@synqa/cli 1.1.0 → 1.2.0

package/dist/tools.js

@@ -1,11 +1,15 @@
 import { spawnSync } from "node:child_process";
+import { Worker } from "node:worker_threads";
 import { closeSync, mkdirSync, openSync, readdirSync, readSync, statSync } from "node:fs";
-import { dirname, join, relative, sep } from "node:path";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
 import { MAX_DIFF_LINES, renderDiff, unifiedDiff } from "./diff.js";
 import { snapshot } from "./journal.js";
                                                 
-import { commandTouchesSecrets, confine, fold, isSensitivePath, writeConfined } from "./paths.js";
+import { MUTATING_TOOLS } from "./modes.js";
+                                                 
+import { commandTouchesSecrets, confine, fold, isHomeDir, isSecretStemSource, isSensitivePath, writeConfined } from "./paths.js";
 import { visibleEscapes } from "./sanitize.js";
+                                        
 
 const MAX_FILE_BYTES = 1_000_000;
 const MAX_PATTERN = 200;
@@ -26,11 +30,33 @@ function readCapped(p        )         {
   return st.size > MAX_FILE_BYTES ? text + `\n[file truncated at ${MAX_FILE_BYTES} bytes]` : text;
 }
 
-// Child processes get the parent environment minus every SYNQA_* variable (the API key).
+// Environment variables that commonly hold credentials, by name: the API key (SYNQA_*), tokens,
+// secrets, keys and passwords (TOKENIZERS_PARALLELISM, AWS_REGION, AWS_DEFAULT_REGION and
+// AWS_PROFILE stay), connection strings, the cloud, code host and package registry families
+// (NPM_* includes npm_config_*), git credential helpers and the SSH agent. Model provider keys are
+// caught by the KEY and TOKEN rules. Narrowing this list must keep the regression list in
+// test/hardening.test.ts passing.
+const SECRET_ENV = [
+  /^SYNQA_/, /TOKEN(?!IZER)/, /AUTHTOKEN/, /SECRET/, /(^|_)KEYS?(_|$)/, /APIKEY/, /PASSWORD/, /PASSWD/, /(^|_)PASS$/, /_PWD$/,
+  /CREDENTIAL/, /CONNECTION_?STRING/, /(^|_)AUTH$/, /^AUTH_/, /ASKPASS/, /^VSCODE_GIT_/, /^SSH_AUTH_SOCK$/,
+  /^SLACK_WEBHOOK_URL$/, /^SENTRY_DSN$/, /^DATABASE_URL$/,
+  /^AWS_(?!REGION$|DEFAULT_REGION$|PROFILE$)/, /^GH_/, /^GITHUB_/, /^GITLAB_/, /^NPM_/, /^HF_/, /^HUGGING_?FACE/, /^AZURE_/,
+  /^GOOGLE_APPLICATION_CREDENTIALS$/,
+];
+// A URL, URI or DSN value with a user and password in it (postgres://user:pass@host) is a secret;
+// a plain URL is kept.
+const URL_NAME = /(^|_)(URL|URI|DSN)$/;
+const USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/\s@:]*:[^/\s@]*@/i;
+
+// Child processes get the parent environment minus every variable that looks like a credential.
+// SSH_AUTH_SOCK is one of them, so git over SSH that needs the agent runs in the user's own terminal.
 export function bashEnv(env                                    )                         {
   const out                         = {};
   for (const [k, v] of Object.entries(env)) {
-    if (v !== undefined && !k.toUpperCase().startsWith("SYNQA_")) out[k] = v;
+    const up = k.toUpperCase();
+    if (v === undefined || SECRET_ENV.some((re) => re.test(up))) continue;
+    if (URL_NAME.test(up) && USERINFO.test(v.trim())) continue;
+    out[k] = v;
   }
   return out;
 }
@@ -43,14 +69,18 @@ export function bashEnv(env                                    )
                    
                
                                              
