@pugi/cli 0.1.0-alpha.10

package/dist/tui/device-flow.js

@@ -0,0 +1,142 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { Box, Text, useInput } from 'ink';
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+const ACCENT_CYAN = 'cyan';
+const ACCENT_RED = 'red';
+/**
+ * P2-1 (triple-review 2026-05-24): both `userCode` and
+ * `verificationUrl` originate from a server response and would render
+ * verbatim into Ink `<Text>`. A hostile or compromised server could
+ * embed ANSI escape sequences (clear screen, cursor moves, hyperlink
+ * faking) and they would EXECUTE in the user's terminal. We whitelist
+ * the user code to the documented alphabet (uppercase letters, digits,
+ * dashes) and clamp the URL to the same safe-http guard used by the
+ * auto-open helper. Anything outside the whitelist renders as a
+ * `<invalid>` placeholder so the visual contract stays intact while
+ * the dangerous bytes never reach the terminal.
+ */
+const USER_CODE_PATTERN = /^[A-Z0-9-]{1,16}$/;
+function sanitizeUserCode(code) {
+    return USER_CODE_PATTERN.test(code) ? code : '<invalid>';
+}
+function hasControlChar(input) {
+    // Reject any C0 (0x00-0x1F, 0x7F) or C1 (0x80-0x9F) control byte.
+    // ESC (0x1B) is the gateway character for every ANSI escape sequence
+    // we care about (CSI, OSC, hyperlink), and CSI alone (0x9B) is the
+    // C1 single-byte form some terminals still honour.
+    for (let i = 0; i < input.length; i += 1) {
+        const code = input.charCodeAt(i);
+        if (code <= 0x1f)
+            return true;
+        if (code === 0x7f)
+            return true;
+        if (code >= 0x80 && code <= 0x9f)
+            return true;
+    }
+    return false;
+}
+function sanitizeDisplayUrl(url) {
+    // Reject control characters BEFORE handing to `new URL`. The URL
+    // parser preserves ESC bytes inside the path, so a server response
+    // with an embedded escape would otherwise round-trip into the Ink
+    // render and execute against the user terminal.
+    if (hasControlChar(url))
+        return '<invalid URL>';
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return '<invalid URL>';
+        }
+        return url;
+    }
+    catch {
+        return '<invalid URL>';
+    }
+}
+/**
+ * Pugi device-flow Ink view. Stateless w.r.t. the network — the host
+ * supplies `status` and we render the matching frame.
+ */
+export function DeviceFlow(props) {
+    const copiedFlashMs = props.copiedFlashMs ?? 800;
+    const spinnerIntervalMs = props.spinnerIntervalMs ?? 120;
+    const [copied, setCopied] = useState(false);
+    const [spinnerFrame, setSpinnerFrame] = useState(0);
+    useInput((input, key) => {
+        if (key.escape) {
+            props.onCancel();
+            return;
+        }
+        if (input === 'c' || input === 'C') {
+            // The host owns the clipboard side effect. The component just
+            // signals the intent and surfaces the "Copied!" flash.
+            props.onCopy();
+            setCopied(true);
+            return;
+        }
+        if (key.return && props.status.kind === 'success') {
+            props.onContinue();
+            return;
+        }
+    });
+    // Spinner pulse — only while polling. Pausing the interval on
+    // success/failure avoids a no-op timer surviving past the final
+    // render frame.
+    useEffect(() => {
+        if (props.status.kind !== 'polling')
+            return;
+        const handle = setInterval(() => {
+            setSpinnerFrame((current) => (current + 1) % SPINNER_FRAMES.length);
+        }, spinnerIntervalMs);
+        return () => clearInterval(handle);
+    }, [props.status.kind, spinnerIntervalMs]);
+    // "Copied!" auto-clear so the chip flashes briefly without sticking.
