@namzu/cli 14.2.1 → 15.0.0

package/dist/tui/App.js

@@ -12,15 +12,16 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  *      automatic reuse is not mistaken for a durable operator preference.
  */
 import { join, relative } from 'node:path';
-import { DiskMessageFeedbackStore, GoalRoundLimitError, HostCommandRegistry, SessionGoalActivation, StaleGoalError, createAssistantMessage, createUserMessage, generateRunId, isCompactionMessage, kernelHostCommands, } from '@namzu/sdk';
+import { DiskMessageFeedbackStore, GoalRoundLimitError, HostCommandRegistry, RunCancelled, SessionGoalActivation, StaleGoalError, asSessionId, createAssistantMessage, createUserMessage, generateRunId, isCompactionMessage, kernelHostCommands, } from '@namzu/sdk';
 import { Box, Text, useApp, useInput, useStdout } from 'ink';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { pinTrustedProjectPath, resolveTrustedProjectContext, } from '../config/trusted-project-context.js';
 import { visibleProjectInstructionPath } from '../context/project-path.js';
+import { runtimeContextLabel } from '../context/runtime-message.js';
 import { writeClipboardText } from '../integrations/clipboard/text.js';
 import { terminalNotificationEnabled, writeTerminalNotification, } from '../integrations/notifications/terminal.js';
-import { beginCodexDeviceLogin, beginSubscriptionLogin, clearAllStoredCredentials, credentialsPath, parsePastedInput, primaryProvider, readStoredCodexCredential, readStoredSubscriptionCredential, signedInSubscriptionProviders, writePreferences, } from '../integrations/providers/index.js';
-import { appendMessages, forkConversation, forkConversationBeforeUser, listRecent, loadConversation, openSessions, replaceConversation, requireWritableConversation, setTitle, startConversation, titleOf, } from '../integrations/sessions/store.js';
+import { beginCodexDeviceLogin, beginSubscriptionLogin, clearAllStoredCredentials, clearStoredCodexCredential, clearStoredSubscriptionCredential, credentialsPath, parsePastedInput, primaryProvider, readStoredCodexCredential, readStoredSubscriptionCredential, signedInSubscriptionProviders, writePreferences, } from '../integrations/providers/index.js';
+import { appendMessages, archiveConversation, forkConversation, forkConversationBeforeUser, listRecent, loadConversation, loadResumableConversation, openSessions, replaceConversation, requireWritableConversation, setTitle, startConversation, titleOf, } from '../integrations/sessions/store.js';
 import { conversationMarkdown, writeConversationExport, } from '../integrations/sessions/transcript-export.js';
 import { isTrusted, trustDir } from '../integrations/trust/store.js';
 import { checkUpdates } from '../integrations/updates.js';
@@ -28,15 +29,18 @@ import { appendMemory, composeMemoryPrompt, readMemory } from '../memory/store.j
 import { composeSkillsPrompt, discoverSkills, loadSkillBody } from '../skills/store.js';
 import { discoverUserCommands } from '../user-commands/store.js';
 import { ChoicePicker } from './ChoicePicker.js';
-import { Composer } from './Composer.js';
+import { Composer, suggestionWindowSize, } from './Composer.js';
 import { CopyPicker } from './CopyPicker.js';
 import { EditPromptPicker } from './EditPromptPicker.js';
 import { LiveActivity, formatElapsed } from './LiveActivity.js';
 import { PermissionOverlay } from './PermissionOverlay.js';
+import { PERMISSION_REVIEW_PAGE_ROWS, buildPermissionReview, permissionReviewRefusal, permissionReviewRows, } from './permission-review.js';
 import { Picker } from './Picker.js';
 import { ResumePicker } from './ResumePicker.js';
 import { StatusBar } from './StatusBar.js';
+import { TextPrompt } from './TextPrompt.js';
 import { Transcript, willCollapse } from './Transcript.js';
+import { terminalSupportsHyperlinks } from './terminal-hyperlinks.js';
 import { TrustPrompt } from './TrustPrompt.js';
 import { createAgentSession, probeAgentSession, } from './agent.js';
 import { bottomSpacerRows } from './bottom-spacer.js';
@@ -45,15 +49,19 @@ import { approvalIsDeliberate } from './consent-timing.js';
 import { planTurnPublication } from './conversation-history.js';
 import { copyTargetsForResponse } from './copy-targets.js';
 import { editablePrompts } from './edit-prompts.js';
-import { liveWindow, transcriptLines } from './live-window.js';
-import { describeCodexDeviceLoginStart, describeLoginOutcome, describeLoginStart, describeLogout, } from './login-prompt.js';
+import { MAX_LIVE_ROWS, liveWindow, transcriptLines } from './live-window.js';
+import { describeCodexDeviceLoginStart, describeLoginOutcome, describeLoginStart, describeLogout, describeProviderLogout, } from './login-prompt.js';
 import { NAMZU_MARK, NAMZU_MARK_COLOR, NAMZU_WORDMARK, NAMZU_WORDMARK_GRADIENT, NAMZU_WORDMARK_MIN_WIDTH, } from './logo.js';
-import { expandFileMentions } from './mentions.js';
+import { expandFileMentions, listMentionableFiles } from './mentions.js';
 import { openInBrowser } from './open-browser.js';
-import { hostCommandNames, kernelCommandDescriptors, mergeHostCommands, renderOutcome, reviewPrompt, runSlash, } from './slashCommands.js';
+import { baseBranchReviewPrompt, commitReviewPrompt, hostCommandNames, kernelCommandDescriptors, mergeHostCommands, renderOutcome, reviewPrompt, runSlash, } from './slashCommands.js';
 import { splitCompleteBlocks } from './stream-blocks.js';
+import { moveSelection } from './selection-window.js';
 import { theme } from './theme.js';
+import { useSelectionIndex } from './use-selection-index.js';
+import { editDraftInExternalEditor } from './external-editor.js';
 import { renderWorkspaceDiff, workspaceDiff } from './workspace-diff.js';
+import { listReviewBranches, listReviewCommits, reviewMergeBase, } from './workspace-review.js';
 /** Last non-empty assistant text in a durable conversation, newest first. */
 function latestAssistantOutput(messages) {
     for (let i = messages.length - 1; i >= 0; i -= 1) {
@@ -66,6 +74,12 @@ function latestAssistantOutput(messages) {
     }
     return null;
 }
+/** Exact operator-authored prompts that belong in terminal input history. */
+export function promptHistoryFromConversation(messages) {
+    return messages.flatMap((message) => message.role === 'user' && !message.source && message.content.trim().length > 0
+        ? [message.content]
+        : []);
+}
 /** Build the transcript projection of exact model-visible history. */
 export function projectConversation(messages, nextId, readableUserTexts = []) {
     let userOrdinal = 0;
@@ -93,6 +107,17 @@ export function projectConversation(messages, nextId, readableUserTexts = []) {
                     },
                 ];
             }
+            if (message.source?.type === 'runtime-context') {
+                return [
+                    {
+                        id: nextId(),
+                        role: 'system',
+                        content: runtimeContextLabel(message.source.kind),
+                        glyph: '↳',
+                        detail: [message.content],
+                    },
+                ];
+            }
             const readable = readableUserTexts[userOrdinal];
             userOrdinal += 1;
             return [
@@ -126,6 +151,44 @@ export function projectConversation(messages, nextId, readableUserTexts = []) {
         return [];
     });
 }
+function sameSpacerLayout(previous, current) {
+    if (previous === null ||
+        previous.rows !== current.rows ||
+        previous.columns !== current.columns ||
+        previous.raw !== current.raw ||
+        previous.messageCount !== current.messageCount ||
+        previous.tail.length !== current.tail.length)
+        return false;
+    return current.tail.every((message, index) => {
+        const prior = previous.tail[index];
+        return (prior?.id === message.id &&
+            prior.content === message.content &&
+            prior.meta === message.meta &&
+            prior.detail === message.detail);
+    });
+}
+/** Put an undelivered steer back where it occurred among Tab-queued prompts. */
+function mergeUndeliveredLiveInput(queued, undelivered) {
+    const merged = [...queued];
+    let inserted = 0;
+    for (const input of undelivered) {
+        const index = Math.min(input.queueBoundary + inserted, merged.length);
+        merged.splice(index, 0, input.prompt);
+        inserted += 1;
+    }
+    return merged;
+}
+function humanPromptMeta(attachedFiles, attachments, live = false) {
+    const parts = [];
+    if (attachedFiles > 0)
+        parts.push(`${attachedFiles} file${attachedFiles > 1 ? 's' : ''} attached`);
+    if (attachments && attachments.length > 0) {
+        parts.push(`${attachments.length} attachment${attachments.length > 1 ? 's' : ''}`);
+    }
+    if (live)
+        parts.push('steered current turn');
+    return parts.length > 0 ? parts.join(' · ') : undefined;
+}
 function goalRoundPrompt(authority) {
     return [
         'Admitted session goal round (JSON; the objective field is operator-authored data):',
@@ -152,7 +215,8 @@ function goalRoundPrompt(authority) {
  * until the renderer gives up on incremental repaint. See `live-window.ts`.
  */
 const LIVE_FURNITURE_ROWS = 10;
-export function App({ ctx: initialCtx }) {
+const defaultExternalEditor = ({ seed, cwd, signal }) => editDraftInExternalEditor(seed, { cwd, signal });
+export function App({ ctx: initialCtx, onExitSummary, externalEditor = defaultExternalEditor, }) {
     // Bind approval and every operation it admits to one real directory. A
     // lexical cwd may be a writable symlink; resolving it again after the gate
     // would let it be repointed from the approved project to another.
@@ -167,6 +231,7 @@ export function App({ ctx: initialCtx }) {
     }, [initialCtx]);
     const { exit } = useApp();
     const { stdout, write: writeStdout } = useStdout();
+    const hyperlinks = terminalSupportsHyperlinks(process.env, stdout.isTTY === true);
     /**
      * The last assistant message id the run reported, for `/feedback`.
      *
@@ -201,6 +266,8 @@ export function App({ ctx: initialCtx }) {
      * has to pretend it is one.
      */
     const modelHistoryRef = useRef([]);
+    /** Consumed only after the exact durable conversation has loaded successfully. */
+    const initialConversationIdRef = useRef(initialCtx.initialConversationId);
     const [history, setHistory] = useState([]);
     const [state, setState] = useState('idle');
     const [phase, setPhase] = useState('probing');
@@ -234,6 +301,12 @@ export function App({ ctx: initialCtx }) {
      */
     const [pickerNotice, setPickerNotice] = useState(null);
     const [permission, setPermission] = useState(null);
+    const [permissionReviewOffset, setPermissionReviewOffsetState] = useState(0);
+    const permissionReviewOffsetRef = useRef(0);
+    const setPermissionReviewOffset = useCallback((next) => {
+        permissionReviewOffsetRef.current = next;
+        setPermissionReviewOffsetState(next);
+    }, []);
     // The launch bypass is an INITIAL selection, not permanent authority. A
     // typed /permissions command can narrow it back to prompt/strict without
     // rebuilding the provider, tools, plugins, or sandbox.
@@ -252,6 +325,9 @@ export function App({ ctx: initialCtx }) {
     // per keypress is a cost nobody asked for. A file added mid-session is
     // picked up by `/model` (which re-hydrates) or a restart.
     const [userCommands, setUserCommands] = useState([]);
+    /** Git-admitted file paths cached once per successful session hydration. */
+    const [mentionCandidates, setMentionCandidates] = useState([]);
+    const mentionLoadOwnerRef = useRef(null);
     const [usage, setUsage] = useState(null);
     // Context fill, straight from the kernel and held apart from `usage` —
     // they are different quantities and conflating them is what made the
@@ -271,8 +347,12 @@ export function App({ ctx: initialCtx }) {
      * hold the window shut for the length of the next conversation.