+                                                                                 
                                                     
                                                                                      
+                                                                            
+                                                                      
                                                                                                             
+                                                                                                             
   
 
 const MAX_OUT = 20_000;
 const MAX_RESULTS = 500;
-const SKIP_DIRS = new Set([".git", "node_modules", ".ssh", ".aws", ".gnupg", ".kube"]);
+const SKIP_DIRS = new Set([".git", "node_modules", ".ssh", ".aws", ".gnupg", ".kube", ".trash"]);
 
 export const TOOL_DEFS = [
   def("read_file", "Read a text file inside the working directory.", {
@@ -113,7 +143,7 @@ function escapeRe(s        )         {
   return s.replace(/[.+^${}()|[\]\\]/g, "\\$&");
 }
 
-function walk(root        , dir        , out          )       {
+function walk(root        , dir        , out          , secret                        )       {
   if (out.length >= MAX_RESULTS * 20) return;
   let entries;
   try {
@@ -124,12 +154,13 @@ function walk(root        , dir        , out          )       {
   for (const e of entries) {
     if (SKIP_DIRS.has(fold(e.name))) continue;
     const full = join(dir, e.name);
-    if (e.isDirectory()) walk(root, full, out);
+    // A folder of credentials or a browser profile is never walked into (it can be huge, too).
+    if (e.isDirectory()) { if (!secret(full)) walk(root, full, out, secret); }
     else if (e.isFile()) out.push(relative(root, full).split(sep).join("/"));
   }
 }
 
-const RC_FILES = new Set([".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv", ".bash_login"]);
+const RC_FILES = new Set([".bashrc", ".zshrc", ".profile", ".bash_profile", ".zprofile", ".zshenv", ".bash_login", ".zlogin", ".zlogout", ".bash_logout", ".kshrc", ".cshrc", ".tcshrc", ".login", "config.fish"]);
 
 // Why an approved write to this target can run code later (hooks, build files, shell startup files,
 // CI, editor tasks, executables). Compared folded, so ".GIT/hooks" counts as ".git/hooks".
@@ -139,6 +170,15 @@ export function riskReasons(root        , abs        )           {
   const base = parts[parts.length - 1] ?? "";
   const dirs = parts.slice(0, -1);
   const reasons           = [];
+  const full = "/" + fold(abs.split(sep).join("/")).replace(/^\/+/, "");
+  if (rel === ".." || rel.startsWith("../") || isAbsolute(rel)) reasons.push("outside the workspace");
+  if (/\/library\/(launchagents|launchdaemons)\//.test(full)) reasons.push("a launchd job (runs at login or boot)");
+  if (full.includes("/.config/autostart/")) reasons.push("an autostart entry (runs at login)");
+  if (/\/(\.config|\.local\/share)\/systemd\//.test(full)) reasons.push("a systemd unit (runs as a service)");
+  if (full.includes("/.config/fish/")) reasons.push("a fish startup file (runs in every new shell)");
+  if (full.includes("/.local/bin/")) reasons.push("a program on your PATH");
+  if (full.includes("/start menu/programs/startup/")) reasons.push("a Windows startup entry (runs at login)");
+  if (dirs.includes(".synqa") && base === "hooks.json") reasons.push("Synqa hooks (commands that run at session start and around tools)");
   if (rel.startsWith(".git/hooks/") || rel.includes("/.git/hooks/")) reasons.push("a git hook (runs on git actions)");
   else if (dirs.includes(".git")) reasons.push("inside .git");
   if (base === "package.json") reasons.push("package.json (scripts can run on install or test)");
@@ -179,19 +219,31 @@ export function hasNestedQuantifier(pattern        )          {
   return NESTED_QUANTIFIER.test(pattern);
 }
 
