rubino-agent 0.5.1 → 0.5.2.2

data/lib/rubino/cli/chat_command.rb

@@ -114,16 +114,28 @@ module Rubino
         @idle_cards ||= Chat::IdleCardHost.new
       end
 
-      # Auto-opens the EXISTING approval / reply prompt for ONE pending subagent
-      # request the human must act on, from the idle poll loop (#421). Delegates
-      # to the SAME Handlers::Agents the /agents and /reply slash commands use, so
-      # there is no second prompt or new verb — the affordance simply opens itself
-      # at idle instead of waiting for the user to type a slash command. Returns
+      # Auto-opens the EXISTING approval prompt for ONE pending subagent request
+      # the human must act on, from the idle poll loop (#421). Delegates to the
+      # SAME Handlers::Agents the /agents slash command uses, so there is no
+      # second prompt or new verb — the affordance simply opens itself at idle
+      # instead of waiting for the user to type a slash command. Returns
       # true when it presented a request (the poll loop repaints + re-checks),
       # false when nothing was pending. Best-effort: a hiccup in the auto-open
       # must never break the idle prompt, so it falls back to "nothing pending"
       # and the manual slash paths still work.
       def auto_resolve_pending_subagent_request(_runner = nil)
+        # Defer while the subagent PICKER is open (#586): the picker and this
+        # blocking approval/budget modal compete for the same stdin. A child
+        # hammering tool calls re-hits its budget gate every few ticks, so
+        # auto-firing the `wants +budget` modal here would suspend the open picker
+        # and swallow the ↓/Enter the user meant to ATTACH with — worse, the
+        # picker's ↓+Enter gesture could land on the modal's destructive
+        # "Summarize now". The request stays pending and auto-presents on the very
+        # next idle tick once the picker closes: deferred a few seconds, never
+        # lost — it still appears like a permission, in arrival order. (@composer
+        # is nil on the piped/one-shot paths, which have no picker.)
+        return false if @composer&.agent_menu_open?
+
         agents_request_handler.auto_resolve_pending
       rescue StandardError => e
         # Resilience floor: a hiccup in the auto-open must never crash the idle
@@ -276,7 +288,7 @@ module Rubino
         text, image_paths = Chat::ImageInbox.resolve_oneshot(query, opt(:image))
         requested_session_id = session_resolver.resolve_session_id
         runner = build_runner(session_id: requested_session_id, ui: ui,
-                              announce_session: announce_session)
+                              announce_session: announce_session, interactive: false)
         warn_if_resume_forked(requested_session_id, runner)
         note_if_resuming_compacted_parent(runner)
         recorder = Output::TurnRecorder.new.attach!
@@ -973,6 +985,31 @@ module Rubino
         # the loop commits as normal messages when their turn runs.
         @pending_queued = []
 
+        # ONE BottomComposer per interactive session (BUG 02). The REPL used to
+        # build a FRESH composer for EVERY idle read AND every turn and #start /
+        # #stop it each time; each new/start→stop cycle churned native-backed
+        # state (the raw-mode/IO.console buffers, the reader thread + self/wake
+        # pipes, the escape-reader buffers, the frame strings) that malloc freed
+        # but never returned to the OS — so RSS climbed superlinearly with the
+        # turn count. Construct it ONCE here, #start it once (the reader thread,
+        # pipes and raw-mode entry are now allocated a single time and stay live
+        # for the whole session), and swap $stdout for the proxy once. Each phase
+        # (idle read ↔ run_turn) only RECONFIGURES the per-phase hooks/echo/prompt
+        # (#reconfigure) and brackets a turn with #begin_turn / #end_turn — no more
+        # per-turn native alloc/free. Torn down ONCE in the ensure below. nil when
+        # the composer can't run (piped / -q / non-TTY): the cooked fallback path
+        # in #next_input is unchanged there.
+        @composer = start_session_composer(input_queue, runner)
+        @composer_stdout = nil
+        if @composer
+          @composer_stdout = $stdout
+          # Force the lazily-built logger to bind to the REAL $stdout NOW, before
+          # the swap — otherwise the first log call would build a Logger against
+          # the proxy and route diagnostic lines into the chat.
+          Rubino.logger
+          $stdout = UI::StdoutProxy.new(@composer)
+        end
+
         # Keep structured JSON log lines OUT of the raw-mode TUI (#125): for the
         # whole interactive session the logger writes to a file in the logs dir
         # instead of the terminal $stdout the renderer owns. A warn/info event
@@ -1020,8 +1057,8 @@ module Rubino
 
