@cruxy/cli 1.4.0 → 1.6.0

package/dist/render/plan-view.js

@@ -61,7 +61,7 @@ export function planChecklist(steps, t, maxRows = Infinity, width = Infinity) {
         return [];
     const done = steps.filter((s) => s.status === "done").length;
     const failed = steps.filter((s) => s.status === "failed").length;
-    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(` · ${failed} failed`) : ""}`);
+    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(`${t.sep}${failed} failed`) : ""}`);
     const finish = (lines) => Number.isFinite(width)
         ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
         : lines;

package/dist/render/status-view.js

@@ -1,13 +1,59 @@
+import { capacityLevel, formatCapacity, } from "../utils/disk.js";
 import { fit } from "./layout.js";
 import { formatTokens } from "./state.js";
 /** `key  value`, aligned on a fixed gutter so the column is scannable. */
 function row(key, value, t) {
     return `  ${t.muted(key.padEnd(11))} ${value}`;
 }
+/**
+ * Collapse locations that report identical figures into one row, naming all of
+ * them.
+ *
+ * A project under `~` and `~/.cruxy` are usually the same filesystem, and two
+ * rows saying `54% free · 251 GiB of 465 GiB` twice is noise dressed as detail.
+ * Grouping is on the RENDERED numbers rather than on mount identity because
+ * `statfs` gives no filesystem id to compare — and grouping on the numbers is
+ * the honest test anyway: if two locations report the same total and the same
+ * free bytes, either they are one filesystem or they are two the reader has no
+ * way to tell apart, and in both cases one row is the whole of what's known.
+ */
+function groupLocations(locations) {
+    const groups = new Map();
+    for (const loc of locations) {
+        const key = `${loc.capacity.totalBytes}:${loc.capacity.freeBytes}`;
+        const existing = groups.get(key);
+        if (existing)
+            existing.labels.push(loc.label);
+        else
+            groups.set(key, { labels: [loc.label], capacity: loc.capacity });
+    }
+    return [...groups.values()];
+}
+/**
+ * The disk rows: `disk  cli, ~/.cruxy  54% free · 251 GiB of 465 GiB`.
+ *
+ * Coloured by {@link capacityLevel}, which judges absolute bytes — so a nearly
+ * full 4 TB disk with plenty left in it is not dressed up as an emergency, and
+ * a small VM disk with 800 MB left is, whatever percentage that happens to be.
+ * Only the first row carries the key; the rest align under it, because a `disk`
+ * label repeated down the column reads as several different facts.
+ */
+function diskLines(locations, t) {
+    return groupLocations(locations).map((group, i) => {
+        const text = formatCapacity(group.capacity, t.glyph.sep);
+        const level = capacityLevel(group.capacity);
+        const value = level === "critical"
+            ? t.danger(text)
+            : level === "low"
+                ? t.warning(text)
+                : t.muted(text);
+        return row(i === 0 ? "disk" : "", `${group.labels.join(", ")}  ${value}`, t);
+    });
+}
 /** The full `/status` block as lines to print. */
 export function sessionStatusLines(status, t, width = Infinity) {
     const lines = [t.heading("status")];
-    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`· ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
+    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`${t.glyph.sep} ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
     // The mode leads the safety half, and carries its description rather than its
     // name alone. The objection that removed the auto-approve config flag was that
     // it disarmed the gate with nothing on screen saying so; a status screen
@@ -22,7 +68,7 @@ export function sessionStatusLines(status, t, width = Infinity) {
     if (status.context) {
         const { used, total, compactAt } = status.context;
         lines.push(row("context", `${t.strong(`~${formatTokens(used)} / ${formatTokens(total)} budget`)} ` +
-            t.muted(`· compacts above ~${formatTokens(compactAt)}`), t));
+            t.muted(`${t.glyph.sep} compacts above ~${formatTokens(compactAt)}`), t));
     }
     // A sandbox that is ON but whose runtime we cannot name is reported as on
     // WITHOUT a name, rather than omitted — the safety-relevant half is that it
@@ -33,13 +79,19 @@ export function sessionStatusLines(status, t, width = Infinity) {
     lines.push(row("checkpoints", status.checkpoints
         ? t.muted("on — `cruxy rollback` can undo a run's file changes")
         : t.warning("off — file changes are not restorable"), t));
+    // Next to checkpoints, the feature that turns a turn into a shadow copy of
+    // the tree: the two rows answer one question between them — will this
+    // session's writes land.
+    if (status.disk && status.disk.length > 0) {
+        lines.push(...diskLines(status.disk, t));
+    }
     if (status.jobs) {
         const { total, running, needingApproval } = status.jobs;
         const detail = total === 0
             ? t.muted("none this session")
-            : `${total} · ${running} running` +
+            : `${total}${t.sep}${running} running` +
                 (needingApproval > 0
-                    ? t.warning(` · ${needingApproval} awaiting approval`)
+                    ? t.warning(`${t.sep}${needingApproval} awaiting approval`)
                     : "");
         lines.push(row("jobs", detail, t));
     }

