@plurnk/plurnk 0.77.0 → 0.78.0

package/dist/tui.js

@@ -1,4 +1,4 @@
-// TUI mode — interactive REPL with glyph waterfall. Vanilla ANSI + readline.
+// TUI mode — interactive Plurnk client on pi-tui's main-screen renderer.
 // Per TUI.md §3.
 //
 // Line language (converged with plurnk.nvim — one vocabulary, two surfaces):
@@ -7,50 +7,38 @@
 //   ## LOOK0 (uri) off-run READ — inspect a uri's content for ME, not the model
 //   ! cmd          op.exec via the daemon
 //   ... msg         loop.inject — speak into the running model loop
-//   ? text         ask — loop.run with flags.mode="ask"
+//   ? text         deny EXEC for this loop and keep proposal review client-owned
 //   : text         act (the default)
 //   text           prompt
-// The readline prompt is `[🔥|⌛︎|progress%]: `: one three-cell slot, then input.
-import readline from "node:readline";
-import { PassThrough } from "node:stream";
 import { readFile } from "node:fs/promises";
 import { isAbsolute, resolve } from "node:path";
-import PasteFilter from "./paste.js";
+import { matchesKey } from "@earendil-works/pi-tui";
+import TuiSurface from "./tui-surface.js";
+import TerminalGuards from "./tui-guards.js";
+import ModelText from "./model-text.js";
 import { extractOpenPaths } from "./openpaths.js";
 import { pathPartial, completePath, dslOpPartial, completeOps, dslStatement } from "./completion.js";
-import { renderLogEntry, renderReasoningFrame, renderSummary, isPromptEntry, progressLabel, entryTarget, isEntryMaterialization } from "./render.js";
-import { renderProposalMenu, keyToResolution, isServerResolved, renderQuestionMenu, questionChoices, answerForQuestion, editInEditor } from "./proposal.js";
+import { renderLogEntry, renderReasoning, renderSummary, isPromptEntry, entryTarget, isEntryMaterialization } from "./render.js";
+import { renderProposalMenu, keyToResolution, renderQuestionMenu, questionChoices, answerForQuestion, editInEditor } from "./proposal.js";
 import { ProblemError, renderDiagnostic, report, clientSubcommandUnknownVerb, NO_MODEL_HINT } from "./diagnostics.js";
 import StreamTrace, { inlineable, renderInline } from "./stream.js";
 import { runModels, runWorkspaceList, runWorkspaceWorkers, runLogRead } from "./subcommands.js";
 import { Validator, } from "@plurnk/plurnk-contracts";
+import { formatCapabilityProjection, parseCapabilityPolicy, promptPolicy } from "./policy.js";
 import { handleMcp } from "./mcp.js";
 import { handleSkills } from "./skills.js";
 import { handleAgents } from "./agents.js";
+import { handleMembers } from "./members.js";
 import { formatWorkerReasoning, readWorkerReasoning, setWorkerReasoning, } from "./reasoning.js";
-import { derivationActivity, renderStatusLine } from "./status.js";
+import { EMPTY_TALLY, derivationActivity, projectStatusGauge, renderStatusLine, tallyOutcome } from "./status.js";
+import { COMMANDS, completeCommandSyntax, isCommandName, renderCommandHelp, } from "./commands.js";
 export const renderTuiFailure = (cause) => {
+    // A Problem may quote the model's own line; a thrown message may carry anything (plurnk#35).
     if (cause instanceof ProblemError) {
-        return renderDiagnostic(cause.problem)
+        return renderDiagnostic(ModelText.plainFields(cause.problem))
             + (cause.problem.status === 501 ? NO_MODEL_HINT : "");
     }
-    return `  \x1b[31merror: ${cause instanceof Error ? cause.message : String(cause)}\x1b[0m`;
-};
-export const renderInputPrompt = (yolo, activePercent, loopActive = false, status = null) => {
-    const progressActive = activePercent !== null
-        && Number.isFinite(activePercent)
-        && activePercent < 100;
-    if (status !== null) {
-        return `${renderStatusLine({
-            ...status,
-            lifecycle: loopActive ? "running" : status.lifecycle,
-            activity: status.activity ?? (progressActive ? { label: "", percent: Math.floor(activePercent) } : null),
-        }, { idleGlyph: yolo ? "🔥" : "" })}\x1b[1m: \x1b[0m`;
-    }
-    const slot = progressActive ? progressLabel(activePercent)
-        : loopActive ? "⌛︎ "
-            : yolo ? "🔥 " : "   ";
-    return `${slot}\x1b[1m: \x1b[0m`;
+    return `  \x1b[31merror: ${ModelText.plain(cause instanceof Error ? cause.message : String(cause))}\x1b[0m`;
 };
 // One verb vocabulary across nvim's :AI/, the TUI, and (where they exist)
 // the argv subcommands. Convergence is policy: divergence needs a reason.
@@ -58,74 +46,20 @@ export const renderInputPrompt = (yolo, activePercent, loopActive = false, statu
 // lists them; /worker forks a new worker, /workers lists them. The old /new was
 // ambiguous (workspace or worker?) and is gone. /rename retargets the current
 // workspace's mutable handle (a worker's name is immutable — no /rename for workers).
-export const VERBS = [
-    "help", "models", "workspaces", "workers", "log", "model", "child", "reasoning",
-    "yolo", "workspace", "rename", "worker", "stop", "quit",
-    "pick", "hide", "view", "drop", "members", "import", "script", "mcp", "editor",
-    "accept", "reject", "cancel", "edit",
-];
-export const TUI_HELP = [
-    "  /models [search] /workspaces /workers /log [n]   inspect",
-    "  /model <selector> · /child <selector|inherit>   parent and child models",
-    "  /reasoning [off|adaptive|effort]       inspect or set reasoning",
-    "  /yolo                              toggle local auto-accept",
-    "  /workspace [name]                    new workspace",
-    "  /rename <name>                     rename this workspace (a mutable handle)",
-    "  /worker [name]                     create a new worker",
-    "  /pick <glob>                       track file(s)",
-    "  /hide <glob>                       hide file(s)",
-    "  /view <glob>                       track file(s) (read-only)",
-    "  /drop <glob>                       no longer pick file(s)",
-    "  /members                           the model's resolved file universe (+ rules)",
-    "  /import <path>                     dump a local file's content into the prompt",
-    "  /script <path>                     run a .plk file (its DSL → op.parse)",
-    "  /mcp                              list available workspace MCP servers",
-    "       add <alias> <target> [options.json] · enable/disable/remove <alias>",
-    "       oauth <alias> <callback-url>",
-    "  /agents                           list this Worker's outbound A2A agents",
-    "       discover <url> · add <alias> <url> [options.json] · enable/disable/remove <alias>",
-    "  /skills                           list this Worker's Agent Skills",
-    "       discover <query|source> · add <name> <source> [--global] · enable/disable/remove <name>",
-    "  /accept /reject /cancel /edit      resolve a pending proposal (or keys a/e/r/c)",
-    "  /stop                              cancel the running loop",
-    "  /quit                              exit",
-    "  # PLAN0 / ## OP0                  raw PLURNK (op.parse)",
-    "  ## LOOK0 (uri)                    off-run READ — inspect a uri for you, not the model",
-    "  Alt-p / Alt-n                     cycle ## LOOK0 through prior operations' targets",
-    "  Ctrl-J / Alt-Enter                 insert a ↵ newline (editable); Enter submits",
-    "  Esc                               cancel the running loop; idle: clear the line",
-    "  /editor · Alt-e                    compose the prompt line in $EDITOR",
-    "  Alt-m/s · Alt-R/L/Y/N/M · Alt-x    quick verbs (nvim case): models workspaces runs",
-    "                                     log yolo workspace members stop · Alt-h help",
-].join("\n") + "\n";
-// The non-submitting newline keys, by their raw byte sequence (post paste
-// filter): Ctrl-J is LF (`\n`, a distinct byte from Enter's CR — works on every
-// terminal); Alt-Enter is Meta+Return (ESC then CR/LF). Enter itself is CR
-// (`\r`) and is NOT matched here, so it still submits. Shift-Enter is absent by
-// design (it can't be distinguished without the kitty/modifyOtherKeys protocol).
