@cruxy/cli 1.2.1 → 1.4.0

package/dist/plan/approve.js

@@ -10,27 +10,33 @@ import { renderPlan } from "./render.js";
  */
 export async function promptPlanDecision(plan, io) {
     const t = themeForColor(io.color);
-    io.write(renderPlan(plan, io.color));
-    io.write("\n\n");
-    io.write(`  ${t.muted("Approving consents to the shape of the work — every action still asks before it runs.")}\n`);
-    io.write(`  ${t.muted(`[a] approve ${t.glyph.sep}`)} [g] approve ${t.strong("+ allow the read/mutate steps")} this run ${t.muted("(destructive still confirms)")} ${t.muted(`${t.glyph.sep} [e] reject & revise`)} `);
-    const key = (await io.readKey()).toLowerCase();
-    io.write("\n");
-    switch (key) {
-        case "a":
-            return { kind: "approve" };
-        case "g":
-            return { kind: "approve-grant" };
-        case "e":
-        case "n": {
-            io.write("  what should change about the plan? ");
-            const feedback = (await io.readLine()).trim();
-            // No feedback ⇒ treat as an abort, not an empty revision request.
-            return feedback ? { kind: "revise", feedback } : { kind: "abort" };
+    io.beginPrompt?.();
+    try {
+        io.write(renderPlan(plan, io.color));
+        io.write("\n\n");
+        io.write(`  ${t.muted("Approving consents to the shape of the work — every action still asks before it runs.")}\n`);
+        io.write(`  ${t.muted(`[a] approve ${t.glyph.sep}`)} [g] approve ${t.strong("+ allow the read/mutate steps")} this run ${t.muted("(destructive still confirms)")} ${t.muted(`${t.glyph.sep} [e] reject & revise`)} `);
+        const key = (await io.readKey()).toLowerCase();
+        io.write("\n");
+        switch (key) {
+            case "a":
+                return { kind: "approve" };
+            case "g":
+                return { kind: "approve-grant" };
+            case "e":
+            case "n": {
+                io.write("  what should change about the plan? ");
+                const feedback = (await io.readLine()).trim();
+                // No feedback ⇒ treat as an abort, not an empty revision request.
+                return feedback ? { kind: "revise", feedback } : { kind: "abort" };
+            }
+            default:
+                // Unrecognized key, empty, EOF, Ctrl-C → default-deny.
+                return { kind: "abort" };
         }
-        default:
-            // Unrecognized key, empty, EOF, Ctrl-C → default-deny.
-            return { kind: "abort" };
+    }
+    finally {
+        io.endPrompt?.();
     }
 }
 /**
@@ -39,8 +45,14 @@ export async function promptPlanDecision(plan, io) {
  */
 export async function promptContinueAfterFailure(io) {
     const t = themeForColor(io.color);
-    io.write(`  ${t.danger("step failed.")} ${t.muted(`[c] continue with the remaining steps ${t.glyph.sep} [any other key] abort`)} `);
-    const key = (await io.readKey()).toLowerCase();
-    io.write("\n");
-    return key === "c";
+    io.beginPrompt?.();
+    try {
+        io.write(`  ${t.danger("step failed.")} ${t.muted(`[c] continue with the remaining steps ${t.glyph.sep} [any other key] abort`)} `);
+        const key = (await io.readKey()).toLowerCase();
+        io.write("\n");
+        return key === "c";
+    }
+    finally {
+        io.endPrompt?.();
+    }
 }