package/dist/render/units.js

@@ -0,0 +1,22 @@
+/**
+ * Display units shared by every surface that shows a token figure (P10 track 3).
+ *
+ * `compactTokens` lived in `tui/limits-panel.ts` while it was the rail's alone.
+ * `/budget` states the same quantity — weighted tokens — against the same server
+ * windows, and the two must not round differently: a panel reading `8.5M` beside
+ * a command reading `8500000` is one fact wearing two faces.
+ */
+/** 14_000_000 → "14M", 8_700_000 → "8.7M", 125_000 → "125k", 900 → "900". */
+export function compactTokens(n) {
+    const abs = Math.abs(n);
+    if (abs >= 1_000_000)
+        return `${trimZero(n / 1_000_000)}M`;
+    if (abs >= 1_000)
+        return `${trimZero(n / 1_000)}k`;
+    return `${Math.round(n)}`;
+}
+/** One decimal, but only when it says something: 8.7 stays, 14.0 becomes 14. */
+function trimZero(n) {
+    const one = n.toFixed(1);
+    return one.endsWith(".0") ? one.slice(0, -2) : one;
+}

package/dist/session/index.js

@@ -15,6 +15,7 @@ export { PROJECTS_DIR_NAME, RESERVED_SUBDIRS, SESSION_FILE_EXT, projectDir, proj
 export { SessionLog } from "./log.js";
 export { defaultExportName, exportMarkdown, } from "./export.js";
 export { foldEvents, readEvents, readMeta, replaySession } from "./replay.js";
+export { redactMessages } from "./redact.js";
 export { findSession, isAmbiguous, listSessions, summarizeSession, } from "./list.js";
 export { cwdMismatchWarning, describeSession, loadResume, relativeAge, resumeById, resumePicker, shortId, PICKER_LIMIT, } from "./resume.js";
 export { SESSION_FILE_VERSION, SessionEventSchema, SessionMetaSchema, } from "./types.js";

package/dist/session/log.js

@@ -92,6 +92,25 @@ export class SessionLog {
             outputTokens,
         });
     }
+    /**
+     * `/redact` (P10 track 5): from here on, replay masks every recognised secret
+     * in the history recorded SO FAR.
+     *
+     * The one writer in this class that changes how EARLIER lines are read. It
+     * does not touch them — see the class header on why this file is only ever
+     * appended to — and it deliberately records no secret material: `kinds` and
+     * `count` say what was found, which is all a reader could already work out by
+     * running the same detector.
+     */
+    redact(kinds, count) {
+        this.write({
+            kind: "redact",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            kinds,
+            count,
+        });
+    }
     runId() {
         const id = this.currentRunId?.();
         return id === undefined ? {} : { runId: id };

