@pellux/goodvibes-tui 1.0.0 → 1.1.0

package/src/core/stream-stall-watchdog.ts

@@ -1,15 +1,26 @@
 /**
- * StreamStallWatchdog — detects STREAM_START events where no STREAM_DELTA
- * arrives within a configurable threshold, and emits a single low-priority
- * hint to the user.
+ * StreamStallWatchdog — detects gaps of silence (no STREAM_DELTA) longer than
+ * a configurable threshold, whether the gap is at the start of a turn or in
+ * the middle of an otherwise-flowing stream, and emits a low-priority hint
+ * each time a gap crosses the threshold.
  *
  * Design:
- *   - Arm on STREAM_START: set a timeout for STALL_THRESHOLD_MS.
- *   - Disarm on STREAM_DELTA: clear the pending timeout (stream is alive).
+ *   - Arm on STREAM_START: reset the episode counter, set a timeout for
+ *     STALL_THRESHOLD_MS.
+ *   - Re-arm on STREAM_DELTA: every byte received resets the no-delta clock,
+ *     so a stall that begins mid-stream (after tokens were already flowing)
+ *     is caught just as reliably as a stall at turn start. This is the fix
+ *     for the "silence after the first delta never re-triggers" gap: the
+ *     previous behaviour disarmed permanently on the first STREAM_DELTA,
+ *     which meant a multi-minute stall after output had already started
+ *     produced zero indication.
  *   - Disarm on STREAM_END / TURN_COMPLETED / TURN_ERROR / TURN_CANCEL:
  *     clear the timeout (turn finished normally or with error).
- *   - If the timeout fires: emit ONE hint, do NOT repeat until the next turn.
- *   - Re-arm only on the next STREAM_START (next turn).
+ *   - If the timeout fires: emit ONE hint for that episode (do not repeat
+ *     while the same gap continues), then wait for the gap to close (another
+ *     STREAM_DELTA/STREAM_START) before a further silence can fire again —
+ *     each such re-arm-then-timeout cycle is a new "stall episode" and the
+ *     episode counter passed to onStall increments each time.
  *   - dispose(): clears all subscriptions and any pending timeout.
  *
  * @module
@@ -32,10 +43,13 @@ export interface StreamStallWatchdogOptions {
   /** The turns event surface to subscribe on. */
   events: WatchdogTurnEvents;
   /**
-   * Called once per turn when the stall threshold is exceeded.
-   * Receives the provider display name for the hint message.
+   * Called once per stall episode when the no-delta threshold is exceeded.
+   * Receives the provider display name and a 1-based episode counter that
+   * increments each time a new silence (after a re-arm) crosses the
+   * threshold within the same turn — so a second mid-stream stall after a
+   * recovery is distinguishable from the first.
    */
-  onStall: (providerName: string) => void;
+  onStall: (providerName: string, episode: number) => void;
   /**
    * Provides the current provider display name at the moment the hint fires.
    * Optional — defaults to 'provider' when not supplied.
@@ -63,17 +77,19 @@ export function createStreamStallWatchdog(opts: StreamStallWatchdogOptions): Str
   const { events, onStall, getProviderName, thresholdMs = STALL_THRESHOLD_MS } = opts;
 
   let stallTimer: ReturnType<typeof setTimeout> | null = null;
-  let hintFiredForTurn = false;
+  let hintFiredForEpisode = false;
+  let episodeCount = 0;
 
   function arm(): void {
     disarm();
-    hintFiredForTurn = false;
+    hintFiredForEpisode = false;
     stallTimer = setTimeout(() => {
       stallTimer = null;
-      if (!hintFiredForTurn) {
-        hintFiredForTurn = true;
+      if (!hintFiredForEpisode) {
+        hintFiredForEpisode = true;
+        episodeCount++;
         const provider = getProviderName ? getProviderName() : 'provider';
-        onStall(provider);
+        onStall(provider, episodeCount);
       }
     }, thresholdMs);
   }
@@ -85,9 +101,17 @@ export function createStreamStallWatchdog(opts: StreamStallWatchdogOptions): Str
     }
   }
 