package/dist/plan/execute.js

@@ -1,6 +1,5 @@
 import { CruxyError } from "../errors/index.js";
 import { promptContinueAfterFailure } from "./approve.js";
-import { renderStepStatus } from "./render.js";
 export async function executePlan(plan, deps) {
     const { runStep, io, renderer } = deps;
     try {
@@ -13,20 +12,20 @@ export async function executePlan(plan, deps) {
                 title: step.title,
             });
             renderer?.setPhase({ kind: "executing-step" });
-            io.write(renderStepStatus(step, io.color) + "\n");
+            renderer?.setPlan(plan.steps);
             try {
                 await runStep(step);
                 step.status = "done";
-                io.write(renderStepStatus(step, io.color) + "\n");
+                renderer?.setPlan(plan.steps);
             }
             catch (err) {
                 step.status = "failed";
-                io.write(renderStepStatus(step, io.color) + "\n");
+                renderer?.setPlan(plan.steps);
                 // Surface the failure via the U.5 shape when we have it.
                 const detail = err instanceof CruxyError
                     ? `${err.title}${err.cause ? ` — ${err.cause}` : ""}`
                     : err.message;
-                io.write(`  ${detail}\n`);
+                renderer?.note(`  ${detail}`);
                 const cont = await promptContinueAfterFailure(io);
                 if (!cont) {
                     return { completed: false, halted: true, failedStepId: step.id };
@@ -38,8 +37,11 @@ export async function executePlan(plan, deps) {
         return { completed, halted: false };
     }
     finally {
-        // The plan owns the progress register; release it on every exit path so
-        // no stale "[i/n]" prefix outlives the run.
+        // The plan owns both registers; release them on every exit path so no stale
+        // "[i/n]" prefix and no stale checklist outlives the run. A renderer that
+        // keeps its checklist live rather than committing each transition (the TUI)
+        // commits one final copy as it clears, so the record survives the release.
         renderer?.progress(null);
+        renderer?.setPlan(null);
     }
 }

package/dist/plan/render.js

@@ -1,25 +1,17 @@
 import { themeForColor } from "../theme/index.js";
+import { statusMark } from "../render/index.js";
 /**
  * Plan rendering (C.31): data → string so it's testable and color is gated on a
- * boolean (NO_COLOR / non-TTY aware, passed in by the caller). Used both for the
- * approval prompt and for live status during execution. Glyphs and colors are
- * sourced from the theme (U.1); status is carried by the glyph (○/◐/✓/✗) and
- * risk by the `[read]/[mutate]/[destructive]` label, so meaning survives
- * NO_COLOR.
+ * boolean (NO_COLOR / non-TTY aware, passed in by the caller). This is the
+ * APPROVAL view — the whole plan, with each step's risk tag and rationale,
+ * shown once before execution. Per-step status DURING execution is the
+ * renderer's `setPlan` surface (`render/plan-view.ts`), which shares the status
+ * glyph below so the two views mark a step identically.
+ *
+ * Glyphs and colors are sourced from the theme (U.1); status is carried by the
+ * glyph (○/◐/✓/✗) and risk by the `[read]/[mutate]/[destructive]` label, so
+ * meaning survives NO_COLOR.
  */
-/** Status glyph, colored when enabled. */
-function statusMark(status, t) {
-    switch (status) {
-        case "pending":
-            return t.muted(t.glyph.pending);
-        case "running":
-            return t.accent(t.glyph.running);
-        case "done":
-            return t.success(t.glyph.success);
-        case "failed":
-            return t.danger(t.glyph.failure);
-    }
-}
 /** A short tag for the step's risk estimate. */
 function kindTag(kind, t) {
     switch (kind) {
@@ -48,8 +40,3 @@ export function renderPlan(plan, color) {
         lines.push(renderStep(step, t));
     return lines.join("\n");
 }
-/** A one-line status update for a single step (used during execution). */
-export function renderStepStatus(step, color) {
-    const t = themeForColor(color);
-    return `${statusMark(step.status, t)} ${t.strong(step.id + ".")} ${step.title}`;
-}

package/dist/plan/service.js

@@ -86,7 +86,10 @@ export async function runPlanSession(args) {
         const plan = holder.plan;
         const decision = await promptPlanDecision(plan, args.io);
         if (decision.kind === "abort") {
-            args.io.write("plan aborted — nothing was executed.\n");
+            // Committed output goes through the renderer, not the prompt io (P3):
+            // the io is for asking, and a plain write on it bypasses the live region
+            // that owns the screen.
+            args.renderer?.note("plan aborted — nothing was executed.");
             return finish();
         }
         if (decision.kind !== "revise") {