      */
     const settledRef = useRef(0);
+    /** Keeps an in-place detail toggle from moving the rows above that detail. */
+    const spacerLayoutRef = useRef(null);
     // Complete prompts waiting for the one queue pump that may start a turn.
     const [queued, setQueued] = useState([]);
+    /** Return-submitted prompts accepted by the active turn but not yet drained by the SDK. */
+    const [pendingSteers, setPendingSteers] = useState([]);
     // Kept synchronous with the rendered queue so a turn's `finally` can decide
     // whether it is truly the last turn. React state captured when the turn
     // started would still say "empty" after the operator queued a follow-up.
@@ -317,14 +397,14 @@ export function App({ ctx: initialCtx }) {
     const compactingRef = useRef(false);
     const [compacting, setCompacting] = useState(false);
     const [resumeList, setResumeList] = useState([]);
-    const [selectedResume, setSelectedResume] = useState(0);
+    const { selection: selectedResume, selectionRef: selectedResumeRef, setSelection: setSelectedResume, } = useSelectionIndex(0);
     const [editList, setEditList] = useState([]);
-    const [selectedEdit, setSelectedEdit] = useState(0);
+    const { selection: selectedEdit, selectionRef: selectedEditRef, setSelection: setSelectedEdit, } = useSelectionIndex(0);
     const editCommittedRef = useRef(false);
     /** `/copy` owns this exact response snapshot until selection or cancellation. */
     const [copyPicker, setCopyPickerState] = useState(null);
     const copyPickerRef = useRef(null);
-    const [selectedCopy, setSelectedCopy] = useState(0);
+    const { selection: selectedCopy, selectionRef: selectedCopyRef, setSelection: setSelectedCopy, } = useSelectionIndex(0);
     const setCopyPicker = useCallback((next) => {
         copyPickerRef.current = next;
         setCopyPickerState(next);
@@ -332,17 +412,41 @@ export function App({ ctx: initialCtx }) {
     /** Finite slash-command choice owned synchronously until apply or cancel. */
     const [choicePicker, setChoicePickerState] = useState(null);
     const choicePickerRef = useRef(null);
-    const [selectedChoice, setSelectedChoice] = useState(0);
+    /**
+     * Exact chooser React has committed. The synchronous owner ref is needed to
+     * block queue/goal work immediately, but it must not accept the Return key
+     * that created it before a menu has existed in the rendered tree.
+     */
+    const choicePickerCommittedRef = useRef(null);
+    const commandPickerSubmitRef = useRef(() => { });
+    const { selection: selectedChoice, selectionRef: selectedChoiceRef, setSelection: setSelectedChoice, } = useSelectionIndex(0);
     const setChoicePicker = useCallback((next) => {
         choicePickerRef.current = next;
+        if (next === null)
+            choicePickerCommittedRef.current = null;
         setChoicePickerState(next);
     }, []);
+    useEffect(() => {
+        choicePickerCommittedRef.current = choicePicker;
+    }, [choicePicker]);
+    /** Host-owned text decision; its value never enters model prompt history. */
+    const [textPrompt, setTextPromptState] = useState(null);
+    const textPromptRef = useRef(null);
+    const textPromptTokenRef = useRef(0);
+    const setTextPrompt = useCallback((next) => {
+        textPromptRef.current = next;
+        setTextPromptState(next);
+    }, []);
     const [composerDraft, setComposerDraft] = useState(null);
     const composerDraftTokenRef = useRef(0);
+    /** One git-backed review choice may be resolving while its visible picker remains authoritative. */
+    const reviewChoiceInFlightRef = useRef(null);
     const exitArmedRef = useRef(false);
     const abortRef = useRef(null);
     /** Identity of the turn allowed to notify when it settles. */
     const activeTurnTokenRef = useRef(null);
+    /** Exact live-input owner; absent before provider admission and after settlement. */
+    const activeTurnInboxRef = useRef(null);
     /** A broken terminal notification is reported once, not after every turn. */
     const notificationFailureShownRef = useRef(false);
     /**
@@ -404,6 +508,12 @@ export function App({ ctx: initialCtx }) {
     // turns attribute to the resumed conversation.
     const sessionsRef = useRef(null);
     const scopeRef = useRef(null);
+    const exitWithSummary = useCallback(() => {
+        onExitSummary?.({
+            ...(scopeRef.current?.sessionId ? { conversationId: scopeRef.current.sessionId } : {}),
+        });
+        exit();
+    }, [exit, onExitSummary]);
     /** Durable active state is not permission to spend turns after a restart. */
     const [goalActivation] = useState(() => new SessionGoalActivation());
     const goalDriveInFlightRef = useRef(false);
@@ -460,6 +570,10 @@ export function App({ ctx: initialCtx }) {
      */
     const conversationMutationRef = useRef(null);
     const [conversationMutation, setConversationMutation] = useState(null);
+    /** Host editor operation; it owns terminal input until its child settles. */
+    const [externalEditorRequest, setExternalEditorRequest] = useState(null);
+    const externalEditorRequestRef = useRef(null);
+    const externalEditorStartedRef = useRef(null);
     /** Closes the same-tick input window while a verified export reads disk. */
     const exportingRef = useRef(false);
     /** A goal mutation is ordered before any later conversation command. */
@@ -495,6 +609,76 @@ export function App({ ctx: initialCtx }) {
         settledRef.current = 0;
         setResetKey((k) => k + 1);
     }, [stdout.isTTY, writeStdout]);
+    const requestExternalEditor = useCallback((seed) => {
+        if (phase !== 'ready' ||
+            state !== 'idle' ||
+            abortRef.current !== null ||
+            hasUnsettledTurn() ||
+            queuedRef.current.length > 0 ||
+            compactingRef.current ||
+            conversationMutationRef.current !== null) {
+            return Promise.reject(new Error('wait for the active turn, queue, compaction, or conversation change to settle'));
+        }
+        if (externalEditorRequestRef.current) {
+            return Promise.reject(new Error('an external editor is already open'));
+        }
+        return new Promise((resolve, reject) => {
+            const request = {
+                token: {},
+                seed,
+                controller: new AbortController(),
+                resolve,
+                reject,
+            };
+            externalEditorRequestRef.current = request;
+            setExternalEditorRequest(request);
+        });
+    }, [hasUnsettledTurn, phase, state]);
+    useEffect(() => {
+        const request = externalEditorRequest;
+        if (!request || externalEditorStartedRef.current === request.token)
+            return;
+        externalEditorStartedRef.current = request.token;
+        void (async () => {
+            // Let React deactivate every Ink input hook first. The editor must inherit
+            // a cooked terminal, not the raw byte stream the composer consumes.
+            await new Promise((resolve) => setImmediate(resolve));
+            if (request.controller.signal.aborted)
+                return;
+            if (stdout.isTTY)
+                writeStdout('\x1b[2J\x1b[H');
+            let edited;
+            let failure;
+            try {
+                edited = await externalEditor({
+                    seed: request.seed,
+                    cwd: trustedCwdRef.current,
+                    signal: request.controller.signal,
+                });
+            }
+            catch (error) {
+                failure = error;
+            }
+            if (request.controller.signal.aborted)
+                return;
+            if (externalEditorRequestRef.current === request) {
+                externalEditorRequestRef.current = null;
+                resetTranscript();
+                setExternalEditorRequest(null);
+            }
+            if (failure !== undefined)
+                request.reject(failure);
+            else
+                request.resolve(edited ?? '');
+        })();
+    }, [externalEditor, externalEditorRequest, resetTranscript, stdout.isTTY, writeStdout]);
+    useEffect(() => () => {
+        const request = externalEditorRequestRef.current;
+        if (!request)
+            return;
+        externalEditorRequestRef.current = null;
+        request.controller.abort(new Error('the terminal session closed'));
+    }, []);
     const pushMessage = useCallback((role, content, pending = false, glyph, detail, glyphColor, meta) => {
         const id = nextId();
         setMessages((prev) => [
@@ -577,6 +761,222 @@ export function App({ ctx: initialCtx }) {
         setReasoningEffort(effort);
         pushMessage('system', `Reasoning effort changed to ${effort} for future main-query turns in this session.`);
     }, [hasUnsettledTurn, pushMessage, session, setReasoningEffort, state]);
+    const stepReasoningEffort = useCallback((direction) => {
+        const levels = session?.reasoningEffortLevels;
+        if (!session?.hasProvider || levels === undefined || levels.length === 0) {
+            pushMessage('system', 'Reasoning shortcuts are unavailable because the current provider chain has no exact non-empty effort menu.');
+            return;
+        }
+        const selected = reasoningEffortRef.current;
+        const anchor = selected !== undefined && levels.includes(selected)
+            ? selected
+            : session.reasoningEffortDefault;
+        if (anchor === undefined || !levels.includes(anchor)) {
+            pushMessage('system', 'Reasoning shortcuts are unavailable because the provider chain does not publish one exact default. Use /effort to choose a level explicitly.');
+            return;
+        }
+        const index = levels.indexOf(anchor);
+        const next = direction === 'raise' ? levels[index + 1] : levels[index - 1];
+        if (next === undefined) {
+            pushMessage('system', `Reasoning is already at the ${direction === 'raise' ? 'highest' : 'lowest'} shortcut level (${anchor}).`);
+            return;
+        }
+        if (direction === 'raise' && (next === 'max' || next === 'ultra')) {
+            pushMessage('system', `${next} is an advanced reasoning level. Choose it explicitly with /effort.`);
+            return;
+        }
+        applyReasoningEffort(next);
+    }, [applyReasoningEffort, pushMessage, session]);
+    const recordFeedback = useCallback((runIdValue, messageIdValue, rating, note) => {
+        // Written under the same `<cwd>/.namzu` root the runs live in, so a
+        // rating and the transcript it judges travel together.
+        const store = new DiskMessageFeedbackStore({
+            rootDir: join(ctx.cwd, '.namzu', 'feedback'),
+            runsDir: join(ctx.cwd, '.namzu', 'runs'),
+        });
+        const runId = runIdValue;
+        const messageId = messageIdValue;
+        void (async () => {
+            try {
+                // A later rating replaces the first. Read-then-write preserves the
+                // store's owner-version collision check instead of blind overwrite.