-export const isNewlineKey = (forward) => forward === "\n" || forward === "\x1b\r" || forward === "\x1b\n";
-// A soft-enter inserts this single-width glyph into readline's ONE line, so the
-// whole multi-line buffer stays natively editable (backspace deletes the ↵ to
-// rejoin; arrows/history cross it; readline owns the wrapping). On submit it
-// expands back to a real newline. A pasted literal ↵ is preserved — expansion
-// runs on the typed line BEFORE paste markers expand, so paste content is
-// untouched.
-export const NL_MARK = "↵";
-export const expandNewlines = (line) => line.replaceAll(NL_MARK, "\n");
+export const VERBS = COMMANDS.map(({ name }) => name);
+export const TUI_HELP = renderCommandHelp();
 // Muscle-memory quick-keys, converged with plurnk.nvim's `<leader>a<letter>`
 // mnemonics — SAME CASE as nvim (lowercase m/s/x, capital R/L/Y/N/M), which
 // Alt-<letter> can carry (Alt-m = `ESC m`, Alt-M = `ESC M` — distinct bytes).
-// Delivered as Alt not Ctrl because Ctrl-<letter> collides with terminal/
-// readline control codes: Ctrl-m IS Enter, Ctrl-Shift-m is ALSO Enter (Shift
-// doesn't change a control code), Ctrl-s is XOFF, Ctrl-i is Tab, and readline
-// owns a/e/n/p/u/w/k/l. Alt-b/f/d are skipped (readline word-ops).
+// Delivered as Alt not Ctrl because Ctrl-<letter> collides with terminal and
+// editor control keys. Alt-b/f/d remain the editor's word operations.
 export const ALT_SHORTCUTS = Object.freeze({
     m: "/models", s: "/workspaces", R: "/workers", L: "/log",
     Y: "/yolo", N: "/workspace", M: "/members", x: "/stop", h: "/help", e: "/editor",
 });
 // An Alt-<letter> keypress (ESC then a single letter, no `[`/`O` → not an arrow
 // or function key) mapped to its verb, or null. Case-sensitive (mirrors nvim).
-// Reassembled by the paste filter whether it arrives in one chunk or split.
+// pi-tui's terminal buffer reassembles split escape sequences.
 export const altShortcut = (forward) => {
     const m = forward.match(/^\x1b([a-zA-Z])$/);
     return m ? (ALT_SHORTCUTS[m[1]] ?? null) : null;
@@ -133,22 +67,10 @@ export const altShortcut = (forward) => {
 // Recognize the client-only LOOK surface so it can be routed to `op.look`.
 // The AG-UI observation action owns validation and the single LOOK→READ rewrite.
 export const lookStatement = (line) => line.startsWith("## LOOK") ? line : null;
-// §2.0 prompt prefixes (converged with nvim's :AI ? / :AI :): `? ` puts mode:"ask"
-// on the wire flags, `: ` forces act, both overriding a --flags base mode; `...`
-// (injection) strips without minting flags. Mode is a per-line habit, never --ask.
-export const lineMode = (trimmed, base) => {
-    const prefix = trimmed[0];
-    const flags = prefix === "?" || prefix === ":"
-        ? { ...(base ?? {}), mode: prefix === "?" ? "ask" : "act" }
-        : base;
-    return { ...(flags !== undefined ? { flags } : {}), prompt: trimmed.replace(/^(\.\.\.|[?:]+)\s*/, "") };
-};
+export const linePolicy = promptPolicy;
+export const renderSubmittedInput = (text, yolo) => text.split("\n").map((line, index) => `${index === 0 ? (yolo ? "🔥 " : "› ") : "  "}${line}`).join("\n");
 // Alt-p / Alt-n cycle the LOOK target through prior operations (prev/next op).
-// Alt-<letter> (`ESC<letter>`) survives the input pipeline intact — the paste
-// filter always holds a lone ESC and reassembles `ESC<letter>`, the same path the
-// Alt verb shortcuts use — whereas a Shift-Up CSI (`ESC[1;2A`) fragments at `ESC[1`
-// and leaks to readline as history-prev. Caught before altShortcut (which has no
-// lowercase p/n binding). null = not a cycle key.
+// null = not a cycle key.
 export const cycleKey = (forward) => forward === "\x1bp" ? "up" : forward === "\x1bn" ? "down" : null;
 // Pure cursor math for the LOOK coordinate cycler over `count` seen coordinates
 // (oldest→newest). Up walks toward older (start at newest), down toward newer.
@@ -164,89 +86,108 @@ export const parseSlash = (line) => {
     const m = line.match(/^\/(\S*)\s*(.*)$/);
     return { verb: m?.[1] ?? "", rest: (m?.[2] ?? "").trim() };
 };
-// readline completer — verbs after `/`, model aliases after `/model ` or `/child `.
-// Plain readline machinery only; no screen takeover, no terminal hell.
-// readline's async completer form (arity 2 → async). Verb/alias completion
-// answers synchronously; path positions read the local fs (co-location law)
-// and answer once readdir resolves. A fragment holding a provider prefix
+// Command syntax comes from the registry. Paths read the local filesystem;
+// model and Functionality aliases are fetched only when the cursor reaches a
+// position that consumes them. A fragment holding a provider prefix
 // (`/model openai/…`) completes lazily from one bounded, provider-scoped
 // daemon catalog page ([§cli-plurnk-models]); the client never preloads or
 // owns the Models.dev snapshot.