+  function onStreamStart(): void {
+    episodeCount = 0;
+    arm();
+  }
+
   const unsubs: Array<() => void> = [
-    events.on('STREAM_START', arm),
-    events.on('STREAM_DELTA', disarm),
+    events.on('STREAM_START', onStreamStart),
+    // Re-arm (not disarm) on every delta: the no-delta clock must reset on
+    // each byte so a stall that starts mid-stream is still caught, not just
+    // a stall before the first byte.
+    events.on('STREAM_DELTA', arm),
     events.on('STREAM_END', disarm),
     events.on('TURN_COMPLETED', disarm),
     events.on('TURN_ERROR', disarm),

package/src/export/cost-utils.ts

@@ -1,13 +1,38 @@
 // ---------------------------------------------------------------------------
 // cost-utils — canonical pricing source for token cost calculations (consumed by CostTrackerPanel and share-runtime)
+//
+// Pricing resolution order (resolvePricing):
+//   1. `:free` suffix (OpenRouter free-tier convention) — always priced at $0.
+//   2. The live SDK model catalog, when a source has been wired via
+//      setPricingSource() (bootstrap-core.ts wires ProviderRegistry.getRawCatalogModels()
+//      once catalog init completes) — exact id match, then prefix/substring.
+//   3. STATIC_FALLBACK_PRICING — a small hand-maintained safety net for common
+//      frontier models, used when the catalog has no source wired (e.g. tests)
+//      or hasn't matched (catalog not yet loaded, or a model this net covers
+//      that the catalog happens to miss).
+//   4. Unpriced: the model is genuinely unknown to every source above. This is
+//      reported explicitly via `priced: false` so consumers can render an
+//      honest "unpriced" state instead of a silent $0.
 // ---------------------------------------------------------------------------
 
+import type { CatalogModel } from '@pellux/goodvibes-sdk/platform/providers';
+
 export interface ModelPricing {
   input: number;
   output: number;
 }
 
-const MODEL_PRICING: Record<string, ModelPricing> = {
+/** Result of a pricing lookup: the resolved (possibly zero) price, and whether it's real. */
+export interface PricingResult {
+  pricing: ModelPricing;
+  /** False when no source (catalog or static fallback) recognized the model — the zero pricing is a placeholder, not a real price. */
+  priced: boolean;
+}
+
+// Hand-maintained safety net, used only when the live catalog has no source
+// wired or does not recognize the model. NOT the primary pricing source —
+// see resolvePricing() below.
+const STATIC_FALLBACK_PRICING: Record<string, ModelPricing> = {
   // Free tier
   'openrouter/free': { input: 0, output: 0 },
 
@@ -34,17 +59,71 @@ const MODEL_PRICING: Record<string, ModelPricing> = {
   'gemini-2.5-pro':        { input: 1.25,  output: 5 },
 };
 
