@pugi/cli 0.1.0-beta.4 → 0.1.0-beta.40

package/dist/tui/render.js

@@ -2,6 +2,7 @@ import React from 'react';
 import { render } from 'ink';
 import { DeviceFlow } from './device-flow.js';
 import { LoginPicker } from './login-picker.js';
+import { PermissionsPicker } from './permissions-picker.js';
 import { Splash } from './splash.js';
 import { collectSplashData } from './splash-data.js';
 /**
@@ -66,6 +67,40 @@ export function renderLoginPicker(apiUrl) {
         }));
     });
 }
+/**
+ * Sentinel thrown when the operator dismisses the permissions picker
+ * via Esc / q. Mirrors `LoginCancelledError` — the host catches and
+ * prints a one-line abort message; no mode flip lands.
+ */
+export class PermissionsPickerCancelledError extends Error {
+    constructor() {
+        super('Permissions picker cancelled');
+        this.name = 'PermissionsPickerCancelledError';
+    }
+}
+export function renderPermissionsPicker(options) {
+    return new Promise((resolveMode, rejectMode) => {
+        let settled = false;
+        const finish = (cb) => {
+            if (settled)
+                return;
+            settled = true;
+            instance.unmount();
+            setImmediate(cb);
+        };
+        const instance = render(React.createElement(PermissionsPicker, {
+            currentMode: options.currentMode,
+            sourceLabel: options.sourceLabel,
+            firstRun: options.firstRun ?? false,
+            onSelect: (mode) => {
+                finish(() => resolveMode(mode));
+            },
+            onCancel: () => {
+                finish(() => rejectMode(new PermissionsPickerCancelledError()));
+            },
+        }));
+    });
+}
 /**
  * Mount `<DeviceFlow />` on a TTY and return a handle the host uses to
  * drive the frame. Mirrors `renderLoginPicker`'s lifecycle: we

package/dist/tui/repl-render.js

@@ -16,14 +16,19 @@
  * a tiny `event:`/`data:`/`id:` parser. This keeps the dependency
  * graph at zero new packages.
  */
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 import React from 'react';
 import { render } from 'ink';
 import { Repl } from './repl.js';
 import { printPugMascotPreInk } from './repl-splash-mascot.js';
+import { ThemeProvider } from '../core/theme/context.js';
+import { resolveTheme } from '../core/theme/state.js';
 import { ReplSession, } from '../core/repl/session.js';
 import { resolveWorkspaceContext } from '../core/repl/workspace-context.js';
 import { SqliteSessionStore } from '../core/repl/store/index.js';
 import { slugForCwd } from '../core/repl/history.js';
+import { loadSettings } from '../core/settings.js';
 import { WorkingSet, buildRepoSkeleton, loadPugiIgnore, PugiWatcher, } from '../core/context/index.js';
 /**
  * Mount the REPL and resolve when the user exits via Ctrl+C × 2 or
@@ -31,12 +36,85 @@ import { WorkingSet, buildRepoSkeleton, loadPugiIgnore, PugiWatcher, } from '../
  * `pugi resume <sessionId>` once that command exists).
  */
 export async function renderRepl(options) {
+    // beta.9 CEO dogfood 2026-05-26: claim stdin raw mode + alt-screen
+    // BEFORE any async bootstrap step so keystrokes typed during the
+    // [launch -> Ink mount] window cannot echo into the terminal in
+    // cooked mode. Previously openLocalStore (SQLite open) +
+    // bootstrapContext (chokidar start) could take hundreds of ms to
+    // multiple seconds on a fresh install / large repo; during that
+    // window stdin stayed in cooked mode and the terminal echoed
+    // every typed character literally onto the screen below the
+    // pre-printed mascot/header. The visible result was the operator's
+    // "ssssss" landing on the rendered status-bar bottom row (CEO
+    // screenshot 2026-05-26: beta.8 REPL bug 2).
+    //
+    // The claim is idempotent with Ink's own raw-mode enable: Ink
+    // ref-counts setRawMode calls, and Node's stdin.setRawMode is
+    // safe to call twice with the same value. The pre-Ink claim acts
+    // as a "raw-mode floor" - whatever Ink does after mount layers on
+    // top, and our finally{} restore drops the floor only after Ink
+    // has cleanly torn down (or never mounted on a bootstrap crash).
+    const bootstrap = claimTerminalForRepl();
+    // beta.13 auto-init wire (CEO dogfood 2026-05-26): scaffold the
+    // `.pugi/` workspace silently on REPL boot so launching `pugi` in a
+    // fresh cwd no longer demands an explicit `pugi init` round-trip.
+    // Idempotent — every helper inside scaffoldPugiWorkspace is a
+    // `*_IfMissing` write, so re-running over an existing workspace is
+    // a no-op. Fail-safe: any FS / perms error never blocks REPL launch.
+    // Operator escape hatch: PUGI_NO_AUTO_INIT=1.