-export const makeCompleter = (getAliases, cwd, getReasoningPolicies = () => [], getProviderModels = async () => []) => (line, callback) => {
-    const verbFrag = line.match(/^\/(\w*)$/);
-    if (verbFrag) {
-        callback(null, [VERBS.map((v) => `/${v}`).filter((v) => v.startsWith(line)), line]);
-        return;
+export const completeInput = async (line, options) => {
+    const command = completeCommandSyntax(line);
+    if (command?.kind === "syntax")
+        return { suggestions: command.suggestions, prefix: command.prefix };
+    if (command?.kind === "aliases") {
+        let aliases = [];
+        try {
+            aliases = await options.getFunctionalityAliases?.(command.family) ?? [];
+        }
+        catch { /* completion failure is an empty result; the editor remains intact */ }
+        return {
+            suggestions: aliases
+                .filter((alias) => alias.startsWith(command.prefix))
+                .map((value) => ({ value, description: `${command.family} alias` })),
+            prefix: command.prefix,
+        };
     }
     const aliasFrag = line.match(/^\/(model|child)\s+(\S*)$/);
     if (aliasFrag) {
         const fragment = aliasFrag[2];
         const provider = /^([A-Za-z0-9_-]+)\//.exec(fragment)?.[1];
         if (provider !== undefined) {
-            getProviderModels(provider).then((selectors) => callback(null, [selectors.filter((selector) => selector.startsWith(fragment)), fragment]), () => callback(null, [[], fragment]));
-            return;
+            let selectors = [];
+            try {
+                selectors = await options.getProviderModels?.(provider) ?? [];
+            }
+            catch { /* bounded remote completion is optional */ }
+            return {
+                suggestions: selectors.filter((selector) => selector.startsWith(fragment))
+                    .map((value) => ({ value, description: "model route" })),
+                prefix: fragment,
+            };
         }
         const candidates = aliasFrag[1] === "child"
-            ? ["inherit", ...getAliases().filter((alias) => alias !== "inherit")]
-            : getAliases();
-        callback(null, [candidates.filter((a) => a.startsWith(fragment)), fragment]);
-        return;
+            ? ["inherit", ...options.getAliases().filter((alias) => alias !== "inherit")]
+            : options.getAliases();
+        return {
+            suggestions: candidates.filter((alias) => alias.startsWith(fragment))
+                .map((value) => ({ value, description: value === "inherit" ? "inherit parent route" : "model alias" })),
+            prefix: fragment,
+        };
     }
     const reasoningFrag = line.match(/^\/reasoning\s+(\S*)$/);
     if (reasoningFrag) {
-        callback(null, [
-            getReasoningPolicies().filter((policy) => policy.startsWith(reasoningFrag[1])),
-            reasoningFrag[1],
-        ]);
-        return;
-    }
-    const mcpFrag = line.match(/^\/mcp\s+(\S*)$/);
-    if (mcpFrag) {
-        const fragment = mcpFrag[1];
-        const commands = ["add", "enable", "disable", "remove", "oauth"]
-            .filter((command) => command.startsWith(fragment));
-        callback(null, [commands, fragment]);
-        return;
-    }
-    const agentsFrag = line.match(/^\/agents\s+(\S*)$/);
-    if (agentsFrag) {
-        const fragment = agentsFrag[1];
-        const commands = ["add", "discover", "enable", "disable", "remove"]
-            .filter((command) => command.startsWith(fragment));
-        callback(null, [commands, fragment]);
-        return;
-    }
-    const skillsFrag = line.match(/^\/skills\s+(\S*)$/);
-    if (skillsFrag) {
-        const fragment = skillsFrag[1];
-        const commands = ["add", "discover", "enable", "disable", "remove"]
-            .filter((command) => command.startsWith(fragment));
-        callback(null, [commands, fragment]);
-        return;
+        return {
+            suggestions: (options.getReasoningPolicies?.() ?? [])
+                .filter((policy) => policy.startsWith(reasoningFrag[1]))
+                .map((value) => ({ value, description: "reasoning policy" })),
+            prefix: reasoningFrag[1],
+        };
     }
     const op = dslOpPartial(line);
     if (op !== null) {
-        callback(null, completeOps(op));
-        return;
+        const [values, prefix] = completeOps(op);
+        return { suggestions: values.map((value) => ({ value, description: "Plurnk operation" })), prefix };
     }
     const partial = pathPartial(line);
     if (partial !== null) {
-        void completePath(partial, cwd).then((result) => callback(null, result));
-        return;
+        const [values, prefix] = await completePath(partial, options.cwd);
+        return { suggestions: values.map((value) => ({ value, description: "local path" })), prefix };
     }
-    callback(null, [[], line]);
+    return { suggestions: [], prefix: line };
 };
-// Seed readline history from the workspace's prior prompts (svc#238) so up/down
-// recalls them across restarts. One clean RPC — newest-first, exactly what
-// rl.history wants. Best-effort: a fresh workspace has none, failures are silent.
-export const seedPromptHistory = async (rpc, workspaceId, rl) => {
+export const makeAutocompleteProvider = (options) => ({
+    triggerCharacters: ["/", "#", "@"],
+    getSuggestions: async (lines, cursorLine, cursorCol) => {
+        const beforeCursor = lines.slice(0, cursorLine).concat(lines[cursorLine]?.slice(0, cursorCol) ?? "").join("\n");
+        const { suggestions, prefix } = await completeInput(beforeCursor, options);
+        if (suggestions.length === 0)
+            return null;
+        return {
+            items: suggestions.map(({ value, description }) => ({ value, label: value, description })),
+            prefix,
+        };
+    },
+    applyCompletion: (lines, cursorLine, cursorCol, item, prefix) => {
+        const current = lines[cursorLine] ?? "";
+        const before = current.slice(0, cursorCol);
+        const after = current.slice(cursorCol);
+        const replaceFrom = Math.max(0, before.length - prefix.length);
+        const completed = `${before.slice(0, replaceFrom)}${item.value}`;
+        const next = [...lines];
+        next[cursorLine] = completed + after;
+        return { lines: next, cursorLine, cursorCol: completed.length };
+    },
+});
+// Seed editor history from prior workspace prompts. The server returns newest
+// first; the surface owns the insertion order required by its editor.
+export const seedPromptHistory = async (rpc, workspaceId, history) => {
     try {
         // Bridge mode has no client-known workspace id → omit it (the connection's
         // attached workspace answers); WS passes the real id.
         const params = workspaceId > 0 ? { id: workspaceId, limit: 100 } : { limit: 100 };
         const { prompts } = await rpc.call("workspace.prompts", params);
         if (Array.isArray(prompts) && prompts.length > 0)
-            rl.history = prompts;
+            history.addHistory(prompts);
     }
     catch { /* history is a convenience; never block the REPL */ }
 };
@@ -285,10 +226,17 @@ export const handleVerb = async (line, ctx) => {
         ctx.setSpawnModel(model.spawnModel);
         ctx.setReasoning(await readWorkerReasoning(rpc));
     };
+    if (verb.length === 0) {
+        write(renderCommandHelp());
+        return;
+    }
+    if (!isCommandName(verb)) {
+        report(clientSubcommandUnknownVerb(`/${verb}`, [...VERBS]));
+        return;
+    }
     switch (verb) {
-        case "":
         case "help":
-            write(TUI_HELP);
+            write(renderCommandHelp(rest));
             return;
         case "models":
             await runModels(rpc, {
@@ -343,6 +291,19 @@ export const handleVerb = async (line, ctx) => {
                 write(`${renderTuiFailure(cause)}\n`);
             }
             return;
+        case "capabilities":
+            try {
+                const projection = rest.length === 0
+                    ? await rpc.call("worker.capabilities.get")
+                    : await rpc.call("worker.capabilities.set", {
+                        policy: parseCapabilityPolicy("/capabilities", rest),
+                    });
+                write(`${formatCapabilityProjection(projection).trimEnd().replace(/^/gm, "  ")}\n`);
+            }
+            catch (cause) {
+                write(`${renderTuiFailure(cause)}\n`);
+            }
+            return;
         case "child":
             if (rest.length === 0) {
                 write(`  child: ${ctx.spawnModel === null ? "inherit" : resolvedModelLabel(ctx.spawnModel)}\n`);
@@ -395,70 +356,8 @@ export const handleVerb = async (line, ctx) => {
             write(`  worker: ${forked.workerName} (new)\n`);
             return;
         }
-        case "pick":
-        case "hide":
-        case "view": {
-            // Membership overlay — service vocabulary, live via
-            // workspace.constrain (workspace-scoped, re-resolved immediately).