             # While ATTACHED to a subagent (the agent-view), the prompt is scoped
             # to it: the line NEVER runs a parent turn. A `/`-line is an
-            # agent-scoped command; anything else steers the child (or answers it
-            # when it is blocked on you). The `--attach` command that ENTERS this
+            # agent-scoped command; anything else steers the child. The `--attach`
+            # command that ENTERS this
             # mode (from the main prompt) arrives while @attached_id is still nil,
             # so it falls through to normal dispatch below.
             if attached_to_agent?
@@ -1184,9 +1221,9 @@ module Rubino
         ensure
           # Structured-concurrency teardown: the parent REPL is leaving (clean quit
           # OR the double-tap Ctrl+C break above), so cancel every live subagent
-          # before we return. Without this a child blocked on ask_parent(blocking)
-          # stays parked on its gate for the full ask_parent_timeout (~900s) — the
-          # parent that owed it an answer is gone, but nothing wakes its gate.
+          # before we return. Without this a child parked on its approval gate
+          # stays parked for the full approval timeout — the parent that owed it a
+          # decision is gone, but nothing wakes its gate.
           # #shutdown! wakes each within one WAKE_TICK so it unwinds via its
           # `rescue Rubino::Interrupted` with the clean "cancelled" message. If a
           # child is stuck in a provider read and never observes the cancel token,
@@ -1195,6 +1232,11 @@ module Rubino
           Tools::BackgroundTasks.instance.shutdown!
           restore_signal_traps(prev_signal_traps)
           restore_logger(prev_log_io)
+          # Tear the single session composer down ONCE (BUG 02): restore the real
+          # $stdout (flushing any held partial through the still-live composer),
+          # then stop the reader thread / leave raw mode / restore the traps. No-op
+          # when no composer ran (piped / -q).
+          stop_session_composer
         end
 
         # Mark the session ended on a clean teardown (#100) so it stops showing
@@ -1461,7 +1503,15 @@ module Rubino
         # Shift+Tab, and hosts
         # the background-subagent card region (F1) when children are live. The
         # plain cooked readline is the fallback for non-TTY / piped / -q input.
-        if UI::BottomComposer.active?
+        #
+        # BUG 02: gate on @composer, NOT a live UI::BottomComposer.active? check.
+        # The session composer is built once when active? was true, and $stdout is
+        # now the StdoutProxy (swapped at session setup) whose #tty? is false — so
+        # a fresh active? here would read FALSE and wrongly fall to the cooked
+        # branch (a blocking $stdin.gets that fights the live raw reader for stdin
+        # — the "dead idle prompt" regression). @composer is non-nil exactly when
+        # the composer is running, so it is the correct, proxy-immune gate.
+        if @composer
           read_idle_line(input_queue, draft, runner)
         else
           cooked_input(build_prompt, draft)
@@ -1496,20 +1546,19 @@ module Rubino
         # to run the clear/two-tap-exit through #idle_interrupt — declared here so
         # the lambda captures it.
         int_pending = false
-        composer = UI::BottomComposer.new(
-          input_queue: input_queue,
+        # RECONFIGURE the single session composer for the IDLE prompt (BUG 02):
+        # it was built + #started ONCE at session setup and $stdout already routes
+        # through its proxy, so the idle read no longer allocates a fresh composer
+        # or re-swaps $stdout — it only re-points the per-phase hooks/echo/prompt.
+        # nil ⇒ no composer (this method isn't reached on the cooked fallback).
+        composer = @composer
+        composer.reconfigure(
           prompt: build_prompt,
-          rail: composer_rail,
           on_ctrl_o: ctrl_o_handler,
           on_mode_cycle: mode_cycle_handler(runner),
           on_agent_cycle: agent_cycle_handler(runner),
-          completion_source: @completion_source,
-          history: @input_history,
           echo: :prompt,
-          pending_queued: pending_queued,
           status_line: build_status_line(runner),
-          max_input_rows: Rubino.configuration.display_input_max_rows,
-          paste_store: paste_store,
           on_double_esc: runner ? -> { rewind_pending = true } : nil,
           on_idle_interrupt: -> { int_pending = true },
           # ONE Esc cancels the detached post-turn polishing (#319): only when
@@ -1521,27 +1570,25 @@ module Rubino
           # the same). Routed through the input queue so the idle loop runs it the
           # same way a typed /detach would. nil when not attached.
           on_back: (attached_to_agent? ? -> { input_queue.push("/detach") } : nil),
-          # Seed the focus-gate from the PERSISTENT attach-state (#82): this
-          # composer is rebuilt every idle pass, so a flag set on the previous
-          # one at attach time is gone the moment the loop recreates it.
-          # Reconcile it here so the parent cards stay suppressed and the
-          # focused sub's live tail owns the screen. The id (not just a bool)
-          # so the while-attached switcher marks the focused sub (#87).
+          # Seed the focus-gate from the PERSISTENT attach-state (#82) so the
+          # parent cards stay suppressed and the focused sub's live tail owns the
+          # screen. The id (not just a bool) marks the focused sub (#87).
           attached: @attached_id
         )
-        composer.start
-        # Route $stdout through the composer for the whole idle read — the SAME
-        # StdoutProxy swap a turn gets — so anything printed while the idle
-        # prompt is pinned (a background subagent's completion note, a late
-        # status line) commits ABOVE the input under the composer's render
-        # mutex instead of raw-painting over the prompt row (#169). The logger
-        # is forced to bind to the real IO first, exactly as in #start_composer.
-        real_stdout = $stdout
-        Rubino.logger
-        $stdout = UI::StdoutProxy.new(composer)
+        # The composer's reader is already live and $stdout is on the proxy for the
+        # whole session, so anything printed while the idle prompt is pinned (a
+        # background subagent's completion note, a late status line) commits ABOVE
+        # the input under the render mutex (#169) — no per-read swap needed.
+        #
+        # BUG 02: the composer is REUSED, so an unsubmitted draft from the prior
+        # turn may still sit in the buffer. The chat loop carries that draft
+        # explicitly via @pending_draft → +draft+ here, so clear the buffer first
+        # and re-seed it — otherwise the carried draft would DOUBLE. On the old
+        # per-turn composer the fresh instance was already empty.
+        composer.reset_input
         seed_draft(composer, draft)
         idle_cards.paint
-        ticker = idle_cards.children_live? ? idle_cards.start_ticker(composer) : nil
+        ticker = idle_cards.children_live? ? idle_cards.start_ticker(composer) { tail_attached_shell(composer) } : nil
 