+// Module-level injection point. Kept as a bare singleton (not threaded through
+// call sites) because the 9 existing consumers are pure functions with no
+// ProviderRegistry in scope; see WO-315 brief for the tradeoff. Tests that
+// never call setPricingSource() fall through to the static-fallback path,
+// which keeps them isolated from catalog state by default.
+let pricingSource: (() => readonly CatalogModel[]) | null = null;
+
+/** Wire (or clear, with null) the live catalog as the primary pricing source. */
+export function setPricingSource(source: (() => readonly CatalogModel[]) | null): void {
+  pricingSource = source;
+}
+
+function findInCatalog(modelId: string, models: readonly CatalogModel[]): ModelPricing | null {
+  const exact = models.find((m) => m.id === modelId);
+  if (exact) return exact.tier === 'free' ? { input: 0, output: 0 } : exact.pricing;
+  for (const m of models) {
+    if (modelId.startsWith(m.id) || modelId.includes(m.id)) {
+      return m.tier === 'free' ? { input: 0, output: 0 } : m.pricing;
+    }
+  }
+  return null;
+}
+
+function findInStaticFallback(modelId: string): ModelPricing | null {
+  const exact = STATIC_FALLBACK_PRICING[modelId];
+  if (exact) return exact;
+  for (const [key, pricing] of Object.entries(STATIC_FALLBACK_PRICING)) {
+    if (modelId.startsWith(key) || modelId.includes(key)) return pricing;
+  }
+  return null;
+}
+
+/**
+ * resolvePricing — resolve USD-per-1M-token pricing for a model ID, and
+ * whether that pricing is real (vs. an unpriced placeholder). See the module
+ * header for the full resolution order.
+ */
+export function resolvePricing(modelId: string): PricingResult {
+  if (modelId.endsWith(':free')) return { pricing: { input: 0, output: 0 }, priced: true };
+
+  const models = pricingSource?.() ?? [];
+  const catalogHit = findInCatalog(modelId, models);
+  if (catalogHit) return { pricing: catalogHit, priced: true };
+
+  const fallbackHit = findInStaticFallback(modelId);
+  if (fallbackHit) return { pricing: fallbackHit, priced: true };
+
+  // Genuinely unknown — no source recognizes this model. Report honestly
+  // rather than collapsing into the same zero a free model would return.
+  return { pricing: { input: 0, output: 0 }, priced: false };
+}
+
 /**
  * getPricing — resolve USD-per-1M-token pricing for a model ID.
- * Exact match first; then prefix/substring; falls back to zero.
+ * Back-compat wrapper over resolvePricing(); returns zero for both genuinely
+ * free and genuinely unknown models (use resolvePricing/isModelPriced to
+ * distinguish the two).
  */
 export function getPricing(modelId: string): ModelPricing {
-  if (MODEL_PRICING[modelId]) return MODEL_PRICING[modelId]!;
-  if (modelId.endsWith(':free')) return { input: 0, output: 0 };
-  for (const [key, pricing] of Object.entries(MODEL_PRICING)) {
-    if (modelId.startsWith(key) || modelId.includes(key)) return pricing;
-  }
-  return { input: 0, output: 0 };
+  return resolvePricing(modelId).pricing;
+}
+
+/** True when `modelId` resolves to a real price (free or paid), false when it's an unpriced placeholder. */
+export function isModelPriced(modelId: string): boolean {
+  return resolvePricing(modelId).priced;
 }
 
 /**
@@ -56,6 +135,9 @@ export function getPricing(modelId: string): ModelPricing {
  * cacheRead      — cumulative cache-read tokens
  * cacheWrite     — cumulative cache-write tokens
  * modelId        — registry model identifier
+ *
+ * Unpriced models contribute 0 to the total (same as before this WO) — only
+ * the display layer distinguishes "genuinely free/priced" from "unpriced".
  */
 export function calcSessionCost(
   inputTokens: number,

package/src/input/command-registry.ts

@@ -78,6 +78,14 @@ export interface CommandUiActions {
   clearScreen?: () => void;
   activatePlan?: (planId: string, task: string) => void;
   requestPermission?: PermissionRequestHandler;
+  /**
+   * Force a full-screen repaint on the next frame (reuses Compositor.resetDiff(),
+   * the same call resize/bootstrap already use). Defense-in-depth for command
+   * handlers whose spawned subprocess may have written to the real tty (e.g. a
+   * stderr-capture regression) — nulls the diff buffers so the next composite()
+   * repaints over any stray output instead of leaving it until an unrelated resize.
+   */
+  requestFullRepaint?: () => void;
 }
 