package/dist/render/capabilities.js

@@ -6,6 +6,8 @@ function isSet(value) {
 }
 /** Fallback width when the terminal reports none (non-TTY, pipe, unknown). */
 export const DEFAULT_COLUMNS = 80;
+/** Fallback height when the terminal reports none (non-TTY, pipe, unknown). */
+export const DEFAULT_ROWS = 24;
 /**
  * Resolve the terminal width (U.12) — the single rule behind
  * {@link RenderCapabilities.width} and every resize recompute. `COLUMNS` wins
@@ -22,6 +24,20 @@ export function resolveColumns(stream = process.stdout, env = process.env) {
         return stream.columns;
     return DEFAULT_COLUMNS;
 }
+/**
+ * Resolve the terminal height — the vertical twin of {@link resolveColumns},
+ * with the identical precedence rule: `LINES` wins when set (so `LINES=40 cruxy`
+ * and CI overrides work), then the stream's own `rows`, then
+ * {@link DEFAULT_ROWS}. Never returns a non-positive height.
+ */
+export function resolveRows(stream = process.stdout, env = process.env) {
+    const fromEnv = env.LINES === undefined ? NaN : Number.parseInt(env.LINES, 10);
+    if (Number.isFinite(fromEnv) && fromEnv > 0)
+        return fromEnv;
+    if (typeof stream.rows === "number" && stream.rows > 0)
+        return stream.rows;
+    return DEFAULT_ROWS;
+}
 /**
  * Reduced-motion (U.11) — the ecosystem `NO_MOTION` signal, the explicit cruxy
  * knob `CRUXY_REDUCED_MOTION`, and `CRUXY_NO_SPINNER` kept as an alias flowing
@@ -44,12 +60,19 @@ export function detectReducedMotion(env = process.env) {
  * The axes are independent (U.1/U.11): a NO_COLOR terminal still supports
  * in-place status updates; a dumb terminal supports neither; reduced motion and
  * screen-reader mode compose orthogonally with color and unicode.
+ *
+ * `stdin` is probed separately from `stream` because they are genuinely
+ * different channels: `echo hi | cruxy` has a piped stdin and a TTY stdout, and
+ * `cruxy > log` the reverse. Resolving both here — and their conjunction as
+ * `interactive` — is what lets every call site stop reading
+ * `process.stdin.isTTY` for itself.
  */
-export function detectCapabilities(stream = process.stdout, env = process.env) {
+export function detectCapabilities(stream = process.stdout, env = process.env, stdin = process.stdin) {
     const tty = Boolean(stream.isTTY);
     const dumb = env.TERM === "dumb";
     const cursor = tty && !dumb;
     const reducedMotion = detectReducedMotion(env);
+    const stdinTty = Boolean(stdin.isTTY);
     return {
         tty,
         color: shouldUseColor(stream, env) && !dumb,
@@ -62,6 +85,12 @@ export function detectCapabilities(stream = process.stdout, env = process.env) {
         // Unicode glyph safety (U.1) — independent of color. dumb / CRUXY_ASCII →
         // ASCII glyphs; everything else (incl. pipes) keeps unicode.
         unicode: detectUnicode(env),
+        stdinTty,
+        // The one interactivity rule, resolved once: a key read needs a terminal to
+        // read FROM and a terminal that can be repainted. Either half missing and
+        // no component may draw a frame or block on a key.
+        interactive: stdinTty && cursor,
         width: resolveColumns(stream, env),
+        height: resolveRows(stream, env),
     };
 }

