@north-light/crouter 0.3.154

package/dist/clients/attach/overlays/mcp.d.ts

@@ -0,0 +1,32 @@
+import type { ClientToBroker } from '../../../core/runtime/broker-protocol.js';
+import type { Picker } from './pickers.js';
+/** One configured MCP server, joined against the adapter's tool cache. */
+export interface McpServerRow {
+    name: string;
+    /** 'http' | 'sse' | 'stdio' — the config's `type`, or inferred (url → http, command → stdio). */
+    transport: string;
+    /** The connection target: the url (http) or the command line (stdio). */
+    target: string;
+    /** Cached tool count, or null when the server has no cache entry (never connected). */
+    toolCount: number | null;
+    /** True when a cache entry exists but its configHash no longer matches the
+     *  current config — the adapter treats that cache as a miss, so the tool
+     *  count is stale. Always false when toolCount is null. */
+    stale: boolean;
+}
+/** Read + merge the adapter's config sources (see file header) and join the
+ *  tool cache into display rows. Returns [] when nothing is configured. */
+export declare function readMcpServers(home?: string, cwd?: string): McpServerRow[];
+/** The hint shown when no source configures any server — lists the same
+ *  sources readMcpServers actually reads (mirroring the adapter). */
+export declare const MCP_EMPTY_STATE_HINT = "No MCP servers configured \u2014 add one to ~/.config/mcp/mcp.json, ~/.pi/agent/mcp.json, <cwd>/.mcp.json, or <cwd>/.pi/mcp.json";
+/** Enter on a row: bridge the right adapter action to the engine via a
+ *  `prompt` frame. Never connected → OAuth kick-off; connected before →
+ *  reconnect, falling back to auth-start (the re-auth path — expired OAuth
+ *  still shows as cached, so reconnect must always be reachable). */
+export declare function startMcpServerAction(row: McpServerRow, send: (frame: ClientToBroker) => void, notify: (message: string) => void): void;
+/** Build the /mcp status panel as an inline picker. Enter on any row acts:
+ *  never-connected → OAuth kick-off, cached → reconnect/re-auth (see
+ *  startMcpServerAction). Status reflects the CACHE — "cached" means the
+ *  server connected before under this config, not that it is connected now. */
+export declare function buildMcpPicker(rows: McpServerRow[], send: (frame: ClientToBroker) => void, close: () => void, notify: (message: string) => void): Picker;

package/dist/clients/attach/overlays/mcp.js

@@ -0,0 +1,310 @@
+// overlays/mcp.ts — the native /mcp panel for `crtr surface attach`.
+//
+// The pi-mcp-adapter's own /mcp is an interactive pi TUI command, DEAD in
+// crtr's print-mode broker — so the viewer renders MCP server status natively,
+// from the adapter's own on-disk state (no MCP protocol reimplementation).
+//
+// Config sources MIRROR the adapter's `getConfigSources` (pi-mcp-adapter
+// config.ts), in the same precedence order (later sources override earlier,
+// field-level merge per server):
+//   1. ~/.config/mcp/mcp.json      (generic user-global standard MCP)
+//   2. <agentDir>/mcp.json         (pi global override — $PI_CODING_AGENT_DIR,
+//                                   else ~/.pi/agent, like the adapter's getAgentPath)
+//   3. <cwd>/.mcp.json             (project standard MCP)
+//   4. <cwd>/.pi/mcp.json          (project pi override)
+// Each file may name servers under `mcpServers` OR the `mcp-servers` alias,
+// and may declare `imports` (cursor / claude-code / claude-desktop / codex /
+// windsurf / vscode) whose servers merge UNDER the file's own entries —
+// all mirroring the adapter's validateConfig/expandImports/extractServers
+// (incl. the alias being honored only for cursor/windsurf/vscode imports, and
+// a non-object `mcpServers` invalidating a file's own imports too).
+//
+// Status joins <agentDir>/mcp-cache.json (the adapter's tool cache). A cache
+// entry means the server has CONNECTED BEFORE — it does NOT prove live
+// connectivity or valid auth. The entry is validated like the adapter's
+// `isServerCacheValid`: its `configHash` is compared against a local
+// recomputation of `computeServerHash`, AND an entry older than 7 days is a
+// miss; either failure marks the row stale. (The hash interpolates env vars from THIS process — a viewer whose
+// env differs from the engine's can report a false "config changed", which
+// only softens the wording, never hides a server.)