         # SIGINT trap as a FALLBACK only (BH-2 / #551): the dependable idle Ctrl+C
         # path is now the in-band \x03 byte (on_idle_interrupt above), because
@@ -1585,11 +1632,11 @@ module Rubino
             break
           end
 
-          # Auto-open the EXISTING approval / reply prompt for a pending subagent
-          # request (#421): a parked child needs a human decision, so the
-          # affordance presents ITSELF here at idle instead of leaving a passive
-          # card the user must answer by guessing `/agents <id>` / `/reply <id>`.
-          # This is the SAME prompt those slash commands open — just auto-opened.
+          # Auto-open the EXISTING approval prompt for a pending subagent request
+          # (#421): a parked child needs a human decision, so the affordance
+          # presents ITSELF here at idle instead of leaving a passive card the
+          # user must answer by guessing `/agents <id>`. This is the SAME prompt
+          # that slash command opens — just auto-opened.
           # Because the REPL re-enters this idle loop at EVERY turn boundary
           # (including after an interrupted/aborted turn), a request that arrived
           # mid-turn or survived an abort is re-detected here and never lost. The
@@ -1597,6 +1644,7 @@ module Rubino
           # suspend THIS composer and restore it after), so it does not race the
           # reader. Resolves one request, then `next` so the cards repaint and the
           # loop re-checks for the next pending request before reading input.
+          # (It defers itself while the picker is open — see the hook, #586.)
           if auto_resolve_pending_subagent_request(runner)
             idle_cards.paint
             next
@@ -1676,18 +1724,15 @@ module Rubino
         restore_idle_int(prev_int)
         ticker&.kill
         ticker&.join
-        # Mirror #stop_composer: restore the real $stdout, then flush any held
-        # partial line through the still-live composer before tearing it down.
-        if real_stdout
-          proxy = $stdout
-          $stdout = real_stdout
-          proxy.finish if proxy.respond_to?(:finish)
-        end
+        # The session composer is NOT stopped here (BUG 02) — its reader/raw mode
+        # live for the whole session and $stdout stays on the proxy; the single
+        # teardown is #stop_session_composer on REPL exit. Just preserve an
+        # un-submitted draft so the NEXT prompt pre-fills with it (a submitted
+        # line already cleared the buffer).
         if composer
           pending = composer.buffer.to_s
           @pending_draft = pending unless pending.strip.empty?
         end
-        composer&.stop
       end
 
       # The idle composer's single-Esc hook (#319): cancel the detached post-turn
@@ -1908,7 +1953,11 @@ module Rubino
         # cards stay visible and their elapsed time advances until the turn ends.
         # Killed in the ensure below.
         idle_cards.paint
-        card_ticker = idle_cards.children_live? ? idle_cards.start_ticker(composer) : nil
+        card_ticker = if idle_cards.children_live?
+                        idle_cards.start_ticker(composer) do
+                          tail_attached_shell(composer)
+                        end
+                      end
 