+    useEffect(() => {
+        if (!copied)
+            return;
+        const handle = setTimeout(() => setCopied(false), copiedFlashMs);
+        return () => clearTimeout(handle);
+    }, [copied, copiedFlashMs]);
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 1, children: [_jsx(Box, { children: _jsx(Text, { bold: true, color: ACCENT_CYAN, children: "Authorize Pugi CLI" }) }), _jsx(CodeChip, { code: sanitizeUserCode(props.userCode) }), _jsx(BrowserHintRow, { opened: props.browserOpened, url: sanitizeDisplayUrl(props.verificationUrl), copied: copied }), _jsx(Box, { marginTop: 1, children: _jsx(StatusRow, { status: props.status, spinnerFrame: spinnerFrame }) }), _jsx(Box, { marginTop: 1, children: _jsx(FooterHint, { status: props.status }) })] }));
+}
+/**
+ * Centered short-code "chip". The Pugi device-flow user code is
+ * always the 9-character "XXXX-XXXX" form (4 + dash + 4) generated by
+ * the Anvil device-flow start endpoint — we render it in cyan-bold so
+ * the user's eye lands on it instantly when comparing against the
+ * cabinet page.
+ */
+function CodeChip({ code }) {
+    return (_jsx(Box, { marginTop: 1, justifyContent: "center", children: _jsx(Text, { bold: true, color: ACCENT_CYAN, children: `  ${code}  ` }) }));
+}
+function BrowserHintRow({ opened, url, copied, }) {
+    if (copied) {
+        return (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: ACCENT_CYAN, children: "Copied!" }) }));
+    }
+    if (opened) {
+        return (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Browser opened to" }), _jsx(Text, { dimColor: true, children: url })] }));
+    }
+    return (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Browser didn't open? Use the URL below to sign in (c to copy)" }), _jsx(Text, { children: url })] }));
+}
+function StatusRow({ status, spinnerFrame, }) {
+    if (status.kind === 'polling') {
+        const glyph = SPINNER_FRAMES[spinnerFrame] ?? SPINNER_FRAMES[0];
+        return (_jsxs(Text, { children: [_jsx(Text, { color: ACCENT_CYAN, children: glyph }), _jsx(Text, { children: ' Waiting for browser approval…' })] }));
+    }
+    if (status.kind === 'success') {
+        return (_jsxs(Text, { children: [_jsx(Text, { color: ACCENT_CYAN, children: '✓ ' }), _jsx(Text, { color: ACCENT_CYAN, children: `Logged in as ${status.principalLabel}` })] }));
+    }
+    // failure
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { color: ACCENT_RED, children: '✗ ' }), _jsx(Text, { color: ACCENT_RED, children: status.reason })] }), status.hint ? _jsx(Text, { dimColor: true, children: status.hint }) : null] }));
+}
+function FooterHint({ status }) {
+    if (status.kind === 'success') {
+        return _jsx(Text, { dimColor: true, children: "Press Enter to continue\u2026" });
+    }
+    if (status.kind === 'failure') {
+        return _jsx(Text, { dimColor: true, children: "Esc to dismiss \u00B7 Run `pugi login` again to retry" });
+    }
+    return _jsx(Text, { dimColor: true, children: "Esc to cancel \u00B7 c to copy URL" });
+}
+//# sourceMappingURL=device-flow.js.map

package/dist/tui/input-box.js

@@ -0,0 +1,474 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * REPL input box - Sprint α6.14 (REPL UX P0 wave 1).
+ *
+ * Bordered, cursor-aware input box matching Claude Code / Codex CLI
+ * aesthetics. Layered upgrade over α5.7:
+ *
+ *   - Top divider (full-width cyan rule) anchors the input below the
+ *     main pane and gives the operator a clear visual seam.
+ *   - Rounded cyan border wraps the prompt + line + cursor.
+ *   - Cursor follows the caret position (left/right arrows + Home/End
+ *     reposition without losing the trailing text).
+ *   - Single-arrow `›` prompt in brand cyan; dim continuation prompt
+ *     `┊` when the input wraps past the available width so the operator
+ *     sees that they are still inside one logical line.
+ *   - History navigation (↑/↓), slash palette inline suggestion, Esc
+ *     cancel, Ctrl+C ×2 exit remain wired identically to α5.7.
+ *
+ * State that belongs in this component:
+ *   - `line` (string)             - current buffer
+ *   - `cursor` (number)           - caret offset into `line`
+ *   - `history` (string[])        - session-local; persistence lands in
+ *                                   commit 2 (per-workspace JSONL).