-// A file that holds secrets is opened only after an explicit yes. With --yes, or with nobody to ask,
-// the answer is no: a prompt injection must not be able to read keys by running unattended. Every
-// tool that reads a file's bytes (read_file, edit_file) goes through this before opening it.
-async function sensitiveGate(ctx             , p        , verb        )                              {
-  if (!isSensitivePath(p)) return undefined;
-  if (ctx.yes) return "error: refused: this file may hold secrets and --yes never opens those";
-  if (!(await ctx.confirm(`${verb} ${visibleEscapes(p)}? It may hold secrets, and its text would be sent to the model.`))) return "denied by user";
-  return undefined;
+// A file that holds secrets (see isSensitivePath) is never opened, written or edited by a tool:
+// not with --yes, not with a yes to a question. The answer names no content, so it is not an
+// oracle either. The person can open the file themselves; the model never gets its text.
+export const SECRET_REFUSAL = "error: refused: this file may hold secrets (keys, tokens or credentials), so Synqa never reads, writes or edits it. Open it yourself if you need to.";
+
+const secretIn = (ctx             ) => (p        ) => isSensitivePath(p, undefined, ctx.home);
+
+function sensitiveGate(ctx             , p        )                     {
+  return secretIn(ctx)(p) ? SECRET_REFUSAL : undefined;
+}
+
+// grep and glob also skip source files named like a secret store (secrets.py): see isSecretStemSource.
+const skipIn = (ctx             ) => (p        ) => secretIn(ctx)(p) || isSecretStemSource(p);
+
+// secrets.py, credentials.js and the like are opened only after an explicit yes, --yes or not;
+// with nobody to ask the answer is no.
+async function stemGate(ctx             , p        , verb        )                              {
+  if (!isSecretStemSource(p)) return undefined;
+  const ok = await ctx.confirm(`${verb} ${visibleEscapes(p)}? Its name says it may hold secrets, and its text would be sent to the model.`);
+  return ok ? undefined : "denied by user";
 }
 
 async function toolRead(ctx             , a                         )                  {
   const p = confine(ctx.cwd, str(a, "path"));
-  const refused = await sensitiveGate(ctx, p, "Read");
+  const refused = sensitiveGate(ctx, p) ?? (await stemGate(ctx, p, "Read"));
   if (refused) return refused;
   return truncate(readCapped(p));
 }
@@ -203,20 +255,22 @@ async function approve(ctx             , question        , path        , before
   const rel = relative(ctx.cwd, path) || path;
   // A file that can run code later (hook, package.json, shell startup file, dotfile) is shown in
   // full: a payload on line 60 must not hide behind a cut.
-  const risky = riskReasons(ctx.cwd, path).length > 0 || isSensitivePath(path);
-  const maxLines = risky ? Infinity : MAX_DIFF_LINES;
-  const detail = before === "too-large"
+  // A write to a secrets-named source file (secrets.py) asks too, like reading it does.
+  const risky = riskReasons(ctx.cwd, path).length > 0 || isSecretStemSource(path);
+  const diff = (maxLines        ) => before === "too-large"
     ? "  (the existing file is too large to preview)"
-    : renderDiff(unifiedDiff(rel, before === null ? null : before.toString("utf8"), after), { color: ctx.color ?? false }, maxLines);
+    : renderDiff(unifiedDiff(rel, before === null ? null : before.toString("utf8"), after), ctx.style ?? { color: ctx.color ?? false, depth: 8 }, maxLines);
   // --yes skips the question only for an ordinary file with no AGENTS.md loaded. A write that can
   // run code later, a secrets file, or any write while repository text steers the model always asks
   // (and is denied when nobody can answer): a shell prompt is no boundary if another tool can plant
   // a hook, a Makefile or a workflow that runs without one.
   if (ctx.yes && !risky && !ctx.notesLoaded) {
-    ctx.show?.(detail);
+    // Already approved by --yes: the shown diff may be cut for length.
+    ctx.show?.(diff(MAX_DIFF_LINES));
     return true;
   }
-  return ctx.confirm(question, detail);
+  // A question always shows the whole change: nothing can hide below a cut while you decide.
+  return ctx.confirm(question, diff(Infinity));
 }
 
