@cruxy/cli 1.5.0 → 1.6.0

package/dist/memory/secrets.js

@@ -59,3 +59,46 @@ export function containsSecret(text) {
     }
     return { secret: false };
 }
+/**
+ * The global twins of {@link SECRET_PATTERNS}, built once.
+ *
+ * Detection asks "is there one?" and can stop at the first hit; redaction has to
+ * replace EVERY occurrence, which needs the `g` flag — and a `g` regex carries
+ * `lastIndex` state that would make `containsSecret` return alternating answers
+ * for the same input. So the two uses get their own objects rather than sharing
+ * one and remembering to reset it.
+ */
+const GLOBAL_PATTERNS = SECRET_PATTERNS.map(({ kind, re }) => ({ kind, re: new RegExp(re.source, `${re.flags}g`) }));
+/**
+ * Replace every recognised secret in `text` with an opaque marker (P10 track 5).
+ *
+ * THE SAME DENYLIST as detection, deliberately — a `/redact` that used a
+ * different pattern set from the one that refuses a memory write would give two
+ * different answers about what counts as a secret, and the weaker of the two
+ * would be the one a user found out about.
+ *
+ * The marker is fixed text with no quotes, backslashes or control characters, so
+ * a redacted string survives being embedded in JSON unchanged — which is what
+ * lets a `tool_use` input be redacted by round-tripping through its serialised
+ * form rather than by walking an arbitrary shape.
+ *
+ * Everything the pattern matched goes, including a `api_key =` prefix on the
+ * generic assignment rule. Keeping the field name would read better and would
+ * leak the shape of the thing next to a marker announcing that something was
+ * there; the marker's `kind` already says as much as is safe to say.
+ */
+export function redactSecrets(text) {
+    const kinds = [];
+    let count = 0;
+    let out = text;
+    for (const { kind, re } of GLOBAL_PATTERNS) {
+        re.lastIndex = 0;
+        out = out.replace(re, () => {
+            count++;
+            if (!kinds.includes(kind))
+                kinds.push(kind);
+            return `[redacted ${kind}]`;
+        });
+    }
+    return { text: out, kinds, count };
+}

package/dist/render/context-view.js

@@ -51,8 +51,8 @@ export function contextReportLines(report, t, width = Infinity) {
     // The headline, worded exactly as the panel words it — same estimate, same
     // caveats, so the detail view can never read as the more authoritative one.
     lines.push(`${t.strong(`${approx(reading.used)} / ${formatTokens(reading.total)} budget`)} ` +
-        t.muted(`(estimated · budget is a local setting, not the model's window)`));
-    lines.push(t.muted(`${report.messages} message${report.messages === 1 ? "" : "s"} · compacts above ${approx(reading.compactAt)}`));
+        t.muted(`(estimated${t.sep}budget is a local setting, not the model's window)`));
+    lines.push(t.muted(`${report.messages} message${report.messages === 1 ? "" : "s"}${t.sep}compacts above ${approx(reading.compactAt)}`));
     // ── where the tokens are ──────────────────────────────────────────────────
     const historyTokens = report.parts.reduce((sum, p) => sum + p.tokens, 0);
     lines.push("");

package/dist/render/plan-view.js

@@ -61,7 +61,7 @@ export function planChecklist(steps, t, maxRows = Infinity, width = Infinity) {
         return [];
     const done = steps.filter((s) => s.status === "done").length;
     const failed = steps.filter((s) => s.status === "failed").length;
-    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(` · ${failed} failed`) : ""}`);
+    const header = t.strong(`plan ${done}/${steps.length}${failed > 0 ? t.danger(`${t.sep}${failed} failed`) : ""}`);
     const finish = (lines) => Number.isFinite(width)
         ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
         : lines;