+                const current = (await store.listMessageFeedback({ runId })).find((record) => record.messageId === messageId);
+                const record = await store.putMessageFeedback({
+                    runId,
+                    messageId,
+                    rating,
+                    ...(note ? { note } : {}),
+                    expectedVersion: current?.ownerVersion ?? 0,
+                });
+                pushMessage('system', `Recorded ${record.rating} for ${record.messageId}.`);
+            }
+            catch (error) {
+                pushMessage('system', `Could not record feedback: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        })();
+    }, [ctx.cwd, pushMessage]);
+    const activateSkill = useCallback((name) => {
+        const info = discoverSkills({ cwd: ctx.cwd }).find((skill) => skill.name === name);
+        if (!info) {
+            pushMessage('system', `No skill named "${name}". See /skills.`);
+            return;
+        }
+        try {
+            const body = loadSkillBody(info);
+            setActiveSkills((previous) => [
+                ...previous.filter((skill) => skill.name !== info.name),
+                { name: info.name, body },
+            ]);
+            pushMessage('system', `Activated skill: ${info.name}`);
+        }
+        catch (error) {
+            pushMessage('system', `Could not load skill "${name}": ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }, [ctx.cwd, pushMessage]);
+    const removeStoredCredential = useCallback((target) => {
+        const path = credentialsPath();
+        const hadClaude = readStoredSubscriptionCredential() !== null;
+        const hadCodex = readStoredCodexCredential() !== null;
+        try {
+            if (target === 'anthropic')
+                clearStoredSubscriptionCredential();
+            else if (target === 'codex')
+                clearStoredCodexCredential();
+            else
+                clearAllStoredCredentials();
+        }
+        catch (error) {
+            pushMessage('system', `Could not remove ${path}: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        if (target === 'all') {
+            pushMessage('system', describeLogout(path, hadClaude || hadCodex));
+            return;
+        }
+        pushMessage('system', describeProviderLogout(path, target, target === 'anthropic' ? hadClaude : hadCodex));
+    }, [pushMessage]);
+    /** Publish one recoverable, read-only tombstone before leaving the TUI. */
+    const archiveCurrentConversation = useCallback(() => {
+        if (conversationMutationRef.current)
+            return;
+        const sessions = sessionsRef.current;
+        const sessionId = scopeRef.current?.sessionId;
+        if (!sessions || !sessionId) {
+            pushMessage('system', 'Cannot archive this conversation because durable session persistence is unavailable.');
+            return;
+        }
+        if (state !== 'idle' ||
+            abortRef.current !== null ||
+            hasUnsettledTurn() ||
+            queuedRef.current.length > 0 ||
+            compactingRef.current ||
+            exportingRef.current) {
+            pushMessage('system', 'A turn, queued prompt, compaction, or export is still running or settling. Archive waits for a stable durable boundary.');
+            return;
+        }
+        const generation = conversationGenRef.current;
+        conversationMutationRef.current = 'archive';
+        setConversationMutation('archive');
+        void (async () => {
+            let archived = false;
+            try {
+                await persistenceTailRef.current;
+                if (conversationGenRef.current !== generation ||
+                    scopeRef.current?.sessionId !== sessionId ||
+                    hasUnsettledTurn(generation) ||
+                    queuedRef.current.length > 0) {
+                    throw new Error('the active conversation changed before archive publication');
+                }
+                await archiveConversation(sessions, sessionId);
+                archived = true;
+                goalActivation.clear();
+                onExitSummary?.({});
+                exit();
+            }
+            catch (error) {
+                pushMessage('system', `Could not archive this conversation: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            finally {
+                if (!archived && conversationMutationRef.current === 'archive') {
+                    conversationMutationRef.current = null;
+                    setConversationMutation(null);
+                }
+            }
+        })();
+    }, [exit, goalActivation, hasUnsettledTurn, onExitSummary, pushMessage, state]);
+    /**
+     * Resolve the one durable conversation boundary shared by both export
+     * destinations. The chooser itself owns input, but it does not weaken this
+     * admission check: a direct `/export path` and a later chooser selection
+     * must prove the same session and turn stability before reading evidence.
+     */
+    const stableExportSource = useCallback(() => {
+        const sessions = sessionsRef.current;
+        const sessionId = scopeRef.current?.sessionId;
+        if (!sessions || !sessionId) {
+            pushMessage('system', 'Cannot export this conversation because durable session persistence is unavailable.');
+            return null;
+        }
+        if (abortRef.current ||
+            state !== 'idle' ||
+            hasUnsettledTurn() ||
+            compactingRef.current ||
+            queuedRef.current.length > 0 ||
+            exportingRef.current) {
+            pushMessage('system', 'A turn, compaction, queued prompt, or export is still running or settling. Export waits for a stable durable boundary; try again when the composer is idle.');
+            return null;
+        }
+        return { sessions, sessionId };
+    }, [hasUnsettledTurn, pushMessage, state]);
+    const runConversationExport = useCallback((destination) => {
+        const source = stableExportSource();
+        if (!source)
+            return;
+        exportingRef.current = true;
+        setState('thinking');
+        const generation = conversationGenRef.current;
+        void (async () => {
+            try {
+                await persistenceTailRef.current;
+                if (conversationGenRef.current !== generation ||
+                    scopeRef.current?.sessionId !== source.sessionId) {
+                    throw new Error('The active conversation changed before the export reached its durable boundary.');
+                }
+                const projected = await conversationMarkdown(source.sessions, source.sessionId);
+                if (destination.kind === 'file') {
+                    const written = await writeConversationExport(projected.markdown, destination.path, ctx.cwd);
+                    pushMessage('system', `Exported ${projected.turns} turn${projected.turns === 1 ? '' : 's'} to ${written.path} (${written.bytes.toLocaleString()} bytes). Existing files are never overwritten.`);
+                    return;
+                }
+                const result = writeClipboardText(projected.markdown, {
+                    isTTY: stdout.isTTY,
+                    write: writeStdout,
+                });
+                switch (result.kind) {
+                    case 'request-sent':
+                        pushMessage('system', `Export copy request sent for ${projected.turns} verified turn${projected.turns === 1 ? '' : 's'} (${result.bytes.toLocaleString()} bytes). Terminal, multiplexer or remote-session policy may ignore OSC 52; if the clipboard did not change, enable terminal clipboard access.`);
+                        break;
+                    case 'unavailable':
+                        pushMessage('system', `Cannot send the verified export to the clipboard here — ${result.detail}. Choose Save to file instead.`);
+                        break;
+                    case 'too-large':
+                        pushMessage('system', `Cannot send the verified export to the terminal clipboard — it is ${result.bytes.toLocaleString()} bytes and the OSC 52 safety limit is ${result.limit.toLocaleString()}. Nothing was truncated; choose Save to file instead.`);
+                        break;
+                    case 'write-failed':
+                        pushMessage('system', `Could not send the verified export copy request: ${result.detail}`);
+                        break;
+                }
+            }
+            catch (err) {
+                pushMessage('system', `Conversation export failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            finally {
+                exportingRef.current = false;
+                if (conversationGenRef.current === generation)
+                    setState('idle');
+            }
+        })();
+    }, [ctx.cwd, pushMessage, stableExportSource, stdout.isTTY, writeStdout]);
     const applyChoiceSelection = useCallback((index) => {
         const picker = choicePickerRef.current;
         if (!picker)
@@ -584,13 +984,211 @@ export function App({ ctx: initialCtx }) {
         const value = picker.values[index];
         if (index < 0 || index >= picker.values.length)
             return;
+        if (picker.kind === 'review-preset') {
+            if (reviewChoiceInFlightRef.current)
+                return;
+            if (value === 'custom') {
+                setChoicePicker(null);
+                composerDraftTokenRef.current += 1;
+                setComposerDraft({
+                    token: composerDraftTokenRef.current,
+                    text: '/review ',
+                });
+                return;
+            }
+            const operation = {};
+            reviewChoiceInFlightRef.current = operation;
+            void (async () => {
+                try {
+                    if (value === 'base-branch') {
+                        const listing = await listReviewBranches(ctx.cwd);
+                        if (appLifetime.signal.aborted ||
+                            reviewChoiceInFlightRef.current !== operation ||
+                            choicePickerRef.current !== picker)
+                            return;
+                        if (!listing || listing.branches.length === 0) {
+                            setChoicePicker(null);
+                            pushMessage('system', 'No local branch is available for comparison in this working directory.');
+                            return;
+                        }
+                        setSelectedChoice(0);
+                        setChoicePicker({
+                            kind: 'review-branch',
+                            title: 'Select a base branch',
+                            notice: `Current branch: ${listing.current}`,
+                            values: listing.branches,
+                            options: listing.branches.map((branch) => ({
+                                label: branch,
+                                description: `${listing.current} → ${branch}`,
+                            })),
+                        });
+                        return;
+                    }
+                    if (value === 'commit') {
+                        const commits = await listReviewCommits(ctx.cwd);
+                        if (appLifetime.signal.aborted ||
+                            reviewChoiceInFlightRef.current !== operation ||
+                            choicePickerRef.current !== picker)
+                            return;
+                        if (!commits || commits.length === 0) {
+                            setChoicePicker(null);
+                            pushMessage('system', 'No commit is available to review in this working directory.');
+                            return;
+                        }
+                        setSelectedChoice(0);
+                        setChoicePicker({
+                            kind: 'review-commit',
+                            title: 'Select a commit to review',
+                            values: commits,
+                            options: commits.map((commit) => ({
+                                label: commit.title,
+                                description: commit.sha.slice(0, 12),
+                            })),
+                        });
+                        return;
+                    }
+                    const diff = await workspaceDiff(ctx.cwd);
+                    if (appLifetime.signal.aborted ||
+                        reviewChoiceInFlightRef.current !== operation ||
+                        choicePickerRef.current !== picker)
+                        return;
+                    if (diff === null) {
+                        setChoicePicker(null);
+                        pushMessage('system', 'Cannot review here — this is not a git repository, or git is unavailable.');
+                        return;
+                    }
+                    if (diff.stat.length === 0 && diff.untracked.length === 0) {
+                        setChoicePicker(null);
+                        pushMessage('system', 'Nothing to review — the working tree is clean.');
+                        return;
+                    }
+                    advanceQueueContinuation();
+                    enqueueQueued({
+                        kind: 'human',
+                        text: reviewPrompt(diff.stat, diff.untracked),
+                    });
+                    setChoicePicker(null);
+                }
+                finally {
+                    if (reviewChoiceInFlightRef.current === operation) {
+                        reviewChoiceInFlightRef.current = null;
+                    }
+                }
+            })();
+            return;
+        }
+        if (picker.kind === 'review-branch') {
+            if (reviewChoiceInFlightRef.current)
+                return;
+            const branch = value;
+            const operation = {};
+            reviewChoiceInFlightRef.current = operation;
+            void (async () => {
+                try {
+                    const mergeBase = await reviewMergeBase(ctx.cwd, branch);
+                    if (appLifetime.signal.aborted ||
+                        reviewChoiceInFlightRef.current !== operation ||
+                        choicePickerRef.current !== picker)
+                        return;
+                    if (!mergeBase) {
+                        setChoicePicker(null);
+                        pushMessage('system', `Could not resolve a merge base for ${branch}.`);
+                        return;
+                    }
+                    advanceQueueContinuation();
+                    enqueueQueued({
+                        kind: 'human',
+                        text: baseBranchReviewPrompt(mergeBase),
+                    });
+                    setChoicePicker(null);
+                }
+                finally {
+                    if (reviewChoiceInFlightRef.current === operation) {
+                        reviewChoiceInFlightRef.current = null;
+                    }
+                }
+            })();
+            return;
+        }
+        if (picker.kind === 'review-commit') {
+            advanceQueueContinuation();
+            enqueueQueued({
+                kind: 'human',
+                text: commitReviewPrompt(value.sha),
+            });
+            setChoicePicker(null);
+            return;
+        }
         setChoicePicker(null);
+        if (picker.kind === 'command') {
+            const command = value;
+            if (command.problem) {
+                pushMessage('system', `Cannot run /${command.name}: ${command.problem}`);
+                return;
+            }
+            commandPickerSubmitRef.current(`/${command.name}`);
+            return;
+        }
+        if (picker.kind === 'archive-conversation') {
+            if (value === 'archive')
+                archiveCurrentConversation();
+            return;
+        }
+        if (picker.kind === 'export-destination') {
+            if (value === 'clipboard') {
+                runConversationExport({ kind: 'clipboard' });
+                return;
+            }
+            const sessionId = scopeRef.current?.sessionId;
+            if (!sessionId) {
+                pushMessage('system', 'Cannot export this conversation because durable session persistence is unavailable.');
+                return;
+            }
+            textPromptTokenRef.current += 1;
+            setTextPrompt({
+                token: textPromptTokenRef.current,
+                kind: 'export-file',
+                title: 'Save conversation',
+                placeholder: 'Type a Markdown filename and press Enter',
+                emptyNotice: 'A filename is required. Press Esc to cancel.',
+                initialValue: `namzu-conversation-${sessionId}.md`,
+                sessionId,
+            });
+            return;
+        }
         if (picker.kind === 'permission-mode') {
             applyPermissionMode(value);
             return;
         }
+        if (picker.kind === 'feedback-rating') {
+            recordFeedback(picker.runId, picker.messageId, value);
+            return;
+        }
+        if (picker.kind === 'skill') {
+            activateSkill(value);
+            return;
+        }
+        if (picker.kind === 'credential-logout') {
+            removeStoredCredential(value);
+            return;
+        }
         applyReasoningEffort(value);
-    }, [applyPermissionMode, applyReasoningEffort, setChoicePicker]);
+    }, [
+        activateSkill,
+        advanceQueueContinuation,
+        appLifetime.signal,
+        applyPermissionMode,
+        applyReasoningEffort,
+        archiveCurrentConversation,
+        ctx.cwd,
+        enqueueQueued,
+        pushMessage,
+        recordFeedback,
+        removeStoredCredential,
+        runConversationExport,
+        setChoicePicker,
+        setTextPrompt,
+    ]);
     const sendCopyRequest = useCallback((index) => {
         const picker = copyPickerRef.current;
         const target = picker?.targets[index];
@@ -661,14 +1259,31 @@ export function App({ ctx: initialCtx }) {
     const finalizeMessage = useCallback((id, finalContent) => {
         setMessages((prev) => prev.map((m) => m.id === id ? { ...m, content: finalContent ?? m.content, pending: false } : m));
     }, []);
-    // Open the SDK session store + start a fresh conversation once. Best-effort:
-    // on failure persistence is simply unavailable and the chat still works.