 export interface CommandShellUiOpeners {
@@ -141,6 +149,14 @@ export interface CommandSessionServices {
   readonly sessionLineageTracker?: import('@pellux/goodvibes-sdk/platform/core').SessionLineageTracker;
   readonly wrfcController?: import('@pellux/goodvibes-sdk/platform/agents').WrfcController;
   readonly changeTracker?: import('@pellux/goodvibes-sdk/platform/sessions').SessionChangeTracker;
+  /**
+   * Recompute the Orchestrator's session-wide usage totals from the
+   * conversation's current message history. Call after a session resume
+   * replays historical messages, before the next render, so the footer's
+   * token counter reflects the resumed session's real usage instead of a
+   * fresh Orchestrator's zeroed default (W0.9).
+   */
+  readonly hydrateSessionUsage?: () => void;
 }
 
 export interface CommandProviderServices {

package/src/input/commands/diff-runtime.ts

@@ -1,8 +1,39 @@
 import { join } from 'path';
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
-import type { CommandRegistry } from '../command-registry.ts';
+import { GitService } from '@pellux/goodvibes-sdk/platform/git';
+import type { CommandContext, CommandRegistry } from '../command-registry.ts';
 import { requirePanelManager, requireSessionChangeTracker, requireShellPaths } from './runtime-services.ts';
 
+/**
+ * Run a git command that lists changed file names, capturing stderr instead
+ * of letting it fall through to the process's real stderr (which, for a
+ * spawned child with no stdio option, is inherited from the parent — i.e.
+ * written straight to the TUI's controlling terminal, corrupting the screen
+ * outside the renderer's front/back-buffer diffing). Mirrors the 'staged'
+ * subcommand's existing pattern below.
+ */
+async function runGitNameOnly(args: string[], cwd: string): Promise<{ files: string[]; errText: string; ok: boolean }> {
+  const proc = Bun.spawn(args, { stdout: 'pipe', stderr: 'pipe', cwd });
+  const [out, errRaw] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  const exitCode = await proc.exited;
+  return {
+    files: out.trim().split('\n').filter(Boolean),
+    errText: errRaw.trim(),
+    ok: exitCode === 0,
+  };
+}
+
+/** Report a failed name-only fetch through the normal print channel and force
+ * a full repaint on the next frame as defense-in-depth, in case anything did
+ * reach the real tty. */
+function reportGitNameOnlyFailure(ctx: CommandContext, label: string, errText: string): void {
+  ctx.print(`${label} failed: ${errText || 'unknown error'}`);
+  ctx.requestFullRepaint?.();
+}
+
 async function enrichSemanticDiff(
   panel: InstanceType<typeof import('../../panels/diff-panel.ts').DiffPanel>,
   files: string[],
@@ -12,7 +43,7 @@ async function enrichSemanticDiff(
 ): Promise<void> {
   const { computeSemanticDiff, formatSemanticDiffSummary } = await import('../../renderer/semantic-diff.ts');
   const { relative: pathRelative } = await import('path');
-  const repoRootProc = Bun.spawn(['git', 'rev-parse', '--show-toplevel'], { stdout: 'pipe', cwd: workingDirectory });
+  const repoRootProc = Bun.spawn(['git', 'rev-parse', '--show-toplevel'], { stdout: 'pipe', stderr: 'pipe', cwd: workingDirectory });
   await repoRootProc.exited;
   const repoRoot = (await new Response(repoRootProc.stdout).text()).trim() || workingDirectory;
   await Promise.allSettled(
@@ -57,6 +88,14 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
     async handler(args, ctx) {
       const shellPaths = requireShellPaths(ctx);
       const workingDirectory = shellPaths.workingDirectory;
+      // Gate before any git spawn happens (same defensive check /git already
+      // has) — every subcommand below shells out to git, and without this
+      // they each produced a differently-shaped error for the same
+      // not-a-git-repo condition.
+      if (!GitService.isGitRepo(workingDirectory)) {
+        ctx.print('Not a git repository here. Run /git to initialize one.');
+        return;
+      }
       const { DiffPanel } = await import('../../panels/diff-panel.ts');
 