-            if (rest.length === 0) {
-                write(`  usage: /${verb} <glob>\n`);
-                return;
-            }
-            await rpc.call("workspace.constrain", { effect: verb, glob: rest });
-            write(`  ${verb}: ${rest}\n`);
-            return;
-        }
-        case "drop": {
-            if (rest.length === 0) {
-                write("  usage: /drop <glob>\n");
-                return;
-            }
-            const { constraints } = await rpc.call("workspace.constraints");
-            const matches = constraints.filter((c) => c.glob === rest);
-            if (matches.length === 0) {
-                write(`  no constraint matching ${JSON.stringify(rest)}\n`);
-                return;
-            }
-            for (const { effect, glob } of matches)
-                await rpc.call("workspace.unconstrain", { effect, glob });
-            write(`  dropped ${matches.length} constraint${matches.length === 1 ? "" : "s"} (${rest})\n`);
-            return;
-        }
-        case "members": {
-            // The model's RESOLVED universe (svc#243) — daemon-resolved
-            // (ls-files ∪ pick) − hide, never the client's rule globs. Showing
-            // the rules here (the old behavior) misinforms: rules are deltas,
-            // not the universe. The constraint list rides along as a footer —
-            // it's what /drop targets, but it is NOT "what the model sees".
-            const { members, hidden } = await rpc.call("workspace.members");
-            const editable = members.filter((m) => m.effect === "member");
-            const view = members.filter((m) => m.effect === "view");
-            if (members.length === 0 && hidden.length === 0) {
-                write("  the model's universe is empty — no Git members or /pick rules\n");
-            }
-            else {
-                write(`  the model's universe: ${members.length} file${members.length === 1 ? "" : "s"}`
-                    + ` — ${editable.length} editable, ${view.length} read-only`
-                    + `${hidden.length ? `, ${hidden.length} hidden` : ""}\n`);
-                for (const m of view)
-                    write(`  view    ${m.path}\n`);
-                for (const p of hidden)
-                    write(`  hidden  ${p}\n`);
-                if (editable.length <= 40)
-                    for (const m of editable)
-                        write(`  member  ${m.path}\n`);
-                else
-                    write(`  member  …${editable.length} editable files (git-tracked); listing suppressed\n`);
-            }
-            const { constraints } = await rpc.call("workspace.constraints");
-            write(constraints.length === 0
-                ? "  rules: none (git-tracked files only)\n"
-                : `  rules: ${constraints.map((c) => `${c.effect} ${c.glob}`).join(", ")}\n`);
-            return;
-        }
         case "import":
-            // Dump a LOCAL file's content into the prompt (co-location law),
-            // via the paste machinery. The rl/paste glue lives in ctx.importFile.
+            // Dump a LOCAL file's content into the multiline composer.
             if (rest.length === 0) {
                 write("  usage: /import <path>\n");
                 return;
@@ -492,6 +391,10 @@ export const handleVerb = async (line, ctx) => {
             await handleAgents(rest, rpc, write);
             return;
         }
+        case "members": {
+            await handleMembers(rest, rpc, write);
+            return;
+        }
         case "accept":
         case "reject":
         case "cancel":
@@ -507,16 +410,15 @@ export const handleVerb = async (line, ctx) => {
             return;
         case "quit":
             return "quit";
-        default:
-            report(clientSubcommandUnknownVerb(`/${verb}`, [...VERBS]));
-            return;
     }
+    verb;
 };
 export const runTui = async (transport, workspace, opts) => {
     let current = workspace;
     // Loop state, hoisted so the line handler and SIGINT can share it.
     let inFlight = false;
     let cancelRequested = false;
+    let printAbove = (text) => { process.stdout.write(`${text}\n`); };
     // One cancel path for every interrupt gesture (Ctrl-C, Esc, /stop): the
     // run's active drain cancels via loop.cancel; the pending loop resolves
     // 499 and the REPL continues. A failed cancel SURFACES — a stop button
@@ -525,14 +427,18 @@ export const runTui = async (transport, workspace, opts) => {
         if (cancelRequested)
             return;
         cancelRequested = true;
-        process.stdout.write("\r\x1b[2K  \x1b[2mcancelling… (ctrl-c again to quit)\x1b[0m\n");
+        printAbove("  \x1b[2mcancelling… (ctrl-c again to quit)\x1b[0m");
         void transport.rpc("loop.cancel", { reason }).catch((err) => {
-            process.stdout.write(`\r\x1b[2K  \x1b[31mcancel failed: ${err instanceof Error ? err.message : String(err)}\x1b[0m\n`);
+            printAbove(`  \x1b[31mcancel failed: ${err instanceof Error ? err.message : String(err)}\x1b[0m`);
         });
     };
     // Ephemeral progress projected into the prompt while background work is active.
     let lifecycle = "idle";
-    let observedTurn = null;
+    let authoritativeStatus = null;
+    let tally = EMPTY_TALLY;
+    let runningSince = null;
+    let conversationWorkerId = null;
+    let conversationWorker = opts.workerName ?? null;
     let embedding = false;
     let embeddingPercent = null;
     let searchFetching = false;
@@ -544,14 +450,8 @@ export const runTui = async (transport, workspace, opts) => {
     const priorTargets = [];
     let lookCursor = null;
     let liveReasoning = null;
-    // Print a line ABOVE the live readline prompt without eating the user's
-    // in-progress input. The canonical "log while prompting" idiom: wipe the
-    // prompt row, write the line, then re-render the prompt + current buffer on
-    // the row below (rl.prompt(true) preserves what's typed). This is what lets a
-    // loop stream traces AND keep a steer prompt the user can inject into — no
-    // cursor/width math, readline owns the redraw. Reassigned to the real impl
-    // once rl exists; until then (no loop can be running yet) it just appends.
-    let printAbove = (text) => { process.stdout.write(`${text}\n`); };
+    let pendingProposal = null;
+    let pendingQuestion = null;
     // Streams, coalesced: one start line, one conclusion line, and tiny concluded
     // outputs inlined (the single bounded content fetch the TUI makes — SPEC §5.3).
     const streams = new StreamTrace();
@@ -620,12 +520,27 @@ export const runTui = async (transport, workspace, opts) => {
         reasoningPolicy: workerReasoning.policy,
         yolo: opts.yolo,
     });
-    process.stdout.write(`\x1b[2m${header}\x1b[0m\n\n`);
+    const surface = new TuiSurface();
+    const releaseGuards = TerminalGuards.install(surface);
+    printAbove = (text) => surface.append(text);
+    surface.append(`\x1b[2m${header}\x1b[0m`);
+    surface.append("");
     if (reasoningFailure !== undefined)
-        process.stdout.write(`${renderTuiFailure(reasoningFailure)}\n`);
+        printAbove(renderTuiFailure(reasoningFailure));
     // Client-owned lifecycle and model lead the input affordance; ephemeral
     // derivation, search, and branch work share its final activity position.