package/dist/render/status-view.js

@@ -40,7 +40,7 @@ function groupLocations(locations) {
  */
 function diskLines(locations, t) {
     return groupLocations(locations).map((group, i) => {
-        const text = formatCapacity(group.capacity);
+        const text = formatCapacity(group.capacity, t.glyph.sep);
         const level = capacityLevel(group.capacity);
         const value = level === "critical"
             ? t.danger(text)
@@ -53,7 +53,7 @@ function diskLines(locations, t) {
 /** The full `/status` block as lines to print. */
 export function sessionStatusLines(status, t, width = Infinity) {
     const lines = [t.heading("status")];
-    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`· ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
+    lines.push(row("session", `${status.sessionId.slice(0, 8)} ${t.muted(`${t.glyph.sep} ${status.turns} turn${status.turns === 1 ? "" : "s"}`)}`, t));
     // The mode leads the safety half, and carries its description rather than its
     // name alone. The objection that removed the auto-approve config flag was that
     // it disarmed the gate with nothing on screen saying so; a status screen
@@ -68,7 +68,7 @@ export function sessionStatusLines(status, t, width = Infinity) {
     if (status.context) {
         const { used, total, compactAt } = status.context;
         lines.push(row("context", `${t.strong(`~${formatTokens(used)} / ${formatTokens(total)} budget`)} ` +
-            t.muted(`· compacts above ~${formatTokens(compactAt)}`), t));
+            t.muted(`${t.glyph.sep} compacts above ~${formatTokens(compactAt)}`), t));
     }
     // A sandbox that is ON but whose runtime we cannot name is reported as on
     // WITHOUT a name, rather than omitted — the safety-relevant half is that it
@@ -89,9 +89,9 @@ export function sessionStatusLines(status, t, width = Infinity) {
         const { total, running, needingApproval } = status.jobs;
         const detail = total === 0
             ? t.muted("none this session")
-            : `${total} · ${running} running` +
+            : `${total}${t.sep}${running} running` +
                 (needingApproval > 0
-                    ? t.warning(` · ${needingApproval} awaiting approval`)
+                    ? t.warning(`${t.sep}${needingApproval} awaiting approval`)
                     : "");
         lines.push(row("jobs", detail, t));
     }

package/dist/render/units.js

@@ -0,0 +1,22 @@
+/**
+ * Display units shared by every surface that shows a token figure (P10 track 3).
+ *
+ * `compactTokens` lived in `tui/limits-panel.ts` while it was the rail's alone.
+ * `/budget` states the same quantity — weighted tokens — against the same server
+ * windows, and the two must not round differently: a panel reading `8.5M` beside
+ * a command reading `8500000` is one fact wearing two faces.
+ */
+/** 14_000_000 → "14M", 8_700_000 → "8.7M", 125_000 → "125k", 900 → "900". */
+export function compactTokens(n) {
+    const abs = Math.abs(n);
+    if (abs >= 1_000_000)
+        return `${trimZero(n / 1_000_000)}M`;
+    if (abs >= 1_000)
+        return `${trimZero(n / 1_000)}k`;
+    return `${Math.round(n)}`;
+}
+/** One decimal, but only when it says something: 8.7 stays, 14.0 becomes 14. */
+function trimZero(n) {
+    const one = n.toFixed(1);
+    return one.endsWith(".0") ? one.slice(0, -2) : one;
+}

package/dist/session/index.js

@@ -15,6 +15,7 @@ export { PROJECTS_DIR_NAME, RESERVED_SUBDIRS, SESSION_FILE_EXT, projectDir, proj
 export { SessionLog } from "./log.js";
 export { defaultExportName, exportMarkdown, } from "./export.js";
 export { foldEvents, readEvents, readMeta, replaySession } from "./replay.js";
+export { redactMessages } from "./redact.js";
 export { findSession, isAmbiguous, listSessions, summarizeSession, } from "./list.js";
 export { cwdMismatchWarning, describeSession, loadResume, relativeAge, resumeById, resumePicker, shortId, PICKER_LIMIT, } from "./resume.js";
 export { SESSION_FILE_VERSION, SessionEventSchema, SessionMetaSchema, } from "./types.js";

package/dist/session/log.js

@@ -92,6 +92,25 @@ export class SessionLog {
             outputTokens,
         });
     }
+    /**
+     * `/redact` (P10 track 5): from here on, replay masks every recognised secret
+     * in the history recorded SO FAR.
+     *
+     * The one writer in this class that changes how EARLIER lines are read. It
+     * does not touch them — see the class header on why this file is only ever
+     * appended to — and it deliberately records no secret material: `kinds` and
+     * `count` say what was found, which is all a reader could already work out by
+     * running the same detector.
+     */
+    redact(kinds, count) {
+        this.write({
+            kind: "redact",
+            at: new Date().toISOString(),
+            ...this.runId(),
+            kinds,
+            count,
+        });
+    }
     runId() {
         const id = this.currentRunId?.();
         return id === undefined ? {} : { runId: id };

