@spinalfluid/ultrac 0.1.0 → 0.1.5

package/README.md

@@ -35,7 +35,7 @@ For local testing before a registry release, build and install the verified tarb
 pnpm check
 pnpm verify:install
 npm pack
-npm install -g ./spinalfluid-ultrac-0.1.0.tgz
+npm install -g ./spinalfluid-ultrac-0.1.5.tgz
 ultrac login
 ```
 
@@ -53,7 +53,17 @@ ultrac logout    # drop local credentials and revoke the minted key
 
 For interactive use, `ultrac login` opens `https://ultrac.io/cli/login` (or the same path on a local
 site). Approve the CLI using your existing website account; the site mints a key and the CLI stores
-it in `~/.ultrac/auth.json` with `0600` permissions. You do not need to create or paste a key.
+it in `~/.ultrac/auth.json`. The browser return is bound to the initiating CLI with loopback,
+state, and PKCE checks. Confirm that the browser and terminal show the same reference code; you do
+not enter that code during the normal flow. If the browser cannot reach the loopback callback, the
+CLI accepts the short-lived, one-time completion code from the failed
+localhost callback URL and exchanges it with the same PKCE verifier. This recovery path never asks
+for a permanent API key. `--no-browser` prints the authorization URL instead of opening it.
+
+Credentials use an owner-only `0600` file because the package intentionally avoids native keychain
+dependencies. On filesystems that do not enforce Unix permission bits, protect the account and home
+directory with the operating system's access controls. You do not need to create or paste a key for
+normal browser sign-in.
 
 For scripts and CI, do not run the browser sign-in flow. Create a dedicated API key in the account's
 `/keys` page, store it in your CI secret manager, and expose it to the command as `ULTRAC_API_KEY`.
@@ -62,8 +72,10 @@ for an existing key, and `ultrac login --key <key>` verifies and stores one; use
 intentionally need a local saved credential, not as the default CI setup. Avoid putting secrets in
 shell history, command arguments, project config, or source control. An approved Ultrac account is required for model access.
 
-The minted key is checked with `GET <base>/models` before it is saved: a 401/403 is refused and
-nothing is written; if the API cannot be reached the key is saved anyway with a warning.
+Every key is checked with `GET <base>/models` before it is saved. A browser-issued key is stored only
+after the API accepts it; a 401/403 or unavailable verification writes nothing. For compatibility,
+an explicitly supplied `--key` or `--manual` key may still be saved with a warning when verification
+is unavailable, but a rejected key is never saved.
 
 ### Cosmic 1, in a repo
 
@@ -129,6 +141,10 @@ ultrac "Find the main entry points and summarize the architecture"
 Inside a session:
 
 - Type to talk to Ultrac; it gathers repository context first and can call tools.
+- You can type another message while Ultrac is working. It is queued and inserted after the current
+  tool batch or completed model response, before the next model request. Slash commands wait for
+  the main prompt instead of entering model context.
+- Ctrl-C stops active work at a safe boundary. At an idle prompt, Ctrl-C exits and saves the session.
 - Gated tools (file writes, shell, network) prompt for approval: `once` / `always` / `no`.
 - Coding commands: `/plan [task]`, `/coding`, `/review [focus]`, `/diff [--staged]`,
   `/test [instructions]`, `/init`, `/max-steps [number]`.

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import chalk14 from "chalk";
+import chalk15 from "chalk";
 import { Command } from "commander";
 
 // src/commands/ask.ts
@@ -11186,16 +11186,16 @@ function normalizeFilter(filter, workspace) {
 function tokenizeCommand(command) {
   const tokens = [];
   let current = "";
-  let quote = null;
+  let quote2 = null;
   let started = false;
   for (const character of command) {
-    if (quote) {
-      if (character === quote) quote = null;
+    if (quote2) {
+      if (character === quote2) quote2 = null;
       else current += character;
       continue;
     }
     if (character === '"' || character === "'") {
-      quote = character;
+      quote2 = character;
       started = true;
       continue;
     }
@@ -12900,6 +12900,7 @@ import { stdin as stdin3 } from "process";
 
 // src/auth/browser-login.ts
 import { hostname as osHostname } from "os";
+import { randomInt } from "crypto";
 
 // src/auth/loopback.ts
 import http from "http";
@@ -13097,6 +13098,7 @@ function errorMessage(error) {
 
 // src/auth/browser-login.ts
 var BROWSER_LOGIN_REQUEST_TIMEOUT_MS = 15e3;
+var BROWSER_LOGIN_CALLBACK_TIMEOUT_MS = 2 * 60 * 1e3;
 var BrowserLoginError = class extends Error {
   code;
   constructor(code, message) {
@@ -13110,16 +13112,20 @@ async function loginWithBrowser(input) {
   const hostname = (input.hostname ?? osHostname()).trim();
   const fetchImpl = input.fetchImpl ?? ((url, init) => fetch(url, init));
   const requestTimeoutMs = input.requestTimeoutMs ?? BROWSER_LOGIN_REQUEST_TIMEOUT_MS;
+  const callbackTimeoutMs = input.timeoutMs ?? BROWSER_LOGIN_CALLBACK_TIMEOUT_MS;
   const pkce = generatePkce();
   const state = generateOAuthState();
   const log = input.onInfo ?? (() => void 0);
+  const startLoopback = input.startLoopback ?? startLoopbackServer;
   let loopback;
+  let redirectUri;
   try {
-    loopback = await startLoopbackServer({ expectedState: state, timeoutMs: input.timeoutMs });
+    loopback = await startLoopback({ expectedState: state, timeoutMs: callbackTimeoutMs });
+    redirectUri = loopback.redirectUri;
   } catch (error) {
-    throw new BrowserLoginError(
-      "loopback_bind",
-      `Could not bind a local callback server (${error instanceof Error ? error.message : String(error)}). Use \`ultrac login --manual\` to paste a key.`
+    redirectUri = `http://127.0.0.1:${randomInt(49152, 65536)}/callback`;
+    log(
+      `Could not bind a local callback server (${error instanceof Error ? error.message : String(error)}).`
     );
   }
   try {
@@ -13129,7 +13135,7 @@ async function loginWithBrowser(input) {
       {
         client: "ultrac",
         hostname,
-        redirect_uri: loopback.redirectUri,
+        redirect_uri: redirectUri,
         state,
         code_challenge: pkce.challenge,
         code_challenge_method: pkce.method
@@ -13153,26 +13159,27 @@ async function loginWithBrowser(input) {
     if (input.openBrowser(verificationUrl) === false) {
       log("If a browser did not open, paste the URL above.");
     }
-    const callback = await loopback.wait;
-    if (!callback.ok) {
-      if (callback.error === "access_denied") {
-        throw new BrowserLoginError("access_denied", "Sign-in was denied in the browser.");
-      }
-      if (callback.error === "expired_token") {
-        throw new BrowserLoginError("expired_token", "Timed out waiting for the browser. Run ultrac login again.");
+    let code;
+    if (loopback) {
+      const callback = await loopback.wait;
+      if (callback.ok) {
+        code = callback.code;
+      } else {
+        if (callback.error === "access_denied") {
+          throw new BrowserLoginError("access_denied", "Sign-in was denied in the browser.");
+        }
+        code = await requestRecoveryCode(input, log, callback.description);
       }
-      throw new BrowserLoginError(
-        callback.error,
-        callback.description ?? `Browser login failed (${callback.error}).`
-      );
+    } else {
+      code = await requestRecoveryCode(input, log);
     }
     const exchanged = await postJson(
       fetchImpl,
       `${origin}/api/cli/login/exchange`,
       {
-        code: callback.code,