-    const buildPrompt = () => {
+    const statusContext = () => ({
+        workspace: current.name,
+        worker: conversationWorker,
+        child: workerSpawnModel === null ? null : resolvedModelLabel(workerSpawnModel),
+        tally,
+        runningSince,
+        now: Date.now(),
+    });
+    const buildStatus = () => {
+        if (authoritativeStatus !== null) {
+            return renderStatusLine(authoritativeStatus, statusContext(), { idleGlyph: opts.yolo ? "🔥" : "" });
+        }
         const branchCompleted = Number(branchBatch?.completed);
         const branchTotal = Number(branchBatch?.total);
         const branchPercent = branchBatch !== null
@@ -634,9 +549,6 @@ export const runTui = async (transport, workspace, opts) => {
             && branchTotal > 0
             ? Math.floor((branchCompleted / branchTotal) * 100)
             : null;
-        const activePercent = embedding ? embeddingPercent
-            : searchFetching ? searchPercent
-                : branchPercent;
         const activity = embedding ? { label: "indexing", percent: embeddingPercent }
             : searchFetching ? { label: "search", percent: searchPercent }
                 : branchPercent !== null ? { label: "branches", percent: branchPercent }
@@ -644,28 +556,20 @@ export const runTui = async (transport, workspace, opts) => {
         const model = workerModel === null
             ? opts.modelSelector ?? activeAlias ?? null
             : resolvedModelLabel(workerModel);
-        return renderInputPrompt(opts.yolo, activePercent, inFlight, {
-            lifecycle,
+        return renderStatusLine({
+            lifecycle: inFlight ? "running" : lifecycle,
             model,
-            turn: observedTurn,
+            packetCount: null,
             activity,
-        });
+        }, statusContext(), { idleGlyph: opts.yolo ? "🔥" : "" });
     };
-    // Bracketed-paste buffering (paste.ts): a multi-line paste must become ONE
-    // prompt, not one loop.run per line. readline reads a PassThrough we feed
-    // filtered stdin into; since the input is no longer the TTY directly, raw
-    // mode and ?2004 are ours to manage (terminal:true keeps readline's
-    // keypress decoding). Stream plumbing only — no cursor/width math.
-    const paste = new PasteFilter();
-    const input = new PassThrough();
-    process.stdin.setRawMode?.(true);
-    process.stdout.write("\x1b[?2004h");
-    const rl = readline.createInterface({
-        input,
-        output: process.stdout,
-        terminal: true,
-        prompt: buildPrompt(),
-        completer: makeCompleter(() => aliasCache, process.cwd(), () => workerReasoning.supportedPolicies, async (provider) => {
+    const reprompt = () => surface.setStatus(buildStatus());
+    const repromptPreserving = reprompt;
+    surface.setAutocompleteProvider(makeAutocompleteProvider({
+        getAliases: () => aliasCache,
+        cwd: process.cwd(),
+        getReasoningPolicies: () => workerReasoning.supportedPolicies,
+        getProviderModels: async (provider) => {
             // One bounded page per provider, cached for the session: lazy,
             // provider-scoped, never the whole catalog.
             const cached = providerModelCache.get(provider);
@@ -677,95 +581,40 @@ export const runTui = async (transport, workspace, opts) => {
                 .filter((selector) => typeof selector === "string");
             providerModelCache.set(provider, selectors);
             return selectors;
-        }),
-    });
-    const reprompt = () => {
-        readline.cursorTo(process.stdout, 0);
-        readline.clearLine(process.stdout, 0);
-        rl.setPrompt(buildPrompt());
-        rl.prompt();
-    };
-    // Repaint the prompt preserving a typed-in inject (rl.prompt(true)) — used
-    // when active progress changes mid-typing. The
-    // printAbove idiom; readline owns the redraw, no cursor/width math.
-    const repromptPreserving = () => {
-        readline.cursorTo(process.stdout, 0);
-        readline.clearLine(process.stdout, 0);
-        rl.setPrompt(buildPrompt());
-        rl.prompt(true);
-    };
-    const clearPromptAndLiveReasoning = () => {
-        readline.cursorTo(process.stdout, 0);
-        readline.clearLine(process.stdout, 0);
-        if (liveReasoning?.tailShown === true) {
-            readline.moveCursor(process.stdout, 0, -1);
-            readline.cursorTo(process.stdout, 0);
-            readline.clearLine(process.stdout, 0);
-            liveReasoning.tailShown = false;
-        }
-    };
-    const redrawLiveReasoning = () => {
-        if (liveReasoning !== null && liveReasoning.tail !== null) {
-            process.stdout.write(`${liveReasoning.tail}\n`);
-            liveReasoning.tailShown = true;
-        }
-        rl.prompt(true);
-    };
-    // Now that rl exists, printAbove can re-render the prompt after each line.
-    // A live reasoning preview remains the final row above it, so concurrent
-    // stream or worker activity cannot corrupt the preview's cursor ownership.
-    printAbove = (text) => {
-        clearPromptAndLiveReasoning();
-        process.stdout.write(`${text}\n`);
-        redrawLiveReasoning();
-    };
+        },
+        getFunctionalityAliases: async (family) => {
+            const result = await transport.rpc(`worker.${family}.list`, {});
+            if (!Array.isArray(result.definitions))
+                throw new TypeError(`worker.${family}.list returned an invalid result.`);
+            return result.definitions
+                .map((definition) => definition !== null && typeof definition === "object"
+                ? definition.alias
+                : undefined)
+                .filter((alias) => typeof alias === "string");
+        },
+    }));
     const presentReasoning = (update) => {
         if (update.phase === "start") {
             if (liveReasoning !== null)
                 throw new TypeError("A second reasoning message started before the first ended.");
-            liveReasoning = {
-                messageId: update.messageId,
-                columns: process.stdout.columns ?? 80,
-                committed: 0,
-                tail: null,
-                tailShown: false,
-            };
+            liveReasoning = { messageId: update.messageId, rendered: "" };
             return;
         }
         if (liveReasoning === null || liveReasoning.messageId !== update.messageId) {
             throw new TypeError(`Reasoning ${update.phase} did not match the active message.`);
         }
-        clearPromptAndLiveReasoning();
+        const rendered = renderReasoning(update.content);
+        liveReasoning.rendered = rendered;
         if (update.phase === "content") {
-            const frame = renderReasoningFrame(update.content, liveReasoning.columns);
-            if (frame.committed.length < liveReasoning.committed) {
-                throw new TypeError("Growing reasoning replaced an already committed terminal row.");
-            }
-            const rows = frame.committed.slice(liveReasoning.committed);
-            if (rows.length > 0)
-                process.stdout.write(`${rows.join("\n")}\n`);
-            liveReasoning.committed = frame.committed.length;
-            liveReasoning.tail = frame.tail;
-            redrawLiveReasoning();
+            surface.setLive(rendered);
             return;
         }
-        const frame = renderReasoningFrame(update.content, liveReasoning.columns);
-        const rows = frame.committed.slice(liveReasoning.committed);
-        if (rows.length > 0)
-            process.stdout.write(`${rows.join("\n")}\n`);
-        if (frame.tail !== null)
-            process.stdout.write(`${frame.tail}\n`);
+        surface.setLive(null);
+        if (rendered.length > 0)
+            printAbove(rendered);
         liveReasoning = null;
-        rl.prompt(true);
-    };
-    // Replace the whole readline buffer with `text`, public-API only: Ctrl-U kills
-    // to line start, Ctrl-K from there to the end (clearing whatever was typed),
-    // then type the new text. No private fields, no cursor/width math.
