Web client: transcript zoom gap, command redaction, plain scene, -84% boot payload

apps/ade-cli/src/tuiClient/__tests__/format.test.ts

@@ -1626,7 +1626,7 @@ describe("renderChatLines", () => {
           sessionId: "s1",
           timestamp: "2026-01-01T12:00:02.000Z",
           sequence: 2,
-          event: { type: "tool_call", tool: "shell", args: { command: "git branch" }, itemId: "tool-1" },
+          event: { type: "tool_call", tool: "shell", args: { command: "API_KEY=fake git branch" }, itemId: "tool-1" },
         },
         {
           sessionId: "s1",
@@ -1637,6 +1637,8 @@ describe("renderChatLines", () => {
       ],
     });
     expect(lines.map((line) => line.tone)).toEqual(["assistant", "tool", "assistant"]);
+    expect(lines[1]?.body).toContain("API_KEY=<redacted> git branch");
+    expect(lines[1]?.body).not.toContain("API_KEY=fake");
     expect(lines[0]?.body).toBe("I'll check the branch.");
     expect(lines[2]?.body).toBe("We're on main.");
     expect(lines[2]?.header).toBeUndefined();

apps/ade-cli/src/tuiClient/format.ts

@@ -10,6 +10,8 @@ import {
   type ChatTaskListSnapshot,
 } from "../../../desktop/src/shared/chatTaskList";
 import { deriveChatSources } from "../../../desktop/src/shared/chatSources";
+import { redactCommandLine } from "../../../desktop/src/shared/secretRedaction";
+import { maskShellCommandArgs } from "../../../desktop/src/renderer/components/chat/toolPresentation";
 import { deriveSubagentCardName, subagentSummaryPlainText } from "../../../desktop/src/shared/chatSubagents";
 import { describeUserMessageStatus } from "../../../desktop/src/shared/chatUserMessageStatus";
 import type { LaneSummary } from "../../../desktop/src/shared/types/lanes";
@@ -1015,10 +1017,13 @@ export function renderChatLines(args: {
       continue;
     }
     if (event.type === "tool_call") {
+      // The TUI prints the arguments on screen: a shell command is masked as the desktop masks it.
+      const isArgsRecord = event.args !== null && typeof event.args === "object" && !Array.isArray(event.args);
+      const shownArgs = isArgsRecord ? maskShellCommandArgs(event.tool, event.args as Record<string, unknown>) : event.args;
       lines.push({
         id,
         tone: "tool",
-        body: `> ${event.tool}  ${singleLine(event.args, 96)}`,
+        body: `> ${event.tool}  ${singleLine(shownArgs, 96)}`,
       });
       continue;
     }
@@ -1044,12 +1049,14 @@ export function renderChatLines(args: {
     }
     if (event.type === "command") {
       const failed = event.status === "failed" || (event.exitCode ?? 0) !== 0;
+      // The TUI prints the command on screen: mask secrets the same way the desktop does.
+      const shownCommand = redactCommandLine(event.command ?? "");
       lines.push({
         id,
         tone: failed ? "error" : "tool",
         body: failed && expanded
-          ? `x run ${event.command}  ${event.durationMs ? `${event.durationMs}ms` : ""}\n${multiLine(event.output, 24)}`
-          : `${failed ? "x" : "✓"} run ${event.command}  ${event.durationMs ? `${event.durationMs}ms` : ""}${failed ? "  ↵ expands" : ""}\n${summarizeCommandOutput(event.output)}`,
+          ? `x run ${shownCommand}  ${event.durationMs ? `${event.durationMs}ms` : ""}\n${multiLine(event.output, 24)}`
+          : `${failed ? "x" : "✓"} run ${shownCommand}  ${event.durationMs ? `${event.durationMs}ms` : ""}${failed ? "  ↵ expands" : ""}\n${summarizeCommandOutput(event.output)}`,
       });
       continue;
     }

apps/desktop/lint-baseline.json

@@ -2,8 +2,7 @@
   "version": 1,
   "files": {
     "apps/desktop/src/renderer/components/app/CommandPalette.tsx": {
-      "ade-ui/no-fixed-overlay": 1,
-      "ade-ui/no-raw-z-index": 1
+      "ade-ui/no-fixed-overlay": 1
     },
     "apps/desktop/src/renderer/components/app/FeedbackReporterModal.tsx": {
       "ade-ui/no-fixed-overlay": 1,

apps/desktop/package.json

@@ -30,6 +30,7 @@
     "build:ade-media": "node ./scripts/build-ade-media.mjs",
     "test:ade-media": "swift test --package-path ./native/ADEMedia",
     "build:webclient": "vite build --config vite.webclient.config.ts --configLoader runner && node ./scripts/check-webclient-entry.mjs",
+    "bench:webclient": "node ./scripts/bench-webclient.mjs",
     "dist:win:test": "node ./scripts/run-windows-test-build.mjs",
     "dist:win": "npm run materialize:runtime-resources && npm run validate:runtime-resources && npm run materialize:whisper-resources && npm run validate:whisper-resources && npm run validate:win:artifacts && npm run build:capture-helper:win && npm run build:desktop-driver:win && npm run build:music-host:win && npm run build:now-playing:win && npm run build && npm run package:win && npm run validate:win:release",
     "dist:win:signed": "npm run materialize:runtime-resources && npm run validate:runtime-resources && npm run materialize:whisper-resources && npm run validate:whisper-resources && npm run validate:win:artifacts && npm run build:capture-helper:win && npm run build:desktop-driver:win && npm run build:music-host:win && npm run build:now-playing:win && npm run build && npm run package:win:signed && npm run validate:win:release:signed",