+        code,
         code_verifier: pkce.verifier,
-        redirect_uri: loopback.redirectUri
+        redirect_uri: redirectUri
       },
       requestTimeoutMs
     );
@@ -13193,7 +13200,32 @@ async function loginWithBrowser(input) {
       label: exchanged.body.label
     };
   } finally {
-    await loopback.close().catch(() => void 0);
+    await loopback?.close().catch(() => void 0);
+  }
+}
+async function requestRecoveryCode(input, log, reason) {
+  if (!input.requestCompletionCode) {
+    throw new BrowserLoginError(
+      "callback_failed",
+      `${reason ? `${reason} ` : ""}Browser completion did not reach this terminal. Run ultrac login again.`
+    );
+  }
+  log("Browser completion did not reach this terminal.");
+  log("Copy the short-lived completion code (or the failed localhost callback URL) from the browser.");
+  const supplied = (await input.requestCompletionCode()).trim();
+  const code = completionCodeFromInput(supplied);
+  if (!code) {
+    throw new BrowserLoginError("missing_code", "No completion code was provided. Nothing was saved.");
+  }
+  return code;
+}
+function completionCodeFromInput(value) {
+  if (!value) return "";
+  try {
+    const url = new URL(value);
+    return url.searchParams.get("code")?.trim() ?? "";
+  } catch {
+    return value;
   }
 }
 async function postJson(fetchImpl, url, body, timeoutMs) {
@@ -13376,7 +13408,8 @@ async function browserLogin(baseUrl, shouldOpen) {
       baseUrl,
       hostname: osHostname2(),
       openBrowser: (url) => shouldOpen ? openBrowser(url) : false,
-      onInfo: (line) => console.log(line)
+      onInfo: (line) => console.log(line),
+      requestCompletionCode: () => promptSecret("Paste the one-time completion code: ")
     });
   } catch (error) {
     if (error instanceof BrowserLoginError) throw new Error(error.message);
@@ -13400,7 +13433,10 @@ async function verifyAndStore(input) {
   } else {
     console.log(chalk4.yellow("unverified"));
     console.log(chalk4.yellow(`  Could not verify the key (${check.message}).`));
-    console.log(chalk4.yellow("  Saving it anyway; run `ultrac doctor` once the API is reachable."));
+    if (!input.pasted) {
+      throw new Error("Nothing was saved. Browser sign-in keys are stored only after the API accepts them.");
+    }
+    console.log(chalk4.yellow("  Saving the explicitly supplied key; run `ultrac doctor` once the API is reachable."));
   }
   const path = await writeCredentials({
     apiKey: input.apiKey,
@@ -14529,7 +14565,7 @@ async function readStdin() {
 // src/commands/repl.ts
 import { createInterface as createInterface3 } from "readline";
 import { stdin as stdin5, stdout as stdout5 } from "process";
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 
 // src/config/budget.ts
 function applyBudgetFlags(flags, config) {
@@ -14929,6 +14965,21 @@ Acknowledge that you have the context and wait for the user's first request.`
     this.fileProvenance.set(contextMessage, unknownContextProvenance());
     this.started = true;
   }
+  appendQueuedMessages(handlers) {
+    const queued = handlers.drainQueuedMessages?.() ?? [];
+    let appended = 0;
+    for (const raw of queued) {
+      const content = raw.trim();
+      if (!content) continue;
+      const message = { role: "user", content };
+      this.messages.push(message);
+      this.pinnedMessages.push(message);
+      this.userConstraints.push({ kind: "message", content });
+      handlers.onQueuedMessage?.(content);
+      appended += 1;
+    }
+    return appended;
+  }
   async ask(input, handlers = {}) {
     if (!this.started) await this.start();
     if (!this.firstTask) this.firstTask = input;
@@ -14947,6 +14998,7 @@ Acknowledge that you have the context and wait for the user's first request.`
           handlers.onInterrupted?.();
           break;
         }
+        this.appendQueuedMessages(handlers);
         const system = buildSystemPrompt(
           this.advertisedTools(),
           getEffectiveModePermissions(this.activeMode, this.permissions),
@@ -15029,7 +15081,8 @@ Acknowledge that you have the context and wait for the user's first request.`
           handlers.onInterrupted?.();
           break;
         }
-        if (parsed.done && parsed.toolCalls.length === 0) {
+        const queuedMessages = this.appendQueuedMessages(handlers);
+        if (parsed.done && parsed.toolCalls.length === 0 && queuedMessages === 0) {
           stopReason = "completed";
           break;
         }
@@ -15395,6 +15448,21 @@ ${context}`
     this.fileProvenance.set(contextMessage, unknownContextProvenance());
     this.started = true;
   }
+  appendQueuedMessages(handlers) {
+    const queued = handlers.drainQueuedMessages?.() ?? [];
+    let appended = 0;
+    for (const raw of queued) {
+      const content = raw.trim();
+      if (!content) continue;
+      const message = { role: "user", content };
+      this.messages.push(message);
+      this.pinnedMessages.push(message);
+      this.userConstraints.push({ kind: "message", content });
+      handlers.onQueuedMessage?.(content);
+      appended += 1;
+    }
+    return appended;
+  }
   async ask(input, handlers = {}) {
     if (!this.started) await this.start();
     if (!this.firstTask) this.firstTask = input;
@@ -15412,6 +15480,7 @@ ${context}`
           handlers.onInterrupted?.();
           break;
         }
+        this.appendQueuedMessages(handlers);
         this.refreshSystemPrompt();
         const tools = toToolSchemas(this.advertisedTools());
         const turn = this.steps.length + 1;
@@ -15462,9 +15531,17 @@ ${context}`
           });
         }
         if (!response.toolCalls.length) {
-          stopReason = "completed";
           this.steps.push(step);
-          break;
+          if (handlers.signal?.aborted) {
+            stopReason = "aborted";
+            handlers.onInterrupted?.();
+            break;
+          }
+          if (this.appendQueuedMessages(handlers) === 0) {
+            stopReason = "completed";
+            break;
+          }
+          continue;
         }
         for (const call of response.toolCalls) {
           if (handlers.signal?.aborted) break;
@@ -15508,6 +15585,7 @@ ${context}`
           handlers.onInterrupted?.();
           break;
         }
+        this.appendQueuedMessages(handlers);
       }
     } catch (error) {
       stopReason = "error";
@@ -16212,6 +16290,149 @@ var Spinner = class {
   }
 };
 
+// src/ui/tool-activity.ts
+var VERBS = {
+  read_file: "Read",
+  read_many_files: "Read",
+  write_file: "Edit",
+  replace_in_file: "Edit",
+  multi_edit: "Edit",
+  apply_patch: "Apply patch",
+  search_files: "Search",
+  list_files: "List files",
+  inspect_project: "Inspect project",
+  repo_map: "Map repository",
+  context_bundle: "Gather context",
+  run_shell: "Run",
+  run_package_script: "Run package script",
+  run_tests: "Run tests",
+  diagnostics: "Check diagnostics",
+  task: "Delegate",
+  fetch_url: "Fetch",
+  git_status: "Check Git status",
+  git_diff: "Read Git diff",
+  git_log: "Read Git log",
+  git_show: "Read Git object",
+  git_blame: "Read Git blame",
+  git_commit: "Commit changes",
+  git_push: "Push changes"
+};
+function toolActivityLabel(call) {
+  const verb = VERBS[call.tool] ?? humanize(call.tool);
+  const target = toolTarget(call);
+  return target ? `${verb} ${target}` : verb;
+}
+function toolFailurePreview(result) {
+  if (result.ok) return void 0;
+  const detail = result.content.split("\n").map((line) => line.trim()).filter(Boolean).slice(0, 2).join(" \xB7 ");
+  return detail ? truncate2(detail, 240) : `${humanize(result.tool)} failed`;
+}
+function toolTarget(call) {