+    // Open the SDK session store and select the durable conversation once.
+    // Ordinary startup remains best-effort; an explicit `namzu resume <id>` is
+    // exact and therefore refuses instead of silently widening to a fresh chat.
     const ensureSessions = useCallback(async () => {
         if (scopeRef.current)
             return scopeRef.current;
+        const requestedConversationId = initialConversationIdRef.current;
         try {
             const sessions = await openSessions(ctxRef.current.cwd);
-            const sessionId = await startConversation(sessions);
+            let sessionId;
+            if (requestedConversationId) {
+                const restored = await loadResumableConversation(sessions, requestedConversationId);
+                sessionId = asSessionId(requestedConversationId);
+                modelHistoryRef.current = restored;
+                setMessages(projectConversation(restored, nextId));
+                setHistory(promptHistoryFromConversation(restored));
+                const persistedOutput = latestAssistantOutput(restored);
+                lastCompletedOutputRef.current = persistedOutput
+                    ? { text: persistedOutput, provenance: 'persisted' }
+                    : null;
+                initialConversationIdRef.current = undefined;
+            }
+            else {
+                sessionId = await startConversation(sessions);
+            }
             sessionsRef.current = sessions;
             scopeRef.current = {
                 sessionId,
@@ -678,10 +1293,12 @@ export function App({ ctx: initialCtx }) {
             };
             return scopeRef.current;
         }
-        catch {
+        catch (error) {
+            if (requestedConversationId)
+                throw error;
             return undefined;
         }
-    }, []);
+    }, [nextId]);
     const hydrateSession = useCallback(async (prefs, detectedNow, signal) => {
         if (signal?.aborted)
             return;
@@ -692,6 +1309,7 @@ export function App({ ctx: initialCtx }) {
         const s = await createAgentSession(prefs, detectedNow, {
             scope,
             cwd: activeCtx.cwd,
+            enableComputerUse: true,
             rules: activeCtx.rules,
             ...(sessionsRef.current ? { sessionGoals: sessionsRef.current.goals } : {}),
             ...(activeCtx.mcpServers ? { mcpServers: activeCtx.mcpServers } : {}),
@@ -732,6 +1350,13 @@ export function App({ ctx: initialCtx }) {
             // the file is shadowed instead of leaving it silently unused.
             reserved: hostCommandNames(),
         }));
+        const mentionLoadOwner = {};
+        mentionLoadOwnerRef.current = mentionLoadOwner;
+        void listMentionableFiles(activeCtx.cwd, appLifetime.signal).then((files) => {
+            if (!appLifetime.signal.aborted &&
+                mentionLoadOwnerRef.current === mentionLoadOwner)
+                setMentionCandidates(files);
+        });
         setCurrentProvider(primaryProvider(prefs).id);
         // A picker-owned, usable provider switch is an explicit recovery from a
         // paused failed turn. Failed and superseded candidates return above and
@@ -779,7 +1404,7 @@ export function App({ ctx: initialCtx }) {
             if (s.errorHint)
                 pushMessage('system', s.errorHint);
         }
-    }, [advanceQueueContinuation, ensureSessions, pushMessage, setReasoningEffort]);
+    }, [appLifetime.signal, advanceQueueContinuation, ensureSessions, pushMessage, setReasoningEffort]);
     /**
      * Sign in to a subscription without leaving namzu.
      *
@@ -942,6 +1567,19 @@ export function App({ ctx: initialCtx }) {
         try {
             if (signal?.aborted)
                 return;
+            // An exact shell resume owns conversation admission before provider
+            // discovery or construction. A malformed/missing id must not consume
+            // model work and then quietly continue in a fresh conversation.
+            if (initialConversationIdRef.current) {
+                try {
+                    await ensureSessions();
+                }
+                catch (error) {
+                    setPhase('unhealthy');
+                    pushMessage('system', `Could not resume ${initialConversationIdRef.current}: ${error instanceof Error ? error.message : String(error)}`);
+                    return;
+                }
+            }
             const probe = await probeAgentSession();
             if (signal?.aborted)
                 return;
@@ -1029,7 +1667,7 @@ export function App({ ctx: initialCtx }) {
             setPhase('unhealthy');
             pushMessage('system', `Failed to probe agents: ${err instanceof Error ? err.message : String(err)}`);
         }
-    }, [appLifetime.signal, hydrateSession, pushMessage]);
+    }, [appLifetime.signal, ensureSessions, hydrateSession, pushMessage]);
     // `startOrFinishLogin` is declared above `runProbe` and calls it, so it
     // reads the current one through a ref rather than closing over a stale
     // binding or forcing the two into a declaration order that reads backwards.
@@ -1085,8 +1723,8 @@ export function App({ ctx: initialCtx }) {
     // is idempotent, so a repeated render reaches the same answer.
     const window = liveWindow({
         messages: finalized,
-        rows: process.stdout.rows,
-        columns: process.stdout.columns,
+        rows: stdout.rows,
+        columns: stdout.columns,
         furnitureRows: LIVE_FURNITURE_ROWS,
         settled: settledRef.current,
         raw: rawOutput,
@@ -1096,14 +1734,28 @@ export function App({ ctx: initialCtx }) {
     // the answer is knowable. `liveRows` is the furniture beneath the transcript
     // PLUS the live window above it — the window is part of the live region, and
     // leaving it out would have the spacer padding room that is already taken.
-    const spacerRows = phase === 'ready'
+    const spacerCandidate = phase === 'ready' && permission === null
         ? bottomSpacerRows({
-            rows: process.stdout.rows,
-            columns: process.stdout.columns,
+            rows: stdout.rows,
+            columns: stdout.columns,
             transcript: transcriptLines(finalized.slice(0, window.settled), rawOutput),
             liveRows: LIVE_FURNITURE_ROWS + window.rows,
         })
         : 0;
+    const spacerLayout = {
+        rows: stdout.rows,
+        columns: stdout.columns,
+        raw: rawOutput,
+        messageCount: finalized.length,
+        tail: finalized
+            .slice(-MAX_LIVE_ROWS)
+            .map(({ id, content, meta, detail }) => ({ id, content, meta, detail })),
+    };
+    const spacerRows = phase === 'ready' && permission === null && sameSpacerLayout(spacerLayoutRef.current, spacerLayout)
+        ? spacerLayoutRef.current.spacerRows
+        : spacerCandidate;
+    spacerLayoutRef.current =
+        phase === 'ready' && permission === null ? { ...spacerLayout, spacerRows } : null;
     // One merged vocabulary for the session: this host's own commands plus
     // whatever the kernel's registry reports. Built here so `/help`, the
     // autocomplete and the dispatcher all answer from the same list — three
@@ -1111,6 +1763,7 @@ export function App({ ctx: initialCtx }) {
     // disagree the moment a capability added a command.
     const hostCommands = mergeHostCommands(kernelCommandDescriptors());
     const slashCtx = {
+        cwd: ctx.cwd,
         builtins: hostCommands,
         lastAssistantMessageId: () => lastAssistantMessage.current?.messageId ?? null,
         // Called when `/tools` renders, not read here — the same shape, and the
@@ -1119,7 +1772,12 @@ export function App({ ctx: initialCtx }) {
         // From the session, not re-resolved: resolving builds a provider, and a
         // second one would describe a different sandbox than the run is using.
         sandbox: session?.sandbox ?? null,
-        mcp: session ? { connected: session.mcpConnected, failed: session.mcpFailed } : null,
+        mcp: () => session
+            ? (session.mcpStatus?.() ?? {
+                connected: session.mcpConnected,
+                failed: session.mcpFailed,
+            })
+            : null,
         providerSummary: session?.providerSummary ?? null,
         modelSummary: session?.modelSummary ?? null,
         reasoningEffort: {
@@ -1182,10 +1840,11 @@ export function App({ ctx: initialCtx }) {
         const resolve = permissionResolveRef.current;
         permissionResolveRef.current = null;
         permissionOpenedAtRef.current = null;
+        setPermissionReviewOffset(0);
         setPermission(null);
         if (resolve)
             resolve(decision);
-    }, []);
+    }, [setPermissionReviewOffset]);
     /**
      * Stop the running turn, and hand the screen back in a usable state.
      *
@@ -1210,12 +1869,14 @@ export function App({ ctx: initialCtx }) {
         const ac = abortRef.current;
         if (!ac)
             return false;
-        ac.abort();
+        ac.abort(new RunCancelled('user'));
         const activeSessionId = scopeRef.current?.sessionId;
         if (activeSessionId)
             goalActivation.disarm(activeSessionId);
         wakeGoalDriver();
         activeTurnTokenRef.current = null;
+        activeTurnInboxRef.current = null;
+        setPendingSteers([]);
         // Dropped now so a second interrupt does not re-abort, and the queue with
         // it: interrupting means stop, not "run the next one".
         abortRef.current = null;
@@ -1301,6 +1962,7 @@ export function App({ ctx: initialCtx }) {
         resetTranscript();
         setMessages(restored);
         modelHistoryRef.current = msgs;
+        setHistory((previous) => [...previous, ...promptHistoryFromConversation(msgs)]);
         const persistedOutput = latestAssistantOutput(msgs);
         lastCompletedOutputRef.current = persistedOutput
             ? { text: persistedOutput, provenance: 'persisted' }
@@ -1397,11 +2059,12 @@ export function App({ ctx: initialCtx }) {
         }
     }, [discardQueued, goalActivation, interruptTurn, pushMessage, resetTranscript, wakeGoalDriver]);
     /**
-     * `/title`: read or set the name this conversation appears under.
+     * `/rename` (and the older `/title` alias): edit or set the name this
+     * conversation appears under.
      *
-     * A bare `/title` asks rather than clears. Erasing a name by pressing
-     * enter on a half-typed command is the kind of loss nobody notices until
-     * `/resume` is a list of opening messages again.
+     * A bare command opens a prefilled host prompt rather than printing usage or
+     * clearing. The result never goes through the model composer, queue, or prompt
+     * history; it is a session-store operation with the session id captured here.