package/dist/session/redact.js

@@ -0,0 +1,74 @@
+import { redactSecrets } from "../memory/secrets.js";
+/**
+ * Mask every recognised secret across a whole message array.
+ *
+ * Returns a NEW array (and new blocks) rather than mutating: the caller's array
+ * is the one the recorder's watermark is measured against, and replacing it
+ * wholesale is what `Session` already does after every turn.
+ */
+export function redactMessages(messages) {
+    const kinds = [];
+    let count = 0;
+    const scrub = (text) => {
+        const r = redactSecrets(text);
+        count += r.count;
+        for (const k of r.kinds)
+            if (!kinds.includes(k))
+                kinds.push(k);
+        return r.text;
+    };
+    const out = messages.map((message) => {
+        if (typeof message.content === "string") {
+            return { ...message, content: scrub(message.content) };
+        }
+        return {
+            ...message,
+            content: message.content.map((block) => scrubBlock(block, scrub)),
+        };
+    });
+    return { messages: out, kinds, count };
+}
+/**
+ * One content block.
+ *
+ * `tool_use.input` is arbitrary JSON and is where the highest-risk material
+ * actually lands — a `run_command` whose argv carries a token, an HTTP tool with
+ * an auth header. It is redacted by round-tripping through its serialised form
+ * rather than by walking an unknown shape: the marker contains no character JSON
+ * escapes, so the string stays parseable, and a parse failure (which should be
+ * impossible) leaves the block untouched rather than corrupting a history the
+ * provider has to accept on the next turn.
+ *
+ * An unknown block kind is passed through unchanged. A newer cruxy's block must
+ * survive an older one reading the file (`ContentBlockSchema` says so), and
+ * inventing a redaction for a shape this build cannot interpret would be the
+ * lossy behaviour that rule exists to prevent.
+ */
+function scrubBlock(block, scrub) {
+    if (block.type === "text")
+        return { ...block, text: scrub(block.text) };
+    if (block.type === "tool_result") {
+        return { ...block, content: scrub(block.content) };
+    }
+    if (block.type === "tool_use") {
+        if (block.input === undefined)
+            return block;
+        let serialised;
+        try {
+            serialised = JSON.stringify(block.input);
+        }
+        catch {
+            return block; // not serialisable — leave it exactly as it was
+        }
+        const scrubbed = scrub(serialised);
+        if (scrubbed === serialised)
+            return block;
+        try {
+            return { ...block, input: JSON.parse(scrubbed) };
+        }
+        catch {
+            return block;
+        }
+    }
+    return block;
+}

package/dist/session/replay.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { modeFromFlags } from "../agent/mode.js";
+import { redactMessages } from "./redact.js";
 import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
 /**
  * Replay: fold an append-only event log back into the state a session needs to
@@ -74,6 +75,7 @@ export function foldEvents(events, skipped = 0) {
     // timestamp.
     let planMode = false;
     let mode = null;
+    let redactions = 0;
     const usage = { input_tokens: 0, output_tokens: 0 };
     for (const event of events) {
         switch (event.kind) {
@@ -101,6 +103,19 @@ export function foldEvents(events, skipped = 0) {
                 usage.input_tokens += event.inputTokens;
                 usage.output_tokens += event.outputTokens;
                 break;
+            case "redact":
+                // Exactly what `Session.redact` did in memory: mask every recognised
+                // secret across the history AS IT STANDS. Position in the fold is the
+                // whole meaning of the event — messages appended afterwards are not
+                // covered, because at the moment the user asked, they did not exist.
+                //
+                // The event's own `kinds`/`count` are deliberately not consulted: they
+                // record what the writing build found, and this build's denylist may
+                // have grown since. Re-running the detector is what makes a redaction
+                // get stronger over time rather than being frozen at write time.
+                messages = redactMessages(messages).messages;
+                redactions++;
+                break;
             case "meta":
                 break;
         }
@@ -114,6 +129,7 @@ export function foldEvents(events, skipped = 0) {
         // could be on, so nothing is being inferred.
         mode: mode ?? modeFromFlags(planMode, false),
         skipped,
+        redactions,
     };
 }
 /** Read and parse a session file into its events, counting unusable lines. */

package/dist/session/resume.js

@@ -71,6 +71,14 @@ export function loadResume(session, cwd) {
         warnings.push(`${state.skipped} unreadable line${state.skipped === 1 ? "" : "s"} in the session log were skipped — ` +
             `the restored history may be incomplete`);
     }
+    if (state.redactions > 0) {
+        // Said on resume because the alternative is a user finding `[redacted …]`
+        // in a transcript and not knowing whether cruxy did it or the model wrote
+        // it. The second clause is the part that is easy to leave out and matters
+        // most: `/redact` never rewrote the file it is being replayed from.
+        warnings.push(`this session was redacted ${state.redactions === 1 ? "once" : `${state.redactions} times`} — ` +
+            `secrets are masked in the restored history, but the original text is still in ${session.file}`);
+    }
     return { session, state, warnings };
 }
 /**