package/dist/render/context-view.js

@@ -0,0 +1,106 @@
+import { formatTokens } from "./state.js";
+import { fit } from "./layout.js";
+/**
+ * Rendering `/context` (P6 track 3) — the DETAIL VIEW behind the rail's two
+ * numbers, not a second copy of them.
+ *
+ * THE PANEL'S RULES STILL APPLY HERE, and nothing below may weaken them. The
+ * context panel's doc comment is explicit that two plain numbers are the honest
+ * presentation and that a progress bar would not be: a filled bar reads as a
+ * measurement, and this is a chars/4 heuristic measured against a local config
+ * default. So there is no bar here either, no percentage-of-window, and every
+ * figure carries a `~`. "budget", never "window".
+ *
+ * WHAT THIS ADDS is the two things that genuinely cannot live in a 24-column
+ * strip without implying a precision they do not have:
+ *
+ *  1. **Where the tokens are.** A breakdown by what the content IS — prompts,
+ *     assistant text, tool calls, tool results, and summaries a previous
+ *     compaction already folded in — plus the individual messages large enough
+ *     to be worth naming. "60% of your context is one grep result" is
+ *     actionable; a single occupancy figure is not.
+ *  2. **What compaction would actually drop.** Computed by the SAME `findCut`
+ *     the seam uses, so the explanation cannot be subtly wrong exactly where it
+ *     matters. Including the case that surprises people: a history with no safe
+ *     cut point, where `/compact` will do nothing at all.
+ *
+ * The reserve is shown as its own row rather than folded into a total. It is
+ * part of `used`, it is present in no message, and a breakdown that omitted it
+ * would leave several thousand tokens looking unexplained.
+ */
+/** `~34k`, `~900` — the leading tilde is not decoration. See the module note. */
+function approx(n) {
+    return `~${formatTokens(n)}`;
+}
+/** `12%` — a share of the measured history, never of the model's real window. */
+function share(tokens, of) {
+    if (of <= 0)
+        return "";
+    return `${Math.round((tokens / of) * 100)}%`;
+}
+/**
+ * The full `/context` report as lines to print.
+ *
+ * `width` fits each row so a narrow terminal truncates rather than soft-wrapping
+ * a table into a misaligned mess; the default is unbounded for callers that
+ * reflow themselves (the TUI's main column).
+ */
+export function contextReportLines(report, t, width = Infinity) {
+    const { reading, compaction } = report;
+    const lines = [t.heading("context")];
+    // The headline, worded exactly as the panel words it — same estimate, same
+    // caveats, so the detail view can never read as the more authoritative one.
+    lines.push(`${t.strong(`${approx(reading.used)} / ${formatTokens(reading.total)} budget`)} ` +
+        t.muted(`(estimated · budget is a local setting, not the model's window)`));
+    lines.push(t.muted(`${report.messages} message${report.messages === 1 ? "" : "s"} · compacts above ${approx(reading.compactAt)}`));
+    // ── where the tokens are ──────────────────────────────────────────────────
+    const historyTokens = report.parts.reduce((sum, p) => sum + p.tokens, 0);
+    lines.push("");
+    lines.push(t.strong("where it is"));
+    if (report.parts.length === 0) {
+        lines.push(t.muted("  no conversation yet"));
+    }
+    else {
+        for (const part of report.parts) {
+            lines.push(`  ${part.part.padEnd(13)} ${approx(part.tokens).padStart(7)} ` +
+                t.muted(`${share(part.tokens, historyTokens).padStart(4)}  ${part.messages} msg`));
+        }
+    }
+    // Named separately because it is real, unavoidable, and in no message — the
+    // one part of the figure a user cannot shrink by pruning the conversation.
+    lines.push(`  ${"reserve".padEnd(13)} ${approx(report.reserveTokens).padStart(7)} ` +
+        t.muted("       system prompt + tool schemas"));
+    // ── the biggest single messages ───────────────────────────────────────────
+    if (report.largest.length > 0) {
+        lines.push("");
+        lines.push(t.strong("largest messages"));
+        for (const c of report.largest) {
+            const head = `  ${String(c.position).padStart(3)}. ${approx(c.tokens).padStart(7)}  ${c.label}`;
+            lines.push(`${head}${c.excerpt === "" ? "" : t.muted(` — ${c.excerpt}`)}`);
+        }
+    }
+    // ── what compaction would do ──────────────────────────────────────────────
+    lines.push("");
+    lines.push(t.strong("if you compact now"));
+    if (compaction.cut === null) {
+        // The case that surprises people, and the reason this section exists at all.
+        lines.push(t.muted("  nothing — there is no safe cut point yet. A summary can only replace"));
+        lines.push(t.muted("  whole completed turns, so an in-progress turn (or a history with no"));
+        lines.push(t.muted("  finished turn behind it) has nothing it can fold away."));
+    }
+    else {
+        lines.push(t.muted(`  ${compaction.droppedMessages} message${compaction.droppedMessages === 1 ? "" : "s"} ` +
+            `(${approx(compaction.droppedTokens)}) folded into a summary; ` +
+            `${compaction.keptMessages} kept verbatim (${approx(compaction.keptTokens)})`));
+        // A ceiling, not a saving: the summary that replaces the prefix costs
+        // tokens of its own, and how many is not knowable until the model writes it.
+        lines.push(t.muted(`  frees at most ${approx(compaction.droppedTokens)} — the summary that replaces them costs`));
+        lines.push(t.muted("  tokens of its own, which cannot be known in advance."));
+    }
+    lines.push(compaction.overThreshold
+        ? t.warning("  the next turn will compact on its own")
+        : t.muted("  below the threshold — the next turn will not compact"));
+    return Number.isFinite(width)
+        ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
+        : lines;
+}