+//
+// All reads are best-effort: a missing/corrupt file degrades to an empty
+// state, never a crash.
+//
+// The action: Enter bridges to the ENGINE (the adapter runtime lives in the
+// engine process, unreachable from the viewer) by sending a `prompt` frame —
+// a never-connected server gets an OAuth kick-off (mcp({ action:
+// "auth-start", server })), a previously-connected one gets a reconnect with
+// auth-start as the fallback, covering the re-auth case (expired OAuth shows
+// as cached but fails to reconnect). Action names verified against the
+// installed adapter (pi-mcp-adapter index.ts: "auth-start" / "auth-complete" /
+// "ui-messages"; `connect: <name>`).
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { piAgentDir } from '../../../core/runtime/package-health.js';
+import { SelectList, visibleWidth } from '@earendil-works/pi-tui';
+import { getSelectListTheme } from '@earendil-works/pi-coding-agent';
+/** Adapter metadata-cache.ts CACHE_MAX_AGE_MS — entries older than this are misses. */
+const CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/** The adapter's import-source table (pi-mcp-adapter config.ts IMPORT_PATHS).
+ *  Relative candidates (vscode) resolve against the cwd. */
+function importPathCandidates(kind, home) {
+    switch (kind) {
+        case 'cursor':
+            return [join(home, '.cursor', 'mcp.json')];
+        case 'claude-code':
+            return [
+                join(home, '.claude', 'mcp.json'),
+                join(home, '.claude.json'),
+                join(home, '.claude', 'claude_desktop_config.json'),
+            ];
+        case 'claude-desktop':
+            return [join(home, 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json')];
+        case 'codex':
+            return [join(home, '.codex', 'config.json')];
+        case 'windsurf':
+            return [join(home, '.windsurf', 'mcp.json')];
+        case 'vscode':
+            return ['.vscode/mcp.json'];
+        default:
+            return [];
+    }
+}
+function readJson(path) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null; // missing or corrupt → empty state, never a crash
+    }
+}
+/** Mirror of the adapter's validateConfig (config.ts): a source file's own
+ *  servers may live under `mcpServers` OR the `mcp-servers` alias — but a
+ *  non-object value invalidates the WHOLE file, dropping its `imports` too. */
+function validateConfigSource(raw) {
+    const servers = raw.mcpServers ?? raw['mcp-servers'] ?? {};
+    if (typeof servers !== 'object' || servers === null || Array.isArray(servers)) {
+        return { servers: {}, imports: [] };
+    }
+    return {
+        servers: servers,
+        imports: Array.isArray(raw.imports) ? raw.imports : [],
+    };
+}
+/** Mirror of the adapter's extractServers (config.ts): the `mcp-servers`
+ *  alias is honored only for cursor/windsurf/vscode imports —
+ *  claude-code/claude-desktop/codex read `mcpServers` only. */
+function extractImportedServers(raw, kind) {
+    if (!raw || typeof raw !== 'object')
+        return {};
+    const obj = raw;
+    let servers;
+    switch (kind) {
+        case 'claude-desktop':
+        case 'claude-code':
+        case 'codex':
+            servers = obj.mcpServers;
+            break;
+        case 'cursor':
+        case 'windsurf':
+        case 'vscode':
+            servers = obj.mcpServers ?? obj['mcp-servers'];
+            break;
+        default:
+            return {};
+    }
+    if (!servers || typeof servers !== 'object' || Array.isArray(servers))
+        return {};
+    return servers;
+}
+/** Field-level per-server merge — the adapter's mergeServerMaps. */
+function mergeServerMaps(base, next) {
+    const merged = { ...base };
+    for (const [name, spec] of Object.entries(next)) {
+        merged[name] = { ...(merged[name] ?? {}), ...spec };
+    }
+    return merged;
+}
+/** Read one config file: its own servers layered OVER any `imports` servers
+ *  (first import wins per name, own config wins overall — adapter expandImports). */
+function readConfigSource(path, cwd, home) {
+    const raw = readJson(path);
+    if (raw === null)
+        return {};
+    const { servers: own, imports } = validateConfigSource(raw);
+    const imported = {};
+    for (const kind of imports) {
+        // The adapter's resolveImportPath selects the first EXISTING candidate
+        // (existsSync) and only then reads it — a corrupt first candidate yields
+        // nothing for this import kind, never a fall-through to the next path.