+    //
+    // Beta.13 P2 fix 2026-05-26: gate the scaffold on project-root markers
+    // so launching `pugi` from `$HOME` / `/tmp` / arbitrary dirs does NOT
+    // sprinkle `.pugi/` directories all over the filesystem. The gate
+    // mirrors `isBoundWorkspace` from workspace-context.ts but also
+    // accepts non-JS roots (Cargo / pyproject / go.mod) because the CLI
+    // is language-agnostic and an operator working in a Rust repo deserves
+    // the same auto-init UX as a Node operator. Already-bound `.pugi/`
+    // dirs also opt back in so the scaffold can fill any missing
+    // sub-artifacts the operator deleted.
+    // Leak L22 (2026-05-27): `--bare` (PUGI_BARE=1) ALSO suppresses the
+    // auto-init scaffold. Bare mode is the deterministic "fresh install
+    // anywhere" path — no `.pugi/` writes, no PUGI.md scaffold, no
+    // settings.json seed. The pre-existing PUGI_NO_AUTO_INIT escape
+    // hatch stays — bare mode just unions with it.
+    const { isBareMode } = await import('../core/bare-mode/index.js');
+    if (process.env.PUGI_NO_AUTO_INIT !== '1' &&
+        !isBareMode() &&
+        isProjectRoot(process.cwd())) {
+        try {
+            const { scaffoldPugiWorkspace } = await import('../runtime/cli.js');
+            await scaffoldPugiWorkspace({
+                cwd: process.cwd(),
+                noDefaults: true,
+                log: () => {
+                    /* silent — never leak scaffold progress into the REPL alt-screen */
+                },
+            });
+        }
+        catch (err) {
+            // Fail-safe: read-only FS or perms error never blocks REPL launch.
+            // Beta.13 P2 fix 2026-05-26: bare-catch swallowed the diagnostic;
+            // surface it on stderr under PUGI_DEBUG=1 so operator-triage on
+            // "why isn't .pugi/ being created?" has a starting point without
+            // having to re-instrument the bootstrap.
+            if (process.env.PUGI_DEBUG === '1') {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[pugi-debug] auto-init failed: ${msg}\n`);
+            }
+        }
+    }
     const transport = createProductionTransport();
     // Auto-bind the workspace context from process.cwd() so Mira knows
     // which repo the operator launched the CLI in. The resolver is
     // best-effort — any FS error falls back to a basename-only summary,
     // never blocks REPL launch. Wave 4 fix 2026-05-25.
     const workspace = options.workspace ?? resolveWorkspaceContext(process.cwd());
+    // Beta.13 P1 fix 2026-05-26: read `ui.cyberZoo` from
+    // `.pugi/settings.json` so the operator's splash posture flows to
+    // admin-api on session open. Without this, the renderer's `cyberZoo`
+    // parameter (added beta.13) was always defaulted to 'on' regardless
+    // of the operator's actual setting.
+    const cyberZoo = readCyberZooSetting(process.cwd());
     // α6.4: open the local SessionStore for `/resume` persistence. The
     // store lives under `~/.pugi/projects/<slug>/`; failure is fail-safe
     // — we log a one-line warning to stderr and continue with the REPL
@@ -64,6 +142,7 @@ export async function renderRepl(options) {
         cliVersion: options.cliVersion,
         transport,
         workspace,
+        cyberZoo,
         store,
         localSessionId: openedSessionId,
         repoSkeleton: skeleton,
@@ -86,26 +165,54 @@ export async function renderRepl(options) {
     // Kick off the connect; the Repl renders the connecting state until
     // the session pushes `connection: 'on_watch'` from the SSE onOpen.
     void session.start();
+    // beta.9: drain any keystrokes that landed in stdin between the
+    // pre-Ink raw-mode claim and now. Without this, the queued bytes
+    // would feed Ink's first useInput tick as a flood of "stale"
+    // characters once the InputBox mounts - the operator would see
+    // their pre-typed input materialise in the prompt as if they had
+    // typed it after the REPL became interactive. Idempotent: no-op
+    // when stdin is not a TTY or no bytes were buffered.
+    drainBufferedStdin(process.stdin);
     // α6.14.2 wave 5: paint the chafa-baked brand-pug ANSI render to
-    // stdout BEFORE Ink mounts. Ink's layout engine would mis-measure
-    // the truecolor escape sequences, so the pug must land verbatim.
-    // The flag is passed into <Repl /> so the splash component knows to
-    // skip its own hand-crafted PUG_MASCOT column — otherwise the
-    // operator sees both the chafa pug AND the ASCII fallback stacked.
-    // When skipSplash is true (operator opted out via --no-splash), we
-    // suppress the pre-print too so the boot stays silent.
+    // stdout BEFORE Ink mounts (but AFTER alt-screen enter). Ink's
+    // layout engine would mis-measure the truecolor escape sequences,
+    // so the pug must land verbatim. The flag is passed into <Repl />
+    // so the splash component knows to skip its own hand-crafted
+    // PUG_MASCOT column - otherwise the operator sees both the chafa
+    // pug AND the ASCII fallback stacked. When skipSplash is true
+    // (operator opted out via --no-splash), we suppress the pre-print
+    // too so the boot stays silent.
     const mascotPrePrinted = options.skipSplash === true ? false : printPugMascotPreInk(process.stdout);
-    const instance = render(React.createElement(Repl, {
+    // Leak L30 (2026-05-27): resolve the active theme ONCE at mount
+    // and wrap `<Repl />` in `<ThemeProvider>` so every Ink consumer
+    // (`<Header>`, `<DoctorTable>`, `<StyleTable>`, `<ThemeTable>`,
+    // …) picks up the same color tokens. The provider is stable for
+    // the lifetime of the REPL — operator `/theme <name>` writes to
+    // disk + appends a system line, and the next `pugi` launch re-
+    // mounts with the new slug. Re-mounting mid-session would race
+    // against Ink's raw-mode handler so we deliberately keep the
+    // session-lifetime contract instead of polling the config file.