+  const input = call.input;
+  const path = stringValue(input.path);
+  if (path) return compact2(path);
+  const paths = Array.isArray(input.paths) ? input.paths.filter((value) => typeof value === "string") : [];
+  if (paths.length === 1) return compact2(paths[0]);
+  if (paths.length > 1) return `${paths.length} files`;
+  if (call.tool === "run_shell") return compact2(stringValue(input.command), 72);
+  if (call.tool === "run_package_script") return compact2(stringValue(input.script), 50);
+  if (call.tool === "search_files") return quote(stringValue(input.query) || stringValue(input.pattern));
+  if (call.tool === "fetch_url") return compact2(stringValue(input.url), 72);
+  if (call.tool === "task") return compact2(stringValue(input.description) || stringValue(input.task), 64);
+  if (call.tool === "git_show") return compact2(stringValue(input.ref), 40);
+  if (call.tool === "git_commit") return quote(stringValue(input.message), 56);
+  return "";
+}
+function stringValue(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function compact2(value, max = 64) {
+  if (!value) return "";
+  return truncate2(value.replace(/\s+/g, " "), max);
+}
+function quote(value, max = 48) {
+  return value ? `\u201C${compact2(value, max)}\u201D` : "";
+}
+function truncate2(value, max) {
+  return value.length > max ? `${value.slice(0, Math.max(1, max - 1))}\u2026` : value;
+}
+function humanize(value) {
+  const words = value.replace(/[_-]+/g, " ").trim();
+  return words ? `${words[0].toUpperCase()}${words.slice(1)}` : "Tool";
+}
+
+// src/ui/welcome.ts
+import chalk9, { Chalk } from "chalk";
+var LOGO = [
+  "\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2557",
+  "\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551  \u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D",
+  "\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551     ",
+  "\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551     \u2588\u2588\u2551   \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2551     ",
+  "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551   \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557",
+  " \u255A\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D   \u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u255D"
+];
+function renderWelcome(info, options = {}) {
+  const columns = normalizeColumns(options.columns);
+  const paint = new Chalk({ level: options.color === false ? 0 : chalk9.level });
+  const cardWidth = Math.min(88, Math.max(42, columns));
+  const innerWidth = cardWidth - 4;
+  const wide = columns >= 64;
+  const lines = [];
+  if (wide) {
+    lines.push("");
+    for (let index = 0; index < LOGO.length; index += 1) {
+      const color = index < 2 ? paint.hex("#38BDF8") : index < 4 ? paint.hex("#22D3EE") : paint.hex("#A78BFA");
+      lines.push(`  ${color(LOGO[index])}`);
+    }
+  } else {
+    lines.push("", `  ${paint.bold.hex("#22D3EE")("ULTRAC")} ${paint.gray(`v${info.version}`)}`);
+  }
+  const topLabel = wide ? ` ultrac v${info.version} ` : " session ";
+  const topFill = Math.max(0, cardWidth - topLabel.length - 2);
+  lines.push(paint.cyan(`\u256D${topLabel}${"\u2500".repeat(topFill)}\u256E`));
+  lines.push(cardLine(`${info.model} via ${info.providerName}`, innerWidth, paint.bold));
+  lines.push(cardLine(`${info.mode} \xB7 ${info.protocol}`, innerWidth, paint.white));
+  lines.push(cardLine(shortenMiddle(info.workspace, innerWidth), innerWidth, paint.gray));
+  lines.push(paint.cyan(`\u251C${"\u2500".repeat(cardWidth - 2)}\u2524`));
+  lines.push(cardLine(info.budget, innerWidth, paint.gray));
+  lines.push(cardLine(`logs ${shortenMiddle(info.diagnosticPath, Math.max(8, innerWidth - 5))}`, innerWidth, paint.gray));
+  lines.push(paint.cyan(`\u2570${"\u2500".repeat(cardWidth - 2)}\u256F`));
+  lines.push(
+    wide ? `${paint.gray("  /help commands")} ${paint.dim("\xB7")} ${paint.gray("/exit quit")} ${paint.dim("\xB7")} ${paint.gray("Ctrl-C interrupt")}` : paint.gray("  /help \xB7 /exit \xB7 Ctrl-C")
+  );
+  return lines.join("\n");
+}
+function renderComposer(columns = 80, color = true) {
+  const paint = new Chalk({ level: color ? chalk9.level : 0 });
+  const width = Math.min(88, Math.max(28, normalizeColumns(columns)));
+  const label = " message ";
+  const fill = Math.max(1, width - label.length - 2);
+  return {
+    frame: `
+${paint.cyan(`\u256D\u2500${label}${"\u2500".repeat(fill)}`)}
+${paint.cyan("\u2502")}`,
+    prompt: paint.bold.hex("#22D3EE")("\u2570\u2500\u276F ")
+  };
+}
+function cardLine(value, width, style) {
+  const clipped = truncate3(value, width);
+  return `\u2502 ${style(clipped)}${" ".repeat(Math.max(0, width - clipped.length))} \u2502`;
+}
+function normalizeColumns(columns) {
+  return Number.isFinite(columns) ? Math.max(28, Math.floor(columns)) : 80;
+}
+function truncate3(value, width) {
+  if (value.length <= width) return value;
+  if (width <= 1) return "\u2026";
+  return `${value.slice(0, width - 1)}\u2026`;
+}
+function shortenMiddle(value, width) {
+  if (value.length <= width) return value;
+  if (width < 9) return truncate3(value, width);
+  const side = Math.floor((width - 1) / 2);
+  return `${value.slice(0, side)}\u2026${value.slice(value.length - (width - side - 1))}`;
+}
+
 // src/update/check.ts
 import { spawn as spawn4 } from "child_process";
 import { randomBytes as randomBytes4 } from "crypto";
@@ -16438,14 +16659,14 @@ async function runRepl(options, initialTask = "") {
   if (loaded.needsApproval && await offerWorkspaceTrust(workspace, loaded.withheld, loaded.trustSnapshot, loaded.trustStatus)) {
     loaded = await loadConfigWithTrust(workspace);
     if (loaded.needsApproval) {
-      console.log(chalk9.yellow(`
+      console.log(chalk10.yellow(`
   ${withheldNotice(workspace, loaded.withheld, loaded.trustStatus)}
 `));
     }
   }
   const config = loaded.config;
   const toolSelection = applyBudgetFlags(options, config);
-  setContextBudgetNotice((message) => console.log(chalk9.yellow(`
+  setContextBudgetNotice((message) => console.log(chalk10.yellow(`
   ! ${message}`)));
   const providerName = options.provider ?? config.provider;
   if (!isProviderName(providerName)) {
@@ -16461,8 +16682,8 @@ async function runRepl(options, initialTask = "") {
   }
   const hasFallbackChain = Boolean(config.fallback?.chain?.length);
   if (providerName === "ultrac" && !hasFallbackChain && !await resolveUltracCredentials()) {
-    console.log(chalk9.yellow("You are not signed in to Ultrac."));
-    console.log(`Run ${chalk9.cyan("ultrac login")} first, or start with ${chalk9.cyan("--provider echo")}.`);
+    console.log(chalk10.yellow("You are not signed in to Ultrac."));
+    console.log(`Run ${chalk10.cyan("ultrac login")} first, or start with ${chalk10.cyan("--provider echo")}.`);
     process.exitCode = EXIT_REPL_NOT_STARTED;
     return;
   }
@@ -16474,26 +16695,26 @@ async function runRepl(options, initialTask = "") {
       model,
       fallback: config.fallback,
       onFailover: (event) => {
-        console.log(chalk9.yellow(formatFailoverNotice(event)));
+        console.log(chalk10.yellow(formatFailoverNotice(event)));
         if (event.to) {
-          console.log(chalk9.gray(`  now answering: provider ${event.to.provider} \xB7 model ${event.to.model}`));
+          console.log(chalk10.gray(`  now answering: provider ${event.to.provider} \xB7 model ${event.to.model}`));
         }
       },
       // A tool-calling turn served by an entry without native tool calling still
       // answers, but over the JSON tool protocol. Say so rather than letting the
       // banner's "native tools" claim go stale.