       const pm = requirePanelManager(ctx);
@@ -81,13 +120,11 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
           ctx.print('Loading working-tree diff...');
           await diffPanel.showGitDiff();
           ctx.print('Diff panel updated: working tree changes.');
-          const workingChangedFiles = await (async () => {
-            const proc = Bun.spawn(['git', 'diff', '--name-only'], { stdout: 'pipe', cwd: workingDirectory });
-            await proc.exited;
-            return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
-          })();
-          if (workingChangedFiles.length > 0) {
-            enrichSemanticDiff(diffPanel, workingChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
+          const workingChanged = await runGitNameOnly(['git', 'diff', '--name-only'], workingDirectory);
+          if (!workingChanged.ok) {
+            reportGitNameOnlyFailure(ctx, 'git diff --name-only', workingChanged.errText);
+          } else if (workingChanged.files.length > 0) {
+            enrichSemanticDiff(diffPanel, workingChanged.files, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
           }
           break;
         }
@@ -106,13 +143,11 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
           } else {
             diffPanel.loadRawDiff(raw);
             ctx.print('Diff panel updated: staged changes.');
-            const stagedChangedFiles = await (async () => {
-              const stagedProc = Bun.spawn(['git', 'diff', '--cached', '--name-only'], { stdout: 'pipe', cwd: workingDirectory });
-              await stagedProc.exited;
-              return (await new Response(stagedProc.stdout).text()).trim().split('\n').filter(Boolean);
-            })();
-            if (stagedChangedFiles.length > 0) {
-              enrichSemanticDiff(diffPanel, stagedChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
+            const stagedChanged = await runGitNameOnly(['git', 'diff', '--cached', '--name-only'], workingDirectory);
+            if (!stagedChanged.ok) {
+              reportGitNameOnlyFailure(ctx, 'git diff --cached --name-only', stagedChanged.errText);
+            } else if (stagedChanged.files.length > 0) {
+              enrichSemanticDiff(diffPanel, stagedChanged.files, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
             }
           }
           break;
@@ -121,13 +156,11 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
           ctx.print('Loading diff vs HEAD...');
           await diffPanel.showGitDiff('HEAD');
           ctx.print('Diff panel updated: all changes vs HEAD.');
-          const headChangedFiles = await (async () => {
-            const proc = Bun.spawn(['/bin/sh', '-c', 'git diff HEAD --name-only'], { stdout: 'pipe', cwd: workingDirectory });
-            await proc.exited;
-            return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
-          })();
-          if (headChangedFiles.length > 0) {
-            enrichSemanticDiff(diffPanel, headChangedFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
+          const headChanged = await runGitNameOnly(['git', 'diff', 'HEAD', '--name-only'], workingDirectory);
+          if (!headChanged.ok) {
+            reportGitNameOnlyFailure(ctx, 'git diff HEAD --name-only', headChanged.errText);
+          } else if (headChanged.files.length > 0) {
+            enrichSemanticDiff(diffPanel, headChanged.files, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
           }
           break;
         }
@@ -143,13 +176,11 @@ export function registerDiffRuntimeCommands(registry: CommandRegistry): void {
             ctx.print('No session changes tracked yet. Showing diff vs HEAD...');
             await diffPanel.showGitDiff('HEAD');
             ctx.print('Diff panel updated: all changes vs HEAD.');
-            const fallbackFiles = await (async () => {
-              const proc = Bun.spawn(['/bin/sh', '-c', 'git diff HEAD --name-only'], { stdout: 'pipe', cwd: workingDirectory });
-              await proc.exited;
-              return (await new Response(proc.stdout).text()).trim().split('\n').filter(Boolean);
-            })();
-            if (fallbackFiles.length > 0) {
-              enrichSemanticDiff(diffPanel, fallbackFiles, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
+            const fallback = await runGitNameOnly(['git', 'diff', 'HEAD', '--name-only'], workingDirectory);
+            if (!fallback.ok) {
+              reportGitNameOnlyFailure(ctx, 'git diff HEAD --name-only', fallback.errText);
+            } else if (fallback.files.length > 0) {
+              enrichSemanticDiff(diffPanel, fallback.files, 'HEAD', () => ctx.renderRequest(), workingDirectory).catch((err) => { logger.debug('semantic diff enrichment failed', { err }); });
             }
           }
           break;