 function journalWrite(ctx             , written        , before        , after        )         {
@@ -228,6 +282,8 @@ function journalWrite(ctx             , written        , before        , after
 async function toolWrite(ctx             , a                         )                  {
   const p = confine(ctx.cwd, str(a, "path"));
   const content = str(a, "content");
+  const refused = sensitiveGate(ctx, p);
+  if (refused) return refused;
   const before = snapshot(p);
   const q = `Write ${content.length} chars to ${visibleEscapes(p)}?${riskNote(ctx.cwd, p)}`;
   if (!(await approve(ctx, q, p, before, content))) return "denied by user";
@@ -240,7 +296,7 @@ async function toolEdit(ctx             , a                         )
   const p = confine(ctx.cwd, str(a, "path"));
   const oldS = str(a, "old_string");
   const newS = str(a, "new_string");
-  const refused = await sensitiveGate(ctx, p, "Edit");
+  const refused = sensitiveGate(ctx, p) ?? (await stemGate(ctx, p, "Edit"));
   if (refused) return refused;
   const text = readCapped(p);
   if (text.endsWith(`[file truncated at ${MAX_FILE_BYTES} bytes]`)) return "error: file too large to edit";
@@ -259,25 +315,50 @@ async function toolEdit(ctx             , a                         )
 function toolGlob(ctx             , a                         )         {
   const re = globToRegExp(str(a, "pattern"));
   const all           = [];
-  walk(ctx.cwd, ctx.cwd, all);
-  const hits = all.filter((f) => re.test(f) && !isSensitivePath(join(ctx.cwd, f))).sort().slice(0, MAX_RESULTS);
+  walk(ctx.cwd, ctx.cwd, all, secretIn(ctx));
+  const hits = all.filter((f) => re.test(f) && !skipIn(ctx)(join(ctx.cwd, f))).sort().slice(0, MAX_RESULTS);
   return hits.length ? hits.join("\n") : "no matches";
 }
 
-function toolGrep(ctx             , a                         )         {
+// The matching loop runs in a worker thread, so a pattern that backtracks badly ((a|a)*$ and the
+// like, which no static check catches) is stopped after GREP_BUDGET_MS instead of hanging the session.
+const GREP_BUDGET_MS = 10_000;
+const GREP_WORKER = `
+const { parentPort, workerData } = require("node:worker_threads");
+const re = new RegExp(workerData.pattern);
+const out = [];
+for (const f of workerData.files) {
+  if (out.length >= workerData.max) break;
+  f.text.split("\\n").forEach((line, i) => {
+    if (out.length < workerData.max && re.test(line.slice(0, 2000))) out.push(f.rel + ":" + (i + 1) + ":" + line.slice(0, 300));
+  });
+}
+parentPort.postMessage(out);
+`;
+
+function grepInWorker(pattern        , files                                      , budgetMs        )                                {
+  return new Promise((resolve, reject) => {
+    const w = new Worker(GREP_WORKER, { eval: true, workerData: { pattern, files, max: MAX_RESULTS } });
+    const timer = setTimeout(() => { void w.terminate(); resolve("timeout"); }, budgetMs);
+    w.once("message", (m          ) => { clearTimeout(timer); void w.terminate(); resolve(m); });
+    w.once("error", (e) => { clearTimeout(timer); reject(e); });
+  });
+}
+
+async function toolGrep(ctx             , a                         )                  {
   const pat = str(a, "pattern");
   if (pat.length > MAX_PATTERN) return `error: pattern longer than ${MAX_PATTERN} characters`;
   if (hasNestedQuantifier(pat)) return "error: pattern has a quantified group containing a quantifier (nested quantifier); rewrite it";
-  const re = new RegExp(pat);
+  new RegExp(pat); // a syntax error is reported here, before any file is read
   const base = confine(ctx.cwd, typeof a.path === "string" && a.path ? a.path : ".");
-  const files           = [];
-  if (statSync(base).isDirectory()) walk(base, base, files);
-  else files.push("");
-  const out           = [];
-  for (const f of files) {
-    if (out.length >= MAX_RESULTS) break;
+  const paths           = [];
+  if (statSync(base).isDirectory()) walk(base, base, paths, secretIn(ctx));
+  else paths.push("");
+  const files                                       = [];
+  let bytes = 0;
+  for (const f of paths) {
     const full = f ? join(base, f) : base;
-    if (isSensitivePath(full)) continue;
+    if (skipIn(ctx)(full)) continue;
     let text        ;
     try {
       if (statSync(full).size > MAX_FILE_BYTES) continue;
@@ -286,20 +367,23 @@ function toolGrep(ctx             , a                         )         {
       continue;
     }
     if (text.includes("\u0000")) continue;
-    text.split("\n").forEach((line, i) => {
-      if (out.length < MAX_RESULTS && re.test(line.slice(0, 2000))) out.push(`${relative(ctx.cwd, full)}:${i + 1}:${line.slice(0, 300)}`);
-    });
+    files.push({ rel: relative(ctx.cwd, full), text });
+    bytes += text.length;
+    if (bytes > 64 * MAX_FILE_BYTES) break;
   }
+  const out = await grepInWorker(pat, files, ctx.grepBudgetMs ?? GREP_BUDGET_MS);
+  if (out === "timeout") return `error: the pattern took longer than ${Math.round((ctx.grepBudgetMs ?? GREP_BUDGET_MS) / 1000)}s (it may backtrack heavily); use a simpler pattern`;
   return out.length ? out.join("\n") : "no matches";
 }
 