-      onDowngrade: (event) => console.log(chalk9.yellow(formatDowngradeNotice(event))),
+      onDowngrade: (event) => console.log(chalk10.yellow(formatDowngradeNotice(event))),
       onRetry: (event) => {
         diagnosticEvent("provider.retry", event);
         console.log(
-          chalk9.yellow(
+          chalk10.yellow(
             `  retrying ${event.target.provider} (${event.target.model}) in ${event.delayMs}ms after ${event.classification.reason}`
           )
         );
       }
     });
   } catch (error) {
-    console.log(chalk9.red(error instanceof Error ? error.message : String(error)));
+    console.log(chalk10.red(error instanceof Error ? error.message : String(error)));
     process.exitCode = EXIT_REPL_NOT_STARTED;
     return;
   }
@@ -16525,7 +16746,7 @@ async function runRepl(options, initialTask = "") {
     permissions: basePermissions
   });
   const writeCheckpoint = createSessionCheckpointWriter(workspace, (message) => {
-    console.error(chalk9.yellow(message));
+    console.error(chalk10.yellow(message));
   });
   const persistSession = async (target = session) => {
     const snapshot = target.toSession();
@@ -16543,7 +16764,7 @@ async function runRepl(options, initialTask = "") {
     diagnosticPath2
   );
   if (mcpRuntime && mcpRuntime.statuses.length > 0) {
-    console.log(chalk9.bold("\nMCP servers"));
+    console.log(chalk10.bold("\nMCP servers"));
     console.log(renderMcpStatuses(mcpRuntime.statuses));
   }
   try {
@@ -16553,24 +16774,25 @@ async function runRepl(options, initialTask = "") {
   }
   const update = await updateCheck;
   if (update?.updateAvailable && update.latestVersion) {
-    console.log(chalk9.yellow(`
+    console.log(chalk10.yellow(`
   \u2191 Update available: ${update.currentVersion} \u2192 ${update.latestVersion}`));
-    console.log(chalk9.gray("    Run `ultrac update` after this session."));
+    console.log(chalk10.gray("    Run `ultrac update` after this session."));
   }
   const rl = createInterface3({ input: stdin5, output: stdout5 });
   const reader = new LineReader(rl);
   const question = async (prompt, signal) => {
     stdout5.write(prompt);
-    return reader.next(signal);
+    return reader.nextFresh(signal);
   };
+  const drainQueuedMessages = () => reader.drainQueuedMessages();
   setAskUserRuntime(async (text, options2, signal) => {
-    console.log(chalk9.cyan(`
+    console.log(chalk10.cyan(`
   ? ${text}`));
     if (options2?.length) {
-      options2.forEach((option, index) => console.log(chalk9.gray(`     ${index + 1}. ${option}`)));
-      console.log(chalk9.gray("     (type a number, or answer in your own words)"));
+      options2.forEach((option, index) => console.log(chalk10.gray(`     ${index + 1}. ${option}`)));
+      console.log(chalk10.gray("     (type a number, or answer in your own words)"));
     }
-    const rawAnswer = await question(chalk9.cyan("  \u203A "), signal);
+    const rawAnswer = await question(chalk10.cyan("  \u203A "), signal);
     if (signal?.aborted) return null;
     const answer = (rawAnswer ?? "").trim();
     const picked = Number.parseInt(answer, 10);
@@ -16582,11 +16804,10 @@ async function runRepl(options, initialTask = "") {
   let running = true;
   let turnAbort;
   rl.on("SIGINT", () => {
-    if (turnAbort && !turnAbort.signal.aborted) {
-      turnAbort.abort();
-      return;
-    }
-    console.log("\nUse /exit to end the session.");
+    if (handleReplInterrupt(turnAbort) === "abort-turn") return;
+    running = false;
+    console.log(chalk10.gray("\nExiting ultrac\u2026"));
+    rl.close();
   });
   const terminate = () => {
     running = false;
@@ -16604,12 +16825,18 @@ async function runRepl(options, initialTask = "") {
   };
   try {
     if (initialTask) {
-      console.log(chalk9.cyan(`
+      console.log(chalk10.cyan(`
 \u203A ${initialTask}`));
-      await withInterrupt((signal) => runAndCheckpointTurn(session, initialTask, question, signal, persistSession));
+      await withInterrupt((signal) => runAndCheckpointTurn(session, initialTask, question, signal, persistSession, drainQueuedMessages));
     }
     while (running) {
-      stdout5.write(chalk9.cyan("\n\u203A "));
+      if (stdout5.isTTY) {
+        const composer = renderComposer(stdout5.columns, true);
+        console.log(composer.frame);
+        stdout5.write(composer.prompt);
+      } else {
+        stdout5.write(chalk10.cyan("\n\u203A "));
+      }
       const line = await reader.next();
       if (line === null) break;
       const raw = line.trim();
@@ -16625,9 +16852,9 @@ async function runRepl(options, initialTask = "") {
               permissions: session.currentPermissions
             });
             resetContextBudgetNotices();
-            console.log(chalk9.gray("Started a fresh conversation."));
+            console.log(chalk10.gray("Started a fresh conversation."));
           }, async (prompt) => {
-            await runAndCheckpointTurn(session, prompt, question, signal, persistSession);
+            await runAndCheckpointTurn(session, prompt, question, signal, persistSession, drainQueuedMessages);
           }, signal, async (id) => {
             const lineage = await loadSessionLineage(workspace, id);
             const restored = createSession({ model: session.model, mode: session.mode, permissions: session.currentPermissions });
@@ -16656,7 +16883,7 @@ async function runRepl(options, initialTask = "") {
         }
         continue;
       }
-      await withInterrupt((signal) => runAndCheckpointTurn(session, raw, question, signal, persistSession));
+      await withInterrupt((signal) => runAndCheckpointTurn(session, raw, question, signal, persistSession, drainQueuedMessages));
     }
   } finally {
     process.off("SIGTERM", terminate);
@@ -16665,9 +16892,9 @@ async function runRepl(options, initialTask = "") {
     await saveTranscript(session, writeCheckpoint);
     mcpRuntime?.close();
   }
-  console.log(chalk9.gray("Goodbye."));
+  console.log(chalk10.gray("Goodbye."));
 }
-async function runTurn(session, input, question, signal) {
+async function runTurn(session, input, question, signal, drainQueuedMessages) {
   const spinner = new Spinner();
   const detachProgress = attachProgressUi();
   let deltaChars = 0;
@@ -16676,7 +16903,7 @@ async function runTurn(session, input, question, signal) {
       ...signal ? { signal } : {},
       onInterrupted: () => {
         spinner.stop();
-        console.log(chalk9.yellow("\n  \u238B interrupted \u2014 the work so far is kept. Ask again to continue."));
+        console.log(chalk10.dim("\n  Interrupted \u2014 current work stopped. Session preserved."));
       },
       onModelStart: () => {
         deltaChars = 0;
@@ -16694,34 +16921,41 @@ ${message.trim()}`);
         }
       },
       onToolStart: (call) => {
-        console.log(chalk9.gray(`  \u2699 ${call.tool} ${compactInput(call.input)}`));
+        console.log(chalk10.dim(`  ${toolActivityLabel(call)}`));
       },
-      onToolResult: (call, result) => printToolResult2(result),
+      onToolResult: (_call, result) => printToolResult2(result),
+      ...drainQueuedMessages ? {
+        drainQueuedMessages,
+        onQueuedMessage: () => {
+          spinner.stop();
+          console.log(chalk10.dim("  Queued message added to the current turn."));
+        }
+      } : {},
       onToolDenied: (call, permission) => {
-        console.log(chalk9.yellow(`  \u2717 denied ${permission} for ${call.tool}`));
+        console.log(chalk10.yellow(`  \u2717 denied ${permission} for ${call.tool}`));
       },
       onProviderNotice: (notice) => {
-        console.log(chalk9.yellow(`  ! ${notice}`));
+        console.log(chalk10.yellow(`  ! ${notice}`));
       },
       onStopped: (reason) => {
         if (reason === "aborted") return;