package/dist/render/diff.js

@@ -7,8 +7,115 @@ import { fit, fitMiddle } from "./layout.js";
  * `+`/`-` lines from the exact same code path. Diff add/remove intentionally
  * reuse the `success`/`danger` hues (green/red), as before.
  */
-/** Cap on rendered preview lines before collapsing the rest. */
+/** Default cap on rendered preview lines before collapsing the rest. A DEFAULT,
+ * not a constant of the format: a surface that owns a sized region (the TUI's
+ * main column) passes its own cap, so the collapse point matches the space the
+ * block will actually be drawn into. */
 export const PREVIEW_MAX_LINES = 40;
+/** Lines a replacement string contributes: "" → 0, "a\nb" and "a\nb\n" → 2. */
+function lineCount(text) {
+    if (text === "")
+        return 0;
+    const body = text.endsWith("\n") ? text.slice(0, -1) : text;
+    return body.split("\n").length;
+}
+/**
+ * Whether a replacement covers whole lines, which is what makes its count
+ * exact. An `edit_file` swap is an arbitrary substring — usually neither empty
+ * nor newline-terminated — so most edits are honestly approximate.
+ */
+function lineAligned(text) {
+    return text === "" || text.endsWith("\n");
+}
+/** One file's stat from a patch entry. */
+function patchFileStat(file) {
+    if (file.op === "delete") {
+        // Only a path is recorded, so the removed count is unknowable here.
+        return {
+            path: file.path,
+            op: "delete",
+            added: 0,
+            removed: null,
+            approximate: false,
+        };
+    }
+    if (file.op === "create") {
+        return {
+            path: file.path,
+            op: "create",
+            // The pre-capped listing plus what the cap dropped: the whole file.
+            added: file.lines.length + file.omittedLines,
+            removed: 0,
+            approximate: false,
+        };
+    }
+    let added = 0;
+    let removed = 0;
+    let approximate = false;
+    for (const hunk of file.hunks) {
+        added += lineCount(hunk.newStr);
+        removed += lineCount(hunk.oldStr);
+        if (!lineAligned(hunk.oldStr) || !lineAligned(hunk.newStr))
+            approximate = true;
+    }
+    return { path: file.path, op: "update", added, removed, approximate };
+}
+/**
+ * Per-file line counts for any preview — the structured form, so a caller can
+ * lay out a summary rather than scrape it back out of rendered text.
+ *
+ * Empty for `pr`, `rollback` and `rollback-set`: the first changes no files
+ * here, and the latter two are restores whose own renderers already lead with
+ * their blast radius.
+ */
+export function previewStats(preview) {
+    if (!preview)
+        return [];
+    if (preview.type === "patch")
+        return preview.files.map(patchFileStat);
+    if (preview.type === "edit") {
+        return [
+            {
+                path: "",
+                op: "update",
+                added: lineCount(preview.newStr),
+                removed: lineCount(preview.oldStr),
+                approximate: !lineAligned(preview.oldStr) || !lineAligned(preview.newStr),
+            },
+        ];
+    }
+    if (preview.type === "write") {
+        return [
+            {
+                path: "",
+                op: preview.exists ? "update" : "create",
+                added: preview.lines.length + preview.omittedLines,
+                // Overwriting discards the previous contents, whose length the preview
+                // does not record.
+                removed: preview.exists ? null : 0,
+                approximate: false,
+            },
+        ];
+    }
+    return [];
+}
+/**
+ * `+12/-3`, `~+1/-1`, `+8` — omitting a side the preview cannot count.
+ *
+ * Takes only the three fields it reads rather than a whole {@link DiffFileStat},
+ * so P7's git-status changes render through this same formatter instead of a
+ * second one that would eventually disagree with it about what `null` means.
+ */
+export function formatStat(stat, c) {
+    const parts = [];
+    if (stat.added !== null && stat.added > 0)