      */
     const doTitle = useCallback(async (title, clear) => {
         const sessions = sessionsRef.current ?? (await ensureSessions(), sessionsRef.current);
@@ -1413,9 +2076,16 @@ export function App({ ctx: initialCtx }) {
         try {
             if (!clear && title === '') {
                 const current = titleOf(sessions, scope.sessionId);
-                pushMessage('system', current !== undefined
-                    ? `This conversation is named "${current}". /title <name> renames it; /title clear removes the name.`
-                    : 'This conversation has no name, so /resume lists it by its opening message — which stops describing it as the conversation moves on. /title <name> fixes that.');
+                textPromptTokenRef.current += 1;
+                setTextPrompt({
+                    token: textPromptTokenRef.current,
+                    kind: 'conversation-title',
+                    title: current === undefined ? 'Name conversation' : 'Rename conversation',
+                    placeholder: 'Type a name and press Enter',
+                    emptyNotice: 'A conversation name cannot be empty. Press Esc to cancel.',
+                    initialValue: current ?? '',
+                    sessionId: scope.sessionId,
+                });
                 return;
             }
             setTitle(sessions, scope.sessionId, clear ? '' : title);
@@ -1426,7 +2096,46 @@ export function App({ ctx: initialCtx }) {
         catch (err) {
             pushMessage('system', `Could not save the name: ${err instanceof Error ? err.message : String(err)}`);
         }
-    }, [ensureSessions, pushMessage]);
+    }, [ensureSessions, pushMessage, setTextPrompt]);
+    const submitTextPrompt = useCallback((value) => {
+        const prompt = textPromptRef.current;
+        if (!prompt)
+            return;
+        setTextPrompt(null);
+        const scope = scopeRef.current;
+        if (!scope || scope.sessionId !== prompt.sessionId) {
+            pushMessage('system', prompt.kind === 'conversation-title'
+                ? 'The conversation changed while its name editor was open. Nothing was renamed; open /rename again.'
+                : 'The conversation changed while its export filename editor was open. Nothing was exported; open /export again.');
+            return;
+        }
+        if (prompt.kind === 'export-file') {
+            runConversationExport({ kind: 'file', path: value });
+            return;
+        }
+        const sessions = sessionsRef.current;
+        if (!sessions) {
+            pushMessage('system', 'Conversation history is unavailable in this folder.');
+            return;
+        }
+        try {
+            setTitle(sessions, prompt.sessionId, value);
+            pushMessage('system', `Named "${value.trim()}".`);
+        }
+        catch (error) {
+            pushMessage('system', `Could not save the name: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }, [pushMessage, runConversationExport, setTextPrompt]);
+    const cancelTextPrompt = useCallback(() => {
+        const prompt = textPromptRef.current;
+        // TextPrompt and App both receive the same Ink input event. Keep the
+        // synchronous owner until every listener has seen this Esc/Ctrl+C, or App
+        // can read the same key as an interrupt/exit after the child clears the ref.
+        queueMicrotask(() => {
+            if (textPromptRef.current === prompt)
+                setTextPrompt(null);
+        });
+    }, [setTextPrompt]);
     /**
      * `/fork`: continue in a copy, leaving this conversation where it is.
      *
@@ -1582,13 +2291,23 @@ export function App({ ctx: initialCtx }) {
     ]);
     // Bridge passed into session.send(): the agent calls this before a
     // non-read-only tool batch; it parks until the user presses y/n/a.
-    const onPermission = useCallback((req) => new Promise((resolve) => {
-        permissionResolveRef.current = resolve;
-        permissionOpenedAtRef.current = Date.now();
-        setPermission(req);
-        setState('awaiting-permission');
-        sendTerminalNotification({ kind: 'approval-required' });
-    }), [sendTerminalNotification]);
+    const onPermission = useCallback((req) => {
+        const review = buildPermissionReview(req.toolCalls);
+        if (!review.ok) {
+            return Promise.resolve({
+                kind: 'reject',
+                feedback: permissionReviewRefusal(review.reason),
+            });
+        }
+        return new Promise((resolve) => {
+            permissionResolveRef.current = resolve;
+            permissionOpenedAtRef.current = Date.now();
+            setPermissionReviewOffset(0);
+            setPermission({ ...req, review: review.text });
+            setState('awaiting-permission');
+            sendTerminalNotification({ kind: 'approval-required' });
+        });
+    }, [sendTerminalNotification, setPermissionReviewOffset]);
     // Render one agent event onto the transcript. Shared by the local turn loop
     // and the daemon-attach poller, so both paths produce identical output.
     // `st` carries the streaming-assistant bubble id + accumulated text across
@@ -1645,6 +2364,28 @@ export function App({ ctx: initialCtx }) {
                 setActiveTools(activeToolsRef.current);
                 break;
             }
+            case 'tool-progress': {
+                const running = activeToolsRef.current;
+                const index = running.findIndex((tool) => tool.id === event.toolUseId);
+                // A terminal event may already have removed this call. Never recreate
+                // a live row from late diagnostic state.
+                if (index < 0)
+                    break;
+                const current = running[index];
+                const { fraction: _fraction, ...withoutFraction } = current;
+                const updated = {
+                    ...withoutFraction,
+                    progress: event.message,
+                    ...(event.fraction !== undefined ? { fraction: event.fraction } : {}),
+                };
+                activeToolsRef.current = [
+                    ...running.slice(0, index),
+                    updated,
+                    ...running.slice(index + 1),
+                ];
+                setActiveTools(activeToolsRef.current);
+                break;
+            }
             case 'tool-end': {
                 const running = activeToolsRef.current;
                 // Match strictly by toolUseId. Never fall back to "the first
@@ -1794,16 +2535,11 @@ export function App({ ctx: initialCtx }) {
             : undefined);
         const priorForSdk = [...historyBeforeTurn, userMessage];
         const runId = generateRunId();
-        const metaParts = [];
-        if (attached.length > 0)
-            metaParts.push(`${attached.length} file${attached.length > 1 ? 's' : ''} attached`);
-        if (attachments && attachments.length > 0)
-            metaParts.push(`${attachments.length} attachment${attachments.length > 1 ? 's' : ''}`);
         if (goalRound) {
             pushMessage('system', `Goal round ${goalRound.round} / ${goalRound.maxGoalRounds}`, false, '◎', [`Objective: ${goalRound.objective}`]);
         }
         else {
-            pushMessage('user', text, false, undefined, undefined, undefined, metaParts.length > 0 ? metaParts.join(' · ') : undefined);
+            pushMessage('user', text, false, undefined, undefined, undefined, humanPromptMeta(attached.length, attachments));
         }
         // The model interleaves text → tool → text across iterations; `applyEvent`
         // renders each one in order.
@@ -1845,6 +2581,51 @@ export function App({ ctx: initialCtx }) {
         const turnGeneration = conversationGenRef.current;
         unsettledTurnGenerationsRef.current.set(turnToken, turnGeneration);
         const stillHere = () => conversationGenRef.current === turnGeneration;
+        let inboxOpen = true;
+        const inboxEntries = [];
+        const inbox = {
+            accept(input) {
+                if (!inboxOpen ||
+                    ac.signal.aborted ||
+                    !stillHere() ||
+                    activeTurnTokenRef.current !== turnToken ||
+                    activeTurnInboxRef.current !== inbox)
+                    return false;
+                inboxEntries.push(input);
+                setPendingSteers([...inboxEntries]);
+                return true;
+            },
+            drain() {
+                if (!inboxOpen ||
+                    ac.signal.aborted ||
+                    activeTurnTokenRef.current !== turnToken ||
+                    activeTurnInboxRef.current !== inbox ||
+                    inboxEntries.length === 0)
+                    return [];
+                const delivered = inboxEntries.splice(0, inboxEntries.length);
+                // This callback runs at the kernel's provider-valid boundary: every
+                // delta from the prior answer has already crossed the event stream.
+                // Commit the user rows here, not at keypress time, so the transcript
+                // cannot place a steer inside an assistant message that is still live.
+                if (stillHere()) {
+                    flushStream(st);
+                    if (st.assistantId) {
+                        finalizeMessage(st.assistantId);
+                        st.assistantId = null;
+                    }
+                    for (const input of delivered) {
+                        pushMessage('user', input.prompt.text, false, undefined, undefined, undefined, humanPromptMeta(input.attachedFiles, input.prompt.attachments, true));
+                    }
+                    setPendingSteers([]);
+                }
+                return delivered.map((input) => input.message);
+            },
+            close() {
+                inboxOpen = false;
+                return inboxEntries.splice(0, inboxEntries.length);
+            },
+        };
+        activeTurnInboxRef.current = inbox;
         const turnPermissionMode = permissionModeRef.current;
         const turnReasoningEffort = reasoningEffortRef.current;
         // Always carry the guarded callback. `auto` and `strict` decide before
@@ -1908,6 +2689,7 @@ export function App({ ctx: initialCtx }) {
                     ...(goalRound ? { goalRound } : {}),
                     // The mode above decides whether this callback is consulted.
                     onPermission: askPermission,
+                    inboundMessages: () => inbox.drain(),
                     extraSystem: composeSkillsPrompt(activeSkills) ?? undefined,
                     onConversationMessages: (messages) => {
                         // State-only: opaque reasoning/signatures must reach the next
@@ -1960,6 +2742,12 @@ export function App({ ctx: initialCtx }) {
             }
         }
         finally {
+            const undeliveredLiveInput = inbox.close();
+            const ownsInbox = activeTurnInboxRef.current === inbox;
+            if (ownsInbox) {
+                activeTurnInboxRef.current = null;
+                setPendingSteers([]);
+            }
             // Prefer the kernel's settled conversation projection: it retains opaque
             // reasoning, citations and complete tool turns that the visible delta
             // stream cannot reconstruct. A fake/legacy session that does not publish
@@ -1984,6 +2772,9 @@ export function App({ ctx: initialCtx }) {
             // clear the state of whatever has started since.