package/src/input/commands/session-content.ts

@@ -7,6 +7,7 @@ import { exportToMarkdown } from '@pellux/goodvibes-sdk/platform/export';
 import { TemplateManager, parseTemplateArgs } from '@pellux/goodvibes-sdk/platform/templates';
 import { requireSessionManager, requireSessionMemoryStore, requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import { sessionCommand } from './session.ts';
 
 export function registerSessionContentCommands(registry: CommandRegistry): void {
   registry.register({
@@ -238,7 +239,18 @@ export function registerSessionContentCommands(registry: CommandRegistry): void
   registry.register({
     name: 'sessions',
     description: 'List saved sessions',
+    usage: '[resume <id|name>]',
+    argsHint: '[resume <id|name>]',
     async handler(_args, ctx) {
+      // Splash's "resume last session" hint and users' muscle memory both say
+      // `/sessions resume <id>` (plural, matching this command's own name) —
+      // but subcommands like `resume` are only implemented on the singular
+      // `/session` command. Forward instead of silently listing and dropping
+      // the subcommand+id on the floor.
+      if (_args.length > 0) {
+        await sessionCommand.handler(_args, ctx);
+        return;
+      }
       const sessionManager = requireSessionManager(ctx);
       const sessions = sessionManager.list();
       if (ctx.openSelection) {

package/src/input/commands/session-workflow.ts

@@ -260,6 +260,9 @@ export async function handleSessionWorkflowCommand(args: string[], ctx: CommandC
           });
         },
       });
+      // Hydrate the footer's token counters from the resumed (+ journal-replayed)
+      // history now, before ctx.renderRequest() below (W0.9).
+      ctx.session.hydrateSessionUsage?.();
 
       if (meta.model) {
         try {

package/src/input/commands/share-runtime.ts

@@ -10,7 +10,7 @@ import {
 import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 import { requireShellPaths } from './runtime-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
-import { calcSessionCost } from '../../export/cost-utils.ts';
+import { calcSessionCost, isModelPriced } from '../../export/cost-utils.ts';
 import {
   GistUploadTarget,
   NO_TOKEN_GUIDANCE,
@@ -113,6 +113,13 @@ export function registerShareRuntimeCommands(registry: CommandRegistry): void {
       const sessionCostUsd = calcSessionCost(
         totalInput, totalOutput, totalCacheRead, totalCacheWrite, sessionModel,
       );
+      // The exported document has no field for "this cost is a placeholder" —
+      // omit `cost` entirely rather than embed a misleading 0 when the model
+      // never resolved to a real price (WO-315).
+      const costIsUnpriced = !isModelPriced(sessionModel);
+      if (costIsUnpriced) {
+        ctx.print(`Note: cost omitted from export — no pricing data for model "${sessionModel}".`);
+      }
 
       const metadata = {
         model: sessionModel,
@@ -120,7 +127,7 @@ export function registerShareRuntimeCommands(registry: CommandRegistry): void {
         sessionId: ctx.session.runtime.sessionId,
         title: ctx.session.conversationManager.title || undefined,
       };
-      const options = { redact, cost: sessionCostUsd };
+      const options = { redact, cost: costIsUnpriced ? undefined : sessionCostUsd };
 