+        const full = importPathCandidates(kind, home)
+            .map((candidate) => (candidate.startsWith('.') ? resolve(cwd, candidate) : candidate))
+            .find((candidate) => existsSync(candidate));
+        if (full === undefined)
+            continue;
+        const importedRaw = readJson(full);
+        if (importedRaw === null)
+            continue;
+        for (const [name, spec] of Object.entries(extractImportedServers(importedRaw, kind))) {
+            if (!(name in imported))
+                imported[name] = spec;
+        }
+    }
+    return mergeServerMaps(imported, own);
+}
+// --- configHash recomputation — mirrors pi-mcp-adapter metadata-cache.ts ----
+function interpolateEnvVars(value) {
+    return value
+        .replace(/\$\{(\w+)\}/g, (_, name) => process.env[name] ?? '')
+        .replace(/\$env:(\w+)/g, (_, name) => process.env[name] ?? '');
+}
+function interpolateEnvRecord(values) {
+    if (!values)
+        return undefined;
+    const resolved = {};
+    for (const [key, value] of Object.entries(values))
+        resolved[key] = interpolateEnvVars(value);
+    return resolved;
+}
+function resolveConfigPath(value) {
+    if (value === undefined)
+        return undefined;
+    const resolved = interpolateEnvVars(value);
+    if (resolved === '~')
+        return homedir();
+    if (resolved.startsWith('~/') || resolved.startsWith('~\\'))
+        return join(homedir(), resolved.slice(2));
+    return resolved;
+}
+function resolveBearerToken(spec) {
+    if (spec.bearerToken !== undefined)
+        return interpolateEnvVars(spec.bearerToken);
+    return spec.bearerTokenEnv ? process.env[spec.bearerTokenEnv] : undefined;
+}
+function stableStringify(value) {
+    if (value === null || value === undefined || typeof value !== 'object') {
+        const serialized = JSON.stringify(value);
+        return serialized === undefined ? 'undefined' : serialized;
+    }
+    if (Array.isArray(value))
+        return `[${value.map((v) => stableStringify(v)).join(',')}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(',')}}`;
+}
+/** The adapter's computeServerHash: sha256 over the identity fields only. */
+function computeServerHash(spec) {
+    const identity = {
+        command: spec.command,
+        args: spec.args,
+        env: interpolateEnvRecord(spec.env),
+        cwd: resolveConfigPath(spec.cwd),
+        url: spec.url,
+        headers: interpolateEnvRecord(spec.headers),
+        auth: spec.auth,
+        bearerToken: resolveBearerToken(spec),
+        bearerTokenEnv: spec.bearerTokenEnv,
+        exposeResources: spec.exposeResources,
+        excludeTools: spec.excludeTools,
+    };
+    return createHash('sha256').update(stableStringify(identity)).digest('hex');
+}
+// ---------------------------------------------------------------------------
+/** Read + merge the adapter's config sources (see file header) and join the
+ *  tool cache into display rows. Returns [] when nothing is configured. */
+export function readMcpServers(home = homedir(), cwd = process.cwd()) {
+    // The pi-global config AND the tool cache live in the agent dir, which
+    // honors $PI_CODING_AGENT_DIR — piAgentDir mirrors the adapter's getAgentDir.