         const line = stopReasonLine(reason);
         const hint = turnStopHint(reason, session.maxSteps);
         if (!line || !hint) return;
-        console.log(chalk9.yellow(`
+        console.log(chalk10.yellow(`
   \u26A0 ${line}`));
-        console.log(chalk9.gray(`  ${hint}`));
+        console.log(chalk10.gray(`  ${hint}`));
       },
       requestPermission: async (call, permission) => {
         const prompt = permission === "shell" && call.tool === "run_shell" ? shellApprovalPrompt(call, session.toSession().workspace) : permission === "shell" ? `  ${call.tool} wants shell access. [o]nce (this call only) / [a]lways (all shell tools for this session) / [n]o (this call) / n[e]ver (this session) \u203A ` : `  ${call.tool} wants ${permission} access. [o]nce / [a]lways / [n]o / n[e]ver \u203A `;
-        const rawAnswer = await question(chalk9.yellow(prompt), signal);
+        const rawAnswer = await question(chalk10.yellow(prompt), signal);
         if (signal?.aborted || rawAnswer === null) return "deny";
         const answer = rawAnswer.trim().toLowerCase();
         if (answer === "a" || answer === "always") return "always";
         if (answer === "o" || answer === "once" || answer === "y" || answer === "yes") return "once";
         if (answer === "e" || answer === "never") {
           console.log(
-            chalk9.gray(
+            chalk10.gray(
               `  ${permission} refused for the rest of the session \u2014 nothing will ask again. /allow ${permission} undoes it.`
             )
           );
@@ -16739,9 +16973,9 @@ ${message.trim()}`);
     detachProgress();
   }
 }
-async function runAndCheckpointTurn(session, input, question, signal, persist) {
+async function runAndCheckpointTurn(session, input, question, signal, persist, drainQueuedMessages) {
   try {
-    return await runTurn(session, input, question, signal);
+    return await runTurn(session, input, question, signal, drainQueuedMessages);
   } finally {
     await persist(session);
   }
@@ -16758,27 +16992,27 @@ function turnStopHint(reason, maxSteps) {
 }
 function printTurnError(error) {
   if (error instanceof ProviderChainError) {
-    console.log(chalk9.red("\n  \u2717 Turn failed: no provider in the chain could answer."));
+    console.log(chalk10.red("\n  \u2717 Turn failed: no provider in the chain could answer."));
     for (const failure of error.failures) {
       const attempts = failure.attempts === 1 ? "1 attempt" : `${failure.attempts} attempts`;
       console.log(
-        chalk9.red(`    - ${failure.provider} (${failure.model}), ${attempts}: ${errorMessage2(failure.error)}`)
+        chalk10.red(`    - ${failure.provider} (${failure.model}), ${attempts}: ${errorMessage2(failure.error)}`)
       );
     }
     console.log(
-      chalk9.gray("  Fix the provider (ultrac login, or --provider echo) and try again; the session is still open.")
+      chalk10.gray("  Fix the provider (ultrac login, or --provider echo) and try again; the session is still open.")
     );
     return;
   }
-  console.log(chalk9.red(`
+  console.log(chalk10.red(`
   \u2717 Turn failed: ${errorMessage2(error)}`));
-  console.log(chalk9.gray("  The session is still open. Try again, or /exit to end it."));
+  console.log(chalk10.gray("  The session is still open. Try again, or /exit to end it."));
 }
 async function saveTranscript(session, writeCheckpoint) {
   const snapshot = session.toSession();
   if (!hasSavedSessionContent(snapshot)) return;
   const stored = await writeCheckpoint(snapshot);
-  if (stored) console.log(chalk9.gray(`
+  if (stored) console.log(chalk10.gray(`
 Session saved: ${stored}`));
 }
 function hasSavedSessionContent(session) {
@@ -16820,7 +17054,7 @@ async function handleSlashCommand(raw, session, providerName, workspace, onClear
       if (extra) console.log(`
 ${extra}`);
       for (const conflict of index.conflicts) {
-        console.log(chalk9.yellow(`  ! ${conflict.message}`));
+        console.log(chalk10.yellow(`  ! ${conflict.message}`));
       }
       return "ok";
     }
@@ -16834,7 +17068,7 @@ ${extra}`);
     case "model":
       if (argument) {
         session.setModel(argument);
-        console.log(chalk9.gray(`Model set to ${argument}.`));
+        console.log(chalk10.gray(`Model set to ${argument}.`));
       } else {
         console.log(`Model: ${session.model}`);
       }
@@ -16842,10 +17076,10 @@ ${extra}`);
     case "mode":
       if (argument) {
         if (!isAgentModeName(argument)) {
-          console.log(chalk9.red(`Unknown mode. Expected one of: ${agentModeNames.join(", ")}.`));
+          console.log(chalk10.red(`Unknown mode. Expected one of: ${agentModeNames.join(", ")}.`));
         } else {
           session.setMode(argument);
-          console.log(chalk9.gray(`Mode set to ${argument}.`));
+          console.log(chalk10.gray(`Mode set to ${argument}.`));
         }
       } else {
         console.log(`Mode: ${session.mode}`);
@@ -16894,7 +17128,7 @@ ${extra}`);
       console.log(
         `Selected ${info.selectedMessages.toLocaleString("en-US")} of ${info.messages.toLocaleString("en-US")} messages; would omit ${info.omittedMessages.toLocaleString("en-US")} messages in ${info.omittedTurns.toLocaleString("en-US")} earlier turns. Prompt headroom ${info.promptRemainingTokens.toLocaleString("en-US")} tokens; window headroom ${info.windowRemainingTokens.toLocaleString("en-US")} of ${info.contextTokens.toLocaleString("en-US")} tokens.`
       );
-      if (info.error) console.log(chalk9.yellow(`Context error: ${info.error}`));
+      if (info.error) console.log(chalk10.yellow(`Context error: ${info.error}`));
       return "ok";
     }
     case "compact":
@@ -16902,7 +17136,7 @@ ${extra}`);
         await session.compactContext(argument, signal);
         console.log("Context compacted. User instructions were retained; earlier activity was replaced by a bounded continuation record.");
       } catch (error) {
-        console.log(chalk9.red(errorMessage2(error)));
+        console.log(chalk10.red(errorMessage2(error)));
       }
       return "ok";
     case "resume":
@@ -16913,7 +17147,7 @@ ${extra}`);
       try {
         await resume(argument);
       } catch (error) {
-        console.log(chalk9.red(errorMessage2(error)));
+        console.log(chalk10.red(errorMessage2(error)));
       }
       return "ok";
     case "save": {
@@ -16964,7 +17198,7 @@ ${extra}`);
       const refused = session.refusedPermissions;
       if (refused.length) {
         console.log(
-          chalk9.gray(`refused for this session: ${refused.join(", ")} (undo with /allow <perm>)`)
+          chalk10.gray(`refused for this session: ${refused.join(", ")} (undo with /allow <perm>)`)
         );
       }
       return "ok";
@@ -16973,9 +17207,9 @@ ${extra}`);
     case "allow": {
       if (argument === "write" || argument === "shell" || argument === "network") {
         session.setPermission(argument, command === "allow");
-        console.log(chalk9.gray(`${command === "allow" ? "Granted" : "Revoked"} ${argument} for this session.`));
+        console.log(chalk10.gray(`${command === "allow" ? "Granted" : "Revoked"} ${argument} for this session.`));
       } else {
-        console.log(chalk9.red(`Usage: /${command} <write|shell|network>`));
+        console.log(chalk10.red(`Usage: /${command} <write|shell|network>`));
       }
       return "ok";
     }
@@ -16994,7 +17228,7 @@ ${extra}`);
       const names = session.advertisedToolNames;
       console.log(`Advertised to the model this turn (${names.length}): ${names.join(", ")}`);
       console.log(
-        chalk9.gray(
+        chalk10.gray(
           "Registered tools remain subject to permission and mode checks. `ultrac tools` lists them all with schemas; --tools all advertises them all."