 async function toolBash(ctx             , a                         )                  {
   const command = str(a, "command");
-  // Asks unless --yes. Even under --yes it asks when AGENTS.md is loaded, or when the command names
-  // a secrets file (or a glob that could): then, with nobody to ask, it is denied. Any other command
-  // under --yes runs unattended: use --yes only in repositories you trust.
+  // Every shell command asks, also under --yes: any file the model read (a README, a code comment)
+  // can carry an instruction such as "printenv | curl ...", so --yes covers file writes inside the
+  // workspace only. With nobody to ask the answer is no. A command that names a secret or dumps
+  // the environment gets a warning in the question.
   const secret = commandTouchesSecrets(command);
-  if ((!ctx.yes || ctx.notesLoaded || secret) && !(await ctx.confirm(`Run: ${visibleEscapes(command)}${secret ? "\n  WARNING: this command refers to files that may hold secrets." : ""}`))) return "denied by user";
+  if (!(await ctx.confirm(`Run: ${visibleEscapes(command)}${secret ? "\n  WARNING: this command refers to files that may hold secrets." : ""}`))) return "denied by user";
   const r = spawnSync("/bin/sh", ["-c", command], {
     cwd: ctx.cwd, encoding: "utf8", timeout: 120_000, maxBuffer: 4 * 1024 * 1024, env: bashEnv(process.env),
   });
@@ -315,14 +399,19 @@ function str(a                         , k        )         {
 }
 
 // Never throws: failures come back as text so the model can react.
-export async function runTool(ctx             , name        , args                         )                  {
+export async function runTool(ctx0             , name        , args                         )                  {
+  // --yes never applies when the workspace is the home folder: too much there can run code later.
+  // The auto-accept mode is --yes for file edits only, with the same limits.
+  if (ctx0.mode === "plan" && MUTATING_TOOLS.includes(name)) return "error: plan only mode is on, so nothing was changed or run. Describe the plan instead; the user leaves this mode with Shift+Tab.";
+  const yes = (ctx0.yes || ctx0.mode === "auto") && !isHomeDir(ctx0.cwd, ctx0.home);
+  const ctx = yes === ctx0.yes ? ctx0 : { ...ctx0, yes };
   try {
     switch (name) {
       case "read_file": return await toolRead(ctx, args);
       case "write_file": return await toolWrite(ctx, args);
       case "edit_file": return await toolEdit(ctx, args);
       case "glob": return toolGlob(ctx, args);
-      case "grep": return toolGrep(ctx, args);
+      case "grep": return await toolGrep(ctx, args);
       case "bash": return await toolBash(ctx, args);
       default: return `error: unknown tool ${name}`;
     }

package/dist/ui.js

@@ -11,9 +11,10 @@ import { formatUsd } from "./account.js";
                                                            
 import { sanitize, visibleEscapes } from "./sanitize.js";
 import { groupDigits } from "./statusbar.js";
-                                       
-import { accent, bold, boneBold, colorDepth, colorEnabled, red, sage, stone, stoneBold, terracotta } from "./theme.js";
-                                                    
+import { CONTEXT_TOKENS } from "./tiers.js";
+                                               
+import { bold, colorDepth, colorEnabled, detectBackground, dim, red, sage, stone, terracotta, terracottaBold } from "./theme.js";
+                                                                
 