+ *   - `historyIndex` (number)     - -1 when not navigating
+ *
+ * Brand voice gate: no forbidden words. ASCII-only glyphs.
+ */
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { Box, Text, useInput, useStdout } from 'ink';
+import { append as appendHistory, read as readHistory, } from '../core/repl/history.js';
+import { applyQuery, currentBrief, cycle, initialSearchState, } from '../core/repl/history-search.js';
+import { SlashPalette, completePalette, filterPalette, } from './slash-palette.js';
+import { EMPTY_KILL_RING, killToLineEnd, killToLineStart, killWordBackward, yankAtCursor, } from '../core/repl/kill-ring.js';
+import { readClipboard } from '../core/repl/clipboard-read.js';
+const CTRL_C_DOUBLE_TAP_MS = 1_000;
+/** Width subtracted from the terminal width so the border + padding fit. */
+const FRAME_OVERHEAD_COLUMNS = 4;
+/** Fallback width when ink cannot read stdout (e.g. test harness). */
+const FALLBACK_COLUMNS = 80;
+/** Cursor blink interval (ms). 530ms matches the GNOME / iTerm2 default. */
+const CURSOR_BLINK_MS = 530;
+/**
+ * Strip ANSI escape sequences, bracketed-paste markers, and C0 control
+ * bytes (except `\n` and `\t`) from clipboard text before splicing it
+ * into the buffer. Keystroke input never reaches the input box with
+ * escapes (ink filters them), so the buffer assumes printable text +
+ * the two whitespace forms we preserve. Clipboard text bypasses ink's
+ * filter, so we re-apply the same constraint here to neutralise any
+ * escape sequence a hostile or accidental copy might carry into the
+ * operator's terminal.
+ */
+export function sanitiseClipboardText(raw) {
+    return raw
+        .replace(/\x1b\[200~/g, '')
+        .replace(/\x1b\[201~/g, '')
+        .replace(/\x1b\[[0-9;?]*[A-Za-z]/g, '')
+        .replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, '')
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
+}
+export function InputBox(props) {
+    // Seed history from disk on mount so the operator can ↑ to last
+    // session's brief immediately. Memoised so we read the file once per
+    // workspace, not on every render.
+    const seededHistory = useMemo(() => {
+        if (!props.workspaceSlug)
+            return [];
+        const entries = readHistory({
+            home: props.historyHome,
+            workspaceSlug: props.workspaceSlug,
+        });
+        return entries.map((e) => e.brief);
+    }, [props.workspaceSlug, props.historyHome]);
+    const [line, setLine] = useState(props.initial ?? '');
+    const [cursor, setCursor] = useState(props.initial?.length ?? 0);
+    const [history, setHistory] = useState(seededHistory);
+    const [historyIndex, setHistoryIndex] = useState(-1);
+    const [lastCtrlCAt, setLastCtrlCAt] = useState(undefined);
+    const [cursorVisible, setCursorVisible] = useState(true);
+    // Ctrl+R / Ctrl+S reverse-search mode. Undefined when idle, a
+    // HistorySearchState while the operator is searching.
+    const [search, setSearch] = useState(undefined);
+    // Draft preserved while the operator searches so Esc returns the
+    // pre-search buffer instead of dropping it on the floor.
+    const [draftBeforeSearch, setDraftBeforeSearch] = useState('');
+    // Slash palette state. When the buffer starts with `/` the palette
+    // renders, ↑/↓ selects a row, Tab autocompletes, Enter runs.
+    const [paletteIndex, setPaletteIndex] = useState(0);
+    // Operator-toggled palette suppression. Esc closes the palette
+    // without clearing the buffer (useful for `/help` text dispatch).
+    const [paletteSuppressed, setPaletteSuppressed] = useState(false);
+    // Readline-style kill ring backing Ctrl+U / Ctrl+K / Ctrl+W / Ctrl+Y.
+    const [killRing, setKillRing] = useState(EMPTY_KILL_RING);
+    // Soft counter; bumping forces Ink to re-render the surrounding
+    // panes when Ctrl+L wipes the terminal (the parent React tree is
+    // otherwise stable and would not redraw on a stdout.write alone).