-    const setLine = (text) => {
-        rl.write(null, { ctrl: true, name: "u" });
-        rl.write(null, { ctrl: true, name: "k" });
-        rl.write(text);
     };
+    const setLine = (text) => surface.setInput(text);
     // Alt-p/Alt-n: walk the REAL target URIs of prior operations and template a
     // `## LOOK0 (<that uri>)` line into the buffer — an editable starting point
     // (hand-edit before Enter). Nothing to cycle → leave the line be.
@@ -784,89 +633,62 @@ export const runTui = async (transport, workspace, opts) => {
         printAbove(content.length > 0 ? content : `  \x1b[2m(look ${r.status}: no content)\x1b[0m`);
         return r;
     };
-    // Multi-line composition. The non-submitting newline keys insert a single ↵
-    // marker into readline's ONE line; Enter submits, expanding ↵→\n. Keeping it
-    // one readline line means backspace/arrows/history edit across newlines
-    // natively — no second buffer, no cursor/width math, the same idiom as
-    // paste. Two keys, one behavior (see isNewlineKey): Ctrl-J (LF) on every
-    // terminal, Alt-Enter (Meta+CR) on most; Shift-Enter is unhandled by design
-    // (needs the kitty/modifyOtherKeys protocols). Interposing on stdin
-    // (paste.ts feeds readline a PassThrough) is where we catch the keys, so the
-    // suppressed bytes never reach readline — which would otherwise submit on
-    // `\n`. Each interactive keypress is its own chunk, so an exact match holds.
-    // onStdin is the single keyboard dispatcher: pending-proposal key, paste,
-    // the newline keys, the Alt-shortcuts, else readline. The proposal/shortcut
-    // handlers are forward-declared (assigned once verbCtx exists).
-    let pendingProposal = null;
+    // pi-tui owns multiline input, paste normalization, modern keyboard
+    // negotiation, history navigation, wrapping, cursor placement, and IME.
+    // Plurnk's listener consumes only product-level gestures before the editor.
     let onProposalKey = () => { };
-    // A pending request-user-input question ({§question-tool}): answered by TYPING
-    // (a number picks an enum choice; anything else is free response), NOT the
-    // a/e/r/c keypress path — free response needs text. The line handler
-    // intercepts while this is set.
-    let pendingQuestion = null;
     let dispatchShortcut = () => { };
-    const onStdin = (chunk) => {
-        const text = chunk.toString("utf8");
-        // Esc interrupts (plurnk#25) — the agent-CLI convention: bare Esc with
-        // a loop in flight cancels it (same path as the first Ctrl-C); idle it
-        // clears the composed line. Read BEFORE the paste filter, which would
-        // otherwise hold a lone ESC as a possible split \x1b[200~ prefix. An
-        // exact lone-ESC chunk while no paste is open is the KEY — the same
-        // whole-chunk rule the Alt-shortcuts rely on.
-        if (text === "\x1b" && paste.idle()) {
+    let requestClose = () => { };
+    const removeInputListener = surface.addInputListener((text) => {
+        if (matchesKey(text, "escape")) {
             if (inFlight) {
                 requestCancel("user_escape");
-                return;
-            }
-            if (rl.line.length > 0) {
-                rl.write(null, { ctrl: true, name: "e" });
-                rl.write(null, { ctrl: true, name: "u" });
+                return { consume: true };
             }
-            return;
+            if (surface.editor.getText().length > 0)
+                surface.setInput("");
+            return { consume: true };
+        }
+        if (matchesKey(text, "ctrl+c")) {
+            if (inFlight && !cancelRequested)
+                requestCancel("user_sigint");
+            else
+                requestClose();
+            return { consume: true };
+        }
+        if (matchesKey(text, "ctrl+d") && surface.editor.getText().length === 0) {
+            requestClose();
+            return { consume: true };
         }
-        const forward = paste.feed(text);
-        if (forward.length === 0)
-            return;
         // A pending proposal + an EMPTY prompt line: a single review key
         // (a/e/r/c) resolves it. Anything else — including typing `/accept` —
-        // falls through to readline, so the no-modifier verb fallback works.
-        if (pendingProposal !== null && rl.line.length === 0 && /^[aerc]$/i.test(forward)) {
-            onProposalKey(forward);
-            return;
+        // falls through to the editor, so the typed verb fallback works.
+        if (pendingProposal !== null && surface.editor.getText().length === 0 && /^[aerc]$/i.test(text)) {
+            onProposalKey(text);
+            return { consume: true };
         }
-        if (isNewlineKey(forward)) {
-            rl.write(NL_MARK);
-            return;
-        }
-        const dir = cycleKey(forward);
+        const dir = cycleKey(text);
         if (dir !== null) {
             cycleLook(dir);
-            return;
+            return { consume: true };
         }
-        const verb = altShortcut(forward);
+        const verb = altShortcut(text);
         if (verb !== null) {
             dispatchShortcut(verb);
-            return;
+            return { consume: true };
         }
-        input.write(forward);
-    };
-    process.stdin.on("data", onStdin);
-    // Cross-restart up/down history from the daemon (svc#238) — non-blocking.
-    void seedPromptHistory({ call: (m, p) => transport.rpc(m, p) }, current.id, rl);
-    // Proposal lifecycle — NON-BLOCKING. Server-resolved (flags.auto/noProposals)
-    // settle in-process → skip. --yolo auto-accepts. A real
-    // proposal renders its menu and parks as `pendingProposal` (queue beyond),
-    // WITHOUT pausing readline or grabbing stdin: resolve via a single key
-    // (onStdin, above) OR the typed `/accept`/`/reject`/`/cancel`/`/edit` verbs.
-    // Only the `$EDITOR` path hands the terminal off — and only for its spawn.