+        parts.push(c.success(`+${stat.added}`));
+    if (stat.removed !== null && stat.removed > 0)
+        parts.push(c.danger(`-${stat.removed}`));
+    if (parts.length === 0)
+        return "";
+    return `${stat.approximate ? "~" : ""}${parts.join("/")}`;
+}
 function diffLines(oldStr, newStr, c) {
     const removed = oldStr.split("\n").map((l) => c.danger(`- ${l}`));
     const added = newStr.split("\n").map((l) => c.success(`+ ${l}`));
@@ -22,20 +129,25 @@ function diffLines(oldStr, newStr, c) {
 function fitPath(path, c, width) {
     return fitMiddle(path, Math.max(1, width - 10), c.glyph.ellipsis);
 }
+/** `update src/x.ts  +12/-3` — the verb, the path, then the counts (P3). */
+function fileHeader(verb, file, c, width) {
+    const stat = formatStat(patchFileStat(file), c);
+    return `${verb} ${fitPath(file.path, c, width)}${stat === "" ? "" : `  ${stat}`}`;
+}
 function renderPatchFiles(files, c, width = Infinity) {
     const out = [];
     for (const file of files) {
         if (file.op === "delete") {
-            out.push(c.danger(`delete ${fitPath(file.path, c, width)}`));
+            out.push(c.danger(fileHeader("delete", file, c, width)));
         }
         else if (file.op === "create") {
-            out.push(c.success(`create ${fitPath(file.path, c, width)}`));
+            out.push(c.success(fileHeader("create", file, c, width)));
             out.push(...file.lines.map((l) => c.success(`+ ${l}`)));
             if (file.omittedLines > 0)
                 out.push(c.muted(`  ...${file.omittedLines} more lines`));
         }
         else {
-            out.push(c.warning(`update ${fitPath(file.path, c, width)}`));
+            out.push(c.warning(fileHeader("update", file, c, width)));
             for (const hunk of file.hunks)
                 out.push(...diffLines(hunk.oldStr, hunk.newStr, c));
         }
@@ -123,14 +235,25 @@ function bodyLines(body) {
 /**
  * Render any {@link ActionPreview} as an indented block: a diff for edits and
  * patches, a create/overwrite listing for writes, the publish plan for PRs.
- * Long previews collapse past {@link PREVIEW_MAX_LINES}.
+ *
+ * `maxLines` defaults to {@link PREVIEW_MAX_LINES} so existing callers are
+ * unchanged, but it is a PARAMETER because the right collapse point belongs to
+ * whatever will draw the block — the TUI passes the rows its main column
+ * actually has, so a preview no longer collapses at 40 lines in a pane that can
+ * show 12 or one that could show 80.
  */
-export function renderActionPreview(preview, c, width = Infinity) {
+export function renderActionPreview(preview, c, width = Infinity, maxLines = PREVIEW_MAX_LINES) {
     if (!preview)
         return "";
     let lines;
     if (preview.type === "edit") {
-        lines = diffLines(preview.oldStr, preview.newStr, c);
+        // A headline stat, so a one-line swap is legible without counting the
+        // diff rows — and `~` marks it as lines touched, not lines gained/lost.
+        const stat = formatStat(previewStats(preview)[0], c);
+        lines = [
+            ...(stat === "" ? [] : [c.muted(`edit  ${stat}`)]),
+            ...diffLines(preview.oldStr, preview.newStr, c),
+        ];
     }
     else if (preview.type === "patch") {
         lines = renderPatchFiles(preview.files, c, width);
@@ -145,19 +268,25 @@ export function renderActionPreview(preview, c, width = Infinity) {
         lines = renderRollbackSetPreview(preview, c);
     }
     else {
-        const header = preview.exists
+        const stat = formatStat(previewStats(preview)[0], c);
+        const label = preview.exists
             ? c.warning("OVERWRITE existing")
             : c.success("create");
+        const header = stat === "" ? label : `${label}  ${stat}`;
         const body = preview.lines.map((l) => `  ${l}`);
         if (preview.omittedLines > 0)
             body.push(c.muted(`  ...${preview.omittedLines} more lines`));
         lines = [header, ...body];
     }
-    if (lines.length > PREVIEW_MAX_LINES) {