         # If this turn's prompt came off the input queue (interrupt-by-default
         # Enter, Alt+Enter, or "/queued" during the previous turn), commit it now
@@ -1935,6 +1984,11 @@ module Rubino
         # Only thread the paste expansions when a placeholder was actually
         # collected, so a normal turn's runner.run signature is unchanged.
         run_kwargs[:paste_expansions] = paste_expansions unless paste_expansions.empty?
+        # Drive the live `ctx ~Xk/…` gauge during THIS turn (#608e): hand the UI a
+        # cheap render lambda (base ctx captured once + the in-flight token
+        # estimate) so its ticker repaints the bar ~1/s as the model generates,
+        # instead of the bar sitting frozen until the turn ends. Cleared in ensure.
+        ui.live_status_provider = live_status_meter(runner) if ui.respond_to?(:live_status_provider=)
         oneshot = one_shot_agent_definition(agent_name)
         if oneshot && runner.respond_to?(:run_with_agent)
           runner.run_with_agent(oneshot, prompt, **run_kwargs)
@@ -1946,11 +2000,11 @@ module Rubino
         # escaped the cooperative path. Cancel and re-raise so run_interactive's
         # loop breaks and the session ends cleanly.
         runner.cancel!
-        # This Ctrl-C-aborted turn may have orphaned a subagent blocked on
-        # ask_parent(blocking:true): the parent turn that owed it an answer is
-        # gone, so without this the child stays parked on its gate for the full
-        # ask_parent_timeout (~900s). Cancel every live child so each unwinds NOW
-        # via its `rescue Rubino::Interrupted` (clean "cancelled" message). The
+        # This Ctrl-C-aborted turn may have orphaned a subagent parked on its
+        # approval gate: the parent turn that owed it a decision is gone, so
+        # without this the child stays parked for the full approval timeout.
+        # Cancel every live child so each unwinds NOW via its
+        # `rescue Rubino::Interrupted` (clean "cancelled" message). The
         # re-raise also reaches run_interactive's teardown #cancel_all, but doing
         # it here keeps the unwind local to the edge that orphaned the child and
         # is idempotent, so the second call is a no-op.
@@ -1969,6 +2023,8 @@ module Rubino
         # time the runner returns, so the facet has already landed in the
         # footer and the engine thread must not outlive the turn.
         ui.turn_finished if ui.respond_to?(:turn_finished)
+        # Stop driving the live ctx gauge; the reconcile below sets the exact bar.
+        ui.live_status_provider = nil if ui.respond_to?(:live_status_provider=)
         # Stop the during-turn panel ticker before tearing the composer down, so
         # it can't repaint over the next idle prompt (the idle read starts its
         # own ticker). Idempotent if it already exited on its own (no live child).
@@ -2001,17 +2057,42 @@ module Rubino
         session  = runner.session
         budget   = Context::TokenBudget.new(model_id: session[:model], config: Rubino.configuration)
         messages = ::Rubino::Session::Store.new.for_session(session[:id])
+        render_status_bar(session, budget, context_tokens(messages, budget))
+      rescue StandardError
+        nil
+      end
+
+      # A cheap, DB-free render lambda for the LIVE ctx gauge (#608e): captures the
+      # base (persisted) token count ONCE here on the main thread, then maps an
+      # in-flight token estimate → a bar line with NO further DB reads, so the UI
+      # ticker can call it ~1/s from its thread without re-querying the session.
+      # The base omits this turn's not-yet-persisted generation; the +extra+
+      # estimate covers it, and #ensure reconciles to the exact bar at turn end.
+      # nil (no live gauge) when the bar is disabled or on any failure.
+      def live_status_meter(runner)
+        return nil unless runner && Rubino.configuration.display_statusbar?
+
+        session = runner.session
+        budget  = Context::TokenBudget.new(model_id: session[:model], config: Rubino.configuration)
+        base    = context_tokens(::Rubino::Session::Store.new.for_session(session[:id]), budget)
+        ->(extra) { render_status_bar(session, budget, base + extra.to_i) }
+      rescue StandardError
+        nil
+      end
+
+      # Renders the model + context-saturation bar for +tokens+ against the
+      # session's window. Shared by the turn-boundary bar (#build_status_line) and
+      # the live gauge (#live_status_meter) so both read one format (#608e).
+      def render_status_bar(session, budget, tokens)
         UI::StatusBar.render(
           chips: { mode: Rubino::Modes.current, agent: status_agent_chip,
                    branch: @branch_short_id,
                    skill: Rubino::ActiveSkill.current },
           model: session[:model] || model_name,
-          tokens: context_tokens(messages, budget),
+          tokens: tokens,
           window: budget.available_tokens,
           pastel: pastel
         )
-      rescue StandardError
-        nil
       end
 