+    const agentDir = piAgentDir(home);
+    const sourcePaths = [...new Set([
+            join(home, '.config', 'mcp', 'mcp.json'),
+            join(agentDir, 'mcp.json'),
+            resolve(cwd, '.mcp.json'),
+            resolve(cwd, '.pi', 'mcp.json'),
+        ])];
+    let servers = {};
+    for (const path of sourcePaths) {
+        servers = mergeServerMaps(servers, readConfigSource(path, cwd, home));
+    }
+    const cache = readJson(join(agentDir, 'mcp-cache.json'));
+    return Object.entries(servers).map(([name, spec]) => {
+        const transport = spec.type ?? (spec.url !== undefined ? 'http' : 'stdio');
+        const target = spec.url ?? [spec.command, ...(spec.args ?? [])].filter(Boolean).join(' ');
+        const entry = cache?.servers?.[name];
+        const tools = entry?.tools;
+        const toolCount = Array.isArray(tools) ? tools.length : null;
+        const stale = toolCount !== null && entry !== undefined && !isCacheEntryFresh(entry, spec);
+        return { name, transport, target, toolCount, stale };
+    });
+}
+/** Mirror of the adapter's isServerCacheValid (metadata-cache.ts): a hash
+ *  mismatch, a missing/invalid cachedAt, or an entry older than
+ *  CACHE_MAX_AGE_MS is a cache miss — the adapter would refetch. */
+function isCacheEntryFresh(entry, spec) {
+    if (entry.configHash !== computeServerHash(spec))
+        return false;
+    if (!entry.cachedAt || typeof entry.cachedAt !== 'number')
+        return false;
+    if (Date.now() - entry.cachedAt > CACHE_MAX_AGE_MS)
+        return false;
+    return true;
+}
+/** The hint shown when no source configures any server — lists the same
+ *  sources readMcpServers actually reads (mirroring the adapter). */
+export const MCP_EMPTY_STATE_HINT = 'No MCP servers configured — add one to ~/.config/mcp/mcp.json, ~/.pi/agent/mcp.json, <cwd>/.mcp.json, or <cwd>/.pi/mcp.json';
+/** Enter on a row: bridge the right adapter action to the engine via a
+ *  `prompt` frame. Never connected → OAuth kick-off; connected before →
+ *  reconnect, falling back to auth-start (the re-auth path — expired OAuth
+ *  still shows as cached, so reconnect must always be reachable). */
+export function startMcpServerAction(row, send, notify) {
+    const nameJson = JSON.stringify(row.name);
+    if (row.toolCount === null) {
+        send({
+            type: 'prompt',
+            text: `Run mcp({ action: "auth-start", server: ${nameJson} }) and show me the returned OAuth URL verbatim (with any instructions). If the server does not need OAuth, run mcp({ connect: ${nameJson} }) instead and report the result.`,
+        });
+        notify(`Asking the engine to start OAuth for ${row.name}…`);
+    }
+    else {
+        send({
+            type: 'prompt',
+            text: `Run mcp({ connect: ${nameJson} }) to reconnect that MCP server and report the result. If it fails with an authentication or authorization error, run mcp({ action: "auth-start", server: ${nameJson} }) and show me the returned OAuth URL verbatim (with any instructions).`,
+        });
+        notify(`Asking the engine to reconnect ${row.name}…`);
+    }
+}
+/** Build the /mcp status panel as an inline picker. Enter on any row acts:
+ *  never-connected → OAuth kick-off, cached → reconnect/re-auth (see
+ *  startMcpServerAction). Status reflects the CACHE — "cached" means the
+ *  server connected before under this config, not that it is connected now. */
+export function buildMcpPicker(rows, send, close, notify) {
+    const items = rows.map((r) => ({
+        value: r.name,
+        label: r.toolCount === null
+            ? `○ ${r.name} — ${r.transport} · never connected (Enter to connect/OAuth)`
+            : r.stale
+                ? `△ ${r.name} — ${r.transport} · config changed — ${r.toolCount} tool${r.toolCount === 1 ? '' : 's'} cached, stale (Enter to reconnect)`
+                : `✓ ${r.name} — ${r.transport} · ${r.toolCount} tool${r.toolCount === 1 ? '' : 's'} cached (Enter to reconnect)`,
+        description: r.target,
+    }));
+    // Widen the primary column past the 30-cell default so the status labels
+    // aren't truncated mid-word. visibleWidth (not .length) so wide/emoji server
+    // names measure in cells, matching what SelectList itself renders. Math.max
+    // is floored at 0 so an empty rows array stays locally safe (-Infinity guard).