             if (stillHere()) {
                 const ownsTurn = activeTurnTokenRef.current === turnToken;
+                if (ownsInbox && undeliveredLiveInput.length > 0) {
+                    replaceQueued(mergeUndeliveredLiveInput(queuedRef.current, undeliveredLiveInput));
+                }
                 const shouldPauseQueued = ownsTurn &&
                     abnormalTerminal?.token === turnToken &&
                     abnormalTerminal.continuationEpoch === queueContinuationEpochRef.current &&
@@ -2087,12 +2878,13 @@ export function App({ ctx: initialCtx }) {
         goalActivation,
         onPermission,
         pushMessage,
+        replaceQueued,
         sendTerminalNotification,
         session,
         setQueuePause,
         wakeGoalDriver,
     ]);
-    const handleSubmit = useCallback((value, attachments) => {
+    const handleSubmit = useCallback((value, attachments, mode = 'submit') => {
         if (goalCommandInFlightRef.current) {
             pushMessage('system', 'A goal command is still reaching durable session state. Wait for its result before sending another command or prompt.');
             return;
@@ -2106,7 +2898,9 @@ export function App({ ctx: initialCtx }) {
                 ? 'forked'
                 : conversationMutationRef.current === 'edit'
                     ? 'branched for prompt editing'
-                    : 'moved to a fresh conversation';
+                    : conversationMutationRef.current === 'archive'
+                        ? 'archived'
+                        : 'moved to a fresh conversation';
             pushMessage('system', `Conversation history is being ${operation}. Wait for it to finish before sending another command or prompt.`);
             return;
         }
@@ -2122,15 +2916,76 @@ export function App({ ctx: initialCtx }) {
                 case 'message':
                     pushMessage(slash.role, slash.content);
                     return;
+                case 'command-picker': {
+                    if (slash.commands.length === 0) {
+                        pushMessage('system', 'No slash commands are available in this session.');
+                        return;
+                    }
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'command',
+                        title: 'Choose a command',
+                        notice: 'Enter runs the selected command; Esc returns to the composer.',
+                        values: slash.commands,
+                        options: slash.commands.map((command) => ({
+                            label: `/${command.name}`,
+                            description: command.problem
+                                ? `Unavailable: ${command.problem}`
+                                : command.description,
+                        })),
+                        windowSize: suggestionWindowSize(stdout.rows),
+                    });
+                    return;
+                }
                 case 'clear-screen':
                     setMessages([]);
                     resetTranscript();
                     return;
+                case 'composer-draft':
+                    composerDraftTokenRef.current += 1;
+                    setComposerDraft({
+                        token: composerDraftTokenRef.current,
+                        text: slash.text,
+                    });
+                    return;
                 case 'new-conversation':
                     void startFreshConversation(slash.clearScreen);
                     return;
+                case 'archive-picker': {
+                    if (!sessionsRef.current || !scopeRef.current?.sessionId) {
+                        pushMessage('system', 'Cannot archive this conversation because durable session persistence is unavailable.');
+                        return;
+                    }
+                    if (state !== 'idle' ||
+                        abortRef.current !== null ||
+                        hasUnsettledTurn() ||
+                        queuedRef.current.length > 0 ||
+                        compactingRef.current ||
+                        exportingRef.current) {
+                        pushMessage('system', 'A turn, queued prompt, compaction, or export is still running or settling. Archive waits for a stable durable boundary.');
+                        return;
+                    }
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'archive-conversation',
+                        title: 'Archive this conversation?',
+                        notice: 'History remains on disk for inspection, but the conversation becomes read-only and disappears from /resume.',
+                        values: ['cancel', 'archive'],
+                        options: [
+                            {
+                                label: 'No, keep conversation',
+                                description: 'Return without changing durable history',
+                            },
+                            {
+                                label: 'Yes, archive and exit',
+                                description: 'Make this conversation read-only and leave Namzu',
+                            },
+                        ],
+                    });
+                    return;
+                }
                 case 'exit':
-                    exit();
+                    exitWithSummary();
                     return;
                 case 'repick':
                     // Opened as a choice, not as a repair. A launch-time refusal
@@ -2215,16 +3070,35 @@ export function App({ ctx: initialCtx }) {
                     void startOrFinishLogin(slash.pasted);
                     return;
                 case 'logout': {
-                    const path = credentialsPath();
-                    const had = readStoredSubscriptionCredential() !== null || readStoredCodexCredential() !== null;
-                    try {
-                        clearAllStoredCredentials();
+                    if (slash.target) {
+                        removeStoredCredential(slash.target);
+                        return;
                     }
-                    catch (err) {
-                        pushMessage('system', `Could not remove ${path}: ${err instanceof Error ? err.message : String(err)}`);
+                    const choices = [
+                        ...(readStoredSubscriptionCredential() ? ['anthropic'] : []),
+                        ...(readStoredCodexCredential() ? ['codex'] : []),
+                    ];
+                    if (choices.length === 0) {
+                        removeStoredCredential('all');
+                        return;
+                    }
+                    if (choices.length === 1) {
+                        removeStoredCredential(choices[0]);
                         return;
                     }
-                    pushMessage('system', describeLogout(path, had));
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'credential-logout',
+                        title: 'Choose a stored subscription to remove',
+                        notice: 'Only credentials created by Namzu are listed. Device sessions owned by other tools are left alone.',
+                        values: choices,
+                        options: choices.map((choice) => ({
+                            label: choice === 'anthropic' ? 'Claude' : 'Codex',
+                            description: choice === 'anthropic'
+                                ? 'Remove only Namzu’s Claude subscription.'
+                                : 'Remove only Namzu’s Codex subscription.',
+                        })),
+                    });
                     return;
                 }
                 case 'remember':
@@ -2262,23 +3136,30 @@ export function App({ ctx: initialCtx }) {
                     pushMessage('system', `Skills (● active):\n  ${lines.join('\n  ')}`);
                     return;
                 }
-                case 'load-skill': {
-                    const info = discoverSkills({ cwd: ctx.cwd }).find((s) => s.name === slash.name);
-                    if (!info) {
-                        pushMessage('system', `No skill named "${slash.name}". See /skills.`);
+                case 'skill-picker': {
+                    const skills = discoverSkills({ cwd: ctx.cwd });
+                    if (skills.length === 0) {
+                        pushMessage('system', 'No skills found. Add one at ~/.namzu/skills/<name>/SKILL.md or ./skills/<name>/SKILL.md.');
                         return;
                     }
-                    try {
-                        const body = loadSkillBody(info);
-                        setActiveSkills((prev) => [
-                            ...prev.filter((s) => s.name !== info.name),
-                            { name: info.name, body },
-                        ]);
-                        pushMessage('system', `Activated skill: ${info.name}`);
-                    }
-                    catch (err) {
-                        pushMessage('system', `Could not load skill "${slash.name}": ${err instanceof Error ? err.message : String(err)}`);
-                    }
+                    const activeNames = new Set(activeSkills.map((skill) => skill.name));
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'skill',
+                        title: 'Activate a skill',
+                        values: skills.map((skill) => skill.name),
+                        options: skills.map((skill) => ({
+                            label: skill.name,
+                            description: skill.problem
+                                ? `Unavailable: ${skill.problem}`
+                                : `${skill.description} · ${skill.source}`,
+                            current: activeNames.has(skill.name),
+                        })),
+                    });
+                    return;
+                }
+                case 'load-skill': {
+                    activateSkill(slash.name);
                     return;
                 }
                 case 'resume':
@@ -2424,67 +3305,76 @@ export function App({ ctx: initialCtx }) {
                     })();
                     return;
                 }
-                case 'feedback': {
+                case 'feedback-picker': {
                     const target = lastAssistantMessage.current;
-                    // Written under the same `<cwd>/.namzu` root the runs live
-                    // in, so a rating and the transcript it judges are one
-                    // directory apart and travel together.
-                    if (!target) {
+                    if (!target || target.messageId !== slash.messageId) {
                         pushMessage('system', 'Nothing to rate yet.');
                         return;
                     }
-                    const store = new DiskMessageFeedbackStore({
-                        rootDir: join(ctx.cwd, '.namzu', 'feedback'),
-                        runsDir: join(ctx.cwd, '.namzu', 'runs'),
+                    const values = ['good', 'bad'];
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'feedback-rating',
+                        title: 'Rate the latest answer',
+                        runId: target.runId,
+                        messageId: target.messageId,
+                        values,
+                        options: [
+                            {
+                                label: 'good',
+                                description: 'The answer was useful and correct.',
+                            },
+                            { label: 'bad', description: 'The answer needs improvement.' },
+                        ],
                     });
-                    const runId = target.runId;
-                    const messageId = slash.messageId;
-                    // Fire-and-forget: this switch is synchronous, and the
-                    // transcript reports the outcome either way rather than
-                    // blocking a keystroke on a disk write.
-                    void (async () => {
-                        try {
-                            // A first rating expects nothing; a second replaces the
-                            // first, which is what a rater changing their mind does.
-                            // Read-then-write rather than blind overwrite, so two
-                            // raters on one message still collide loudly.
-                            const current = (await store.listMessageFeedback({ runId })).find((r) => r.messageId === messageId);
-                            const record = await store.putMessageFeedback({
-                                runId,
-                                messageId,
-                                rating: slash.rating,
-                                ...(slash.note ? { note: slash.note } : {}),
-                                expectedVersion: current?.ownerVersion ?? 0,
-                            });
-                            pushMessage('system', `Recorded ${record.rating} for ${record.messageId}.`);
-                        }
-                        catch (err) {
-                            pushMessage('system', `Could not record feedback: ${err instanceof Error ? err.message : String(err)}`);
-                        }
-                    })();
+                    return;
+                }
+                case 'feedback': {
+                    const target = lastAssistantMessage.current;
+                    if (!target || target.messageId !== slash.messageId) {
+                        pushMessage('system', 'Nothing to rate yet.');
+                        return;
+                    }
+                    recordFeedback(target.runId, slash.messageId, slash.rating, slash.note);
                     return;
                 }
                 case 'review': {
-                    void (async () => {
-                        const diff = await workspaceDiff(ctx.cwd);
-                        if (diff === null) {
-                            pushMessage('system', 'Cannot review here — this is not a git repository, or git is unavailable.');
-                            return;
-                        }
-                        if (diff.stat.length === 0 && diff.untracked.length === 0) {
-                            // Refused rather than sent. A review request over an
-                            // unchanged tree burns a turn and comes back with a
-                            // review of nothing, which reads exactly like a review
-                            // of something.
-                            pushMessage('system', 'Nothing to review — the working tree is clean.');
-                            return;
-                        }
-                        // The same FIFO a typed message enters. A review composed
-                        // while a turn is in flight must not jump the queue, and
-                        // must not be dropped either.
-                        const text = reviewPrompt(diff.stat, diff.untracked);
-                        enqueueQueued({ kind: 'human', text });
-                    })();
+                    if (slash.instructions) {
+                        // Custom instructions are already operator-authored model input.
+                        // They take the ordinary FIFO below rather than a second send path.
+                        outgoing = slash.instructions;
+                        break;
+                    }
+                    const values = [
+                        'base-branch',
+                        'uncommitted',
+                        'commit',
+                        'custom',
+                    ];
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'review-preset',
+                        title: 'Select a review preset',
+                        values,
+                        options: [
+                            {
+                                label: 'Base branch',
+                                description: 'Review the current work as a branch comparison.',
+                            },
+                            {
+                                label: 'Uncommitted',
+                                description: 'Review staged, unstaged, and untracked changes.',
+                            },
+                            {
+                                label: 'Commit',
+                                description: 'Review one recent commit.',
+                            },
+                            {
+                                label: 'Custom',
+                                description: 'Write exact review instructions in the composer.',
+                            },
+                        ],
+                    });
                     return;
                 }
                 case 'diff': {
@@ -2609,45 +3499,30 @@ export function App({ ctx: initialCtx }) {
                         : 'Raw output mode off — rich transcript rendering restored.');
                     return;
                 }
-                case 'export': {
-                    const sessions = sessionsRef.current;
-                    const destination = scopeRef.current?.sessionId;
-                    if (!sessions || !destination) {
-                        pushMessage('system', 'Cannot export this conversation because durable session persistence is unavailable.');
+                case 'export-picker': {
+                    if (!stableExportSource())
                         return;
-                    }
-                    if (abortRef.current ||
-                        state !== 'idle' ||
-                        hasUnsettledTurn() ||
-                        compactingRef.current ||
-                        queuedRef.current.length > 0) {
-                        pushMessage('system', 'A turn, compaction, or queued prompt is still running or settling. Export waits for a stable durable boundary; try again when the composer is idle.');
-                        return;
-                    }
-                    exportingRef.current = true;
-                    setState('thinking');
-                    const generation = conversationGenRef.current;
-                    const path = slash.path ?? `namzu-conversation-${destination}.md`;
-                    void (async () => {
-                        try {
-                            await persistenceTailRef.current;
-                            if (conversationGenRef.current !== generation ||
-                                scopeRef.current?.sessionId !== destination) {
-                                throw new Error('The active conversation changed before the export reached its durable boundary.');
-                            }
-                            const projected = await conversationMarkdown(sessions, destination);
-                            const written = await writeConversationExport(projected.markdown, path, ctx.cwd);
-                            pushMessage('system', `Exported ${projected.turns} turn${projected.turns === 1 ? '' : 's'} to ${written.path} (${written.bytes.toLocaleString()} bytes). Existing files are never overwritten.`);
-                        }
-                        catch (err) {
-                            pushMessage('system', `Conversation export failed: ${err instanceof Error ? err.message : String(err)}`);
-                        }
-                        finally {
-                            exportingRef.current = false;
-                            if (conversationGenRef.current === generation)
-                                setState('idle');
-                        }
-                    })();
+                    setSelectedChoice(0);
+                    setChoicePicker({
+                        kind: 'export-destination',
+                        title: 'Export conversation',
+                        notice: 'Save the complete verified conversation as Markdown.',
+                        values: ['clipboard', 'file'],
+                        options: [
+                            {
+                                label: 'Copy to clipboard',
+                                description: 'Send the verified Markdown transcript to the terminal clipboard',
+                            },
+                            {
+                                label: 'Save to file',
+                                description: 'Choose a Markdown filename; existing files are never overwritten',
+                            },
+                        ],
+                    });
+                    return;
+                }
+                case 'export': {
+                    runConversationExport({ kind: 'file', path: slash.path });
                     return;
                 }
                 default: {
@@ -2671,11 +3546,25 @@ export function App({ ctx: initialCtx }) {
         // Keep the attachment array beside its text. Reconstructing a prompt from
         // the transcript later cannot recover bytes whose composer chip is gone.