       # The status-bar agent chip (#320): the active primary agent name, but
@@ -2102,60 +2183,101 @@ module Rubino
       # the runner or the agent loop, so it cannot race the turn own work — the
       # parked text is consumed by the loop at a safe iteration boundary (atomic
       # #drain), or by #next_input between turns for anything typed in the gap.
-      def start_composer(input_queue, runner)
-        return [nil, nil] unless input_queue && UI::BottomComposer.active?
-
-        # The mode/branch/skill context rides the STATUS BAR (build_status_line);
-        # the prompt itself is the constant clean "❯ " behind the red rail.
-        # `runner` is threaded in (not captured from an enclosing scope) so the
-        # interrupt lambda resolves it — it is a parameter of #run_turn, not in
-        # scope here, and there is no @runner ivar, so capturing it implicitly
-        # raised NameError the instant an Enter-during-turn fired (BH-1).
-        # Same completion + history wiring as the idle composer: the prompt is
-        # pinned and editable for the WHOLE turn — including the post-turn
-        # window where inline jobs (memory auto-extract, skill distill) spend
-        # aux-LLM seconds after the `↳ turn` footer — so `/` and `@` dropdowns
-        # and ↑↓ history work whenever the prompt is visible (#169).
-        busy = busy_command_handler(runner)
-        composer = UI::BottomComposer.new(input_queue: input_queue, prompt: build_prompt,
-                                          rail: composer_rail,
-                                          on_ctrl_o: ctrl_o_handler,
-                                          on_mode_cycle: mode_cycle_handler(runner),
-                                          on_interrupt: interrupt_handler(runner),
-                                          completion_source: @completion_source,
-                                          history: @input_history,
-                                          pending_queued: pending_queued,
-                                          status_line: build_status_line(runner),
-                                          max_input_rows: Rubino.configuration.display_input_max_rows,
-                                          paste_store: paste_store,
-                                          # ← on an empty prompt backs out of an attached subagent view to the
-                                          # main timeline MID-TURN too (slice 3): routed through the SAME busy
-                                          # handler typed lines use so the detach happens IMMEDIATELY on the
-                                          # reader thread (not queued behind the still-running turn). Guarded by
-                                          # attached_to_agent? so it's a no-op cursor key when not attached.
-                                          on_back: -> { busy.call("/back") if attached_to_agent? },
-                                          # Seed the focus-gate from the persistent attach-state (#82):
-                                          # if a turn's composer is built while already attached to a
-                                          # sub (attach happened mid-turn, the parent kept running), it
-                                          # starts suppressed so the parent's stream/cards stay off the
-                                          # focused view. The id (not just a bool) so the while-attached
-                                          # switcher marks the focused sub (#87).
-                                          attached: @attached_id,
-                                          on_busy_command: busy)
+      # Build + #start the SINGLE long-lived composer for this interactive
+      # session (BUG 02). Only the SESSION-STABLE collaborators are wired here —
+      # the input queue, the shared completion source + history, the explicit-
+      # queue stack, the paste store, the rail, the row cap — plus the reader
+      # thread / self+wake pipes / raw-mode entry the #start allocates ONCE. The
+      # PER-PHASE config (prompt, echo, key hooks, status line, focus) is left at
+      # its construction default and re-pointed by #reconfigure at each idle read
+      # / run_turn boundary, so the same instance serves both phases without a
+      # fresh native alloc. Returns the composer, or nil when it can't run (no
+      # queue / non-TTY) — the cooked fallback then runs exactly as before.
+      def start_session_composer(input_queue, runner)
+        return nil unless input_queue && UI::BottomComposer.active?
+
+        composer = UI::BottomComposer.new(
+          input_queue: input_queue,
+          prompt: build_prompt,
+          rail: composer_rail,
+          completion_source: @completion_source,
+          history: @input_history,
+          pending_queued: pending_queued,
+          status_line: build_status_line(runner),
+          max_input_rows: Rubino.configuration.display_input_max_rows,
+          paste_store: paste_store,
+          attached: @attached_id
+        )
         composer.start
-        real_stdout = $stdout
-        # Force the lazily-built logger to bind to the REAL $stdout NOW, before
-        # the swap — otherwise the first log call during the turn would build a
-        # Logger against the proxy and route diagnostic lines into the chat (and,
-        # after the turn, into a dead proxy). The logger stays on the real IO.
-        Rubino.logger
-        $stdout = UI::StdoutProxy.new(composer)
-        [composer, real_stdout]
+        composer
       rescue StandardError
-        # Setup failed — fall back to the plain path so the turn still runs
-        # (no raw, no proxy).
+        # Setup failed — fall back to the plain path so the session still runs
+        # (no raw, no proxy), exactly as the old per-turn #start_composer did.
         composer&.stop
-        $stdout = real_stdout if real_stdout
+        nil
+      end
+
+      # Tear the single session composer down ONCE on REPL exit (BUG 02): restore
+      # the real $stdout (flushing any held partial line through the still-live
+      # composer first), then #stop it — stopping the reader thread, leaving raw
+      # mode and restoring the WINCH/CONT traps. Mirrors the old #stop_composer
+      # teardown, run once per session instead of once per turn. Safe on nil.
+      def stop_session_composer
+        composer = @composer
+        @composer = nil
+        if @composer_stdout
+          proxy = $stdout
+          $stdout = @composer_stdout
+          @composer_stdout = nil
+          proxy.finish if proxy.respond_to?(:finish)
+        end
+        composer&.stop
+      rescue IOError, Errno::ENOTTY, Errno::EIO
+        nil
+      end
+
+      # RECONFIGURE the single session composer for a turn (BUG 02). The composer
+      # was built + #started ONCE at session setup and $stdout already routes
+      # through its proxy, so a turn no longer allocates a fresh one or re-swaps
+      # $stdout — it only re-points the per-phase hooks/echo/prompt onto the
+      # shared instance. Returns [composer, nil]; the nil second slot keeps the
+      # `composer, real_stdout = start_composer(...)` call site and #stop_composer
+      # signature unchanged (the stdout restore is now the session-level teardown,
+      # not per-turn). Returns [nil, nil] when no composer is running (piped / -q /
+      # non-TTY), so the plain path runs exactly as before.
+      #
+      # `runner` is threaded in (not captured) so the interrupt lambda resolves it
+      # — it is a parameter of #run_turn, not in scope on the helpers (BH-1). The
+      # in-turn config differs from the idle prompt only in these hooks/echo: Esc
+      # interrupts the turn (on_interrupt), a typed control command runs NOW
+      # (on_busy_command), ← detaches mid-turn through the same busy handler, and
+      # the idle-only chords (on_double_esc / on_idle_interrupt / on_escape) are
+      # cleared so they can't fire during a turn.
+      def start_composer(_input_queue, runner)
+        return [nil, nil] unless @composer
+
+        busy = busy_command_handler(runner)
+        @composer.reconfigure(
+          prompt: build_prompt,
+          echo: :queued,
+          on_ctrl_o: ctrl_o_handler,
+          on_mode_cycle: mode_cycle_handler(runner),
+          on_interrupt: interrupt_handler(runner),
+          # ← on an empty prompt backs out of an attached subagent view to the main
+          # timeline MID-TURN (slice 3): routed through the SAME busy handler typed
+          # lines use so the detach happens IMMEDIATELY on the reader thread (not
+          # queued behind the still-running turn). A no-op cursor key when not attached.
+          on_back: -> { busy.call("/back") if attached_to_agent? },
+          on_busy_command: busy,
+          status_line: build_status_line(runner),
+          # Seed the focus-gate from the persistent attach-state (#82): a turn that
+          # opens while attached to a sub starts suppressed so the parent's stream/
+          # cards stay off the focused view. The id (not a bool) marks the sub (#87).
+          attached: @attached_id
+        )
+        [@composer, nil]
+      rescue StandardError
+        # Reconfig failed — fall back to the plain path so the turn still runs.
         [nil, nil]
       end
 