+    const [, setRedrawTick] = useState(0);
+    const now = props.now ?? Date.now;
+    const { stdout } = useStdout();
+    const columns = stdout?.columns ?? FALLBACK_COLUMNS;
+    const innerWidth = Math.max(20, columns - FRAME_OVERHEAD_COLUMNS);
+    // Refs mirror the latest committed line + cursor so the async clipboard
+    // paste handler can splice against current values without re-entering
+    // React's setState updater (which strict mode invokes twice and would
+    // double-insert the pasted text). The setState updater pattern used to
+    // capture latest line/cursor (see Codex P2 below) is correct under
+    // single-render mode but broken under React 18 strict mode + the
+    // setLine-inside-setCursor nesting we ended up with. Refs are the
+    // canonical escape hatch for "use the most recently committed value
+    // inside a one-shot async callback".
+    const lineRef = useRef(line);
+    const cursorRef = useRef(cursor);
+    useEffect(() => {
+        lineRef.current = line;
+    }, [line]);
+    useEffect(() => {
+        cursorRef.current = cursor;
+    }, [cursor]);
+    // Soft blink so the operator can spot where typing will land. Ink
+    // re-renders only when state changes, so a 530ms toggle is the cheapest
+    // honest cursor we can show without a custom raw-mode dance. Tests
+    // disable the interval so node:test does not see a dangling timer.
+    const blinkEnabled = props.blinkCursor ?? true;
+    useEffect(() => {
+        if (!blinkEnabled)
+            return undefined;
+        const interval = setInterval(() => {
+            setCursorVisible((prev) => !prev);
+        }, CURSOR_BLINK_MS);
+        return () => clearInterval(interval);
+    }, [blinkEnabled]);
+    useInput((input, key) => {
+        if (key.ctrl && input === 'c') {
+            const t = now();
+            if (typeof lastCtrlCAt === 'number' && t - lastCtrlCAt <= CTRL_C_DOUBLE_TAP_MS) {
+                props.onExit();
+                return;
+            }
+            setLastCtrlCAt(t);
+            setLine('');
+            setCursor(0);
+            setSearch(undefined);
+            return;
+        }
+        // Search-mode key handling. Ctrl+R / Ctrl+S cycle, Enter accepts,
+        // Esc cancels (restoring the pre-search draft), backspace shortens
+        // the query, typed characters extend it.
+        if (search) {
+            if (key.ctrl && input === 'r') {
+                setSearch((s) => (s ? cycle(s, 1) : s));
+                return;
+            }
+            if (key.ctrl && input === 's') {
+                setSearch((s) => (s ? cycle(s, -1) : s));
+                return;
+            }
+            if (key.escape) {
+                setSearch(undefined);
+                setLine(draftBeforeSearch);
+                setCursor(draftBeforeSearch.length);
+                return;
+            }
+            if (key.return) {
+                const picked = currentBrief(search);
+                setSearch(undefined);
+                if (picked !== null) {
+                    setLine(picked);
+                    setCursor(picked.length);
+                }
+                else {
+                    setLine(draftBeforeSearch);
+                    setCursor(draftBeforeSearch.length);
+                }
+                return;
+            }
+            if (key.backspace || key.delete) {
+                const nextQuery = search.query.slice(0, -1);
+                setSearch(applyQuery(search, nextQuery, history));
+                return;
+            }
+            if (input && !key.meta && !key.ctrl) {
+                const nextQuery = search.query + input;
+                setSearch(applyQuery(search, nextQuery, history));
+                return;
+            }
+            // Any other key inside search mode is ignored - the operator can
+            // still escape with Esc or cancel via Ctrl+C handled above.
+            return;
+        }
+        if (key.ctrl && input === 'r') {
+            // Enter reverse-search mode. Stash the current buffer so Esc
+            // restores it untouched.
+            setDraftBeforeSearch(line);
+            setSearch(initialSearchState(history));
+            return;
+        }
+        if (key.ctrl && input === 's') {
+            // Symmetric forward search entry. Cycle direction differs once
+            // active; entry seeds the same browse state.
+            setDraftBeforeSearch(line);
+            setSearch(initialSearchState(history));
+            return;
+        }
+        // Readline-style kill ring shortcuts. All four kills push the
+        // removed slice onto the ring; Ctrl+Y yanks the most recent.