-        const hidden = lines.length - PREVIEW_MAX_LINES;
+    // Collapse against the CALLER's budget, marker INCLUDED — a block handed a
+    // pane's height must fit that pane. With only one row to spend, the marker
+    // wins: "...60 more" is the honest answer, where a single arbitrary diff row
+    // would read as the whole change.
+    if (Number.isFinite(maxLines) && lines.length > maxLines) {
+        const kept = Math.max(0, maxLines - 1);
         lines = [
-            ...lines.slice(0, PREVIEW_MAX_LINES),
-            c.muted(`...${hidden} more`),
+            ...lines.slice(0, kept),
+            c.muted(`...${lines.length - kept} more`),
         ];
     }
     // Horizontal fit at the single choke point (U.12): every content line is
@@ -169,3 +298,66 @@ export function renderActionPreview(preview, c, width = Infinity) {
     const room = Math.max(1, width - 2);
     return lines.map((l) => `  ${fit(l, room, c.glyph.ellipsis)}`).join("\n");
 }
+/**
+ * Colour a UNIFIED diff — git's own output — for `/diff` (P6 track 4).
+ *
+ * A second diff renderer would be exactly what this module's header rules out,
+ * so it lives here beside the others and reuses their palette: add/remove take
+ * the same `success`/`danger` hues an `ActionPreview` does, so a change looks
+ * the same whether you saw it in an approval prompt or asked for it afterwards.
+ *
+ * What differs is the INPUT. Everything else here renders a structured
+ * `ActionPreview` cruxy built itself; this takes text git produced, which means
+ * the file/hunk structure arrives as line prefixes rather than as fields. So the
+ * rule is deliberately narrow — style by leading marker, change nothing else:
+ *
+ *  - `+++` / `---` before `+` / `-`, or every file header reads as a hunk;
+ *  - `` is git's own note, not a removal;
+ *  - the body is passed through verbatim. No re-wrapping, no re-indenting, no
+ *    tab expansion. A diff whose whitespace has been "tidied" is a diff you
+ *    cannot trust to show you a whitespace bug.
+ *
+ * Truncation is from the TOP of the tail, not the bottom: the marker says how
+ * many lines were dropped, and the lines kept are the FIRST ones, because a diff
+ * read from the middle is worse than a diff read from the start and stopped.
+ */
+export function renderUnifiedDiff(diff, c, opts = {}) {
+    const maxLines = opts.maxLines ?? PREVIEW_MAX_LINES;
+    const width = opts.width ?? Infinity;
+    const body = diff.replace(/\n+$/, "");
+    // `"".split("\n")` is `[""]`, not `[]` — an empty diff would otherwise render
+    // as one blank row. The caller guards this today; the renderer should not
+    // depend on that.
+    if (body === "")
+        return [];
+    const raw = body.split("\n");
+    const truncated = raw.length > maxLines;
+    // Reserve the marker's own row, so the block fits the budget it was given.
+    const kept = truncated ? raw.slice(0, Math.max(0, maxLines - 1)) : raw;
+    const styled = kept.map((line) => {
+        if (line.startsWith("diff --git") || line.startsWith("index ")) {
+            return c.strong(line);
+        }
+        // Before the +/- tests: a `+++ b/file` header is a file marker, not an
+        // addition, and colouring it green makes every header read as one.
+        if (line.startsWith("+++") || line.startsWith("---"))
+            return c.muted(line);
+        if (line.startsWith("@@"))
+            return c.accent(line);
+        // git's own note about a missing trailing newline. It starts with a
+        // backslash, but it is prose about the diff rather than part of it.
+        if (line.startsWith("\\"))
+            return c.muted(line);
+        if (line.startsWith("+"))
+            return c.success(line);
+        if (line.startsWith("-"))
+            return c.danger(line);
+        return line;
+    });
+    if (truncated) {
+        styled.push(c.muted(`...${raw.length - kept.length} more diff lines`));
+    }
+    return Number.isFinite(width)
+        ? styled.map((l) => fit(l, width, c.glyph.ellipsis))
+        : styled;
+}