@@ -2223,23 +2345,21 @@ module Rubino
         end
       end
 
-      # Tears down the composer: restores the real $stdout, flushes any held
-      # partial line into scrollback, stops the reader and restores cooked mode.
-      # Safe to call with nils (no composer was started).
-      def stop_composer(composer, real_stdout)
-        proxy = $stdout
-        $stdout = real_stdout if real_stdout
-        proxy.finish if proxy.respond_to?(:finish)
-        # Preserve an un-submitted draft (text typed during the turn with no
-        # Enter) before tearing the composer down; #next_input pre-fills the next
-        # prompt with it. A submitted line clears the buffer, so this only ever
-        # carries genuinely-pending input. An empty buffer leaves any prior draft
-        # untouched so it survives queued steering turns in between.
-        if composer
-          draft = composer.buffer.to_s
-          @pending_draft = draft unless draft.strip.empty?
-        end
-        composer&.stop
+      # End-of-turn handoff for the SINGLE session composer (BUG 02). The
+      # composer is NO LONGER stopped or torn down per turn (its reader thread,
+      # pipes and raw mode live for the whole session, and $stdout stays on the
+      # proxy) — #stop_session_composer does that ONCE on REPL exit. This now only
+      # preserves an un-submitted draft (text typed during the turn with no Enter)
+      # so #next_input pre-fills the next prompt with it. A submitted line cleared
+      # the buffer, so this only ever carries genuinely-pending input; an empty
+      # buffer leaves any prior draft untouched so it survives queued steering
+      # turns in between. +real_stdout+ is retained (nil from #start_composer now)
+      # so the `stop_composer(composer, real_stdout)` call site is unchanged.
+      def stop_composer(composer, _real_stdout = nil)
+        return unless composer
+
+        draft = composer.buffer.to_s
+        @pending_draft = draft unless draft.strip.empty?
       rescue IOError, Errno::ENOTTY, Errno::EIO
         nil
       end
@@ -2422,11 +2542,18 @@ module Rubino
       end
 
