@@ -0,0 +1,106 @@
+# WebUI Composer — Module B closure spec (roadmap 2026-10-03)
+
+Baseline: `webui` branch HEAD `83321d0`. Scope: the four remaining Module B
+(Composer 输入区) rows from the team roadmap (`mcode-webui-roadmap`), following
+the same workflow the Module C closure used: spec first, TDD, browser-harness
+end-to-end run, then report with evidence.
+
+| Roadmap row | Today | Target |
+|---|---|---|
+| 输入历史/草稿 (codex ↑ recall; cross-session drafts) | ❌ | ✅ |
+| 斜杠命令面板 (dev `/` does not open) | 🟡 | ✅ (verify or fix) |
+| 文件/图片/多文件上传与预览 | ➖ | ✅ (verified) |
+| 文件夹上传 / @ 引用 | ➖ | ✅ (verified) |
+
+## B-1 输入历史/草稿
+
+Codex parity: the composer recalls previously submitted inputs with ↑/↓, and
+an unsent draft survives both session switches and a page reload.
+
+### Behavior
+
+1. **Recording.** Every committed composer submission — `submit-turn` (send or
+   queue), `submit-goal`, and `run-command` — records the submitted text in a
+   per-session input history. Mode activations (`/goal`, `/plan` bare) record
+   nothing. Recording happens at commit time (after intent resolution), not on
+   transport success: a refused send must not silently eat the user's input
+   history. The home composer (no session yet) records into the `home` slot;
+   when the silent first-session creation commits, the entry moves to the
+   created session's history.
+2. **Normalization.** Entries are trimmed; blank entries are not recorded; an
+   entry identical to the current newest entry collapses (no consecutive
+   duplicates); history is capped at 100 entries per session (oldest dropped).
+3. **Recall.** With the caret on the first line (selectionStart 0 or within
+   the first line) and no slash popover / mention menu open:
+   - ↑ steps to the previous (older) entry and replaces the draft;
+   - ↓ steps forward; stepping past the newest restores the pre-browse draft
+     and exits browse mode;
+   - Escape during browse exits and restores the pre-browse draft;
+   - any manual edit exits browse mode;
+   - ↑ on a non-first-line caret keeps the caret's default behavior (the
+     textarea's own intra-draft navigation must not be hijacked).
+4. **Cross-session drafts.** Drafts are per session (home has its own slot).
+   Switching sessions saves the outgoing draft and restores the incoming one.
+   Drafts persist to `localStorage` and survive a reload. `新建任务` keeps its
+   existing clearing semantics. The home → silently-created-session draft
+   carry-over (existing behavior, see `SessionComposer` props comment) is
+   preserved.
+5. **Persistence shape.** One key, `webui.composer.state.v1`, holding
+   `{ drafts: Record<sessionKey, string>, history: Record<sessionKey, string[]> }`.
+   Limits: 50 draft slots / 100 history slots / 64 KiB (UTF-8 bytes, not
+   characters) per stored value; the persisted blob is pruned to the newest
+   slots when over budget, with the live session's slot pinned so the prune
+   can never evict it. Storage failures (privacy mode, quota) degrade
+   silently to in-memory state — same convention as `no-project.ts`.
+
+### Units (pure, unit-tested before wiring)
+
+New module `packages/webui/src/client/projection/composer-history.ts`:
+
+- `recordWebuiInputHistory(history, input) → string[]`
+- `startWebuiHistoryBrowse(history, currentDraft) → browse | undefined`
+- `stepWebuiHistoryBrowse(browse, direction, history) → browse | undefined`
+  (`undefined` = exit and restore the stashed draft)
+- `shouldRecallWebuiHistory(value, caret) → boolean` (first-line rule)
+- `loadWebuiComposerPersisted(storage?) / saveWebuiComposerPersisted(state,
+  storage?, keepKeys?)` with sanitize + prune; `keepKeys` pins the live
+  session's slot so an insertion-order prune can never evict it
+- `migrateWebuiHomeComposerState(state, targetKey)` — home slot → created
+  session key (recorded under home before the session existed)
+
+Wiring: the shell owns the persisted store (drafts + history) keyed by
+`selectedSessionId ?? "home"`; `SessionComposer` receives `history`,
+`onInputSubmitted`, and the per-session `draft`/`onDraftChange` it has today.