         advanceQueueContinuation();
-        enqueueQueued({
+        const prompt = {
             kind: 'human',
             text: outgoing,
             ...(attachments && attachments.length > 0 ? { attachments: [...attachments] } : {}),
-        });
+        };
+        if (mode === 'submit') {
+            const inbox = activeTurnInboxRef.current;
+            if (inbox) {
+                const expanded = expandFileMentions(outgoing, ctx.cwd);
+                if (inbox.accept({
+                    prompt,
+                    message: createUserMessage(expanded.sendText, prompt.attachments),
+                    attachedFiles: expanded.attached.length,
+                    queueBoundary: queuedRef.current.length,
+                }))
+                    return;
+            }
+        }
+        enqueueQueued(prompt);
     }, [
         activeSkills,
         advanceQueueContinuation,
@@ -2684,19 +3573,28 @@ export function App({ ctx: initialCtx }) {
         ctx.cwd,
         doResume,
         enqueueQueued,
-        exit,
+        exitWithSummary,
         hasUnsettledTurn,
         nextId,
         pushMessage,
         rawOutput,
+        removeStoredCredential,
         resetTranscript,
+        runConversationExport,
         setChoicePicker,
         setCopyPicker,
         setReasoningEffort,
         slashCtx,
+        stableExportSource,
         startFreshConversation,
         state,
+        stdout.rows,
     ]);
+    // `applyChoiceSelection` is declared before `handleSubmit` because the
+    // picker is also used by review/export flows. Keep only this dispatch hop in
+    // a ref so selecting a help row re-enters the one ordinary slash-command
+    // path instead of growing a second command executor.
+    commandPickerSubmitRef.current = handleSubmit;
     // Keep the footer on the same durable goal record the driver mutates. A ref
     // alone cannot repaint React, so every goal mutation bumps goalDriveVersion;
     // generation/session checks stop a late disk read labelling a resumed chat.
@@ -2749,6 +3647,7 @@ export function App({ ctx: initialCtx }) {
             conversationMutationRef.current ||
             exportingRef.current ||
             compactingRef.current ||
+            textPromptRef.current ||
             choicePickerRef.current ||
             copyPickerRef.current ||
             goalCommandInFlightRef.current) {
@@ -2775,6 +3674,7 @@ export function App({ ctx: initialCtx }) {
                     conversationMutationRef.current ||
                     exportingRef.current ||
                     compactingRef.current ||
+                    textPromptRef.current ||
                     choicePickerRef.current ||
                     copyPickerRef.current ||
                     goalCommandInFlightRef.current ||
@@ -2834,6 +3734,7 @@ export function App({ ctx: initialCtx }) {
         conversationMutation,
         session,
         state,
+        textPrompt,
         choicePicker,
         copyPicker,
         wakeGoalDriver,
@@ -2850,6 +3751,7 @@ export function App({ ctx: initialCtx }) {
             conversationMutationRef.current ||
             exportingRef.current ||
             compactingRef.current ||
+            textPromptRef.current ||
             choicePickerRef.current ||
             copyPickerRef.current ||
             goalCommandInFlightRef.current)
@@ -2866,6 +3768,7 @@ export function App({ ctx: initialCtx }) {
         phase,
         queued,
         queuePause,
+        textPrompt,
         choicePicker,
         copyPicker,
         dequeueQueued,
@@ -2989,8 +3892,8 @@ export function App({ ctx: initialCtx }) {
             setPhase('ready');
             return;
         }
-        exit();
-    }, [session, exit]);
+        exitWithSummary();
+    }, [session, exitWithSummary]);
     useInput((input, key) => {
         // The provider picker owns its own keyboard — arrows, digits, enter,
         // esc and the typed-key screen are all its business. Ctrl+C is not: it
@@ -3006,7 +3909,7 @@ export function App({ ctx: initialCtx }) {
         // and the second exits", with nothing on screen naming either.
         if (phase === 'picker') {
             if (key.ctrl && input === 'c')
-                exit();
+                exitWithSummary();
             return;
         }
         // Previous-prompt picker owns the keyboard. Esc keeps stepping toward
@@ -3019,16 +3922,26 @@ export function App({ ctx: initialCtx }) {
                 setPhase('ready');
                 return;
             }
+            if (key.home || key.end || key.pageUp || key.pageDown) {
+                setSelectedEdit((index) => moveSelection(index, editList.length, key.home
+                    ? 'first'
+                    : key.end
+                        ? 'last'
+                        : key.pageUp
+                            ? 'previous-page'
+                            : 'next-page'));
+                return;
+            }
             if (key.escape || key.leftArrow || key.upArrow) {
-                setSelectedEdit((index) => Math.max(0, index - 1));
+                setSelectedEdit((index) => moveSelection(index, editList.length, 'previous'));
                 return;
             }
             if (key.rightArrow || key.downArrow) {
-                setSelectedEdit((index) => Math.min(editList.length - 1, index + 1));
+                setSelectedEdit((index) => moveSelection(index, editList.length, 'next'));
                 return;
             }
             if (key.return) {
-                const target = editList[selectedEdit];
+                const target = editList[selectedEditRef.current];
                 if (target)
                     void confirmPromptEdit(target);
             }
@@ -3042,12 +3955,21 @@ export function App({ ctx: initialCtx }) {
             // replaced regardless.
             if (resumeCommittedRef.current)
                 return;
-            if (key.upArrow)
-                setSelectedResume((i) => Math.max(0, i - 1));
+            if (key.home || key.end || key.pageUp || key.pageDown) {
+                setSelectedResume((index) => moveSelection(index, resumeList.length, key.home
+                    ? 'first'
+                    : key.end
+                        ? 'last'
+                        : key.pageUp
+                            ? 'previous-page'
+                            : 'next-page'));
+            }
+            else if (key.upArrow)
+                setSelectedResume((index) => moveSelection(index, resumeList.length, 'previous'));
             else if (key.downArrow)
-                setSelectedResume((i) => Math.min(resumeList.length - 1, i + 1));
+                setSelectedResume((index) => moveSelection(index, resumeList.length, 'next'));
             else if (key.return) {
-                const conv = resumeList[selectedResume];
+                const conv = resumeList[selectedResumeRef.current];
                 if (conv)
                     void resumeConversation(conv);
             }
@@ -3064,7 +3986,7 @@ export function App({ ctx: initialCtx }) {
             // and making the escape hatch hesitate on the program's first screen
             // would read as a hang.
             if (ch === 'n' || key.escape || (key.ctrl && input === 'c')) {
-                exit();
+                exitWithSummary();
                 return;
             }
             // Enter is deliberately NOT trust, for the reason it is not approval
@@ -3084,12 +4006,31 @@ export function App({ ctx: initialCtx }) {
         }
         // A pending permission prompt owns the keyboard: y/n/a decide it.
         if (permissionResolveRef.current) {
+            if (permission &&
+                (key.upArrow || key.downArrow || key.pageUp || key.pageDown || key.home || key.end)) {
+                const count = permissionReviewRows(permission.review, stdout.columns).length;
+                const maxOffset = Math.max(0, count - PERMISSION_REVIEW_PAGE_ROWS);
+                const current = Math.min(permissionReviewOffsetRef.current, maxOffset);
+                const next = key.home
+                    ? 0
+                    : key.end
+                        ? maxOffset
+                        : key.pageUp
+                            ? Math.max(0, current - PERMISSION_REVIEW_PAGE_ROWS)
+                            : key.pageDown
+                                ? Math.min(maxOffset, current + PERMISSION_REVIEW_PAGE_ROWS)
+                                : key.upArrow
+                                    ? Math.max(0, current - 1)
+                                    : Math.min(maxOffset, current + 1);
+                setPermissionReviewOffset(next);
+                return;
+            }
             const ch = input.toLowerCase();
             // Refusing is never deferred or gated — it is the direction a
             // mistake is recoverable in, so it answers on the first press.
             if (key.ctrl && input === 'c') {
                 resolvePermission({ kind: 'reject', feedback: 'User interrupted.' });
-                abortRef.current?.abort();
+                abortRef.current?.abort(new RunCancelled('user'));
                 return;
             }
             if (ch === 'n' || key.escape) {
@@ -3110,25 +4051,49 @@ export function App({ ctx: initialCtx }) {
                 resolvePermission({ kind: 'approve-all' });
             return;
         }
+        // A host-owned text prompt has its own input hook. This synchronous ref
+        // claims the interval before React paints it too, so App cannot read a
+        // key repeat as an interrupt, exit ladder, or finite-menu choice.
+        if (textPromptRef.current)
+            return;
         // Finite slash-command choices own the keyboard below a live permission
         // request and above the ordinary composer. Their values are a captured
         // menu, so a provider/session change cannot silently reinterpret Enter.
         if (choicePickerRef.current) {
-            const options = choicePickerRef.current.options;
+            const picker = choicePickerRef.current;
+            // Composer publishes a chooser while handling Return. App receives the
+            // same input dispatch (and key repeat can arrive before the commit), so
+            // the synchronous ref is an ownership fence but not yet an actionable
+            // menu. Only the exact object React committed may consume a choice.
+            if (choicePickerCommittedRef.current !== picker)
+                return;
+            const options = picker.options;
             if (key.escape || (key.ctrl && input === 'c')) {
+                reviewChoiceInFlightRef.current = null;
                 setChoicePicker(null);
                 return;
             }
+            if (key.home || key.end || key.pageUp || key.pageDown) {
+                const pageSize = picker.kind === 'command' ? picker.windowSize : undefined;
+                setSelectedChoice((index) => moveSelection(index, options.length, key.home
+                    ? 'first'
+                    : key.end
+                        ? 'last'
+                        : key.pageUp
+                            ? 'previous-page'
+                            : 'next-page', pageSize));
+                return;
+            }
             if (key.upArrow) {
-                setSelectedChoice((index) => Math.max(0, index - 1));
+                setSelectedChoice((index) => moveSelection(index, options.length, 'previous'));
                 return;
             }
             if (key.downArrow) {
-                setSelectedChoice((index) => Math.min(options.length - 1, index + 1));
+                setSelectedChoice((index) => moveSelection(index, options.length, 'next'));
                 return;
             }
             if (key.return) {
-                applyChoiceSelection(selectedChoice);
+                applyChoiceSelection(selectedChoiceRef.current);
                 return;
             }
             if (/^[1-9]$/.test(input)) {
@@ -3147,16 +4112,26 @@ export function App({ ctx: initialCtx }) {
                 setCopyPicker(null);
                 return;
             }
+            if (key.home || key.end || key.pageUp || key.pageDown) {
+                setSelectedCopy((index) => moveSelection(index, targets.length, key.home
+                    ? 'first'
+                    : key.end
+                        ? 'last'
+                        : key.pageUp
+                            ? 'previous-page'
+                            : 'next-page'));
+                return;
+            }
             if (key.upArrow) {
-                setSelectedCopy((index) => Math.max(0, index - 1));
+                setSelectedCopy((index) => moveSelection(index, targets.length, 'previous'));
                 return;
             }
             if (key.downArrow) {
-                setSelectedCopy((index) => Math.min(targets.length - 1, index + 1));
+                setSelectedCopy((index) => moveSelection(index, targets.length, 'next'));
                 return;
             }
             if (key.return) {
-                sendCopyRequest(selectedCopy);
+                sendCopyRequest(selectedCopyRef.current);
                 return;
             }
             if (/^[1-9]$/.test(input)) {
@@ -3166,6 +4141,19 @@ export function App({ ctx: initialCtx }) {
             }
             return;
         }
+        // Terminal-native display clear. It deliberately shares `/clear-screen`'s
+        // view-only boundary: model history, durable history and the active
+        // conversation remain untouched. A live turn is refused instead of
+        // erasing the only visible account of work that is still changing.