         )
       );
@@ -17003,7 +17237,7 @@ ${extra}`);
     case "memory": {
       const memories = await listMemories(workspace);
       if (!memories.length) {
-        console.log(chalk9.gray("No stored memories. Add one with `ultrac memory add`."));
+        console.log(chalk10.gray("No stored memories. Add one with `ultrac memory add`."));
       } else {
         for (const memory of memories) {
           console.log(`- [${memory.scope}/${memory.name}] (${memory.type}) ${memory.description}`);
@@ -17014,7 +17248,7 @@ ${extra}`);
     case "skills": {
       const skills = await listSkills(workspace);
       if (!skills.length) {
-        console.log(chalk9.gray("No skills installed. Create one with `ultrac skills create`."));
+        console.log(chalk10.gray("No skills installed. Create one with `ultrac skills create`."));
       } else {
         for (const skill of skills) {
           console.log(`- ${skill.name} (${skill.scope}): ${skill.description}`);
@@ -17030,12 +17264,12 @@ ${extra}`);
         force: true
       });
       if (!update.latestVersion) {
-        console.log(chalk9.yellow("Could not check npm. Confirm npm access, then run `ultrac update --check` outside this session."));
+        console.log(chalk10.yellow("Could not check npm. Confirm npm access, then run `ultrac update --check` outside this session."));
       } else if (update.updateAvailable) {
-        console.log(chalk9.yellow(`Update available: ${update.currentVersion} \u2192 ${update.latestVersion}`));
-        console.log(chalk9.gray("Exit this session, then run `ultrac update`."));
+        console.log(chalk10.yellow(`Update available: ${update.currentVersion} \u2192 ${update.latestVersion}`));
+        console.log(chalk10.gray("Exit this session, then run `ultrac update`."));
       } else {
-        console.log(chalk9.green(`ultrac ${update.currentVersion} is up to date.`));
+        console.log(chalk10.green(`ultrac ${update.currentVersion} is up to date.`));
       }
       return "ok";
     }
@@ -17047,27 +17281,27 @@ async function runSkillCommand(session, raw, workspace, question) {
   const resolved = await resolveSkillCommand(workspace, raw);
   if (resolved.status === "ok") {
     console.log(
-      chalk9.gray(`  /${resolved.command.command} \u2192 skill ${resolved.command.skillName} (${resolved.command.scope})`)
+      chalk10.gray(`  /${resolved.command.command} \u2192 skill ${resolved.command.skillName} (${resolved.command.scope})`)
     );
     await runTurn(session, resolved.prompt, question);
     return;
   }
   if (resolved.status === "conflict") {
-    console.log(chalk9.red(resolved.message));
+    console.log(chalk10.red(resolved.message));
     return;
   }
   if (resolved.status === "builtin") {
-    console.log(chalk9.red(`/${resolved.command} is a built-in command and was not handled. Try /help.`));
+    console.log(chalk10.red(`/${resolved.command} is a built-in command and was not handled. Try /help.`));
     return;
   }
   if (resolved.status === "unknown") {
-    console.log(chalk9.red(`Unknown command: /${resolved.command}. Try /help.`));
+    console.log(chalk10.red(`Unknown command: /${resolved.command}. Try /help.`));
     if (resolved.available.length) {
-      console.log(chalk9.gray(`Skill commands: ${resolved.available.map((name) => `/${name}`).join(", ")}`));
+      console.log(chalk10.gray(`Skill commands: ${resolved.available.map((name) => `/${name}`).join(", ")}`));
     }
     return;
   }
-  console.log(chalk9.red("Unknown command. Try /help."));
+  console.log(chalk10.red("Unknown command. Try /help."));
 }
 var LineReader = class {
   queue = [];
@@ -17090,9 +17324,36 @@ var LineReader = class {
     });
   }
   next(signal) {
+    return this.waitForLine(signal, true);
+  }
+  /**
+   * Nested prompts must not consume steering messages entered before the
+   * question appeared. They wait for the next line while the queue stays put.
+   */
+  nextFresh(signal) {
+    return this.waitForLine(signal, false);
+  }
+  /**
+   * Drain ordinary messages in arrival order. A slash command is a control
+   * boundary and remains queued for the main REPL loop along with everything
+   * after it.
+   */
+  drainQueuedMessages() {
+    const messages = [];
+    while (this.queue.length) {
+      const next = this.queue[0].trim();
+      if (next.startsWith("/")) break;
+      this.queue.shift();
+      if (next) messages.push(next);
+    }
+    return messages;
+  }
+  waitForLine(signal, includeBuffered) {
     if (signal?.aborted) return Promise.resolve(null);
-    const buffered = this.queue.shift();
-    if (buffered !== void 0) return Promise.resolve(buffered);
+    if (includeBuffered) {
+      const buffered = this.queue.shift();
+      if (buffered !== void 0) return Promise.resolve(buffered);
+    }
     if (this.closed) return Promise.resolve(null);
     return new Promise((resolve15) => {
       const waiter = { resolve: resolve15, ...signal ? { signal } : {} };
@@ -17117,13 +17378,27 @@ var LineReader = class {
     waiter.resolve(line);
   }
 };
+function handleReplInterrupt(activeTurn) {
+  if (activeTurn && !activeTurn.signal.aborted) {
+    activeTurn.abort();
+    return "abort-turn";
+  }
+  return "exit-session";
+}
 function printBanner(version, providerName, model, mode, workspace, protocol, budget, diagnosticPath2) {
-  console.log(chalk9.cyan("\u256D\u2500") + ` ${chalk9.bold("ultrac")} ${chalk9.gray(`v${version}`)}`);
-  console.log(chalk9.cyan("\u2502 ") + `${model} via ${providerName} \xB7 ${mode} \xB7 ${protocol}`);
-  console.log(chalk9.cyan("\u2502 ") + chalk9.gray(workspace));
-  console.log(chalk9.cyan("\u2502 ") + chalk9.gray(budget));
-  console.log(chalk9.cyan("\u2502 ") + chalk9.gray(`diagnostics ${diagnosticPath2}`));
-  console.log(chalk9.cyan("\u2570\u2500") + chalk9.gray(" Type /help for commands \xB7 /exit to quit"));
+  console.log(renderWelcome(
+    {
+      version,
+      providerName,
+      model,
+      mode,
+      workspace,
+      protocol,
+      budget,
+      diagnosticPath: diagnosticPath2
+    },
+    { columns: stdout5.columns, color: stdout5.isTTY }
+  ));
 }
 function describeBudget(mode, selection, registry) {
   const window = resolveContextWindow();
@@ -17140,20 +17415,12 @@ function describeAdvertisedTools(mode, selection, registry = createDefaultToolRe
   };
 }
 function printToolResult2(result) {
-  const status = result.ok ? chalk9.green("ok") : chalk9.red("failed");
-  console.log(`  ${chalk9.cyan(result.tool)} ${status}`);
-  const preview = result.content.split("\n").slice(0, 6).join("\n");
-  if (preview.trim()) {
-    console.log(chalk9.gray(indent3(truncate2(preview, 800))));
-  }
+  const failure = toolFailurePreview(result);
+  if (failure) console.log(chalk10.red(`    Failed: ${failure}`));
   for (const warning of getMcpArchiveWarnings(result)) {
-    console.log(chalk9.yellow(indent3(`Warning: ${warning}`)));
+    console.log(chalk10.yellow(indent3(`Warning: ${warning}`)));
   }
 }
-function compactInput(input) {
-  const text = JSON.stringify(input);
-  return text.length > 80 ? `${text.slice(0, 77)}...` : text;
-}
 function shellApprovalPrompt(call, workspace) {
   const command = typeof call.input.command === "string" ? call.input.command : "<invalid command>";