       # A row the rewind picker offers: a REAL typed user message — not a tool
-      # result riding the user role, and not the `!` bang-shell injections
-      # (<bash-input>/<bash-stdout> context glue is not something to resend).
+      # result riding the user role, not the `!` bang-shell injections
+      # (<bash-input>/<bash-stdout> context glue), and not a SYNTHETIC harness
+      # injection (the `[harness control]` iteration-cap continuation / blocked-
+      # tool / resume nudges, #75) — those are runtime control text the agent
+      # wrote on the user's behalf, never something to rewind-to-and-resend. Same
+      # principle as Codex's is_user_turn_boundary, which excludes injected /
+      # contextual messages so only genuine user turns are restore points.
       def rewindable_message?(msg)
+        content = msg.content.to_s
         msg.role == "user" && msg.tool_call_id.nil? &&
-          !msg.content.to_s.start_with?("<bash-")
+          !content.start_with?("<bash-") &&
+          !content.start_with?(Agent::Loop::HARNESS_CONTROL_MARKER)
       end
 
       # One picker row: `N ago · <first 60 chars>` — recency + a flattened
@@ -2544,32 +2671,11 @@ module Rubino
         ui.success("agent: #{previous} → #{Rubino::ActiveAgent.current}")
         # A /agent switch is NON-destructive: the REPL, the session, and the
         # subagent registry all stay alive, so we must NOT cancel running
-        # children (that would kill useful in-flight work). But a child blocked on
-        # ask_parent is now waiting on a parent the human just re-pinned, which is
-        # easy to forget — so SURFACE any blocked child (the safe behavior here)
-        # rather than leave it stuck invisibly. The human can still /reply it.
-        warn_blocked_children_after_switch(ui)
+        # children (that would kill useful in-flight work).
       rescue ArgumentError => e
         ui.error(e.message)
       end
 
-      # After a /agent switch, remind the human of any subagent still blocked on
-      # an ask_parent question (waiting on the human OR on its agent-parent) so
-      # the switch never silently strands a parked child at the idle prompt. Pure
-      # surfacing — nothing is cancelled; the children keep running and stay
-      # answerable via /reply <id>. Best-effort and quiet when nothing is blocked.
-      def warn_blocked_children_after_switch(ui)
-        blocked = Tools::BackgroundTasks.instance.running.select do |e|
-          %i[blocked_on_human blocked_on_parent].include?(e.status)
-        end
-        return if blocked.empty?
-
-        ui.warning("#{blocked.size} subagent(s) still waiting on an answer — /reply <id> to answer:")
-        blocked.each { |e| ui.info("  #{e.id} · #{e.subagent}") }
-      rescue StandardError
-        nil
-      end
-
       # Resolves a one-shot `/<agent> <message>` route to its Definition, or nil
       # when no agent was named (the plain-turn path). An unknown name degrades
       # to nil (the turn runs under the sticky agent) rather than crashing.
@@ -2909,7 +3015,7 @@ module Rubino
       # Builds an Agent::Runner with this invocation's shared flag overrides —
       # only the session and UI vary per call site (one-shot, interactive boot,
       # /sessions resume, /new).
-      def build_runner(session_id:, ui:, announce_session: true)
+      def build_runner(session_id:, ui:, announce_session: true, interactive: true)
         Agent::Runner.new(
           session_id: session_id,
           model_override: model_name,
@@ -2917,7 +3023,11 @@ module Rubino
           max_turns: max_turns_override,
           ignore_rules: opt(:ignore_rules) || false,
           ui: ui,
-          announce_session: announce_session
+          announce_session: announce_session,
+          # build_runner is the interactive-REPL builder; only setup_oneshot
+          # overrides this to false (a headless one-shot exits after one turn).
+          # Drives Lifecycle's single-slot KV-cache gate (#608c).
+          interactive: interactive
         )
       end
 
@@ -2951,7 +3061,7 @@ module Rubino
       # and what it said.
       def attach_agent_view(id, ui)
         entry = Tools::BackgroundTasks.instance.find(id)
-        return ui.error("no background subagent with id #{id}") unless entry
+        return ui.error("no background task with id #{id}") unless entry
 