package/dist/session/types.js

@@ -211,6 +211,43 @@ export const UsageEventSchema = z
     outputTokens: z.number().int().nonnegative(),
 })
     .passthrough();
+/**
+ * `/redact` (P10 track 5): every recognised secret in the history SO FAR is
+ * masked from this point in the fold onwards.
+ *
+ * A NEW EVENT RATHER THAN A REWRITE, and that is the entire design. Editing the
+ * earlier lines would mean re-serialising the file, which costs the two
+ * properties this format exists for — O(1) writes per turn, and a crash costing
+ * a torn last line instead of a conversation (see the module header, and
+ * `log.ts` on why temp-then-rename is wrong here). So a redaction changes how
+ * earlier lines are READ, and the earlier lines stay exactly as they were.
+ *
+ * THE EVENT CARRIES NO SECRET, deliberately: recording the strings to remove
+ * would write them into the log in order to say they should not be there. The
+ * fold re-derives the spans by re-running the detector, which is deterministic
+ * over the same messages and gives a reader nothing it could not already see.
+ *
+ * `kinds` and `count` are what the pass FOUND — a record for the user, not an
+ * instruction to the fold. The fold ignores them; a build whose denylist has
+ * since grown will legitimately mask more than the number written here, and
+ * treating the count as authoritative would cap it at what an older build knew.
+ *
+ * An older cruxy that has never heard of this kind SKIPS the line (`replay.ts`)
+ * and shows the unredacted history. That is the honest failure for a
+ * forward-compatibility rule that must not lose conversations, and it is why the
+ * command says the file itself still holds the raw text.
+ */
+export const RedactEventSchema = z
+    .object({
+    kind: z.literal("redact"),
+    at: z.string(),
+    runId: z.string().optional(),
+    /** Secret kinds the pass matched, for the record. Not read by the fold. */
+    kinds: z.array(z.string()).default([]),
+    /** Spans replaced at write time. Not read by the fold. */
+    count: z.number().int().nonnegative().default(0),
+})
+    .passthrough();
 /** Every event, discriminated on `kind`. */
 export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionMetaSchema,
@@ -220,4 +257,5 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
     PlanModeEventSchema,
     SessionModeEventSchema,
     UsageEventSchema,
+    RedactEventSchema,
 ]);