package/dist/session/redact.js

@@ -0,0 +1,74 @@
+import { redactSecrets } from "../memory/secrets.js";
+/**
+ * Mask every recognised secret across a whole message array.
+ *
+ * Returns a NEW array (and new blocks) rather than mutating: the caller's array
+ * is the one the recorder's watermark is measured against, and replacing it
+ * wholesale is what `Session` already does after every turn.
+ */
+export function redactMessages(messages) {
+    const kinds = [];
+    let count = 0;
+    const scrub = (text) => {
+        const r = redactSecrets(text);
+        count += r.count;
+        for (const k of r.kinds)
+            if (!kinds.includes(k))
+                kinds.push(k);
+        return r.text;
+    };
+    const out = messages.map((message) => {
+        if (typeof message.content === "string") {
+            return { ...message, content: scrub(message.content) };
+        }
+        return {
+            ...message,
+            content: message.content.map((block) => scrubBlock(block, scrub)),
+        };
+    });
+    return { messages: out, kinds, count };
+}
+/**
+ * One content block.
+ *
+ * `tool_use.input` is arbitrary JSON and is where the highest-risk material
+ * actually lands — a `run_command` whose argv carries a token, an HTTP tool with
+ * an auth header. It is redacted by round-tripping through its serialised form
+ * rather than by walking an unknown shape: the marker contains no character JSON
+ * escapes, so the string stays parseable, and a parse failure (which should be
+ * impossible) leaves the block untouched rather than corrupting a history the
+ * provider has to accept on the next turn.
+ *
+ * An unknown block kind is passed through unchanged. A newer cruxy's block must
+ * survive an older one reading the file (`ContentBlockSchema` says so), and
+ * inventing a redaction for a shape this build cannot interpret would be the
+ * lossy behaviour that rule exists to prevent.
+ */
+function scrubBlock(block, scrub) {
+    if (block.type === "text")
+        return { ...block, text: scrub(block.text) };
+    if (block.type === "tool_result") {
+        return { ...block, content: scrub(block.content) };
+    }
+    if (block.type === "tool_use") {
+        if (block.input === undefined)
+            return block;
+        let serialised;
+        try {
+            serialised = JSON.stringify(block.input);
+        }
+        catch {
+            return block; // not serialisable — leave it exactly as it was
+        }
+        const scrubbed = scrub(serialised);
+        if (scrubbed === serialised)
+            return block;
+        try {
+            return { ...block, input: JSON.parse(scrubbed) };
+        }
+        catch {
+            return block;
+        }
+    }
+    return block;
+}

package/dist/session/replay.js

@@ -1,5 +1,6 @@
 import { readFileSync } from "node:fs";
 import { modeFromFlags } from "../agent/mode.js";
+import { redactMessages } from "./redact.js";
 import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
 /**
  * Replay: fold an append-only event log back into the state a session needs to
@@ -74,6 +75,7 @@ export function foldEvents(events, skipped = 0) {
     // timestamp.
     let planMode = false;
     let mode = null;
+    let redactions = 0;
     const usage = { input_tokens: 0, output_tokens: 0 };
     for (const event of events) {
         switch (event.kind) {
@@ -101,6 +103,19 @@ export function foldEvents(events, skipped = 0) {
                 usage.input_tokens += event.inputTokens;
                 usage.output_tokens += event.outputTokens;
                 break;
+            case "redact":
+                // Exactly what `Session.redact` did in memory: mask every recognised
+                // secret across the history AS IT STANDS. Position in the fold is the
+                // whole meaning of the event — messages appended afterwards are not
+                // covered, because at the moment the user asked, they did not exist.
+                //
+                // The event's own `kinds`/`count` are deliberately not consulted: they
+                // record what the writing build found, and this build's denylist may
+                // have grown since. Re-running the detector is what makes a redaction
+                // get stronger over time rather than being frozen at write time.
+                messages = redactMessages(messages).messages;
+                redactions++;
+                break;
             case "meta":
                 break;
         }
@@ -114,6 +129,7 @@ export function foldEvents(events, skipped = 0) {
         // could be on, so nothing is being inferred.
         mode: mode ?? modeFromFlags(planMode, false),
         skipped,
+        redactions,
     };
 }
 /** Read and parse a session file into its events, counting unusable lines. */