+    const resolvedTheme = resolveTheme({
+        workspaceRoot: process.cwd(),
+        env: process.env,
+    });
+    const instance = render(React.createElement(ThemeProvider, { slug: resolvedTheme.slug }, React.createElement(Repl, {
         session,
         updateBanner: options.updateBanner ?? null,
         skipSplash: options.skipSplash === true,
         hideToolStream: options.hideToolStream === true,
         mascotPrePrinted,
-    }));
+    })));
+    // Make sure we leave the alt screen on abrupt exits too. Without
+    // this the operator's shell stays "frozen" on the Pugi splash.
+    process.once('exit', bootstrap.restore);
+    process.once('SIGINT', bootstrap.restore);
+    process.once('SIGTERM', bootstrap.restore);
     try {
         await instance.waitUntilExit();
     }
     finally {
+        bootstrap.restore();
         session.close();
         if (store) {
             try {
@@ -125,6 +232,138 @@ export async function renderRepl(options) {
         }
     }
 }
+export function claimTerminalForRepl(stdin = process.stdin, stdout = process.stdout) {
+    const isStdoutTty = stdout.isTTY === true;
+    const isStdinTty = stdin.isTTY === true && typeof stdin.setRawMode === 'function';
+    let altScreenEntered = false;
+    if (isStdoutTty) {
+        try {
+            stdout.write('\x1b[?1049h');
+            stdout.write('\x1b[H');
+            altScreenEntered = true;
+        }
+        catch {
+            /* terminal already detached */
+        }
+    }
+    let rawModeClaimed = false;
+    if (isStdinTty) {
+        try {
+            stdin.setEncoding('utf8');
+            stdin.setRawMode(true);
+            // Resume so the kernel actually delivers bytes to Node's event
+            // loop. Without resume, raw mode is set but data does not flow
+            // until something else (e.g. Ink) attaches a 'data' listener.
+            stdin.resume();
+            rawModeClaimed = true;
+        }
+        catch {
+            /* raw mode unsupported - the operator's shell still works */
+        }
+    }
+    let restored = false;
+    const restore = () => {
+        if (restored)
+            return;
+        restored = true;
+        if (rawModeClaimed && isStdinTty) {
+            try {
+                stdin.setRawMode(false);
+            }
+            catch {
+                /* terminal already detached */
+            }
+        }
+        if (altScreenEntered) {
+            try {
+                stdout.write('\x1b[?1049l');
+            }
+            catch {
+                /* shutdown race - terminal already detached */
+            }
+        }
+    };
+    return { altScreenEntered, rawModeClaimed, restore };
+}
+/**
+ * Read and discard any bytes buffered in stdin between
+ * `claimTerminalForRepl()` and the Ink mount. Returns the number of
+ * bytes drained so tests can assert the behaviour without intercepting
+ * the side effect.
+ *
+ * `stdin.read()` is a no-op when no data is buffered, so this is safe
+ * to call whether or not the operator actually typed during bootstrap.
+ * Wrapped in try/catch because a closed / piped stdin will throw on
+ * read in some Node versions.
+ */
+export function drainBufferedStdin(stdin = process.stdin) {
+    if (stdin.isTTY !== true)
+        return 0;
+    try {
+        let bytesDrained = 0;
+        // Loop until read() returns null - readable streams may chunk
+        // buffered bytes across multiple read() calls when the operator
+        // typed faster than the kernel could deliver to Node's loop.
+        for (;;) {
+            const chunk = stdin.read();
+            if (chunk === null)
+                return bytesDrained;
+            bytesDrained += typeof chunk === 'string' ? chunk.length : chunk.byteLength;
+        }
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Project-root probe — beta.13 P2 fix 2026-05-26.
+ *
+ * Beta.13 auto-init was unconditional and silently created `.pugi/` in
+ * every cwd the REPL was launched from, including `$HOME` and `/tmp`.
+ * Operators who ran `pugi` to ask a quick question outside of any
+ * project ended up with stray `.pugi/` directories polluting their
+ * filesystem. The gate looks for any of six project-root markers
+ * before scaffolding:
+ *
+ *   - `package.json`     — JS / TS workspaces
+ *   - `.git`             — any cloned repo regardless of language
+ *   - `.pugi`            — already-bound Pugi workspace (re-scaffold
+ *                          fills any missing artifacts the operator
+ *                          deleted, idempotent over existing files)
+ *   - `Cargo.toml`       — Rust crates
+ *   - `pyproject.toml`   — Python projects (PEP 518)
+ *   - `go.mod`           — Go modules
+ *
+ * The probe is six cheap `existsSync` calls; the cost is negligible
+ * compared with the alt-screen + Ink mount that follows. Exported so a
+ * future unit spec can lock the contract.