+        if (key.ctrl && input === 'u') {
+            const next = killToLineStart(line, cursor, killRing);
+            setLine(next.line);
+            setCursor(next.cursor);
+            setKillRing(next.ring);
+            return;
+        }
+        if (key.ctrl && input === 'k') {
+            const next = killToLineEnd(line, cursor, killRing);
+            setLine(next.line);
+            setCursor(next.cursor);
+            setKillRing(next.ring);
+            return;
+        }
+        if (key.ctrl && input === 'w') {
+            const next = killWordBackward(line, cursor, killRing);
+            setLine(next.line);
+            setCursor(next.cursor);
+            setKillRing(next.ring);
+            return;
+        }
+        if (key.ctrl && input === 'y') {
+            const next = yankAtCursor(line, cursor, killRing);
+            setLine(next.line);
+            setCursor(next.cursor);
+            return;
+        }
+        if (key.ctrl && input === 'l') {
+            // Clear the terminal viewport. ANSI 2J = erase entire screen,
+            // 0;0H = home cursor. We bump the redraw tick so Ink repaints
+            // the surrounding REPL panes on the next frame; without this
+            // ink keeps its diff buffer and we get a half-wiped screen.
+            if (stdout && typeof stdout.write === 'function') {
+                stdout.write('\x1b[2J\x1b[0;0H');
+            }
+            setRedrawTick((t) => t + 1);
+            return;
+        }
+        if (key.ctrl && input === 'v') {
+            // Ctrl+V: read the OS clipboard and insert at cursor. The
+            // platform helper (pbpaste / wl-paste / xclip -o / Get-Clipboard)
+            // is async + best-effort; on failure the buffer is left
+            // untouched and the operator falls back to terminal paste
+            // (Cmd+V on macOS, right-click on Linux).
+            //
+            // Multi-line pastes preserve interior newlines so the operator
+            // sees the full text in the buffer; the Enter-on-buffered-LF
+            // case is left to the operator (they press Enter when ready).
+            //
+            // Refs (lineRef / cursorRef) hold the latest committed values so
+            // the splice runs against the operator's most recent edits even
+            // if they kept typing while pbpaste was in flight. The previous
+            // setLine-inside-setCursor nesting double-inserted under React
+            // 18 strict mode because each setState updater runs twice in
+            // development. Claude P1.
+            //
+            // sanitiseClipboardText strips ANSI escapes, bracketed-paste
+            // markers, and C0 control bytes so a hostile or accidental copy
+            // cannot inject terminal-control sequences. Claude P2.
+            readClipboard()
+                .then((res) => {
+                if (res.text === null)
+                    return;
+                const sanitised = sanitiseClipboardText(res.text);
+                if (sanitised.length === 0)
+                    return;
+                const currentLine = lineRef.current;
+                const currentCursor = cursorRef.current;
+                const newLine = currentLine.slice(0, currentCursor) +
+                    sanitised +
+                    currentLine.slice(currentCursor);
+                const newCursor = currentCursor + sanitised.length;
+                setLine(newLine);
+                setCursor(newCursor);
+            })
+                .catch(() => {
+                // Helper already swallows errors; the catch here is belt +
+                // suspenders so a TypeError never bubbles into the render.
+            });
+            return;
+        }
+        // Compute palette visibility FIRST so Enter can run the focused
+        // palette row instead of submitting a partial `/he` as unknown.
+        // Palette is hidden when the operator pressed Esc on it.
+        const palette = !paletteSuppressed ? filterPalette(line) : { rows: [], totalBeforeLimit: 0 };
+        const paletteOpen = palette.rows.length > 0;
+        const paletteFocusedIndex = palette.rows.length === 0
+            ? 0
+            : Math.min(paletteIndex, palette.rows.length - 1);
+        if (key.return) {
+            // When the palette is open, Enter expands the buffer to the
+            // complete command name (preserving any args past the head)
+            // before submission. Codex review P2.
+            let payload = line;
+            if (paletteOpen) {
+                const completed = completePalette(line, palette.rows, paletteFocusedIndex);
+                if (completed !== null)
+                    payload = completed;
+            }
+            const trimmed = payload.trim();
+            if (trimmed.length > 0) {
+                setHistory((prev) => {
+                    // In-session dedup of consecutive identical entries mirrors
+                    // the on-disk dedup so ↑ never shows duplicates.