 // ---------------------------------------------------------------- terminal capabilities
 
@@ -22,7 +23,8 @@ import { accent, bold, boneBold, colorDepth, colorEnabled, red, sage, stone, sto
                                                                             
                                                                              
                   
-                                                                       
+                                                                        
+                                                                                        
   
 
                                               
@@ -46,13 +48,14 @@ export function makeUi(env     , out         , platform         = process.platfo
   return {
     color: colorEnabled(env, tty),
     depth: colorDepth(env),
+    bg: detectBackground(env),
     unicode: detectUnicode(env, platform),
     tty,
     get columns() { return Math.max(20, cols()); },
   };
 }
 
-export const styleOf = (ui    )        => ({ color: ui.color, depth: ui.depth });
+export const styleOf = (ui    )        => ({ color: ui.color, depth: ui.depth, bg: ui.bg });
 
                
                                                                        
@@ -154,7 +157,7 @@ export function shortenHome(path        , home         = homedir())         {
   return path;
 }
 
-const pad = (s        , w        ) => s + " ".repeat(Math.max(0, w - textWidth(s)));
+export const pad = (s        , w        ) => s + " ".repeat(Math.max(0, w - textWidth(s)));
 
 // ---------------------------------------------------------------- version
 
@@ -189,87 +192,153 @@ export function balanceLine(b         )         {
   return credit;
 }
 
-// ---------------------------------------------------------------- banner
+// ---------------------------------------------------------------- start screen
 
                           
                   
              
+                  
               
                 
                      
                    
+                                                                                          
+                                                                                                      
+                                                                           
   
 
-// "Synqa. CLI v1.1.0" with the name in bold bone and the period in terracotta. `text` may have
-// been cut by fit(); anything that no longer starts with "Synqa." is painted whole.
-function paintTitle(s       , text        )         {
-  if (!text.startsWith("Synqa.")) return boneBold(s, text);
-  return boneBold(s, "Synqa") + terracotta(s, ".") + boneBold(s, text.slice(6));
+// "Synqa." on one line: the name bold in the terminal's own text colour, the period terracotta.
+function paintName(s       )         {
+  return bold(s, "Synqa") + terracotta(s, ".");
 }
 