+ */
+export function isProjectRoot(cwd) {
+    // ESM static imports — `require()` is not defined in a `"type": "module"`
+    // bundle and would throw `ReferenceError: require is not defined` the
+    // moment the REPL bootstrap calls this gate. Beta.16 P0 fix 2026-05-27.
+    return (existsSync(resolve(cwd, 'package.json')) ||
+        existsSync(resolve(cwd, '.git')) ||
+        existsSync(resolve(cwd, '.pugi')) ||
+        existsSync(resolve(cwd, 'Cargo.toml')) ||
+        existsSync(resolve(cwd, 'pyproject.toml')) ||
+        existsSync(resolve(cwd, 'go.mod')));
+}
+/**
+ * Read the operator's cyber-zoo posture from `.pugi/settings.json`.
+ * Best-effort: when the file is missing / malformed, fall through to
+ * the historical 'on' default so the REPL never refuses to launch on
+ * a settings error. Beta.13 P1 fix 2026-05-26.
+ */
+function readCyberZooSetting(cwd) {
+    try {
+        const settings = loadSettings(cwd);
+        return settings.ui?.cyberZoo ?? 'on';
+    }
+    catch {
+        return 'on';
+    }
+}
 /**
  * Open the local SessionStore for the REPL bootstrap. Returns
  * `{ store: null, openedSessionId: undefined }` on any error so the
@@ -216,13 +455,20 @@ async function bootstrapContext(input) {
 /* ------------------------------------------------------------------ */
 /* Production transport                                               */
 /* ------------------------------------------------------------------ */
-function createProductionTransport() {
+export function createProductionTransport() {
     return {
-        async createSession({ apiUrl, apiKey, workspace }) {
+        async createSession({ apiUrl, apiKey, workspace, cyberZoo }) {
             // Forward the workspace bundle in the POST body so admin-api can
             // surface `<workspace-context>` in Mira's prompt. Older admin-api
             // builds ignore unknown fields, so this stays forward-compatible.
             // Wave 4 fix 2026-05-25.
+            //
+            // Beta.13 P1 fix 2026-05-26: also forward `cyberZoo` so admin-api
+            // can render Mira's `<cyber-zoo>` marker matching the operator's
+            // `.pugi/settings.json::ui.cyberZoo` toggle instead of the
+            // historical 'on' default. Only included on the wire when set
+            // explicitly so a missing setting still survives older admin-api
+            // builds that do not declare the DTO field.
             const body = {};
             if (workspace?.workspaceCwd)
                 body.workspaceCwd = workspace.workspaceCwd;
@@ -230,6 +476,8 @@ function createProductionTransport() {
                 body.workspaceSlug = workspace.workspaceSlug;
             if (workspace?.workspaceSummary)
                 body.workspaceSummary = workspace.workspaceSummary;
+            if (cyberZoo === 'on' || cyberZoo === 'off')
+                body.cyberZoo = cyberZoo;
             const response = await fetch(joinUrl(apiUrl, '/api/pugi/sessions'), {
                 method: 'POST',
                 headers: jsonHeaders(apiKey),
@@ -275,6 +523,31 @@ function createProductionTransport() {
             if (lastEventId) {
                 headers['Last-Event-ID'] = lastEventId;
             }
+            // beta.9 CEO dogfood 2026-05-26: hard timeout on the SSE
+            // handshake so a CDN/proxy that buffers the response (or an
+            // admin-api that accepted the route but never flushed headers)
+            // cannot freeze the REPL in `connecting` forever. The 5s budget
+            // is generous - admin-api routinely responds in <500ms when
+            // healthy - but tight enough that an operator who launched
+            // `pugi` and is staring at the screen will see the status flip
+            // to `reconnecting` instead of an indefinite hang. The
+            // AbortController bound to the fetch aborts the in-flight
+            // request when the timer fires, which surfaces as an
+            // `AbortError` and routes through the existing onError handler
+            // (which calls scheduleReconnect via the session). The timer
+            // is cleared the moment onOpen fires so a slow-but-eventually-
+            // successful handshake still works.
+            const handshakeDeadlineMs = 5_000;
+            const handshakeTimer = setTimeout(() => {
+                controller.abort();
+                // onError is called from the catch block below (the abort
+                // synthesises an AbortError that consumeSseStream / fetch
+                // will throw). No explicit onError call here - we let the
+                // catch path normalise the error message so the operator
+                // sees the consistent "SSE handshake timed out (5s)" prose
+                // through the same plumbing that surfaces every other
+                // transport failure.
+            }, handshakeDeadlineMs);
             void (async () => {
                 try {
                     const response = await fetch(url, {
@@ -288,6 +561,9 @@ function createProductionTransport() {
                     if (!response.body) {
                         throw new Error('SSE response has no body');
                     }
+                    // Handshake survived; cancel the deadline so a slow
+                    // first-event stream does not get aborted later.