package/dist/session/resume.js

@@ -71,6 +71,14 @@ export function loadResume(session, cwd) {
         warnings.push(`${state.skipped} unreadable line${state.skipped === 1 ? "" : "s"} in the session log were skipped — ` +
             `the restored history may be incomplete`);
     }
+    if (state.redactions > 0) {
+        // Said on resume because the alternative is a user finding `[redacted …]`
+        // in a transcript and not knowing whether cruxy did it or the model wrote
+        // it. The second clause is the part that is easy to leave out and matters
+        // most: `/redact` never rewrote the file it is being replayed from.
+        warnings.push(`this session was redacted ${state.redactions === 1 ? "once" : `${state.redactions} times`} — ` +
+            `secrets are masked in the restored history, but the original text is still in ${session.file}`);
+    }
     return { session, state, warnings };
 }
 /**

package/dist/session/types.js

@@ -211,6 +211,43 @@ export const UsageEventSchema = z
     outputTokens: z.number().int().nonnegative(),
 })
     .passthrough();
+/**
+ * `/redact` (P10 track 5): every recognised secret in the history SO FAR is
+ * masked from this point in the fold onwards.
+ *
+ * A NEW EVENT RATHER THAN A REWRITE, and that is the entire design. Editing the
+ * earlier lines would mean re-serialising the file, which costs the two
+ * properties this format exists for — O(1) writes per turn, and a crash costing
+ * a torn last line instead of a conversation (see the module header, and
+ * `log.ts` on why temp-then-rename is wrong here). So a redaction changes how
+ * earlier lines are READ, and the earlier lines stay exactly as they were.
+ *
+ * THE EVENT CARRIES NO SECRET, deliberately: recording the strings to remove
+ * would write them into the log in order to say they should not be there. The
+ * fold re-derives the spans by re-running the detector, which is deterministic
+ * over the same messages and gives a reader nothing it could not already see.
+ *
+ * `kinds` and `count` are what the pass FOUND — a record for the user, not an
+ * instruction to the fold. The fold ignores them; a build whose denylist has
+ * since grown will legitimately mask more than the number written here, and
+ * treating the count as authoritative would cap it at what an older build knew.
+ *
+ * An older cruxy that has never heard of this kind SKIPS the line (`replay.ts`)
+ * and shows the unredacted history. That is the honest failure for a
+ * forward-compatibility rule that must not lose conversations, and it is why the
+ * command says the file itself still holds the raw text.
+ */
+export const RedactEventSchema = z
+    .object({
+    kind: z.literal("redact"),
+    at: z.string(),
+    runId: z.string().optional(),
+    /** Secret kinds the pass matched, for the record. Not read by the fold. */
+    kinds: z.array(z.string()).default([]),
+    /** Spans replaced at write time. Not read by the fold. */
+    count: z.number().int().nonnegative().default(0),
+})
+    .passthrough();
 /** Every event, discriminated on `kind`. */
 export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionMetaSchema,
@@ -220,4 +257,5 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
     PlanModeEventSchema,
     SessionModeEventSchema,
     UsageEventSchema,
+    RedactEventSchema,
 ]);