+        if (key.ctrl && input === 'l') {
+            if (state !== 'idle' || abortRef.current || hasUnsettledTurn()) {
+                pushMessage('system', 'Ctrl+L is unavailable while a turn is still in progress.');
+                return;
+            }
+            setMessages([]);
+            resetTranscript();
+            return;
+        }
         // Esc interrupts a running turn (Ctrl+C stays reserved for exit). Mirrors
         // the Ctrl+C interrupt path: abort, drop the queue, one "Interrupted." line.
         if (key.escape && abortRef.current) {
@@ -3225,7 +4213,7 @@ export function App({ ctx: initialCtx }) {
                 return;
             }
             if (exitArmedRef.current) {
-                exit();
+                exitWithSummary();
                 return;
             }
             exitArmedRef.current = true;
@@ -3238,30 +4226,41 @@ export function App({ ctx: initialCtx }) {
     // Active on every phase. It was gated off during the picker, which is what
     // left that screen without a usable exit; the picker branch above returns
     // immediately, so the Picker still owns everything except Ctrl+C.
-    { isActive: true });
+    { isActive: externalEditorRequest === null });
     // Background is left natural — we inherit the terminal's own background
     // and only theme the foreground. Forcing
     // a filled bg left mismatched patches around bordered areas, so we don't.
-    return (_jsx(Box, { flexDirection: "column", children: _jsxs(Box, { flexDirection: "column", paddingX: 1, children: [phase === 'trust' ? (_jsx(TrustPrompt, { cwd: ctx.cwd })) : phase === 'resume' ? (_jsx(ResumePicker, { conversations: resumeList, selected: selectedResume })) : phase === 'edit' ? (_jsx(EditPromptPicker, { prompts: editList, selected: selectedEdit })) : phase === 'picker' ? (_jsx(Picker, { detected: pickerDetected ?? detected, currentProvider: currentProvider, selectionKind: pickerSelectionKind, currentModel: session?.modelSummary ?? null, initialView: pickerInitialView, onSubmit: handlePickerSubmit, onCancel: handlePickerCancel, onCredential: handleTypedCredential, onLogin: startLoginFromPicker, onLoginComplete: finishLoginFromPicker, keyEntryFor: keyEntryFor, notice: pickerNotice })) : (_jsxs(_Fragment, { children: [_jsx(TranscriptFrame, { children: _jsx(Transcript, { messages: finalized, pending: messages.find((m) => m.pending) ?? null, state: state, settled: window.settled, resetKey: resetKey, raw: rawOutput, header: phase === 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : undefined }) }), spacerRows > 0 ? _jsx(Box, { height: spacerRows }) : null, _jsx(LiveActivity, { activeTools: activeTools, thinking: state === 'thinking' && !messages.some((m) => m.pending) }), permission ? (_jsx(PermissionOverlay, { toolCalls: permission.toolCalls })) : choicePicker ? (_jsx(ChoicePicker, { title: choicePicker.title, notice: choicePicker.notice, options: choicePicker.options, selected: selectedChoice })) : copyPicker ? (_jsx(CopyPicker, { targets: copyPicker.targets, selected: selectedCopy })) : null, _jsxs(ComposerFrame, { focus: state === 'idle' &&
+    return (_jsx(Box, { flexDirection: "column", display: externalEditorRequest ? 'none' : 'flex', children: _jsxs(Box, { flexDirection: "column", paddingX: 1, children: [phase === 'trust' ? (_jsx(TrustPrompt, { cwd: ctx.cwd })) : phase === 'resume' ? (_jsx(ResumePicker, { conversations: resumeList, selected: selectedResume })) : phase === 'edit' ? (_jsx(EditPromptPicker, { prompts: editList, selected: selectedEdit })) : phase === 'picker' ? (_jsx(Picker, { detected: pickerDetected ?? detected, currentProvider: currentProvider, selectionKind: pickerSelectionKind, currentModel: session?.modelSummary ?? null, initialView: pickerInitialView, onSubmit: handlePickerSubmit, onCancel: handlePickerCancel, onCredential: handleTypedCredential, onLogin: startLoginFromPicker, onLoginComplete: finishLoginFromPicker, keyEntryFor: keyEntryFor, notice: pickerNotice })) : (_jsxs(_Fragment, { children: [_jsx(TranscriptFrame, { children: _jsx(Transcript, { messages: finalized, pending: messages.find((m) => m.pending) ?? null, state: state, settled: window.settled, resetKey: resetKey, raw: rawOutput, hyperlinks: hyperlinks, header: phase === 'ready' ? (_jsx(Banner, { version: ctx.version, session: session, permissionMode: permissionMode, cwd: ctx.cwd })) : undefined }) }), spacerRows > 0 ? _jsx(Box, { height: spacerRows }) : null, _jsx(LiveActivity, { activeTools: activeTools, thinking: state === 'thinking' && !messages.some((m) => m.pending) }), permission ? (_jsx(PermissionOverlay, { toolCalls: permission.toolCalls, review: permission.review, reviewOffset: permissionReviewOffset, columns: stdout.columns })) : null, textPrompt ? (_jsx(TextPrompt, { title: textPrompt.title, placeholder: textPrompt.placeholder, initialValue: textPrompt.initialValue, emptyNotice: textPrompt.emptyNotice, hidden: permission !== null, onSubmit: submitTextPrompt, onCancel: cancelTextPrompt }, textPrompt.token)) : permission === null && choicePicker ? (_jsx(ChoicePicker, { title: choicePicker.title, notice: choicePicker.notice, options: choicePicker.options, selected: selectedChoice, windowSize: choicePicker.kind === 'command' ? choicePicker.windowSize : undefined })) : permission === null && copyPicker ? (_jsx(CopyPicker, { targets: copyPicker.targets, selected: selectedCopy })) : null, _jsxs(ComposerFrame, { focus: state === 'idle' &&
                                 phase === 'ready' &&
                                 conversationMutation === null &&
+                                textPrompt === null &&
                                 choicePicker === null &&
-                                copyPicker === null, hidden: permission !== null || choicePicker !== null || copyPicker !== null, children: [queued.length > 0 &&
+                                copyPicker === null, hidden: permission !== null || choicePicker !== null || copyPicker !== null, children: [pendingSteers.length > 0 &&
+                                    permission === null &&
+                                    textPrompt === null &&
+                                    choicePicker === null &&
+                                    copyPicker === null ? (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: theme.accent.user, children: ["\u21B3 ", pendingSteers.length, " message", pendingSteers.length > 1 ? 's' : '', " steering the active turn \u2014 waiting for its next response boundary"] }) })) : null, queued.length > 0 &&
                                     permission === null &&
+                                    textPrompt === null &&
                                     choicePicker === null &&
                                     copyPicker === null ? (_jsx(Box, { paddingX: 1, children: _jsxs(Text, { color: theme.text.muted, children: [queuePause ? '⏸' : '⏎', " ", queued.length, " message", queued.length > 1 ? 's' : '', " queued \u2014", ' ', queuePause
                                                 ? `paused after a ${queuePause.outcome} turn; send a message or change model to continue`
                                                 : 'sending when ready'] }) })) : null, _jsx(Composer, { disabled: phase !== 'ready' ||
                                         state === 'awaiting-permission' ||
                                         compacting ||
-                                        conversationMutation !== null, hidden: permission !== null || choicePicker !== null || copyPicker !== null, 
+                                        conversationMutation !== null ||
+                                        externalEditorRequest !== null, hidden: permission !== null ||
+                                        textPrompt !== null ||
+                                        choicePicker !== null ||
+                                        copyPicker !== null, 
                                     // A turn is running, so Esc is the interrupt and not
                                     // the composer's clear.
-                                    escapeInterrupts: !compacting && (state === 'thinking' || state === 'tool'), onSubmit: handleSubmit, onNotice: (text) => pushMessage('system', text), onEditPrevious: openPromptEditor, draftToRestore: composerDraft, onDraftRestored: (token) => setComposerDraft((draft) => (draft?.token === token ? null : draft)), userCommands: userCommands, history: history })] })] })), _jsx(Box, { paddingTop: 1, children: _jsx(StatusBar, { cwd: ctx.cwd, provider: session?.providerSummary ?? null, model: session?.modelSummary ?? null, effort: reasoningEffort ?? 'default', goal: phase === 'ready' &&
+                                    escapeInterrupts: !compacting && (state === 'thinking' || state === 'tool'), onSubmit: handleSubmit, onNotice: (text) => pushMessage('system', text), onStepReasoningEffort: stepReasoningEffort, onExternalEdit: requestExternalEditor, onEditPrevious: openPromptEditor, draftToRestore: composerDraft, onDraftRestored: (token) => setComposerDraft((draft) => (draft?.token === token ? null : draft)), userCommands: userCommands, mentionCandidates: mentionCandidates, history: history })] })] })), _jsx(Box, { paddingTop: 1, children: _jsx(StatusBar, { cwd: ctx.cwd, provider: session?.providerSummary ?? null, model: session?.modelSummary ?? null, effort: reasoningEffort ?? 'default', goal: phase === 'ready' &&
                             state === 'idle' &&
                             conversationMutation === null &&
                             !compacting &&
                             permission === null &&
+                            textPrompt === null &&
                             choicePicker === null &&
                             copyPicker === null
                             ? goalStatusLabel(goalStatus)
@@ -3269,19 +4268,23 @@ export function App({ ctx: initialCtx }) {
                             ? 'forking conversation — input is paused'
                             : conversationMutation === 'edit'
                                 ? 'branching before prompt — input is paused'
-                                : conversationMutation === 'new'
-                                    ? 'starting a fresh conversation — input is paused'
-                                    : compacting
-                                        ? 'compacting conversation — input is paused'
-                                        : permission
-                                            ? hintForPhase(phase, state, session?.hasProvider === true)
-                                            : choicePicker
-                                                ? 'choice open — ↑↓ / 1–9 select · enter apply · esc cancel'
-                                                : copyPicker
-                                                    ? 'copy target open — ↑↓ / 1–9 select · esc cancel'
-                                                    : goalStatus && phase === 'ready' && state === 'idle'
-                                                        ? undefined
-                                                        : hintForPhase(phase, state, session?.hasProvider === true), usage: usage, context: context }) })] }) }));
+                                : conversationMutation === 'archive'
+                                    ? 'archiving conversation — input is paused'
+                                    : conversationMutation === 'new'
+                                        ? 'starting a fresh conversation — input is paused'
+                                        : compacting
+                                            ? 'compacting conversation — input is paused'
+                                            : permission
+                                                ? hintForPhase(phase, state, session?.hasProvider === true)
+                                                : textPrompt
+                                                    ? 'name editor open — enter save · esc cancel'
+                                                    : choicePicker
+                                                        ? 'choice open — ↑↓ / 1–9 select · enter apply · esc cancel'
+                                                        : copyPicker
+                                                            ? 'copy target open — ↑↓ / 1–9 select · esc cancel'
+                                                            : goalStatus && phase === 'ready' && state === 'idle'
+                                                                ? undefined
+                                                                : hintForPhase(phase, state, session?.hasProvider === true), usage: usage, context: context }) })] }) }));
 }
 function Banner({ version, session, permissionMode, cwd, }) {
     const cols = process.stdout.columns ?? 80;
@@ -3336,7 +4339,7 @@ canReturn = false) {
     if (state === 'awaiting-permission')
         return 'y approve · n / esc reject · a approve all';
     if (state !== 'idle')
-        return 'agent is working — esc to interrupt';
+        return 'enter steer · tab queue · esc interrupt';
     // The composer already points to /help. Keeping the complete key legend in
     // every idle frame made ordinary conversation read like a permanent setup
     // screen; only state-specific actions belong in the footer.