+                    if (prev[prev.length - 1] === trimmed)
+                        return prev;
+                    return [...prev, trimmed];
+                });
+                setHistoryIndex(-1);
+                if (props.workspaceSlug) {
+                    // Fire-and-forget. Helper never throws - it returns null
+                    // when storage is unavailable and history degrades to
+                    // session-local for this turn.
+                    appendHistory({
+                        home: props.historyHome,
+                        workspaceSlug: props.workspaceSlug,
+                        brief: trimmed,
+                    });
+                }
+                props.onSubmit(trimmed);
+            }
+            setLine('');
+            setCursor(0);
+            setPaletteSuppressed(false);
+            setPaletteIndex(0);
+            return;
+        }
+        if (key.escape) {
+            if (paletteOpen) {
+                // Close the palette without clearing the buffer so the operator
+                // can still send `/help` as plain text if they want.
+                setPaletteSuppressed(true);
+                return;
+            }
+            setLine('');
+            setCursor(0);
+            setHistoryIndex(-1);
+            return;
+        }
+        if (key.tab && paletteOpen) {
+            const completed = completePalette(line, palette.rows, paletteFocusedIndex);
+            if (completed !== null) {
+                setLine(completed);
+                setCursor(completed.length);
+            }
+            return;
+        }
+        if (key.upArrow) {
+            if (paletteOpen) {
+                setPaletteIndex((i) => (palette.rows.length === 0 ? 0 : (i - 1 + palette.rows.length) % palette.rows.length));
+                return;
+            }
+            if (history.length === 0)
+                return;
+            const nextIndex = historyIndex === -1 ? history.length - 1 : Math.max(0, historyIndex - 1);
+            const entry = history[nextIndex] ?? '';
+            setHistoryIndex(nextIndex);
+            setLine(entry);
+            setCursor(entry.length);
+            return;
+        }
+        if (key.downArrow) {
+            if (paletteOpen) {
+                setPaletteIndex((i) => (palette.rows.length === 0 ? 0 : (i + 1) % palette.rows.length));
+                return;
+            }
+            if (history.length === 0)
+                return;
+            if (historyIndex === -1)
+                return;
+            const nextIndex = historyIndex + 1;
+            if (nextIndex >= history.length) {
+                setHistoryIndex(-1);
+                setLine('');
+                setCursor(0);
+                return;
+            }
+            const entry = history[nextIndex] ?? '';
+            setHistoryIndex(nextIndex);
+            setLine(entry);
+            setCursor(entry.length);
+            return;
+        }
+        if (key.leftArrow) {
+            setCursor((c) => Math.max(0, c - 1));
+            return;
+        }
+        if (key.rightArrow) {
+            setCursor((c) => Math.min(line.length, c + 1));
+            return;
+        }
+        if (key.backspace || key.delete) {
+            if (cursor === 0)
+                return;
+            // Read cursor via ref inside the updater so the slice indices come
+            // from the latest committed value, not the closure-captured one.
+            // Same React-18 strict-mode race that bit the Ctrl+V paste path
+            // (Claude P1 on PR #335 wave 1): updaters run twice under strict
+            // mode, and a stale closure `cursor` produces a double-edit on the
+            // second invocation. cursorRef is the canonical fix — do NOT
+            // re-introduce closure `cursor` inside setLine updaters.
+            const cursorAtPress = cursorRef.current;
+            setLine((prev) => prev.slice(0, cursorAtPress - 1) + prev.slice(cursorAtPress));
+            setCursor((c) => Math.max(0, c - 1));
+            // Backspacing past `/` re-opens the palette next render.
+            setPaletteSuppressed(false);
+            setPaletteIndex(0);
+            return;
+        }
+        if (input && !key.meta && !key.ctrl) {
+            // Ink delivers one or more characters per event; concatenate at
+            // the cursor without filtering so non-Latin + emoji sequences
+            // (the operator's own brief copy) survive paste.