   const requestedCwd = typeof call.input.cwd === "string" ? call.input.cwd : ".";
@@ -17173,15 +17440,12 @@ function shellApprovalPrompt(call, workspace) {
     "  [o]nce runs only this command / [a]lways grants shell access for this whole session, including other shell-using tools / [n]o (this call) / n[e]ver (this session) \u203A "
   ].join("\n");
 }
-function truncate2(value, max) {
-  return value.length > max ? `${value.slice(0, max)}\u2026` : value;
-}
 function indent3(value) {
   return value.split("\n").map((line) => `    ${line}`).join("\n");
 }
 
 // src/commands/run.ts
-import chalk10 from "chalk";
+import chalk11 from "chalk";
 var EXIT_INCOMPLETE_RUN = 2;
 function registerRunCommand(program2) {
   program2.command("run").alias("chat").description("Run a one-shot coding agent task").argument("<task...>", "Task for the agent").option("-w, --workspace <path>", "Workspace path", ".").option("--provider <name>", "Provider: ultrac (default) or echo (offline test stub)").option("--model <model>", "Model name").option("--base-url <url>", "Ultrac API base URL (overrides ULTRAC_BASE_URL and the stored login)").option("--mode <name>", `Agent mode: ${agentModeNames.join(", ")}`).option("--max-steps <number>", "Maximum agent steps").option("--no-native-tools", "Use the legacy JSON tool protocol").option("--allow-write", "Allow file writes", false).option("--allow-shell", "Grant the model broad, unsandboxed shell access", false).option("--allow-network", "Allow HTTP(S) URL fetches", false).option("--continue <id>", "Continue from a saved session id").option("--tools <list>", "Tools to advertise: `all`, or a comma-separated list. Default: the mode's set").option("--context-tokens <number>", "Model context window in tokens (default 262144)").option("--max-tool-result-chars <number>", "Cap on one tool result in the transcript (default 6000)").option(
@@ -17195,17 +17459,17 @@ function registerRunCommand(program2) {
     }
     const workspace = await assertWorkspaceExists(options.workspace);
     const diagnosticPath2 = configureDiagnosticLog(workspace, "run");
-    console.error(chalk10.gray(`Diagnostic log: ${diagnosticPath2}`));
+    console.error(chalk11.gray(`Diagnostic log: ${diagnosticPath2}`));
     if (options.baseUrl) {
       setBaseUrlFlag(options.baseUrl);
     }
     const loaded = await loadConfigWithTrust(workspace);
     const config = loaded.config;
     if (loaded.needsApproval) {
-      console.error(chalk10.yellow(withheldNotice(workspace, loaded.withheld, loaded.trustStatus)));
+      console.error(chalk11.yellow(withheldNotice(workspace, loaded.withheld, loaded.trustStatus)));
     }
     const toolSelection = applyBudgetFlags(options, config);
-    setContextBudgetNotice((message) => console.error(chalk10.yellow(message)));
+    setContextBudgetNotice((message) => console.error(chalk11.yellow(message)));
     const providerName = options.provider ?? config.provider;
     const mode = options.mode ?? config.mode;
     const previousSessionLineage = options.continue ? await loadSessionLineage(workspace, options.continue) : void 0;
@@ -17226,14 +17490,14 @@ function registerRunCommand(program2) {
       model,
       fallback: config.fallback,
       // stderr, so --json keeps stdout parseable.
-      onFailover: (event) => console.error(chalk10.yellow(formatFailoverNotice(event))),
+      onFailover: (event) => console.error(chalk11.yellow(formatFailoverNotice(event))),
       // AgentRunner uses native tool calls when supported; wired
       // anyway so a non-interactive run stays honest if that ever changes.
-      onDowngrade: (event) => console.error(chalk10.yellow(formatDowngradeNotice(event))),
+      onDowngrade: (event) => console.error(chalk11.yellow(formatDowngradeNotice(event))),
       onRetry: (event) => {
         diagnosticEvent("provider.retry", event);
         console.error(
-          chalk10.yellow(
+          chalk11.yellow(
             `Retrying ${event.target.provider} (${event.target.model}) in ${event.delayMs}ms after ${event.classification.reason}`
           )
         );
@@ -17244,13 +17508,13 @@ function registerRunCommand(program2) {
     setSubagentRuntime({ provider, model, mode, registry });
     try {
       if (mcpRuntime && mcpRuntime.statuses.length > 0) {
-        console.error(chalk10.bold("MCP servers"));
+        console.error(chalk11.bold("MCP servers"));
         console.error(renderMcpStatuses(mcpRuntime.statuses));
       }
       const detachProgress = attachProgressUi();
       const runner = new AgentRunner(registry);
       const writeCheckpoint = createSessionCheckpointWriter(workspace, (message) => {
-        console.error(chalk10.yellow(message));
+        console.error(chalk11.yellow(message));
       });
       const controller = new AbortController();
       const abortRun = () => controller.abort();
@@ -17300,7 +17564,7 @@ function registerRunCommand(program2) {
       }
       const stopReason = result.session.stopReason;
       for (const warning of getSessionMcpArchiveWarnings(result.session)) {
-        console.error(chalk10.yellow(`Warning: ${warning}`));
+        console.error(chalk11.yellow(`Warning: ${warning}`));
       }
       if (options.json) {
         console.log(
@@ -17585,7 +17849,7 @@ function parsePermissions(list) {
 }
 
 // src/commands/tasks.ts
-import chalk11 from "chalk";
+import chalk12 from "chalk";
 
 // src/runs/api.ts
 var RUN_STATUSES = ["queued", "running", "succeeded", "failed", "cancelled"];
@@ -18121,7 +18385,7 @@ function registerTasksCommand(program2, deps = {}) {
     }
     r.out(formatRunTable(page.data, r.now()));
     if (page.next_cursor) {
-      r.err(chalk11.gray(`More: ultrac tasks --cursor ${page.next_cursor}
+      r.err(chalk12.gray(`More: ultrac tasks --cursor ${page.next_cursor}
 `));
     }
   });
@@ -18180,7 +18444,7 @@ async function runTask(promptParts, options, deps) {
 `);
   } else {
     r.err(
-      chalk11.gray(
+      chalk12.gray(
         `Run ${run.id} queued. Following; Ctrl-C ${options.detach ? "leaves it running" : "cancels it"}.
 `
       )
@@ -18198,7 +18462,7 @@ async function follow(r, runId, options) {
       controller.abort();
       return;
     }
-    r.err(chalk11.yellow(`
+    r.err(chalk12.yellow(`
 Leaving run ${runId} as it is.
 `));
     r.exit(EXIT_CANCELLED);
@@ -18214,7 +18478,7 @@ Leaving run ${runId} as it is.
         if (status === "running") {
           const attempt = typeof data?.attempt === "number" ? data.attempt : null;
           if (data?.restarted === true || attempt !== null && attempt > 1) {
-            r.err(chalk11.yellow(`${lead()}[attempt ${attempt ?? "?"} restarted; streaming from the start]
+            r.err(chalk12.yellow(`${lead()}[attempt ${attempt ?? "?"} restarted; streaming from the start]
 `));
           }
           printed = "";
@@ -18229,7 +18493,7 @@ Leaving run ${runId} as it is.
         return;
       }
       case "tool_call": {
-        r.err(chalk11.cyan(`${lead()}[tool_call ${String(data?.name ?? "")} ${String(data?.arguments ?? "")}]
+        r.err(chalk12.cyan(`${lead()}[tool_call ${String(data?.name ?? "")} ${String(data?.arguments ?? "")}]
 `));
         return;
       }
@@ -18269,7 +18533,7 @@ Leaving run ${runId} as it is.