       let outputContent: string;
       try {

package/src/input/handler-content-actions.ts

@@ -427,6 +427,8 @@ export function handleCtrlC(
   lastCtrlCTime: number,
   setLastCtrlCTime: (value: number) => void,
   setShowExitNotice: (value: boolean) => void,
+  lastCtrlCTimeoutId: ReturnType<typeof setTimeout> | null,
+  setLastCtrlCTimeoutId: (value: ReturnType<typeof setTimeout> | null) => void,
 ): void {
   if (prompt.length > 0) {
     saveUndoState();
@@ -436,17 +438,29 @@ export function handleCtrlC(
   }
   cancelGeneration?.();
   const now = Date.now();
+  // Clear any hide-timer pending from a prior press before deciding this
+  // one's outcome, whichever branch below runs. Without this, a hide-timer
+  // scheduled by an earlier press could still fire after a newer notice
+  // window opened, or after exitApp() was just called (if exitApp isn't
+  // synchronous) — flipping showExitNotice/requestRender during a shutdown
+  // the user already believes is in progress.
+  if (lastCtrlCTimeoutId !== null) {
+    clearTimeout(lastCtrlCTimeoutId);
+    setLastCtrlCTimeoutId(null);
+  }
   if (now - lastCtrlCTime < 1000) {
     exitApp();
-  } else {
-    setLastCtrlCTime(now);
-    setShowExitNotice(true);
-    requestRender();
-    setTimeout(() => {
-      setShowExitNotice(false);
-      requestRender();
-    }, 1000);
+    return;
   }
+  setLastCtrlCTime(now);
+  setShowExitNotice(true);
+  requestRender();
+  const timeoutId = setTimeout(() => {
+    setShowExitNotice(false);
+    setLastCtrlCTimeoutId(null);
+    requestRender();
+  }, 1000);
+  setLastCtrlCTimeoutId(timeoutId);
 }
 
 export function handleClipboardPaste(

package/src/input/handler-feed-routes.ts

@@ -30,6 +30,15 @@ export type PanelFocusRouteState = {
   handlePathCompletion: () => boolean;
   cyclePanelTab: (direction: 'next' | 'prev') => void;
   onPanelInputConsumed?: (activePanel: import('../panels/types.ts').Panel | null, key: string) => void;
+  /**
+   * True when the tokens produced by the current feed() call carry more than
+   * one printable character total (a bracketed paste, or several 1-char text
+   * tokens from a fast-typed burst in one stdin chunk). A burst can never be
+   * a deliberate single-key panel hotkey, so it must not be exploded into
+   * per-char activePanel.handleInput(ch) calls — see the text-token branch
+   * below.
+   */
+  isPrintableBurst: boolean;
 };
 
 export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputToken): {
@@ -113,6 +122,19 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
 
   if (token.type === 'text' && token.value) {
     const activePanel = state.panelManager.getActive();
+    // A burst (paste or several fast-typed chars in one stdin chunk) is never
+    // a deliberate single-key panel hotkey. Eating it silently as per-char
+    // hotkeys leaves the user with no echo and no error, looking exactly
+    // like dead keystrokes. Unless the active panel has its own text-capture
+    // buffer open (a `/`-search or draft-answer field that deliberately
+    // wants every character, burst or not — see isCapturingTextBurst), unfocus
+    // the panel and let the token fall through to the prompt route instead,
+    // same as it would from an unfocused panel.
+    if (state.isPrintableBurst && !activePanel?.isCapturingTextBurst?.()) {
+      panelFocused = false;
+      state.requestRender();
+      return { handled: false, panelFocused };
+    }
     if (activePanel?.handleInput) {
       for (const ch of token.value) {
         activePanel.handleInput(ch);
@@ -229,7 +251,15 @@ export function handlePromptTextToken(state: TextRouteState, token: InputToken):
     }
   }
 