+    const width = Math.max(0, ...items.map((i) => visibleWidth(i.label))) + 2;
+    const list = new SelectList(items, 12, getSelectListTheme(), {
+        minPrimaryColumnWidth: width,
+        maxPrimaryColumnWidth: width,
+    });
+    list.onSelect = (item) => {
+        const row = rows.find((r) => r.name === item.value);
+        if (row === undefined)
+            return;
+        close();
+        startMcpServerAction(row, send, notify);
+    };
+    list.onCancel = () => close();
+    return { component: list, focus: list };
+}

package/dist/clients/attach/overlays/pickers.d.ts

@@ -0,0 +1,59 @@
+import { type Component, type KeybindingsManager, type TUI } from '@earendil-works/pi-tui';
+import type { ClientToBroker, GetSettingsData, GetTreeData, ListModelsData, ListScopedModelsData } from '../../../core/runtime/broker-protocol.js';
+import type { ReadOpRequest } from '../../../core/broker-client/index.js';
+/** A built picker overlay: the `component` to show, and the `focus` target the
+ *  caller must `setFocus` (the component itself, or the inner list that owns
+ *  `handleInput`). */
+export interface Picker {
+    component: Component;
+    focus: Component;
+}
+/** Controls handed to a picker builder by InputController.showPicker. `close`
+ *  tears the whole picker down + restores editor focus; `replace` swaps the
+ *  CURRENTLY-mounted component for a new one IN THE SAME inline slot (no centered
+ *  overlay), focusing it — used by multi-step flows like /login, where selecting
+ *  a provider replaces the selector with the login dialog right under the editor. */
+export interface PickerControls {
+    close: () => void;
+    replace: (component: Component, focus: Component) => void;
+}
+/** Send a command frame to the broker (= InputController hooks.onCommand). */
+type Send = (frame: ClientToBroker) => void;
+/** Issue a correlated read-op (lazy loaders need it after construction). */
+type Request = (frame: ReadOpRequest) => Promise<unknown>;
+/** Tear the picker overlay down (owned by InputController). */
+type Close = () => void;
+/** Surface a one-line viewer notice. */
+type Notify = (message: string) => void;
+/** `/model` (and ctrl+l) — the real model selector with search + scope toggle.
+ *  Select → `set_model` with the resolved `provider/id` (the broker's
+ *  `findModelSpec` requires that form). */
+export declare function buildModelPicker(tui: TUI, data: ListModelsData, send: Send, close: Close): Picker;
+/** `/resume` — the real session selector. Opens INSTANTLY and reconstructs from
+ *  async loaders that fetch each scope on demand — the component's own Loading
+ *  header covers the scan (listing a large session dir takes seconds, so the
+ *  fetch must stay off the open path). Select → `switch_session`. Rename/delete
+ *  are out of scope (no command frame). */
+export declare function buildSessionPicker(tui: TUI, currentSessionFile: string | undefined, request: Request, keybindings: KeybindingsManager, send: Send, close: Close): Picker;
+/** `/tree` — the real tree navigator (pure data). Select → `navigate_tree`.
+ *  Label-edit is out of scope (no command frame) → no `onLabelChange`. */
+export declare function buildTreePicker(tui: TUI, data: GetTreeData, send: Send, close: Close): Picker;
+/** `/fork` — the real prior-user-message selector (pure data, from
+ *  `get_tree.forkPoints`). Select → `fork`. The outer component has no
+ *  `handleInput`; the inner `getMessageList()` does (focus target). */
+export declare function buildForkPicker(data: GetTreeData, send: Send, close: Close): Picker;
+/** `/settings` — the real settings menu (the wire `settings` IS a SettingsConfig
+ *  superset). Only the contract-enumerated mutations are wired: thinking level →
+ *  `set_thinking_level`, auto-compact → `set_auto_compaction`. Every other toggle
+ *  has no command frame (out of scope), so its callback notifies rather than
+ *  silently lying that the change took. The theme submenu is viewer-local (CTO).
+ *  The outer component has no `handleInput`; `getSettingsList()` is the focus
+ *  target. */
+export declare function buildSettingsPicker(data: GetSettingsData, send: Send, close: Close, notify: Notify): Picker;
+/** `/scoped-models` — READ-ONLY via a pi-tui SelectList. CONTRACT GAP: pi (through
+ *  0.79.1) does not re-export `ScopedModelsSelectorComponent`, and the contract
+ *  exposes no command frame for its enable/disable/persist mutations, so a
+ *  faithful editable picker is not buildable in scope. This shows the registry
+ *  with the enabled set marked; select notifies that toggling is unsupported. */
+export declare function buildScopedModelsPicker(data: ListScopedModelsData, close: Close, notify: Notify): Picker;
+export {};

package/dist/clients/attach/overlays/pickers.js

@@ -0,0 +1,170 @@
+// overlays/pickers.ts — native interactive pickers for `crtr surface attach`, built against the
+// operator-view wire contract (broker read-op `data` frames). Each builder turns
+// a serialized picker payload into the REAL pi `*SelectorComponent`, wired so a
+// selection dispatches the SAME command frame the text-arg slash path sends and
+// `close()` tears the overlay down. InputController owns the overlay lifecycle
+// (showOverlay/dismiss/focus) and the async data fetch; these are pure builders.