+
+## B-2 斜杠命令面板 (dev `/` trigger)
+
+`slash-palette.ts`, `composer-interactions.ts` (`findWebuiSlashRange`) and the
+`SessionComposer` popover wiring all read complete at `83321d0`; the roadmap's
+"dev 输入 `/` 未触发" therefore needs reproduction before any fix is assumed.
+Plan: a browser-harness spec types `/` into the built client's composer and
+asserts the palette rows render (goal / plan / deploy-website / skills). If it
+reproduces, fix the root cause (suspects: module-level `await` fallback path,
+`slashSkills` initial state, popover positioning) and re-run; if it does not
+reproduce on the built client, verify once on `pnpm dev` and record the dev
+observation as the evidence line, closing the row as a stale report.
+
+## B-3 上传预览 / B-4 文件夹上传与 @ 引用
+
+Both rows are "链路验收通过, 未逐项实测". Closure = browser-harness specs driving
+the built client: attach a file through the hidden input, assert the attachment
+chip (name + size) and its removal; add a folder via the directory input and
+assert the folder chip; type `@` and assert the mention menu offers 添加本地文件
+/ 添加本地文件夹 rows and that choosing one opens the corresponding picker.
+These ride the existing fixture transport (attachments are client-side state
+until submit; the fixture accepts the submit envelope).
+
+## Verification gates (all must pass before reporting)
+
+1. `pnpm --filter @mavis/webui test` — full webui unit suite green, including
+   the new `composer-history` tests.
+2. `node scripts/run-vitest-suite.mjs` suites that exist for webui stay green
+   (no regressions in the shared suites).
+3. `pnpm build:webui` + `pnpm test:webui-browser` — existing three specs plus
+   the new composer spec green.
+4. One manual `pnpm dev` pass for the slash palette observation (B-2) and a
+   reload/switch pass for drafts + ↑ recall.
@@ -139,6 +139,12 @@ import {
   webuiAttachmentLimitError,
   type WebuiMentionRange,
 } from "../projection/composer-interactions.js";
+import {
+  shouldRecallWebuiHistory,
+  startWebuiHistoryBrowse,
+  stepWebuiHistoryBrowse,
+  type WebuiHistoryBrowse,
+} from "../projection/composer-history.js";
 import {
   isWebuiRunnableCommand,
   rankWebuiSlashPalette,
@@ -506,6 +512,8 @@ export function WebuiComposer({
   getAccountStatus,
   draft,
   onDraftChange,
+  inputHistory = [],
+  onInputSubmitted,
   onNeedsSession,
   onSessionCreated,
   enqueueMessage,
@@ -564,6 +572,14 @@ export function WebuiComposer({
   /** The draft lives on the shell so it survives silent first-session creation. */
   readonly draft: string;
   readonly onDraftChange: (next: string) => void;
+  /**
+   * Submitted-input history for ↑ recall (roadmap Module B: 输入历史/草稿).
+   * Keyed by session on the shell; the composer only walks it with the pure
+   * helpers from `composer-history.ts`.
+   */
+  readonly inputHistory?: readonly string[];
+  /** Records one committed submission into the shell's history store. */
+  readonly onInputSubmitted?: (text: string) => void;
   readonly onNeedsSession?: (draft: string) => void;
   readonly onSessionCreated?: (sessionId: string) => void;
   readonly teamModeOff: boolean;
@@ -636,6 +652,27 @@ export function WebuiComposer({
   // ref: a click or an arrow key that only moves the caret still has to
   // re-derive whether a slash token is under it.
   const [composerCaret, setComposerCaret] = useState(0);
+  // ↑ recall browse state (roadmap Module B). `undefined` = not browsing.
+  // While set, ↑/↓ walk `inputHistory` and any manual edit exits (the
+  // textarea's onChange only fires for real user edits — a programmatic
+  // recall swap never ends its own browse); stepping past the newest
+  // restores the stashed pre-browse draft.
+  const [historyBrowse, setHistoryBrowse] = useState<WebuiHistoryBrowse>();
+  useEffect(() => {
+    // Switching sessions swaps the history list under the browse cursor;
+    // restart clean rather than trusting the index still means anything.
+    setHistoryBrowse(undefined);
+  }, [sessionId]);
+  const applyHistoryDraft = (next: string) => {
+    handleDraftChange(next);
+    setComposerCaret(next.length);
+    // The DOM caret lags the controlled value swap by a render; pin it to
+    // the end once the new value is on screen, the way a terminal leaves the
+    // cursor after a recall.