+        return undefined;
+    });
+    void seedPromptHistory({ call: (m, p) => transport.rpc(m, p) }, current.id, surface);
+    // Proposal lifecycle stays non-blocking. The editor remains available for
+    // a/e/r/c or the equivalent typed verbs; only $EDITOR takes terminal custody.
     const proposalQueue = [];
     const showNextProposal = () => {
         if (pendingProposal !== null || proposalQueue.length === 0)
             return;
         pendingProposal = proposalQueue.shift();
-        process.stdout.write(`\r\x1b[2K${renderProposalMenu(pendingProposal)}\n`
-            + `\x1b[2m  resolve: a/e/r/c  or  /accept /reject /cancel /edit\x1b[0m\n`);
-        reprompt();
+        printAbove(`${renderProposalMenu(pendingProposal)}\n`
+            + "\x1b[2m  resolve: a/e/r/c  or  /accept /reject /cancel /edit\x1b[0m");
     };
     const resolvePending = async (resolution) => {
         const p = pendingProposal;
@@ -877,36 +699,27 @@ export const runTui = async (transport, workspace, opts) => {
             await transport.resolve({ logEntryId: p.logEntryId, ...resolution });
         }
         catch (cause) {
-            process.stdout.write(`${renderTuiFailure(cause)}\n`);
+            printAbove(renderTuiFailure(cause));
         }
         showNextProposal();
-        reprompt();
     };
-    // `e`/`/edit` → $EDITOR. It needs the terminal: detach onStdin + raw-off for
-    // the spawn, restore after. The ONE place the non-blocking design still hands
-    // off — bounded to the editor's lifetime.
+    // `e`/`/edit` → $EDITOR through pi-tui's bounded terminal handoff.
     const editAndResolve = async () => {
         const p = pendingProposal;
         if (p === null)
             return;
-        process.stdin.off("data", onStdin);
-        process.stdin.setRawMode?.(false);
         let resolution;
         try {
-            resolution = (await keyToResolution("e", p)) ?? { decision: "cancel", outcome: "edit_failed" };
+            resolution = (await surface.handOff(() => keyToResolution("e", p)))
+                ?? { decision: "cancel", outcome: "edit_failed" };
         }
         catch (cause) {
-            process.stdout.write(`${renderTuiFailure(cause)}\n`);
+            printAbove(renderTuiFailure(cause));
             resolution = { decision: "cancel", outcome: "edit_error" };
         }
-        finally {
-            process.stdin.setRawMode?.(true);
-            process.stdin.resume();
-            process.stdin.on("data", onStdin);
-        }
         await resolvePending(resolution);
     };
-    // Single review key (from onStdin): a/r/c resolve directly, e edits.
+    // Single review key: a/r/c resolve directly, e edits.
     onProposalKey = (key) => {
         if (key.toLowerCase() === "e") {
             void editAndResolve();
@@ -981,13 +794,15 @@ export const runTui = async (transport, workspace, opts) => {
             const target = entryTarget(entry);
             if (target !== null)
                 priorTargets.push(target);
-            if (entry.origin === "model" && Number.isSafeInteger(entry.turn_seq))
-                observedTurn = entry.turn_seq;
-            printAbove(renderLogEntry(entry, process.stdout.columns ?? 80));
+            printAbove(renderLogEntry(entry, surface.columns || 80));
         },
         onNotice: handleNotice,
         onProblem: (problem) => printAbove(renderDiagnostic(problem)),
         onBranchBatch: handleBranchBatch,
+        onStatus: (gauge) => {
+            authoritativeStatus = projectStatusGauge(gauge.plurnk.status);
+            repromptPreserving();
+        },
         onStream: (payload) => {
             // One channel for the lifecycle: concluded carries its exact result, a start
             // event carries state. One start line, one conclusion line, tiny outputs inlined.
@@ -1010,8 +825,6 @@ export const runTui = async (transport, workspace, opts) => {
             }
         },
         onProposal: (p) => {
-            if (isServerResolved(p))
-                return;
             if (opts.yolo) {
                 void transport.resolve({ logEntryId: p.logEntryId, decision: "accept", outcome: "client_yolo" })
                     .catch((cause) => printAbove(`  \x1b[31mauto-accept failed: ${cause instanceof Error ? cause.message : String(cause)}\x1b[0m`));
@@ -1061,6 +874,10 @@ export const runTui = async (transport, workspace, opts) => {
         }
     };
     derivationPoll = setInterval(() => { void pollDerivation(); }, 1_000);
+    // The running loop's elapsed time ticks in the status row.
+    const statusTick = setInterval(() => { if (inFlight)
+        reprompt(); }, 1_000);
+    statusTick.unref();
     void pollDerivation();
     // Verbs + read-only subcommands call rpc.call(...) only; route that through the
     // live transport (WS, or the bridge's management plane over /plurnk/rpc). A
@@ -1080,7 +897,7 @@ export const runTui = async (transport, workspace, opts) => {
         getWorkspace: () => current,
         setWorkspace: (s) => { current = s; },
         switchWorkspace: (name) => transport.useSession(name, { projectRoot: opts.projectRoot, client: opts.client }),
-        write: (text) => { process.stdout.write(text); },
+        write: (text) => { printAbove(text); },
         importFile: async (rest) => {
             const abs = isAbsolute(rest) ? rest : resolve(process.cwd(), rest);
             let content;
@@ -1088,14 +905,14 @@ export const runTui = async (transport, workspace, opts) => {
                 content = await readFile(abs, "utf8");
             }
             catch (cause) {
-                process.stdout.write(`  not readable: ${cause instanceof Error ? cause.message : String(cause)}\n`);
+                printAbove(`  not readable: ${cause instanceof Error ? cause.message : String(cause)}`);
                 return;
             }
-            rl.write(paste.stash(content));
+            surface.insertInput(content);
         },
         resolveProposal: async (action) => {
             if (pendingProposal === null) {
-                process.stdout.write("  (no pending proposal)\n");
+                printAbove("  (no pending proposal)");
                 return;
             }
             if (action === "edit") {
@@ -1104,54 +921,55 @@ export const runTui = async (transport, workspace, opts) => {
             }
             await resolvePending({ decision: action });
         },
-        // /editor · Alt-e (plurnk#26): seed $EDITOR with the composed line
-        // (markers expanded), place the result BACK on the line — never
-        // auto-submit (bash Ctrl-X Ctrl-E executes on exit; a prompt line
-        // spends model tokens, so Enter stays the only submit). Same bounded
-        // terminal handoff as proposal edit. Empty buffer ⇒ line unchanged.
+        // /editor · Alt-e: place the edited multiline value back in the composer;
+        // Enter remains the only submit gesture.
         composeInEditor: async () => {
-            process.stdin.off("data", onStdin);
-            process.stdin.setRawMode?.(false);
             let edited = null;
             try {
-                edited = await editInEditor(paste.expand(expandNewlines(rl.line)), ".md");
+                edited = await surface.handOff(() => editInEditor(surface.editor.getExpandedText(), ".md"));
             }
             catch (cause) {
-                process.stdout.write(`${renderTuiFailure(cause)}\n`);
-            }
-            finally {
-                process.stdin.setRawMode?.(true);
-                process.stdin.resume();
-                process.stdin.on("data", onStdin);
+                printAbove(renderTuiFailure(cause));
             }
             if (edited === null)
                 return;
-            rl.write(null, { ctrl: true, name: "e" });
-            rl.write(null, { ctrl: true, name: "u" });
-            rl.write(paste.stash(edited.replace(/\n$/, "")));
+            surface.setInput(edited.replace(/\n$/, ""));
         },
     };
-    // Alt-<letter> shortcut → run the verb. Wipe the prompt line, dispatch
-    // through the same handleVerb the typed `/verb` uses (the partial prompt in
-    // readline's buffer survives), then reprompt. Print-above pattern; no math.