+                    clearTimeout(handshakeTimer);
                     onOpen();
                     await consumeSseStream(response.body, onEvent);
                     // Server closed the stream cleanly. Treat as an error so
@@ -297,13 +573,27 @@ function createProductionTransport() {
                     onError(new Error('SSE stream ended'));
                 }
                 catch (error) {
-                    if (controller.signal.aborted)
+                    clearTimeout(handshakeTimer);
+                    if (controller.signal.aborted) {
+                        // Distinguish operator-driven close (session.close())
+                        // from the handshake-deadline abort. The session sets a
+                        // `closed` flag before calling controller.abort(); the
+                        // handshake-deadline abort fires while the session is
+                        // still expecting onOpen. We cannot read session state
+                        // from here, so we surface a single error class with a
+                        // clear message - the session-side onError handler
+                        // already short-circuits when `closed=true`.
+                        onError(new Error(`SSE handshake timed out after ${handshakeDeadlineMs}ms`));
                         return;
+                    }
                     onError(error instanceof Error ? error : new Error(String(error)));
                 }
             })();
             return {
-                close: () => controller.abort(),
+                close: () => {
+                    clearTimeout(handshakeTimer);
+                    controller.abort();
+                },
             };
         },
     };

package/dist/tui/repl-splash.js

@@ -67,7 +67,7 @@ export function ReplSplash(props) {
     // pugs. The header card still renders inline so wordmark + status
     // rows stay attached to the splash flow.
     const showHandCraftedMascot = props.mascotPrePrinted !== true;
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, paddingY: 1, children: [_jsxs(Box, { flexDirection: "row", children: [showHandCraftedMascot ? _jsx(MascotColumn, {}) : null, _jsxs(Box, { flexDirection: "column", marginLeft: showHandCraftedMascot ? 2 : 0, marginTop: 1, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Pugi" }), _jsx(Text, { bold: true, color: "cyan", children: ".io" }), _jsx(Text, { dimColor: true, children: `  v${props.cliVersion}` })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(HeaderRow, { label: "Plan", value: props.plan ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Model", value: props.model ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Tenant", value: props.tenant ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Workspace", value: props.workspaceLabel })] })] })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '─'.repeat(40) }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Tips for getting started:" }), _jsx(TipRow, { index: 1, text: "Type a brief, the workforce dispatches" }), _jsx(TipRow, { index: 2, text: "/help for slash commands, /web <url> to pull a page" }), _jsx(TipRow, { index: 3, text: "/skills install <name> for Anthropic / OpenClaw skills" })] })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, paddingY: 1, children: [_jsxs(Box, { flexDirection: "row", children: [showHandCraftedMascot ? _jsx(MascotColumn, {}) : null, _jsxs(Box, { flexDirection: "column", marginLeft: showHandCraftedMascot ? 2 : 0, marginTop: 1, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Pugi" }), _jsx(Text, { bold: true, color: "#3da9fc", children: ".io" }), _jsx(Text, { dimColor: true, children: `  v${props.cliVersion}` })] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(HeaderRow, { label: "Plan", value: props.plan ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Model", value: props.model ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Tenant", value: props.tenant ?? PLACEHOLDER }), _jsx(HeaderRow, { label: "Workspace", value: props.workspaceLabel })] })] })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '─'.repeat(40) }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Tips for getting started:" }), _jsx(TipRow, { index: 1, text: "Type a brief, the workforce dispatches" }), _jsx(TipRow, { index: 2, text: "/help for slash commands, /web <url> to pull a page" }), _jsx(TipRow, { index: 3, text: "/skills install <name> for Anthropic / OpenClaw skills" })] })] }));
 }
 /**
  * Renders the multi-line ASCII pug. Each row is split into colored
@@ -105,7 +105,7 @@ function MascotRow({ row, mask, }) {
     if (buffer.length > 0) {
         runs.push({ text: buffer, cyan: bufferCyan });
     }
-    return (_jsx(Text, { children: runs.map((run, runIndex) => run.cyan ? (_jsx(Text, { color: "cyan", children: run.text }, runIndex)) : (_jsx(Text, { color: "gray", children: run.text }, runIndex))) }));
+    return (_jsx(Text, { children: runs.map((run, runIndex) => run.cyan ? (_jsx(Text, { color: "#3da9fc", children: run.text }, runIndex)) : (_jsx(Text, { color: "gray", children: run.text }, runIndex))) }));
 }
 function HeaderRow({ label, value }) {
     const padded = `${label}:`.padEnd(11, ' ');

package/dist/tui/repl.js

@@ -29,6 +29,7 @@ import { StatusBar } from './status-bar.js';
 import { ToolStreamPane } from './tool-stream-pane.js';
 import { UpdateBanner } from './update-banner.js';
 import { collectWorkspaceContext } from './workspace-context.js';
+import { useTheme } from '../core/theme/context.js';
 import { slugForCwd } from '../core/repl/history.js';
 import { SLASH_COMMAND_HELP, SLASH_COMMAND_GROUPS } from '../core/repl/slash-commands.js';
 const TICK_INTERVAL_MS = 200;
@@ -49,7 +50,12 @@ export function Repl(props) {
     // α6.14 wave 3: boot splash visible until first input, first
     // `agent.spawned` event, or 10s idle. The host gates the initial
     // visibility on `--no-splash` / PUGI_SKIP_SPLASH via `skipSplash`.