+//
+// FOCUS (load-bearing): some selectors put `handleInput` on an INNER list, not
+// the outer Container (UserMessageSelectorComponent → getMessageList(),
+// SettingsSelectorComponent → getSettingsList()). pi-tui drops every keystroke
+// when the focused component has no `handleInput`, so each builder returns BOTH
+// the overlay `component` AND the `focus` target the caller must focus — exactly
+// as pi's own interactive-mode does (`{ component, focus }`).
+//
+// R1 (contract): the tree/fork/settings payloads are PURE DATA — their selectors
+// build verbatim, no reconstruction. The MODEL picker's `ModelSelectorComponent`
+// needs a live `ModelRuntime`/`SettingsManager`: we feed the REAL component a
+// minimal in-memory `SettingsManager` plus a tiny `ModelRuntime` adapter (the
+// component calls only getAvailableSnapshot/getModel/getError/refresh — verified
+// against model-selector.js), preserving its full search + scope-toggle UI without
+// crossing engine state over the socket. The SESSION picker reconstructs
+// faithfully from async loaders (no shim). The SCOPED-MODELS component is NOT
+// re-exported by pi (through 0.79.1) AND has no mutation frame in the contract,
+// so it renders read-only via a pi-tui SelectList.
+//
+// The duck-typed runtime adapter relies on the component's current 4-method
+// ModelRuntime surface — a future pi adding a runtime call there would surface at
+// runtime (caught by live verification).
+import { SelectList, } from '@earendil-works/pi-tui';
+import { getSelectListTheme, ModelSelectorComponent, SessionSelectorComponent, SettingsSelectorComponent, TreeSelectorComponent, UserMessageSelectorComponent, SettingsManager, } from '@earendil-works/pi-coding-agent';
+/** A minimal `ModelRuntime` for `ModelSelectorComponent`: the component calls
+ *  only `getAvailableSnapshot()`, `getModel()`, `getError()`, and `refresh()`
+ *  (verified against pi `model-selector.js`). We satisfy exactly those from the
+ *  wire payload — no auth/runtime state crosses the socket — and cast to the
+ *  nominal class the ctor wants. `refresh()` is a no-op that reports a clean
+ *  result: the viewer holds a snapshot, and a catalog refresh belongs to the
+ *  broker that owns the real runtime. */
+function modelRuntimeAdapter(all, available) {
+    const adapter = {
+        getAvailableSnapshot() {
+            return available;
+        },
+        getModel(provider, id) {
+            return all.find((m) => m.provider === provider && m.id === id);
+        },
+        getError() {
+            return undefined;
+        },
+        async refresh() {
+            return { aborted: false, errors: new Map() };
+        },
+    };
+    return adapter;
+}
+/** `/model` (and ctrl+l) — the real model selector with search + scope toggle.
+ *  Select → `set_model` with the resolved `provider/id` (the broker's
+ *  `findModelSpec` requires that form). */
+export function buildModelPicker(tui, data, send, close) {
+    const all = data.models;
+    const availableSet = new Set(data.availableIds);
+    const available = all.filter((m) => availableSet.has(`${m.provider}/${m.id}`));
+    const current = data.current
+        ? all.find((m) => m.provider === data.current.provider && m.id === data.current.id)
+        : undefined;
+    const component = new ModelSelectorComponent(tui, current, SettingsManager.inMemory(), modelRuntimeAdapter(all, available), data.scopedModels, (model) => {
+        send({ type: 'set_model', model: `${model.provider}/${model.id}` });
+        close();
+    }, () => close());
+    return { component, focus: component };
+}
+/** `/resume` — the real session selector. Opens INSTANTLY and reconstructs from
+ *  async loaders that fetch each scope on demand — the component's own Loading
+ *  header covers the scan (listing a large session dir takes seconds, so the
+ *  fetch must stay off the open path). Select → `switch_session`. Rename/delete
+ *  are out of scope (no command frame). */
+export function buildSessionPicker(tui, currentSessionFile, request, keybindings, send, close) {
+    const revive = (d) => d.sessions.map((s) => ({ ...s, created: new Date(s.created), modified: new Date(s.modified) }));
+    const loader = (scope) => async () => revive((await request({ type: 'list_sessions', scope })));
+    const component = new SessionSelectorComponent(loader('cwd'), loader('all'), (path) => {
+        send({ type: 'switch_session', path });
+        close();
+    }, () => close(), () => close(), () => tui.requestRender(), { showRenameHint: false, keybindings: keybindings }, currentSessionFile);
+    return { component, focus: component };
+}
+/** `/tree` — the real tree navigator (pure data). Select → `navigate_tree`.