-  if (prompt === '/' && state.commandRegistry) {
+  if (prompt === '/') {
+    // Arm commandMode as soon as the prompt becomes a bare '/', regardless of
+    // whether commandRegistry has been (re)attached yet — this is a one-shot
+    // transition (the only place commandMode ever becomes true), and gating
+    // it on commandRegistry meant a transient null during a modal/overlay
+    // handoff would permanently miss the window: every following keystroke
+    // is then processed as plain chat text with no way to recover. Dispatch
+    // (handleCommandModeToken, and the enter-key fallback below) still checks
+    // commandRegistry itself before actually running anything.
     commandMode = true;
     state.modalOpened('command');
     state.autocomplete?.update('');
@@ -257,6 +287,14 @@ export type KeyRouteState = {
   indicatorFocused: boolean;
   conversationManager: ConversationManager | null;
   commandContext: CommandContext | undefined;
+  /**
+   * Optional: only used by the enter-key desync safety net below (a stray
+   * slash-prefixed submission with commandMode somehow still false). When
+   * absent, that fallback simply doesn't trigger — the primary fix (arming
+   * commandMode on the '/' keystroke regardless of registry attachment, in
+   * handlePromptTextToken above) is what actually prevents the desync.
+   */
+  commandRegistry?: CommandRegistry | null;
   autocomplete: AutocompleteEngine | null;
   blockActionsMenu: { open: (block: BlockMeta) => void };
   processModal: { open: () => void };
@@ -351,6 +389,30 @@ export function handlePromptKeyToken(state: KeyRouteState, token: InputToken): {
       return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
     }
     if (text) {
+      // Safety net for a desynced commandMode: text is command-shaped (starts
+      // with '/') but commandMode never armed — e.g. the '/' keystroke landed
+      // during a modal/overlay handoff window. handleCommandModeToken (the
+      // normal dispatch path for '/name ...') never runs in this state since
+      // it early-returns when commandMode is false, so without this the text
+      // would fall straight through to submitInput as ordinary chat. Re-derive
+      // intent from the literal text instead of trusting commandMode alone.
+      if (!commandMode && text.startsWith('/') && state.commandRegistry && state.commandContext?.executeCommand) {
+        const parts = text.slice(1).trim().split(/\s+/);
+        const name = parts[0];
+        const args = parts.slice(1);
+        prompt = '';
+        cursorPos = 0;
+        if (name) {
+          const executeCommand = state.commandContext.executeCommand;
+          void executeCommand(name, args).then((handled) => {
+            if (!handled) {
+              state.commandContext?.submitInput?.(text);
+            }
+            state.requestRender();
+          });
+        }
+        return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
+      }
       const expanded = state.expandPrompt(text);
       const historyRecallText = typeof expanded === 'string'
         ? expanded

package/src/input/handler-feed.ts

@@ -180,6 +180,16 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
   const lineCount = history.getLineCount();
   const keybindings = context.keybindingsManager;
 
+  // A single stdin chunk can tokenize into several 'text' tokens (fast-typed
+  // burst) or one 'text' token with a multi-char value (bracketed paste).
+  // Computed once per feed() call, not per token, so per-token cost stays
+  // the same O(1) check it always was.
+  let totalPrintableChars = 0;
+  for (const t of tokens) {
+    if (t.type === 'text') totalPrintableChars += t.value.length;
+  }
+  const isPrintableBurst = totalPrintableChars > 1;
+
   for (const token of tokens) {
     if (token.type === 'key' && context.keybindingsManager.matches('clear-cancel', token)) {
       context.handleCtrlC();
@@ -320,6 +330,7 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
       panelManager: context.panelManager,
       keybindingsManager: context.keybindingsManager,
       onPanelInputConsumed: context.onPanelInputConsumed,
+      isPrintableBurst,
     }, token);
     context.panelFocused = panelRoute.panelFocused;
     if (panelRoute.handled) {
@@ -408,6 +419,7 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
         indicatorFocused: context.indicatorFocused,
         conversationManager: context.conversationManager,
         commandContext: context.commandContext,
+        commandRegistry: context.commandRegistry,
         autocomplete: context.autocomplete,
         blockActionsMenu: { open: (block: BlockMeta) => context.blockActionsMenu.open(block) },
         processModal: context.processModal,

package/src/input/handler-interactions.ts

@@ -193,6 +193,8 @@ export function handleCtrlCForHandler(handler: InputHandler): void {
       handler.lastCtrlCTime,
       (value) => { handler.lastCtrlCTime = value; },
       (value) => { handler.showExitNotice = value; },
+      handler.lastCtrlCTimeoutId,
+      (value) => { handler.lastCtrlCTimeoutId = value; },
     );
   }