-    const [splashVisible, setSplashVisible] = useState(props.skipSplash !== true);
+    // α6.14.6 CEO dogfood 2026-05-25: default splash to HIDDEN at boot
+    // (parity with Claude Code's minimal one-line banner). Operator can
+    // opt back in via `/splash` slash. The chafa pug pre-print + header
+    // line already give the brand cue without the multi-row Plan/Model/
+    // Tenant block crowding the top.
+    const [splashVisible, setSplashVisible] = useState(false);
     const dismissSplash = useCallback(() => setSplashVisible(false), []);
     // α6.14 wave 3: workspace context snapshot for the status bar. We
     // read once at mount and freeze; a brand-new PUGI.md or skill is
@@ -178,23 +184,73 @@ export function Repl(props) {
             return undefined;
         return props.session.cancel();
     }, [props.session, modalActive]);
-    // α6.14.5 CEO dogfood 2026-05-25 (parity with Claude Code): the
-    // input box must pin to the BOTTOM of the alt-screen viewport, not
-    // float right under the conversation. Beta.3 attempt at full-height
-    // broke keystroke focus (raw echo at row 79). The right pattern is
-    // minHeight on the root + flexGrow on the conversation pane so the
-    // empty space sits ABOVE the input, not below it. The input then
-    // captures all keystrokes because it is the only Ink-focusable
-    // surface adjacent to the cursor row.
+    // Wave 6 BT 8 (Claude Code parity): Esc-Esc walkback. Forwards to
+    // ReplSession.walkbackLastTurn which trims the trailing operator
+    // turn + its persona response from the in-memory transcript. Returns
+    // `'walked-back'` so the input box knows the host did the work;
+    // `'nothing'` covers both the empty-transcript and dispatch-in-flight
+    // refusals (the session module owns the refusal copy in both cases).
+    const handleWalkback = useCallback(() => {
+        if (modalActive)
+            return 'nothing';
+        const verdict = props.session.walkbackLastTurn();
+        return verdict === 'walked-back' ? 'walked-back' : 'nothing';
+    }, [props.session, modalActive]);
+    // Wave 7 — Shift+Tab cycles the 6 canonical permission modes (CC
+    // parity). Refuses while a modal is active so the operator does not
+    // accidentally flip mode mid-prompt; otherwise resolves the current
+    // mode through the workspace > global > default merge, advances via
+    // `nextPermissionMode`, и persists к .pugi/session.json. Returns the
+    // new mode string so the InputBox can flash a one-line toast.
+    const handleCyclePermissionMode = useCallback(() => {
+        if (modalActive)
+            return null;
+        try {
+            // Lazy-require так this code path doesn't drag the permissions
+            // module into the splash + boot stages where it isn't needed.
+            // The require is sync but the inner work is pure JSON IO.
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const perm = require('../core/permissions/index.js');
+            const workspaceRoot = process.cwd();
+            const current = perm.resolveMode({ workspaceRoot });
+            const next = perm.nextPermissionMode(current);
+            perm.setCurrentMode(workspaceRoot, next);
+            return next;
+        }
+        catch {
+            // Persistence is best-effort — if .pugi/session.json is read-only
+            // или ENOENT-on-parent the toast is suppressed so we don't lie
+            // about the flip к the operator.
+            return null;
+        }
+    }, [modalActive]);
+    // α6.14.5 CEO dogfood 2026-05-25 (parity with Claude Code): input
+    // box pinned to alt-screen BOTTOM, conversation grows above it.
+    // Beta.3's height={rows} fix broke keystroke focus - raw echo at
+    // viewport bottom. The right pattern is minHeight on the root +
+    // flexGrow=1 on the MainArea Box: empty alt-screen lives ABOVE the
+    // input, and the input stays the sole focusable surface adjacent
+    // to the cursor row, so all keystrokes route through it.