+    // Alt-<letter> shortcut → the same verb contract as typed `/verb`.
     dispatchShortcut = (verb) => {
-        process.stdout.write("\r\x1b[2K");
         void (async () => {
             try {
                 if (await handleVerb(verb, verbCtx) === "quit") {
-                    rl.close();
+                    requestClose();
                     return;
                 }
             }
             catch (cause) {
-                process.stdout.write(`${renderTuiFailure(cause)}\n`);
+                printAbove(renderTuiFailure(cause));
             }
             reprompt();
         })();
     };
-    reprompt();
     return new Promise((resolve) => {
-        rl.on("line", async (line) => {
+        let closed = false;
+        const close = () => {
+            if (closed)
+                return;
+            closed = true;
+            shuttingDown = true;
+            if (derivationPoll !== null)
+                clearInterval(derivationPoll);
+            transport.shutdown();
+            removeInputListener();
+            surface.stop();
+            process.stdout.write(`  \x1b[2mresume this workspace:  plurnk --workspace ${current.name}\x1b[0m\n`);
+            resolve();
+        };
+        requestClose = close;
+        const submit = async (line) => {
+            if (line.trim().length > 0)
+                printAbove(renderSubmittedInput(line, opts.yolo));
             // A pending request-user-input question consumes the typed line as its
             // answer, BEFORE any verb/prompt/inject handling: a number picks an
             // enum choice, anything else is free response (or raw JSON for a
@@ -1170,9 +988,7 @@ export const runTui = async (transport, workspace, opts) => {
                 reprompt();
                 return;
             }
-            // Expand typed ↵ markers (Ctrl-J / Alt-Enter newlines) FIRST, then
-            // paste markers — so a pasted literal ↵ stays literal.
-            const trimmed = paste.expand(expandNewlines(line)).trim();
+            const trimmed = line.trim();
             if (trimmed.length === 0) {
                 reprompt();
                 return;
@@ -1193,12 +1009,12 @@ export const runTui = async (transport, workspace, opts) => {
                 }
                 try {
                     if (await handleVerb(trimmed, verbCtx) === "quit") {
-                        rl.close();
+                        close();
                         return;
                     }
                 }
                 catch (cause) {
-                    process.stdout.write(`${renderTuiFailure(cause)}\n`);
+                    printAbove(renderTuiFailure(cause));
                 }
                 reprompt();
                 return;
@@ -1221,11 +1037,12 @@ export const runTui = async (transport, workspace, opts) => {
             }
             inFlight = true;
             lifecycle = "running";
-            observedTurn = null;
+            authoritativeStatus = null;
             // Keep a live steer prompt for the duration of the loop so traces can
             // print above an editable injection row.
             reprompt();
             const start = Date.now();
+            runningSince = start;
             let turnCount = 0;
             let terminalResult = { status: 0 };
             let hitMaxTurns = false;
@@ -1249,14 +1066,13 @@ export const runTui = async (transport, workspace, opts) => {
                     terminalResult = await transport.rpc("op.exec", { command });
                 }
                 else {
-                    // Prompt. `? ` = ask (read-only loop, flags.mode="ask");
-                    // `: ` = act. Per-line prefix overrides --flags mode.
-                    const { flags: lineFlags, prompt: promptText } = lineMode(trimmed, opts.loopFlags);
+                    // Prompt prefixes are client policy projections. `?` narrows
+                    // the ordinary loop by denying EXEC and retaining review;
+                    // `:` is the unmodified base policy.
+                    const { policy, prompt: promptText } = linePolicy(trimmed, opts.loopPolicy);
                     // {§worker-model-selection} — no model selector rides the loop: the
                     // worker owns the model; /model and /child persisted it server-side.
-                    const loopParams = { prompt: promptText, requestUserInput: opts.requestUserInput !== false };
-                    if (lineFlags !== undefined && Object.keys(lineFlags).length > 0)
-                        loopParams.flags = lineFlags;
+                    const loopParams = { policy };
                     if (opts.maxTurns !== undefined)
                         loopParams.maxTurns = opts.maxTurns;
                     const openPaths = extractOpenPaths(promptText); // @file refs → daemon turn-0 READs (#260)
@@ -1270,6 +1086,14 @@ export const runTui = async (transport, workspace, opts) => {
                     hitMaxTurns = t.hitMaxTurns;
                     turnCount = t.turnIds?.length ?? 0;
                     usage = t.usage;
+                    if (t.workerId !== undefined && t.workerId !== conversationWorkerId) {
+                        conversationWorkerId = t.workerId;
+                        const { workers } = await transport.rpc("workspace.workers");
+                        const hit = workers.find((worker) => worker.id === conversationWorkerId);
+                        if (hit === undefined)
+                            throw new Error(`worker ${conversationWorkerId} concluded a loop but workspace.workers does not list it`);
+                        conversationWorker = hit.name;
+                    }
                 }
                 lifecycle = terminalResult.status === 202 ? "parked"
                     : terminalResult.status === 499 ? "cancelled"
@@ -1283,38 +1107,25 @@ export const runTui = async (transport, workspace, opts) => {
                 printAbove(renderTuiFailure(cause));
             }
             finally {
+                tally = tallyOutcome(tally, { turns: turnCount, wallMs: Date.now() - start, usage });
+                runningSince = null;
                 inFlight = false;
                 cancelRequested = false;
                 pendingQuestion = null; // loop ended (incl. cancel) → drop any unanswered question
                 reprompt();
             }
-        });
-        rl.on("close", () => {
-            shuttingDown = true; // intentional teardown — the rpc.close that follows isn't a "lost connection"
-            if (derivationPoll !== null)
-                clearInterval(derivationPoll);
-            transport.shutdown(); // suppress the transport's connection-lost reject on an intentional quit
-            process.stdout.write("\x1b[?2004l");
-            process.stdin.off("data", onStdin);
-            process.stdin.setRawMode?.(false);
-            process.stdin.pause();
-            // Steal pi's nicety: hand back the one-liner to pick this workspace up.
-            process.stdout.write(`\n  \x1b[2mresume this workspace:  plurnk --workspace ${current.name}\x1b[0m\n`);
-            resolve();
-        });
-        rl.on("SIGINT", () => {
-            // First Ctrl-C with a dispatch in flight: cancel the run's active
-            // drain via the loop.cancel action; the pending loop resolves with
-            // finalStatus 499 and the REPL continues. Second Ctrl-C (or idle
-            // Ctrl-C) exits — escape hatch for dispatches a drain-cancel can't
-            // unblock (op.parse). A failed cancel SURFACES — a stop button that
-            // silently does nothing is the worst kind of broken.
-            if (inFlight && !cancelRequested) {
-                requestCancel("user_sigint");
-                return;
-            }
-            rl.close();
-        });
+        };
+        surface.editor.onSubmit = (line) => {
+            if (line.trim().length > 0)
+                surface.editor.addToHistory(line);
+            void submit(line);
+        };
+        reprompt();
+        surface.start();
+    }).finally(() => {
+        clearInterval(statusTick);
+        releaseGuards();
+        surface.stop();
     });
 };
 //# sourceMappingURL=tui.js.map