+    requestAnimationFrame(() => {
+      textareaRef.current?.setSelectionRange(next.length, next.length);
+    });
+  };
   const editingGoalDraftRef = useRef(false);
   const textareaRef = useRef<HTMLTextAreaElement | null>(null);
   const composerRegionRef = useRef<HTMLDivElement | null>(null);
@@ -1636,6 +1673,19 @@ export function WebuiComposer({
     });
     const resolvedIntent = intent ?? (attachments.length > 0 ? { kind: "submit-turn" as const } : undefined);
     if (!resolvedIntent) return;
+    // Record the sendable text for ↑ recall on every committed intent —
+    // send/queue turns, goal objectives, and runnable commands all start as
+    // user-typed composer text. Recording at commit time (not transport
+    // success) keeps a refused send from silently eating the user's input,
+    // and mode activations (`/goal`, `/plan` bare) record nothing.
+    if (
+      resolvedIntent.kind === "submit-turn" ||
+      resolvedIntent.kind === "submit-goal" ||
+      resolvedIntent.kind === "run-command"
+    ) {
+      onInputSubmitted?.(messageDraft);
+      setHistoryBrowse(undefined);
+    }
     if (resolvedIntent.kind === "activate-goal-mode") {
       activateGoalMode();
       return;
@@ -1898,6 +1948,9 @@ export function WebuiComposer({
                   onChange={(event) => {
                     const next = event.target.value;
                     handleDraftChange(next);
+                    // A real user edit ends any active history browse (see
+                    // the browse state comment above).
+                    setHistoryBrowse(undefined);
                     const caret = event.target.selectionStart;
                     mentionCaretRef.current = caret;
                     setComposerCaret(caret);
@@ -1961,6 +2014,48 @@ export function WebuiComposer({
                       setComposerCaret(next.length);
                       return;
                     }
+                    if (event.key === "Escape" && historyBrowse) {
+                      // Escape during a history browse restores the draft as
+                      // it was before ↑ first recalled. Sits after the slash
+                      // palette's own Escape so a recalled "/…" closes the
+                      // palette first and exits the browse on the second tap.
+                      event.preventDefault();
+                      const stashed = historyBrowse.draft;
+                      setHistoryBrowse(undefined);
+                      applyHistoryDraft(stashed);
+                      return;
+                    }
+                    // History recall claims ↑/↓ only when nothing else has:
+                    // the mention menu (above) and the slash popover (below,
+                    // behind the `commandSuggestions.length === 0` guard) own
+                    // the arrows while they are open.
+                    if (
+                      commandSuggestions.length === 0 &&
+                      (event.key === "ArrowUp" || event.key === "ArrowDown")
+                    ) {
+                      const caret = event.currentTarget.selectionStart ?? 0;
+                      if (event.key === "ArrowUp") {
+                        const next = historyBrowse
+                          ? stepWebuiHistoryBrowse(historyBrowse, "prev", inputHistory)
+                          : shouldRecallWebuiHistory(draft, caret)
+                            ? startWebuiHistoryBrowse(inputHistory, draft)
+                            : undefined;
+                        if (next) {
+                          event.preventDefault();
+                          setHistoryBrowse(next);
+                          applyHistoryDraft(inputHistory[next.index] ?? "");
+                          return;
+                        }
+                      } else if (historyBrowse) {
+                        const next = stepWebuiHistoryBrowse(historyBrowse, "next", inputHistory);
+                        event.preventDefault();
+                        setHistoryBrowse(next);
+                        // Stepping past the newest exits and restores the
+                        // stashed pre-browse draft.
