
      "title": "Sensitive native feature trust boundaries",
      "webStatus": "implemented",
      "priority": "P0",
      "sensitive": true,
      "guards": ["localhost", "trusted-context", "confirmation"],
      "currentBehavior": "lib/trust-boundaries.mjs centralizes localhost route gating (including network open/close), native-command guard evaluation, and remote-shell warnings for LAN clients. Session switch/rename/delete paths are confined to the Pi session directory. Sensitive slash commands return blocked adapter cards instead of raw HTTP errors.",
      "targetBehavior": "Extend the shared policy to remaining sensitive native flows (login/logout/share/import/quit) and explicit confirmation UI where required."
    },
    {
      "id": "tests.native-parity-harness",
      "kind": "test-harness",
      "category": "foundation",
      "title": "Native parity helper/endpoint tests",
      "webStatus": "implemented",
      "priority": "P0",
      "sensitive": false,
      "guards": ["none"],
      "currentBehavior": "tests/native-parity-harness.test.mjs exercises trust-boundaries and native-command-adapter helpers against WEBUI_TUI_NATIVE_PARITY.json fixtures, and tests/http-endpoints-harness.test.mjs boots the real server with a fake pi RPC stub to cover command routing, bash queue serialization, session-dir confinement, and localhost trust guards over HTTP.",
      "targetBehavior": "Extend HTTP endpoint coverage to SSE events, tab lifecycle (create/patch/close), and session selector flows."
    }
  ]
}