package/dist/subagent/orchestrator.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import { runAgent } from "../agent/loop.js";
-import { CruxyError, ErrorCode, messageOf, subagentDepthExceeded, subagentScopeOverlap, } from "../errors/index.js";
+import { CruxyError, ErrorCode, messageOf, sessionBudgetExhausted, subagentDepthExceeded, subagentScopeOverlap, } from "../errors/index.js";
+import { UNRESOLVED_TIER, } from "../budget/index.js";
+import { resolveTaskModel } from "../routing/index.js";
 import { Workspace } from "../workspace/index.js";
 import { Budget, resolveBudget } from "../agent/budget.js";
 import { scopeRegistry, SUBAGENT_WRITE_TOOLS } from "./registry-scope.js";
@@ -181,6 +183,28 @@ export class SubagentOrchestrator {
             return [];
         // Refuse overlapping write scope BEFORE any child is dispatched.
         this.assertDisjointWriteScopes(specs);
+        // Admission control (P10 track 3 / cli#212), also before dispatch. Ordered
+        // AFTER the scope check on purpose: an overlapping fan-out is malformed and
+        // must be refused whatever the budget says, and narrowing a malformed batch
+        // to two children would hide the overlap rather than report it.
+        const admitted = this.admitFanOut(specs);
+        if (admitted.kind === "refused") {
+            throw sessionBudgetExhausted(admitted.reason);
+        }
+        // The children that do not run come back as an explicit NOT-ADMITTED result
+        // carrying the reason, never as a silently shorter array. The parent model is
+        // the one that has to decide what to do about a half-dispatched plan, and it
+        // can only do that if it is told — a fan-out of 5 that returns 2 results with
+        // no explanation reads as three crashes. Position is preserved for the same
+        // reason the dispatched half preserves it: result i is spec i, always.
+        const dispatch = specs.slice(0, admitted.count);
+        const deferred = [];
+        if (admitted.kind === "narrowed") {
+            this.deps.logger.warn(admitted.reason);
+            for (let i = admitted.count; i < specs.length; i++) {
+                deferred.push(notAdmittedResult(admitted.reason));
+            }
+        }
         const controller = new AbortController();
         const onExternalAbort = () => controller.abort();
         if (opts.signal) {
@@ -189,10 +213,10 @@ export class SubagentOrchestrator {
             else
                 opts.signal.addEventListener("abort", onExternalAbort, { once: true });
         }
-        const results = new Array(specs.length);
-        const total = specs.length;
+        const results = new Array(dispatch.length);
+        const total = dispatch.length;
         try {
-            const settled = await Promise.allSettled(specs.map((spec, i) => this.sem.run(async () => {
+            const settled = await Promise.allSettled(dispatch.map((spec, i) => this.sem.run(async () => {
                 // Already cancelled (a fatal sibling or Ctrl-C fired first): record an
                 // honest cancelled result instead of starting a doomed run.
                 if (controller.signal.aborted) {
@@ -223,12 +247,51 @@ export class SubagentOrchestrator {
                 if (results[i] === undefined)
                     results[i] = cancelledResult();
             }
-            return results;
+            return [...results, ...deferred];
         }
         finally {
             opts.signal?.removeEventListener("abort", onExternalAbort);
         }
     }
+    /**
+     * Ask the session budget whether this batch fits (P10 track 3 / cli#212).
+     *
+     * The estimate is the batch's CEILING, not a guess at its actual draw:
+     * `count × perChildTokens × multiplier`, where `perChildTokens` is the local
+     * cap each child already runs under. A spec may narrow its own budget, so the
+     * per-child figure is the resolved one rather than the configured default —
+     * a fan-out of five deliberately-cheap children should not be refused on the
+     * arithmetic of five expensive ones.
+     *
+     * Tier: the router resolves per task class, and a child defaults to the
+     * `subagent` class. When routing cannot name a tier the request still draws on
+     * the pool, so it is weighed at the worst case rather than skipped — see
+     * `UNRESOLVED_TIER`.
+     */
+    admitFanOut(specs) {
+        const budget = this.deps.budget;
+        if (!budget)
+            return { kind: "allow", count: specs.length, maxTokens: 0 };
+        const { defaultBudget } = this.deps.config.subagent;
+        // The heaviest child in the batch sets the per-run figure. The bound has to
+        // hold for the batch as dispatched, and averaging would let one 64k child
+        // hide behind four 4k ones.
+        const perRunTokens = specs.reduce((max, spec) => Math.max(max, resolveBudget(defaultBudget, spec.budget).maxTokens), 0);
+        return budget.admit({
+            count: specs.length,
+            perRunTokens,
+            tier: this.fanOutTier(),
+        });
+    }
+    /** The tier a child would route to, or the unresolved/no-pool markers. */
+    fanOutTier() {
+        const router = this.deps.router;
+        if (!router)
+            return undefined; // no cruxy routing — not a weighted-pool request
+        // No tier means the router chose `auto` and the gateway decides — a request
+        // that still draws on the pool, so it is weighed at the worst case.
+        return resolveTaskModel(router, "subagent").tier ?? UNRESOLVED_TIER;
+    }
     /**
      * Resolve a child's scope from an optional root name. With a name: a
      * single-root workspace over that root (writes confined to it) + that root's
@@ -344,6 +407,20 @@ function cancelledResult() {
         usage: { input_tokens: 0, output_tokens: 0 },
     };
 }
+/**
+ * A child the budget would not admit. Zero usage and zero iterations, because
+ * that is literally what it consumed — a fabricated non-zero here would show up
+ * in the parent's accounting as spend that never happened.
+ */
+function notAdmittedResult(reason) {
+    return {
+        status: "not-admitted",
+        summary: "",
+        error: `${ErrorCode.SessionBudgetExhausted}: ${reason}`,
+        iterations: 0,
+        usage: { input_tokens: 0, output_tokens: 0 },
+    };
+}
 /** `artifacts` only when non-empty — absent beats `[]` in the parent's context. */
 function artifactsField(artifacts) {
     return artifacts.size > 0 ? { artifacts: [...artifacts].sort() } : {};