     const altScreenRows = process.stdout.rows ?? 24;
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, minHeight: altScreenRows, children: [props.updateBanner ? _jsx(UpdateBanner, { result: props.updateBanner }) : null, splashVisible ? (_jsx(ReplSplash, { cliVersion: state.cliVersion, workspaceLabel: state.workspaceLabel, plan: props.splashPlan, model: props.splashModel, tenant: props.splashTenant, onDismiss: dismissSplash, mascotPrePrinted: props.mascotPrePrinted === true })) : null, _jsx(Header, { state: state }), _jsx(Box, { flexDirection: "column", marginTop: 1, flexGrow: 1, children: overlay === 'help' ? (_jsx(HelpOverlay, {})) : overlay === 'roster' ? (_jsx(RosterOverlay, {})) : overlay === 'farewell' ? (_jsx(FarewellOverlay, {})) : (_jsx(MainArea, { state: state, personaNames: personaNames, nowEpochMs: tickNow, hideToolStream: props.hideToolStream === true, toolStreamCollapsed: toolStreamCollapsed })) }), state.pendingAsk ? (_jsx(Box, { marginTop: 1, children: _jsx(AskModal, { tag: state.pendingAsk, onResolve: handleAskResolve }) })) : null, state.pendingPlanReview ? (_jsx(Box, { marginTop: 1, children: _jsx(PlanReviewModal, { tag: state.pendingPlanReview, onResolve: handlePlanReviewResolve }) })) : null, _jsxs(Box, { flexDirection: "column", marginTop: 1, children: [overlay === 'farewell' || modalActive ? null : (_jsx(InputBox, { onSubmit: handleSubmit, onExit: handleExit, onCancel: handleCancel, now: props.now, 
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, minHeight: altScreenRows, children: [props.updateBanner ? _jsx(UpdateBanner, { result: props.updateBanner }) : null, splashVisible ? (_jsx(ReplSplash, { cliVersion: state.cliVersion, workspaceLabel: state.workspaceLabel, plan: props.splashPlan, model: props.splashModel, tenant: props.splashTenant, onDismiss: dismissSplash, mascotPrePrinted: props.mascotPrePrinted === true })) : null, _jsx(Header, { state: state }), _jsx(Box, { flexDirection: "column", marginTop: 1, flexGrow: 1, justifyContent: "flex-end", children: overlay === 'help' ? (_jsx(HelpOverlay, {})) : overlay === 'roster' ? (_jsx(RosterOverlay, {})) : overlay === 'farewell' ? (_jsx(FarewellOverlay, {})) : (_jsx(MainArea, { state: state, personaNames: personaNames, nowEpochMs: tickNow, hideToolStream: props.hideToolStream === true, toolStreamCollapsed: toolStreamCollapsed })) }), state.pendingAsk ? (_jsx(Box, { marginTop: 1, children: _jsx(AskModal, { tag: state.pendingAsk, onResolve: handleAskResolve }) })) : null, state.pendingPlanReview ? (_jsx(Box, { marginTop: 1, children: _jsx(PlanReviewModal, { tag: state.pendingPlanReview, onResolve: handlePlanReviewResolve }) })) : null, _jsxs(Box, { flexDirection: "column", marginTop: 1, children: [overlay === 'farewell' || modalActive ? null : (_jsx(InputBox, { onSubmit: handleSubmit, onExit: handleExit, onCancel: handleCancel, onWalkback: handleWalkback, onCyclePermissionMode: handleCyclePermissionMode, now: props.now, 
                         // Slug from process.cwd() (full path) so two workspaces with
                         // the same basename do not share history. state.workspaceLabel
                         // is the basename only. Codex review P2.
-                        workspaceSlug: slugForCwd(process.cwd()) })), _jsx(StatusBar, { connection: state.connection, activeAgentCount: countActive(state), tokensDownstreamTotal: state.tokensDownstreamTotal, briefStartedAtEpochMs: state.briefStartedAtEpochMs, nowEpochMs: tickNow, pulsePhase: pulsePhase, pugiMdCount: workspaceContext.pugiMdCount, mcpServerCount: workspaceContext.mcpServerCount, skillCount: workspaceContext.skillCount, quotaPct: props.quotaPct, dispatchState: state.dispatchState, dispatchToolLabel: state.dispatchToolLabel })] })] }));
+                        workspaceSlug: slugForCwd(process.cwd()) })), _jsx(StatusBar, { connection: state.connection, activeAgentCount: countActive(state), tokensDownstreamTotal: state.tokensDownstreamTotal, briefStartedAtEpochMs: state.briefStartedAtEpochMs, nowEpochMs: tickNow, pulsePhase: pulsePhase, pugiMdCount: workspaceContext.pugiMdCount, mcpServerCount: workspaceContext.mcpServerCount, skillCount: workspaceContext.skillCount, quotaPct: props.quotaPct, dispatchState: state.dispatchState, dispatchToolLabel: state.dispatchToolLabel, lastCompletedOutcome: state.lastCompletedOutcome, 
+                        // α7 cost-meter sprint — surface accumulated session totals
+                        // + per-turn delta flash on the status bar's top row. The
+                        // session module owns accumulation; the bar is a pure render.
+                        sessionTokensIn: state.sessionTokensIn, sessionTokensOut: state.sessionTokensOut, sessionCostUsd: state.sessionCostUsd, sessionStartedAtEpochMs: state.sessionStartedAtEpochMs, lastTurnDelta: state.lastTurnDelta })] })] }));
 }
 function Header({ state }) {
-    return (_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Pugi" }), _jsx(Text, { bold: true, color: "cyan", children: ".io" }), _jsx(Text, { dimColor: true, children: `  ·  workspace: ${state.workspaceLabel}  ·  v${state.cliVersion}  ·  ` }), _jsx(Text, { color: "cyan", children: state.connection === 'on_watch' ? 'on watch' : state.connection.replace('_', ' ') })] }));
+    // Leak L30 (2026-05-27): the header `.io` brand accent + connection
+    // pill route through `useTheme()` so the operator's `/theme` flip
+    // (default / dark / light / colorblind) re-tints the chrome on
+    // re-mount. The `useTheme` hook returns the `default` preset's
+    // colors when no provider is mounted, preserving the previous
+    // `#3da9fc` constants for tests that import `<Repl />` standalone.