package/dist/subagent/orchestrator.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import { runAgent } from "../agent/loop.js";
-import { CruxyError, ErrorCode, messageOf, subagentDepthExceeded, subagentScopeOverlap, } from "../errors/index.js";
+import { CruxyError, ErrorCode, messageOf, sessionBudgetExhausted, subagentDepthExceeded, subagentScopeOverlap, } from "../errors/index.js";
+import { UNRESOLVED_TIER, } from "../budget/index.js";
+import { resolveTaskModel } from "../routing/index.js";
 import { Workspace } from "../workspace/index.js";
 import { Budget, resolveBudget } from "../agent/budget.js";
 import { scopeRegistry, SUBAGENT_WRITE_TOOLS } from "./registry-scope.js";
@@ -181,6 +183,28 @@ export class SubagentOrchestrator {
             return [];
         // Refuse overlapping write scope BEFORE any child is dispatched.
         this.assertDisjointWriteScopes(specs);
+        // Admission control (P10 track 3 / cli#212), also before dispatch. Ordered
+        // AFTER the scope check on purpose: an overlapping fan-out is malformed and
+        // must be refused whatever the budget says, and narrowing a malformed batch
+        // to two children would hide the overlap rather than report it.
+        const admitted = this.admitFanOut(specs);
+        if (admitted.kind === "refused") {
+            throw sessionBudgetExhausted(admitted.reason);
+        }
+        // The children that do not run come back as an explicit NOT-ADMITTED result
+        // carrying the reason, never as a silently shorter array. The parent model is
+        // the one that has to decide what to do about a half-dispatched plan, and it
+        // can only do that if it is told — a fan-out of 5 that returns 2 results with
+        // no explanation reads as three crashes. Position is preserved for the same
+        // reason the dispatched half preserves it: result i is spec i, always.
+        const dispatch = specs.slice(0, admitted.count);
+        const deferred = [];
+        if (admitted.kind === "narrowed") {
+            this.deps.logger.warn(admitted.reason);
+            for (let i = admitted.count; i < specs.length; i++) {
+                deferred.push(notAdmittedResult(admitted.reason));
+            }
+        }
         const controller = new AbortController();
         const onExternalAbort = () => controller.abort();
         if (opts.signal) {
@@ -189,10 +213,10 @@ export class SubagentOrchestrator {
             else
                 opts.signal.addEventListener("abort", onExternalAbort, { once: true });
         }
-        const results = new Array(specs.length);
-        const total = specs.length;
+        const results = new Array(dispatch.length);
+        const total = dispatch.length;
         try {
-            const settled = await Promise.allSettled(specs.map((spec, i) => this.sem.run(async () => {
+            const settled = await Promise.allSettled(dispatch.map((spec, i) => this.sem.run(async () => {
                 // Already cancelled (a fatal sibling or Ctrl-C fired first): record an
                 // honest cancelled result instead of starting a doomed run.
                 if (controller.signal.aborted) {
@@ -223,12 +247,51 @@ export class SubagentOrchestrator {
                 if (results[i] === undefined)
                     results[i] = cancelledResult();
             }
-            return results;
+            return [...results, ...deferred];
         }
         finally {
             opts.signal?.removeEventListener("abort", onExternalAbort);
         }
     }
+    /**
+     * Ask the session budget whether this batch fits (P10 track 3 / cli#212).
+     *
+     * The estimate is the batch's CEILING, not a guess at its actual draw:
+     * `count × perChildTokens × multiplier`, where `perChildTokens` is the local
+     * cap each child already runs under. A spec may narrow its own budget, so the
+     * per-child figure is the resolved one rather than the configured default —
+     * a fan-out of five deliberately-cheap children should not be refused on the
+     * arithmetic of five expensive ones.
+     *
+     * Tier: the router resolves per task class, and a child defaults to the
+     * `subagent` class. When routing cannot name a tier the request still draws on
+     * the pool, so it is weighed at the worst case rather than skipped — see
+     * `UNRESOLVED_TIER`.
+     */
+    admitFanOut(specs) {
+        const budget = this.deps.budget;
+        if (!budget)
+            return { kind: "allow", count: specs.length, maxTokens: 0 };
+        const { defaultBudget } = this.deps.config.subagent;
+        // The heaviest child in the batch sets the per-run figure. The bound has to
+        // hold for the batch as dispatched, and averaging would let one 64k child
+        // hide behind four 4k ones.
+        const perRunTokens = specs.reduce((max, spec) => Math.max(max, resolveBudget(defaultBudget, spec.budget).maxTokens), 0);
+        return budget.admit({
+            count: specs.length,
+            perRunTokens,
+            tier: this.fanOutTier(),
+        });
+    }
+    /** The tier a child would route to, or the unresolved/no-pool markers. */
+    fanOutTier() {
+        const router = this.deps.router;
+        if (!router)
+            return undefined; // no cruxy routing — not a weighted-pool request
+        // No tier means the router chose `auto` and the gateway decides — a request
+        // that still draws on the pool, so it is weighed at the worst case.
+        return resolveTaskModel(router, "subagent").tier ?? UNRESOLVED_TIER;
+    }
     /**
      * Resolve a child's scope from an optional root name. With a name: a
      * single-root workspace over that root (writes confined to it) + that root's
@@ -344,6 +407,20 @@ function cancelledResult() {
         usage: { input_tokens: 0, output_tokens: 0 },
     };
 }
+/**
+ * A child the budget would not admit. Zero usage and zero iterations, because
+ * that is literally what it consumed — a fabricated non-zero here would show up
+ * in the parent's accounting as spend that never happened.
+ */
+function notAdmittedResult(reason) {
+    return {
+        status: "not-admitted",
+        summary: "",
+        error: `${ErrorCode.SessionBudgetExhausted}: ${reason}`,
+        iterations: 0,
+        usage: { input_tokens: 0, output_tokens: 0 },
+    };
+}
 /** `artifacts` only when non-empty — absent beats `[]` in the parent's context. */
 function artifactsField(artifacts) {
     return artifacts.size > 0 ? { artifacts: [...artifacts].sort() } : {};