+ *  Label-edit is out of scope (no command frame) → no `onLabelChange`. */
+export function buildTreePicker(tui, data, send, close) {
+    const terminalHeight = process.stdout.rows ?? 24;
+    const component = new TreeSelectorComponent(data.tree, data.currentLeafId, terminalHeight, (entryId) => {
+        send({ type: 'navigate_tree', targetId: entryId });
+        close();
+    }, () => close());
+    return { component, focus: component };
+}
+/** `/fork` — the real prior-user-message selector (pure data, from
+ *  `get_tree.forkPoints`). Select → `fork`. The outer component has no
+ *  `handleInput`; the inner `getMessageList()` does (focus target). */
+export function buildForkPicker(data, send, close) {
+    const component = new UserMessageSelectorComponent(data.forkPoints, (entryId) => {
+        send({ type: 'fork', entryId });
+        close();
+    }, () => close());
+    return { component, focus: component.getMessageList() };
+}
+/** `/settings` — the real settings menu (the wire `settings` IS a SettingsConfig
+ *  superset). Only the contract-enumerated mutations are wired: thinking level →
+ *  `set_thinking_level`, auto-compact → `set_auto_compaction`. Every other toggle
+ *  has no command frame (out of scope), so its callback notifies rather than
+ *  silently lying that the change took. The theme submenu is viewer-local (CTO).
+ *  The outer component has no `handleInput`; `getSettingsList()` is the focus
+ *  target. */
+export function buildSettingsPicker(data, send, close, notify) {
+    const out = () => notify('Only thinking level + auto-compaction are adjustable over view.sock');
+    const callbacks = {
+        onThinkingLevelChange: (level) => send({ type: 'set_thinking_level', level }),
+        onAutoCompactChange: (enabled) => send({ type: 'set_auto_compaction', enabled }),
+        onCancel: () => close(),
+        onShowImagesChange: out,
+        onImageWidthCellsChange: out,
+        onAutoResizeImagesChange: out,
+        onBlockImagesChange: out,
+        onEnableSkillCommandsChange: out,
+        onSteeringModeChange: out,
+        onFollowUpModeChange: out,
+        onTransportChange: out,
+        onHttpIdleTimeoutMsChange: out,
+        onThemeChange: out,
+        onHideThinkingBlockChange: out,
+        onCollapseChangelogChange: out,
+        onEnableInstallTelemetryChange: out,
+        onDoubleEscapeActionChange: out,
+        onTreeFilterModeChange: out,
+        onShowHardwareCursorChange: out,
+        onEditorPaddingXChange: out,
+        onAutocompleteMaxVisibleChange: out,
+        onQuietStartupChange: out,
+        onDefaultProjectTrustChange: out,
+        onClearOnShrinkChange: out,
+        onShowTerminalProgressChange: out,
+        onWarningsChange: out,
+        onShowCacheMissNoticesChange: out,
+        onOutputPadChange: out,
+    };
+    const component = new SettingsSelectorComponent(data.settings, callbacks);
+    return { component, focus: component.getSettingsList() };
+}
+/** `/scoped-models` — READ-ONLY via a pi-tui SelectList. CONTRACT GAP: pi (through
+ *  0.79.1) does not re-export `ScopedModelsSelectorComponent`, and the contract
+ *  exposes no command frame for its enable/disable/persist mutations, so a
+ *  faithful editable picker is not buildable in scope. This shows the registry
+ *  with the enabled set marked; select notifies that toggling is unsupported. */
+export function buildScopedModelsPicker(data, close, notify) {
+    const enabled = data.enabledModelIds;
+    const isEnabled = (m) => {
+        if (enabled === null)
+            return true; // null = no scoping, every model cycles
+        const ref = `${m.provider}/${m.id}`;
+        return enabled.includes(ref) || enabled.includes(m.id) || enabled.includes('*');
+    };
+    const items = data.allModels.map((m) => ({
+        value: `${m.provider}/${m.id}`,
+        label: `${isEnabled(m) ? '✓' : ' '} ${m.provider}/${m.id}`,
+        description: m.name,
+    }));
+    const theme = getSelectListTheme();
+    const list = new SelectList(items, 12, theme);
+    list.onSelect = () => notify("Enabling/disabling scoped models isn't supported over view.sock yet");
+    list.onCancel = () => close();
+    return { component: list, focus: list };
+}