         @attached_id = id
         # Focus the composer on this sub (tmux-style unified render): only frames
@@ -2973,13 +3083,57 @@ module Rubino
           # the focus gate) hands the bottom region to the sub; detach refocuses
           # main and the cards return.
           composer&.set_cards([])
-          ui.info(pastel.cyan("▶ attached to #{id} · #{entry.subagent}") +
-                  pastel.dim(" — type to steer · ↓ to switch subagents · ← to go back"))
-          session_resolver.replay_messages(ui, snapshot)
+          # The attach BODY differs by kind — the one polymorphic seam: a subagent
+          # replays its session transcript (and its per-sub CLI keeps painting live
+          # through the focus gate); a shell has no transcript, so it shows its
+          # captured OUTPUT and the user types straight to its stdin.
+          if entry.shell?
+            ui.info(pastel.cyan("▶ attached to #{id} · shell") +
+                    pastel.dim(" — type to send input · ↓ to switch · ← to go back"))
+            paint_shell_tail(composer, entry, full: true)
+          else
+            ui.info(pastel.cyan("▶ attached to #{id} · #{entry.subagent}") +
+                    pastel.dim(" — type to steer · ↓ to switch subagents · ← to go back"))
+            session_resolver.replay_messages(ui, snapshot)
+          end
+        end
+        # No watcher: a subagent's OWN per-sub CLI paints its ongoing activity live
+        # through the focus gate. A shell has none, so its NEW output is rendered
+        # after each input (see #handle_attached_input) — continuous auto-tailing
+        # is a later refinement.
+      end
+
+      # Paint a focused shell's NEW output into the attached view, through the SAME
+      # focus-gated, render-mutex-safe seam subagent live frames use
+      # (composer#print_above with the shell's origin) — so it is safe to call both
+      # from the keystroke handler AND the 1 Hz idle ticker thread. A private,
+      # mutex-guarded cursor tracks bytes already shown so it NEVER advances the
+      # shared read_offset the model's shell_output reads. full: ⇒ from the start
+      # (on attach); otherwise only bytes added since the last paint.
+      def paint_shell_tail(composer, entry, full: false)
+        return unless composer && entry
+
+        @attached_shell_mutex ||= Mutex.new
+        text = @attached_shell_mutex.synchronize do
+          buf = entry.output_all.to_s
+          @attached_shell_cursor = 0 if full || @attached_shell_cursor.nil?
+          slice = buf.byteslice(@attached_shell_cursor..) || ""
+          @attached_shell_cursor = buf.bytesize
+          slice
         end
-        # No watcher: the sub's OWN per-sub CLI now paints its ongoing activity
-        # live through the focus gate (it commits with this sub's origin), so the
-        # attached view stays live without a polling ticker.
+        return if text.strip.empty?
+
+        composer.print_above(text.chomp, origin: @attached_id)
+      end
+
+      # The idle ticker's per-tick hook (#start_ticker): live-tail the focused
+      # shell's output, if one is attached. A no-op while on a subagent (its own
+      # per-sub CLI streams) or the main view.
+      def tail_attached_shell(composer)
+        return unless @attached_id
+
+        entry = Tools::BackgroundTasks.instance.find(@attached_id)
+        paint_shell_tail(composer, entry) if entry&.shell?
       end
 
       # Leave the agent-view and return to the main session: clear the screen,
@@ -3024,7 +3178,7 @@ module Rubino
 
       # Route a line typed while attached. `/back`/`/detach` (or the child being
       # gone) return to the main view; a `/`-line is a COMMAND — the agent-scoped
-      # raw-text forms (bare `/stop`, `/reply`, `/probe`, `--attach`) are handled
+      # raw-text forms (bare `/stop`, `/probe`, `--attach`) are handled
       # in place, and EVERY other `/`-command (`/stop <id>`, `/agents`, `/status`,
       # …) routes through the SAME executor the main prompt uses (R3); only plain
       # text answers a blocked child or steers a running one. Reuses the existing
@@ -3054,7 +3208,7 @@ module Rubino
         # Switching to another live subagent still works; anything else gets a calm
         # notice — ← / /back returns to main. (Live = the same set BackgroundTasks#
         # live_status? / AgentMenu#live? use; inlined since it's the only use here.)
-        unless %i[running needs_approval blocked_on_human blocked_on_parent stopping].include?(entry.status)
+        unless %i[running needs_approval stopping].include?(entry.status)
           return attach_agent_view(Regexp.last_match(1), ui) if input =~ %r{\A/agents\s+(\S+)\s+--attach\z}
 
           # A `/`-command still EXECUTES even when the sub you're parked on has
@@ -3082,8 +3236,6 @@ module Rubino
           # The picker is a switcher while attached: selecting another subagent
           # SWITCHES the view to it (re-clear + replay) rather than steering.
           attach_agent_view(Regexp.last_match(1), ui)
-        when %r{\A/(?:reply|answer)\s+(.+)\z}m
-          agents_request_handler.deliver_reply(entry, Regexp.last_match(1))
         when %r{\A/probe\s+(.+)\z}m
           agents_request_handler.probe_agent(id, Regexp.last_match(1))
         when %r{\A/}
@@ -3099,12 +3251,13 @@ module Rubino
           result = cmd_executor.try_execute(input)
           attach_agent_view(result[:attach_agent], ui) if result.is_a?(Hash) && result[:attach_agent]
         else
-          if %i[needs_approval blocked_on_human].include?(entry.status)
-            # The child is blocked on YOU → the line is the answer.
-            agents_request_handler.deliver_reply(entry, input)
-          else
-            # The child is running → the line is a steer note folded at its next turn.
-            agents_request_handler.steer_agent(id, input)
+          # Plain text → the worker's input: a subagent folds it as a steer note at
+          # its next turn boundary; a shell writes it to stdin. For a shell, surface
+          # the output that input produced so the attached view stays useful.
+          agents_request_handler.steer_agent(id, input)
+          if entry.shell?
+            sleep 0.2 # let the shell consume the line + emit its response
+            paint_shell_tail(UI::BottomComposer.current, entry)
           end
         end
       end