package/dist/theme/resolve.js

@@ -47,6 +47,7 @@ export function resolveTheme(caps) {
         sep: ` ${glyph.sep} `,
         color: caps.color,
         unicode: caps.unicode,
+        screenReader: caps.screenReader ?? false,
     };
 }
 /**

package/dist/tui/app.js

@@ -1,6 +1,7 @@
 import { DEFAULT_MODE, MODE_LABELS, modeAutoApproves, } from "../agent/index.js";
 import { completeLine } from "../components/autocomplete.js";
 import { SHARED_COMMANDS, SHARED_HELP, announceMode, dispatchCommand, } from "../cli/session-commands.js";
+import { TUI_ONLY_COMMANDS } from "../cli/command-catalog.js";
 import { selectList } from "../components/select.js";
 import { viewLabel, viewOrder } from "./views.js";
 import { canOverlay, createKeyLease, createOverlayIO, } from "./overlay.js";
@@ -31,18 +32,20 @@ import { COLUMN_LABELS, PANEL_LABELS } from "./panels.js";
  */
 /**
  * Every command the TUI completes on Tab — the shared set plus this shell's own
- * panel commands (P5 track 5).
+ * panel and view commands (P5 track 5).
  *
  * This constant existed before and was consumed by NOTHING: exported from
  * `tui/index.ts`, imported nowhere, while the TUI had no completion at all.
  * It is wired to Tab now rather than deleted, because the thing it was reaching
  * for — the REPL's readline completer, which the TUI cannot use — is real.
+ *
+ * Both halves are derived (P10 track 0). The three names used to be written out
+ * here, in the palette, and in this file's `HELP`, and the reserved set knew
+ * about none of them.
  */
 export const TUI_COMMANDS = [
     ...SHARED_COMMANDS,
-    "/close",
-    "/open",
-    "/view",
+    ...TUI_ONLY_COMMANDS.map((c) => c.name),
 ].sort();
 const HELP = [
     "commands:",

package/dist/tui/approval-overlay.js

@@ -1,3 +1,4 @@
+import { themeForColor } from "../theme/index.js";
 /**
  * The approval prompt as an in-viewport modal (P5 track 2).
  *
@@ -28,6 +29,11 @@
  * gives exactly that behaviour without the prompt knowing it is in a modal.
  */
 export function createOverlayPromptIO(surface, lease, color) {
+    // The caret comes from the glyph table, not a literal (P11 track 1). It is a
+    // decorative mark whose meaning is carried by the text beside it, so the table
+    // degrades it to `|` on an ASCII terminal and to nothing at all for a screen
+    // reader — where a lone `▏` announces as noise on the end of every keystroke.
+    const t = themeForColor(color);
     /** Everything the prompt has written this interaction, verbatim. */
     let transcript = "";
     /** The line being typed into a `readLine` follow-up, if one is open. */
@@ -46,7 +52,7 @@ export function createOverlayPromptIO(surface, lease, color) {
         // always shows where the next character lands.
         if (typing !== null) {
             rows[Math.max(0, rows.length - 1)] =
-                `${rows[rows.length - 1] ?? ""}${typing}▏`;
+                `${rows[rows.length - 1] ?? ""}${typing}${t.glyph.cursorBar}`;
         }
         surface.setOverlay(rows);
     };