package/dist/theme/resolve.js

@@ -47,6 +47,7 @@ export function resolveTheme(caps) {
         sep: ` ${glyph.sep} `,
         color: caps.color,
         unicode: caps.unicode,
+        screenReader: caps.screenReader ?? false,
     };
 }
 /**

package/dist/theme/tokens.js

@@ -22,6 +22,8 @@ export const UNICODE_GLYPHS = {
     caretDown: "↓",
     cached: "↻",
     cursorBar: "▏",
+    barFilled: "█",
+    barEmpty: "░",
     bullet: "•",
     sep: "·",
     ellipsis: "…",
@@ -45,6 +47,8 @@ export const ASCII_GLYPHS = {
     caretDown: "v",
     cached: "",
     cursorBar: "|",
+    barFilled: "#",
+    barEmpty: ".",
     bullet: "*",
     sep: "-",
     ellipsis: "...",
@@ -72,6 +76,9 @@ export const SCREEN_READER_GLYPHS = {
     caretDown: "down",
     cached: "",
     cursorBar: "",
+    // A bar announces as nothing; the percentage beside it says everything.
+    barFilled: "",
+    barEmpty: "",
     bullet: "-",
     sep: "-",
     ellipsis: "...",

package/dist/tui/app.js

@@ -1,6 +1,7 @@
 import { DEFAULT_MODE, MODE_LABELS, modeAutoApproves, } from "../agent/index.js";
 import { completeLine } from "../components/autocomplete.js";
 import { SHARED_COMMANDS, SHARED_HELP, announceMode, dispatchCommand, } from "../cli/session-commands.js";
+import { TUI_ONLY_COMMANDS } from "../cli/command-catalog.js";
 import { selectList } from "../components/select.js";
 import { viewLabel, viewOrder } from "./views.js";
 import { canOverlay, createKeyLease, createOverlayIO, } from "./overlay.js";
@@ -31,18 +32,20 @@ import { COLUMN_LABELS, PANEL_LABELS } from "./panels.js";
  */
 /**
  * Every command the TUI completes on Tab — the shared set plus this shell's own
- * panel commands (P5 track 5).
+ * panel and view commands (P5 track 5).
  *
  * This constant existed before and was consumed by NOTHING: exported from
  * `tui/index.ts`, imported nowhere, while the TUI had no completion at all.
  * It is wired to Tab now rather than deleted, because the thing it was reaching
  * for — the REPL's readline completer, which the TUI cannot use — is real.
+ *
+ * Both halves are derived (P10 track 0). The three names used to be written out
+ * here, in the palette, and in this file's `HELP`, and the reserved set knew
+ * about none of them.
  */
 export const TUI_COMMANDS = [
     ...SHARED_COMMANDS,
-    "/close",
-    "/open",
-    "/view",
+    ...TUI_ONLY_COMMANDS.map((c) => c.name),
 ].sort();
 const HELP = [
     "commands:",

package/dist/tui/approval-overlay.js

@@ -1,3 +1,4 @@
+import { themeForColor } from "../theme/index.js";
 /**
  * The approval prompt as an in-viewport modal (P5 track 2).
  *
@@ -28,6 +29,11 @@
  * gives exactly that behaviour without the prompt knowing it is in a modal.
  */
 export function createOverlayPromptIO(surface, lease, color) {
+    // The caret comes from the glyph table, not a literal (P11 track 1). It is a
+    // decorative mark whose meaning is carried by the text beside it, so the table
+    // degrades it to `|` on an ASCII terminal and to nothing at all for a screen
+    // reader — where a lone `▏` announces as noise on the end of every keystroke.
+    const t = themeForColor(color);
     /** Everything the prompt has written this interaction, verbatim. */
     let transcript = "";
     /** The line being typed into a `readLine` follow-up, if one is open. */
@@ -46,7 +52,7 @@ export function createOverlayPromptIO(surface, lease, color) {
         // always shows where the next character lands.
         if (typing !== null) {
             rows[Math.max(0, rows.length - 1)] =
-                `${rows[rows.length - 1] ?? ""}${typing}▏`;
+                `${rows[rows.length - 1] ?? ""}${typing}${t.glyph.cursorBar}`;
         }
         surface.setOverlay(rows);
     };