+            //
+            // Bracketed-paste mode markers (`ESC[200~ ... ESC[201~`) may
+            // arrive when a modern terminal pastes multi-line text. Strip
+            // them inline so the buffer stays clean; the spec calls out
+            // disabling Enter-as-submit during the burst, but Ink's
+            // useInput delivers the whole paste as one event so the burst
+            // is atomic and Enter cannot fire mid-paste here.
+            //
+            // Ink's escape-sequence parser may consume the leading ESC for
+            // unknown CSI sequences, so we match both forms (with + without
+            // the leading ESC byte) to be safe across terminal emulators.
+            const stripped = input
+                .replace(/\x1b\[200~/g, '')
+                .replace(/\x1b\[201~/g, '')
+                .replace(/\[200~/g, '')
+                .replace(/\[201~/g, '');
+            if (stripped.length === 0)
+                return;
+            // Read cursor via ref inside the updater so the splice indices come
+            // from the latest committed value, not the closure-captured one.
+            // Same React-18 strict-mode race that bit the Ctrl+V paste path
+            // (Claude P1 on PR #335 wave 1): updaters run twice under strict
+            // mode, and a stale closure `cursor` produces a duplicated insert
+            // on the second invocation. cursorRef is the canonical fix — do
+            // NOT re-introduce closure `cursor` inside setLine updaters.
+            const cursorAtPress = cursorRef.current;
+            setLine((prev) => prev.slice(0, cursorAtPress) + stripped + prev.slice(cursorAtPress));
+            setCursor((c) => c + stripped.length);
+            // Typing a new char un-suppresses the palette and resets focus.
+            setPaletteSuppressed(false);
+            setPaletteIndex(0);
+        }
+    });
+    const paletteView = !search && !paletteSuppressed ? filterPalette(line) : { rows: [], totalBeforeLimit: 0 };
+    // Clamp focus to current row count so a shrink (e.g. operator typed
+    // a char that narrowed the list) does not point off-the-end.
+    const clampedPaletteIndex = paletteView.rows.length === 0
+        ? 0
+        : Math.min(paletteIndex, paletteView.rows.length - 1);
+    const divider = '─'.repeat(innerWidth);
+    const focusedMatch = search ? search.matches[search.focusedIndex] : undefined;
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: "cyan", dimColor: true, children: divider }), _jsx(Box, { paddingX: 1, flexDirection: "column", children: search ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: "cyan", children: '(reverse-i-search) ' }), _jsx(Text, { children: `\`${search.query}\`: ` }), _jsx(Text, { color: "yellow", children: focusedMatch ? focusedMatch.brief : '(no match)' })] }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: `Ctrl+R next  ·  Ctrl+S prev  ·  Enter accept  ·  Esc cancel  ·  ${search.matches.length} match${search.matches.length === 1 ? '' : 'es'}` }) })] })) : (_jsxs(Box, { children: [_jsx(Text, { color: "cyan", children: '› ' }), _jsx(Text, { children: renderLineWithCursor(line, cursor, cursorVisible) })] })) }), _jsx(Text, { color: "cyan", dimColor: true, children: divider }), line.length > innerWidth - 4 ? (_jsxs(Box, { children: [_jsx(Text, { color: "gray", children: '┊ ' }), _jsx(Text, { dimColor: true, children: 'line wraps - Enter still submits' })] })) : null, _jsx(SlashPalette, { rows: paletteView.rows, focusedIndex: clampedPaletteIndex, totalBeforeLimit: paletteView.totalBeforeLimit }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '↑/↓ history  ·  Ctrl+R search  ·  / commands  ·  Enter brief  ·  Esc cancel  ·  Ctrl+C ×2 exit' }) })] }));
+}
+/**
+ * Render the line with the cursor glyph inserted at `cursor`. The cursor
+ * glyph is an inverted block when visible, a single space when blinked
+ * off - keeping the rendered width stable so the surrounding border
+ * does not jitter.
+ */
+function renderLineWithCursor(line, cursor, visible) {
+    const safeCursor = Math.max(0, Math.min(line.length, cursor));
+    const before = line.slice(0, safeCursor);
+    const after = line.slice(safeCursor);
+    const caret = visible ? '█' : ' ';
+    return `${before}${caret}${after}`;
+}
+//# sourceMappingURL=input-box.js.map