 `);
         } else {
           const seconds = Math.round(info.delayMs / 100) / 10;
-          r.err(chalk11.gray(`${lead()}[reconnecting in ${seconds}s${info.message ? `: ${info.message}` : ""}]
+          r.err(chalk12.gray(`${lead()}[reconnecting in ${seconds}s${info.message ? `: ${info.message}` : ""}]
 `));
         }
       }
@@ -18301,27 +18565,27 @@ Leaving run ${runId} as it is.
     return result.outputSource === "incomplete" ? EXIT_FAILED : exitCodeFor(result.status);
   }
   if (result.outputSource === "incomplete") {
-    r.err(chalk11.yellow(lead() + "[stored task output could not be confirmed; showing text received from the stream]\n"));
+    r.err(chalk12.yellow(lead() + "[stored task output could not be confirmed; showing text received from the stream]\n"));
   }
   switch (result.status) {
     case "succeeded":
       finishHuman(result.text);
       if (result.toolCalls.length && !result.text) {
         const count3 = result.toolCalls.length;
-        r.err(chalk11.gray(`Done with ${count3} tool call${count3 === 1 ? "" : "s"} and no text.
+        r.err(chalk12.gray(`Done with ${count3} tool call${count3 === 1 ? "" : "s"} and no text.
 `));
       }
       return result.outputSource === "incomplete" ? EXIT_FAILED : EXIT_DONE;
     case "failed": {
       finishHuman(result.text);
       const code = result.error?.code ? ` (${result.error.code})` : "";
-      r.err(chalk11.red(`Run ${runId} failed${code}: ${result.error?.message ?? "The task failed."}
+      r.err(chalk12.red(`Run ${runId} failed${code}: ${result.error?.message ?? "The task failed."}
 `));
       return EXIT_FAILED;
     }
     case "cancelled":
       finishHuman(result.text);
-      r.err(chalk11.yellow(`Run ${runId} was cancelled.
+      r.err(chalk12.yellow(`Run ${runId} was cancelled.
 `));
       return EXIT_CANCELLED;
   }
@@ -18334,13 +18598,13 @@ async function interrupted(r, runId, options, printed) {
 `);
     } else {
       r.err(
-        chalk11.yellow(`${lead}Detached. Run ${runId} continues; follow it again with \`ultrac tasks follow ${runId}\`.
+        chalk12.yellow(`${lead}Detached. Run ${runId} continues; follow it again with \`ultrac tasks follow ${runId}\`.
 `)
       );
     }
     return EXIT_CANCELLED;
   }
-  if (!options.json) r.err(chalk11.yellow(`${lead}Cancelling run ${runId}...
+  if (!options.json) r.err(chalk12.yellow(`${lead}Cancelling run ${runId}...
 `));
   try {
     const cancelled = await r.client.cancelRun(runId);
@@ -18348,7 +18612,7 @@ async function interrupted(r, runId, options, printed) {
       r.out(`${JSON.stringify({ id: null, event: "cancel", data: cancelled })}
 `);
     } else {
-      r.err(chalk11.yellow(`${describeCancel(cancelled)}
+      r.err(chalk12.yellow(`${describeCancel(cancelled)}
 `));
     }
   } catch (error) {
@@ -18357,12 +18621,12 @@ async function interrupted(r, runId, options, printed) {
       r.out(`${JSON.stringify({ id: null, event: "cancel_failed", data: { runId, message } })}
 `);
     } else if (error instanceof UltracApiError && error.code === "run_already_finished") {
-      r.err(chalk11.yellow(`${error.message} Nothing to cancel.
+      r.err(chalk12.yellow(`${error.message} Nothing to cancel.
 `));
     } else {
-      r.err(chalk11.red(`Could not cancel run ${runId}: ${message}
+      r.err(chalk12.red(`Could not cancel run ${runId}: ${message}
 `));
-      r.err(chalk11.gray(`Try again with \`ultrac tasks cancel ${runId}\`.
+      r.err(chalk12.gray(`Try again with \`ultrac tasks cancel ${runId}\`.
 `));
     }
   }
@@ -18474,7 +18738,7 @@ ${run.output}${run.output.endsWith("\n") ? "" : "\n"}`;
 
 // src/commands/tools.ts
 import { resolve as resolve14 } from "path";
-import chalk12 from "chalk";
+import chalk13 from "chalk";
 function registerToolsCommand(program2) {
   const toolsCommand = program2.command("tools");
   toolsCommand.description("List built-in agent tools").option("--json", "Print tool metadata as JSON", false).option("--mode <name>", `Only the tools a mode advertises: ${agentModeNames.join(", ")}`).option("--budget", "Print what each mode's tool set costs in characters", false).action((options) => {
@@ -18494,7 +18758,7 @@ function registerToolsCommand(program2) {
     printTools(tools);
     if (options.mode) {
       console.log(
-        chalk12.gray(
+        chalk13.gray(
           `
 ${tools.length} of ${all.length} tools advertised in ${options.mode} mode, ${serializedToolsSize(
             toToolSchemas(tools)
@@ -18543,11 +18807,11 @@ function printToolBudget(all, json) {
   }
   for (const row of [...rows, { ...everything, names: all.map((tool) => tool.name) }]) {
     console.log(
-      `${chalk12.cyan(row.mode.padEnd(9))} ${String(row.tools).padStart(2)} tools  ${String(
+      `${chalk13.cyan(row.mode.padEnd(9))} ${String(row.tools).padStart(2)} tools  ${String(
         row.chars.toLocaleString("en-US")
       ).padStart(7)} chars`
     );
-    console.log(chalk12.gray(`  ${row.names.join(", ")}`));
+    console.log(chalk13.gray(`  ${row.names.join(", ")}`));
   }
 }
 function parseToolInput(inputText) {
@@ -18559,7 +18823,7 @@ function parseToolInput(inputText) {
 }
 
 // src/commands/update.ts
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 function registerUpdateCommand(program2) {
   const packageInfo = readPackageInfo();
   program2.command("update").alias("upgrade").description(`Check for and install the latest ${packageInfo.name} release`).option("--check", "Only check; do not install an available update", false).action(async (options) => {
@@ -18574,7 +18838,7 @@ function registerUpdateCommand(program2) {
       );
     }
     if (!status.updateAvailable) {
-      console.log(chalk13.green(`ultrac ${status.currentVersion} is up to date.`));
+      console.log(chalk14.green(`ultrac ${status.currentVersion} is up to date.`));
       return;
     }
     if (options.check) {
@@ -18583,12 +18847,12 @@ function registerUpdateCommand(program2) {
     }
     console.log(`Updating ultrac ${status.currentVersion} \u2192 ${status.latestVersion}\u2026`);
     await installLatestVersion(packageInfo.name);
-    console.log(chalk13.green(`Updated to ultrac ${status.latestVersion}. Restart ultrac to use the new version.`));
+    console.log(chalk14.green(`Updated to ultrac ${status.latestVersion}. Restart ultrac to use the new version.`));
   });
 }
 function printAvailable(currentVersion, latestVersion) {
-  console.log(chalk13.yellow(`Update available: ultrac ${currentVersion} \u2192 ${latestVersion}`));
-  console.log(chalk13.gray("Run `ultrac update` to install it."));
+  console.log(chalk14.yellow(`Update available: ultrac ${currentVersion} \u2192 ${latestVersion}`));
+  console.log(chalk14.gray("Run `ultrac update` to install it."));
 }
 
 // src/cli.ts
@@ -18618,6 +18882,6 @@ registerSkillsCommand(program);
 registerReplCommand(program);
 program.parseAsync(process.argv).catch((error) => {
   const message = error instanceof Error ? error.message : String(error);
-  console.error(chalk14.red(message));
+  console.error(chalk15.red(message));
   process.exitCode = 1;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spinalfluid/ultrac",
-  "version": "0.1.0",
+  "version": "0.1.5",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Ultrac terminal agent harness for Cosmic 1, with local tools, browser sign-in, streamed answers, and resumable sessions.",
   "author": "Aditya Pundir",