package/dist/tui/layout.js

@@ -164,10 +164,15 @@ export function scrollWindow(lines, rows, offset) {
  *
  * It names the key because a scrolled view is a mode, and a mode the user
  * cannot see the exit from is a trap — there is no scrollbar here to drag.
+ *
+ * The marks come from the glyph table (P11 track 1). This used to branch on
+ * `theme.unicode ? "↓" : "v"`, which is the resolver reimplemented inline and
+ * one table short: screen-reader mode leaves `unicode` TRUE and swaps the table
+ * instead, so the branch printed a bare `↓` to the one reader who could not use
+ * it, where `theme.glyph.caretDown` says "down".
  */
 export function scrollNotice(hiddenBelow, theme) {
-    const glyph = theme.unicode ? "↓" : "v";
-    return theme.warning(`${glyph} ${hiddenBelow} more line${hiddenBelow === 1 ? "" : "s"} below · PgDn / Esc to return`);
+    return theme.warning(`${theme.glyph.caretDown} ${hiddenBelow} more line${hiddenBelow === 1 ? "" : "s"} below${theme.sep}PgDn / Esc to return`);
 }
 /** Rows the overflow notice costs when at least one panel is dropped. */
 const OVERFLOW_ROWS = 1;

package/dist/tui/limits-panel.js

@@ -1,3 +1,4 @@
+import { compactTokens } from "../render/units.js";
 import { bindingWindow, usedFraction } from "../limits/index.js";
 /**
  * The limits panel (P9): what this credential may spend, and how much is left.
@@ -49,20 +50,11 @@ function stateStyle(theme, state) {
         return theme.warning;
     return theme.strong;
 }
-/** 14_000_000 → "14M", 8_700_000 → "8.7M", 125_000 → "125k", 900 → "900". */
-export function compactTokens(n) {
-    const abs = Math.abs(n);
-    if (abs >= 1_000_000)
-        return `${trimZero(n / 1_000_000)}M`;
-    if (abs >= 1_000)
-        return `${trimZero(n / 1_000)}k`;
-    return `${Math.round(n)}`;
-}
-/** One decimal, but only when it says something: 8.7 stays, 14.0 becomes 14. */
-function trimZero(n) {
-    const one = n.toFixed(1);
-    return one.endsWith(".0") ? one.slice(0, -2) : one;
-}
+/**
+ * Re-exported, not defined here any more (P10 track 3): `/budget` states the
+ * same windows in the same unit, so the two share one formatter.
+ */
+export { compactTokens };
 /** 27.77 → "$27.77", 29 → "$29", 0.5 → "$0.50". */
 export function usd(n) {
     return Number.isInteger(n) ? `$${n}` : `$${n.toFixed(2)}`;

package/dist/tui/palette.js

@@ -1,29 +1,21 @@
 import { fuzzyFind } from "../components/fuzzy.js";
-import { COMMAND_CATALOG } from "../cli/session-commands.js";
+import { COMMAND_CATALOG, TUI_ONLY_COMMANDS } from "../cli/command-catalog.js";
 import { canOverlay, createOverlayIO } from "./overlay.js";
-/** The TUI's own commands, which the shared catalogue deliberately excludes. */
-const PANEL_COMMANDS = [
-    {
-        name: "/close",
-        summary: "hide a panel or the whole rail",
-        args: "<sidebar | context | model | git | tools | rail>",
-    },
-    {
-        name: "/open",
-        summary: "show a hidden panel",
-        args: "<sidebar | context | model | git | tools | rail>",
-    },
-];
 /**
- * Everything the palette offers: the shared catalogue, this shell's panel
+ * Everything the palette offers: the shared catalogue, this shell's own
  * commands, and the project's own slash commands.
  *
- * Custom commands come LAST and are labelled. `resolveSlash` consults builtins
- * first, so a custom command named `clear` can never shadow `/clear` — listing
- * it above the builtin would show an order the dispatcher does not honour.
+ * The TUI's own three are {@link TUI_ONLY_COMMANDS} rather than a copy kept
+ * here. The copy had drifted — it listed `/close` and `/open` and had never
+ * gained `/view`, so the one shell with a palette was also the one place `/view`
+ * could not be discovered.
+ *
+ * Custom commands come LAST and are labelled. A custom command can no longer be
+ * named after a reserved one at all (the loader refuses the file), so this list
+ * cannot contain two rows for one name.
  */
 export function paletteItems(slashCommands = []) {
-    const builtins = [...COMMAND_CATALOG, ...PANEL_COMMANDS].map((c) => ({
+    const builtins = [...COMMAND_CATALOG, ...TUI_ONLY_COMMANDS].map((c) => ({
         name: c.name,
         summary: c.summary,
         ...(c.args === undefined ? {} : { args: c.args }),