+                        applyHistoryDraft(next ? inputHistory[next.index] ?? "" : historyBrowse.draft);
+                        return;
+                      }
+                    }
                     // Enter is claimed above by an open mention menu, and below by
                     // an open slash popover. This MUST sit before the
                     // `commandSuggestions.length === 0` guard: that guard
 
@@ -19,6 +19,14 @@ import {
   type ReactElement,
 } from "react";
 import { ArchonShell } from "./ArchonShell.js";
+import {
+  loadWebuiComposerPersisted,
+  migrateWebuiHomeComposerState,
+  recordWebuiInputHistory,
+  saveWebuiComposerPersisted,
+  WEBUI_COMPOSER_HOME_KEY,
+  type WebuiComposerPersisted,
+} from "../projection/composer-history.js";
 import { Composer } from "./Composer.js";
 import { GreetingSkeleton } from "./TranscriptSkeletons.js";
 import {
@@ -258,7 +266,63 @@ export function WebuiClientFoundationApp(
   useEffect(() => {
     dispatchShellSurface({ type: "show-conversation" });
   }, [dispatchShellSurface, selectedSessionId]);
-  const [draft, setDraft] = useState("");
+  // Composer input history + per-session drafts (roadmap Module B:
+  // 输入历史/草稿). One persisted store keyed by session (home has its own
+  // slot), so a draft survives both a session switch and a reload, and ↑ in
+  // the composer recalls that session's submitted inputs. The store is
+  // best-effort: `localStorage` unavailability degrades to memory.
+  const [composerStore, setComposerStore] = useState<WebuiComposerPersisted>(
+    () => loadWebuiComposerPersisted(),
+  );
+  const composerKey = selectedSessionId ?? WEBUI_COMPOSER_HOME_KEY;
+  const composerKeyRef = useRef(composerKey);
+  composerKeyRef.current = composerKey;
+  const draft = composerStore.drafts[composerKey] ?? "";
+  // One updater for every composer-store write: apply the change, persist,
+  // and keep the named slot alive through the prune. `keepKeys` matters
+  // because the store's prune keeps the newest-inserted slots, and an
+  // active session's slot does not re-insert merely by being written to.
+  const applyComposerStore = useCallback(
+    (
+      update: (current: WebuiComposerPersisted) => WebuiComposerPersisted,
+      keepKey: string,
+    ) => {
+      setComposerStore((current) => {
+        const state = update(current);
+        if (state === current) return current;
+        saveWebuiComposerPersisted(state, undefined, [keepKey]);
+        return state;
+      });
+    },
+    [],
+  );
+  const setDraft = useCallback(
+    (next: string) => {
+      applyComposerStore((current) => {
+        const drafts = { ...current.drafts };
+        if (next) drafts[composerKeyRef.current] = next;
+        else delete drafts[composerKeyRef.current];
+        return { ...current, drafts };
+      }, composerKeyRef.current);
+    },
+    [applyComposerStore],
+  );
+  // Recording rides the same store: a committed submission lands in the
+  // current slot's history (home while no session exists yet; the created
+  // session inherits the entry below in `handleSessionCreated`).
+  const recordComposerInput = useCallback(
+    (text: string) => {
+      applyComposerStore((current) => {
+        const key = composerKeyRef.current;
+        const history = {
+          ...current.history,
+          [key]: recordWebuiInputHistory(current.history[key] ?? [], text),
+        };
+        return { ...current, history };
+      }, composerKeyRef.current);
+    },
+    [applyComposerStore],
+  );
   const [teamModeOff, setTeamModeOff] = useState(readTeamModeOff);
   const [teamModeChoices, setTeamModeChoices] =
     useState<TeamModeSessionChoices>(readTeamModeSessionChoices);
@@ -615,6 +679,15 @@ export function WebuiClientFoundationApp(
     // carry it (and the sending flag) across the view switch so the reply
     // stays on screen, and leave home clean.
     migrateSessionRuntimeState(HOME_SESSION_RUNTIME_KEY, id);
+    // The composer store follows the same home → session migration: the
+    // input just submitted was recorded under the home slot, and the new
+    // session's history (and any unsent draft) should own it from here on.
+    // `keepKey` is the NEW session id — `composerKeyRef` still reads "home"
+    // until the next render, and home is being deleted anyway.
+    applyComposerStore(
+      (current) => migrateWebuiHomeComposerState(current, id),
+      id,
+    );
     setSelectedSessionId(id);
     writeTeamModeSessionChoice(id, teamModeOff);
     setTeamModeChoices((current) => ({ ...current, [id]: teamModeOff }));
@@ -987,6 +1060,8 @@ export function WebuiClientFoundationApp(
                     getAccountStatus={transport?.getAccountStatus}
                     draft={draft}
                     onDraftChange={setDraft}
+                    inputHistory={composerStore.history[composerKey] ?? []}
+                    onInputSubmitted={recordComposerInput}
                     teamModeOff={composerTeamModeOff}
                     sessions={page.sessions}
                     workspaceDir={selectedSession?.workspaceDir ?? newTaskWorkspaceDir}