package/dist/tui/disk-status.js

@@ -0,0 +1,47 @@
+import { readDiskCapacity } from "../utils/disk.js";
+export class WorkspaceDiskCache {
+    paths;
+    probe;
+    values = new Map();
+    /** The refresh in flight, so concurrent triggers share one pass. */
+    inFlight = null;
+    constructor(paths, probe = readDiskCapacity) {
+        // Deduplicated: the same path twice would be the same syscall twice for the
+        // same answer. Two DIFFERENT paths on one filesystem are NOT collapsed here
+        // — that is a question about the numbers, and it is answered where they are
+        // rendered (see `status-view.ts`), not by guessing at mount identity.
+        this.paths = [...new Set(paths)];
+        this.probe = probe;
+    }
+    /**
+     * The last known capacity for one path — a map read, safe from the paint
+     * path. `undefined` means not probed yet, probed and unreadable, or a path
+     * this cache was never given; every one of those renders as nothing, so they
+     * do not need telling apart the way the git tri-state does.
+     */
+    current(path) {
+        return this.values.get(path);
+    }
+    /** Re-probe every path, concurrently, and resolve when all have settled. */
+    async refresh() {
+        if (this.inFlight)
+            return this.inFlight;
+        this.inFlight = this.run();
+        try {
+            await this.inFlight;
+        }
+        finally {
+            this.inFlight = null;
+        }
+    }
+    async run() {
+        await Promise.all(this.paths.map(async (path) => {
+            const value = await this.probe(path);
+            // A failed probe keeps the last good reading rather than blanking the
+            // row. A transient failure is not evidence that the disk changed, and a
+            // figure that flickers in and out is read as a bug in the tool.
+            if (value)
+                this.values.set(path, value);
+        }));
+    }
+}

package/dist/tui/index.js

@@ -3,6 +3,7 @@ export { COLUMN_LABELS, PANEL_LABELS, contextPanelLines, gitPanelLines, headerMo
 export { ContextGauge, readContext, } from "./context-gauge.js";
 export { ToolVersions, parseVersion, } from "./tool-versions.js";
 export { GitStatusCache, WorkspaceGitCache, } from "./git-status.js";
+export { WorkspaceDiskCache } from "./disk-status.js";
 export { createOverviewView } from "./overview.js";
 export { createGitView, gitViewLines, GIT_VIEW_MAX_FILES, } from "./git-view.js";
 export { createTasksView, tasksViewLines, TASKS_VIEW_MAX_JOBS, TASKS_VIEW_TAIL, } from "./tasks-view.js";

package/dist/tui/layout.js

@@ -1,6 +1,7 @@
 import { fit, visibleWidth } from "../render/layout.js";
 export const RAIL_PANELS = [
     "context",
+    "limits",
     "model",
     "git",
     "tools",
@@ -163,10 +164,15 @@ export function scrollWindow(lines, rows, offset) {
  *
  * It names the key because a scrolled view is a mode, and a mode the user
  * cannot see the exit from is a trap — there is no scrollbar here to drag.
+ *
+ * The marks come from the glyph table (P11 track 1). This used to branch on
+ * `theme.unicode ? "↓" : "v"`, which is the resolver reimplemented inline and
+ * one table short: screen-reader mode leaves `unicode` TRUE and swaps the table
+ * instead, so the branch printed a bare `↓` to the one reader who could not use
+ * it, where `theme.glyph.caretDown` says "down".
  */
 export function scrollNotice(hiddenBelow, theme) {
-    const glyph = theme.unicode ? "↓" : "v";
-    return theme.warning(`${glyph} ${hiddenBelow} more line${hiddenBelow === 1 ? "" : "s"} below · PgDn / Esc to return`);
+    return theme.warning(`${theme.glyph.caretDown} ${hiddenBelow} more line${hiddenBelow === 1 ? "" : "s"} below${theme.sep}PgDn / Esc to return`);
 }
 /** Rows the overflow notice costs when at least one panel is dropped. */
 const OVERFLOW_ROWS = 1;