+    const theme = useTheme();
+    return (_jsxs(Box, { children: [_jsx(Text, { bold: true, children: "Pugi" }), _jsx(Text, { bold: true, color: theme.accent, children: ".io" }), _jsx(Text, { dimColor: true, children: `  ·  workspace: ${state.workspaceLabel}  ·  v${state.cliVersion}  ·  ` }), _jsx(Text, { color: theme.accent, children: state.connection === 'on_watch' ? 'on watch' : state.connection.replace('_', ' ') })] }));
 }
 function MainArea({ state, personaNames, nowEpochMs, hideToolStream, toolStreamCollapsed, }) {
     // α6.12: three vertical panes stacked above the input box.
@@ -234,14 +290,14 @@ function HelpOverlay() {
                 const rows = grouped.get(group);
                 if (!rows || rows.length === 0)
                     return null;
-                return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { dimColor: true, children: `  -- ${group} --` }), rows.map((row) => (_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "cyan", children: `  /${row.name} ${row.args}`.padEnd(22, ' ') }), _jsx(Text, { dimColor: true, children: row.gloss })] }, row.name)))] }, group));
+                return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { dimColor: true, children: `  -- ${group} --` }), rows.map((row) => (_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "#3da9fc", children: `  /${row.name} ${row.args}`.padEnd(22, ' ') }), _jsx(Text, { dimColor: true, children: row.gloss })] }, row.name)))] }, group));
             }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: `${PUGI_TAGLINE}` }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: 'Press any key to dismiss.' }) })] }));
 }
 function RosterOverlay() {
     return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "On-watch roster" }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: THE_TEN.map((persona) => (_jsxs(Box, { children: [_jsx(Text, { bold: true, children: `  ${persona.name.padEnd(10, ' ')}` }), _jsx(Text, { dimColor: true, children: `${persona.role.padEnd(20, ' ')}` }), _jsx(Text, { children: persona.oneLiner })] }, persona.slug))) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: 'Press any key to dismiss.' }) })] }));
 }
 function FarewellOverlay() {
-    return (_jsx(Box, { flexDirection: "column", alignItems: "center", paddingY: 2, children: _jsx(Text, { bold: true, color: "cyan", children: PUGI_TAGLINE }) }));
+    return (_jsx(Box, { flexDirection: "column", alignItems: "center", paddingY: 2, children: _jsx(Text, { bold: true, color: "#3da9fc", children: PUGI_TAGLINE }) }));
 }
 function applyVerdictSideEffects(verdict, handlers) {
     switch (verdict.kind) {
@@ -266,8 +322,10 @@ function applyVerdictSideEffects(verdict, handlers) {
         case 'consensus':
         case 'diff':
         case 'cost':
+        case 'quota':
         case 'status':
         case 'resume':
+        case 'mcp':
         case 'stub':
             // All non-overlay verdicts: the session module already appended
             // any operator-visible system lines (and, for `ask`, set

package/dist/tui/splash.js

@@ -21,7 +21,7 @@ export function Splash({ data }) {
             cmd: 'pugi login',
             gloss: 'Connect this terminal to your Pugi account',
         };
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 1, children: [_jsx(Box, { children: _jsx(Text, { bold: true, color: "cyan", children: "pugi.io" }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: `v${data.cliVersion}  ·  ${data.apiUrl}` }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "Account: " }), _jsx(Text, { children: accountLine })] }), data.isAuthenticated && data.plan ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "Plan: " }), _jsx(Text, { children: data.plan })] })) : null] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Quick start:" }), _jsx(HintRow, { command: primaryHint.cmd, gloss: primaryHint.gloss }), data.isAuthenticated ? (_jsx(HintRow, { command: 'pugi login', gloss: 'Re-authenticate or switch accounts' })) : (_jsx(HintRow, { command: 'pugi code "fix the bug"', gloss: 'Run a one-shot coding task' })), _jsx(HintRow, { command: 'pugi review --triple', gloss: 'Run the Anvil triple-review gate' }), _jsx(HintRow, { command: 'pugi help', gloss: 'Full command reference' })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Docs: https://pugi.dev   \u00B7   Status: https://pugi.io/status" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 2, paddingY: 1, children: [_jsx(Box, { children: _jsx(Text, { bold: true, color: "#3da9fc", children: "pugi.io" }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: `v${data.cliVersion}  ·  ${data.apiUrl}` }) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "Account: " }), _jsx(Text, { children: accountLine })] }), data.isAuthenticated && data.plan ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "Plan: " }), _jsx(Text, { children: data.plan })] })) : null] }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { dimColor: true, children: "Quick start:" }), _jsx(HintRow, { command: primaryHint.cmd, gloss: primaryHint.gloss }), data.isAuthenticated ? (_jsx(HintRow, { command: 'pugi login', gloss: 'Re-authenticate or switch accounts' })) : (_jsx(HintRow, { command: 'pugi code "fix the bug"', gloss: 'Run a one-shot coding task' })), _jsx(HintRow, { command: 'pugi review --triple', gloss: 'Run the Anvil triple-review gate' }), _jsx(HintRow, { command: 'pugi help', gloss: 'Full command reference' })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "Docs: https://pugi.dev   \u00B7   Status: https://pugi.io/status" }) })] }));
 }
 function HintRow({ command, gloss }) {
     // Pad command names so the gloss column lines up across rows.