-const TILE_W = 6;
-const TILE_GAP = 2;
-
-// The 3-line monogram: a rounded terracotta tile with a bold bone S and a terracotta period.
-function monogram(s       )           {
-  return [
-    terracotta(s, "╭────╮"),
-    terracotta(s, "│ ") + boneBold(s, "S") + terracotta(s, ". │"),
-    terracotta(s, "╰────╯"),
+// The wordmark in half-block letters, four rows: the S at cap height, y n q a at x-height with the
+// y and q descenders on the last row. Letters carry no colour code, so they are drawn in the
+// terminal's own text colour (ink on a light background, bone-like on a dark one); the full stop
+// is a terracotta square on the baseline.
+const LETTERS                                    = {
+  S: ["▄▀▀▀", " ▀▀▄", "▄▄▄▀", "    "],
+  y: ["    ", "█  █", "▀▄▄█", "▄▄▄▀"],
+  n: ["    ", "█▀▀▄", "█  █", "    "],
+  q: ["    ", "▄▀▀█", "▀▄▄█", "   █"],
+  a: ["    ", "▄▀▀█", "▀▄▄█", "    "],
+};
+export const WORDMARK                    = [0, 1, 2, 3].map((r) => ["S", "y", "n", "q", "a"].map((c) => (LETTERS[c]            )[r]).join(" ").trimEnd());
+export const WORDMARK_W = Math.max(...WORDMARK.map(textWidth)) + 2; // plus a space and the dot
+const DOT_ROW = 2;
+
+// The start screen header, in the style of modern coding CLIs, with no box: the Synqa wordmark (60 columns and up,
+// on a UTF-8 terminal), or a one-line bold "Synqa." below that; then dim lines with the version,
+// tier and effort, and the workspace; then dim "⎿" lines for notes and warnings. Every line fits
+// in columns - 1 cells (visible width, escapes not counted), so nothing wraps. Fields are our own
+// tables or sanitized; the API key is never an input.
+export function renderBanner(info            , ui    )           {
+  const s = styleOf(ui);
+  const room = ui.columns - 1;
+  const sep = ui.unicode ? " · " : " | ";
+  const version = `v${oneLine(info.version)}`;
+  const effort = `${info.effort ?? "default"} effort`;
+  const where = oneLine(shortenHome(info.cwd, info.home));
+  const notes                                         = [];
+  if (info.locked) notes.push(["Sign in to Synqa Cloud to unlock chat and other providers", (t) => dim(s, t)]);
+  else notes.push([info.notesChars > 0 ? `AGENTS.md loaded (${groupDigits(info.notesChars)} chars)` : "no AGENTS.md yet: /init writes one", (t) => dim(s, t)]);
+  if (info.locked) { /* no balance before sign-in */ } else if (info.balance.kind === "ok") notes.push([balanceLine(info.balance).replace(" · ", sep), (t) => sage(s, t)]);
+  else notes.push([balanceLine(info.balance), (t) => dim(s, t)]);
+  for (const w of info.warnings ?? []) notes.push([oneLine(w), (t) => dim(s, t)]);
+  const lead = "  ";
+  const hook = ui.unicode ? "⎿ " : "- ";
+  const noteLines = notes.map(([t, p]) => dim(s, lead + hook) + p(fit(t, room - lead.length - hook.length, ui)));
+  const w = room - lead.length;
+  const meta = [
+    lead + dim(s, fit(`${version}${sep}${info.provider ? [info.provider.name, info.provider.model].filter(Boolean).map((x) => oneLine(x          )).join(sep) : info.tier.display}${sep}${effort}`, w, ui)),
+    lead + dim(s, fitPath(where, w, ui)),
   ];
+  if (!ui.unicode || ui.columns < 60) {
+    const name = w >= 6 ? lead + paintName(s) : lead + bold(s, fit("Synqa.", w, ui));
+    return [name, ...meta, ...noteLines];
+  }
+  const mark = WORDMARK.map((row, i) => lead + row + (i === DOT_ROW ? " " + terracotta(s, "▄") : ""));
+  return [...mark, "", ...meta, ...noteLines];
 }
 
-// A boxed welcome panel. Fields are plain text built from our own tables or sanitized; the API key
-// is never an input. On a terminal that is not UTF-8, or a very narrow one, there is no box or
-// tile: a "[S.] Synqa. CLI v..." line and the rows.
-export function renderBanner(info            , ui    )           {
+// A thin rule across the terminal, one cell short of the edge so it never wraps.
+export function rule(ui    )         {
+  return stone(styleOf(ui), (ui.unicode ? "─" : "-").repeat(Math.max(1, ui.columns - 1)));
+}
+
+export const PROMPT_MARK = (ui    ) => (ui.unicode ? "❯" : ">");
+
+export function promptText(ui    )         {
+  return `${terracottaBold(styleOf(ui), PROMPT_MARK(ui))} `;
+}
+
+export const PLACEHOLDER = 'Try "explain this project", or type / for commands';
+
+                          
+             
+                 
+              
+                
+                                  
+                                                            
+                      
+                                                                          
+                    
+                                                                                        
+                                                                   
+                                                      
+  
+
+// The two lines under the input: what is known about the session, then key hints. Unknown values
+// are left out (no "?" or "-" placeholders); separators are dim. The least important parts drop
+// first when the line would not fit in columns - 1 cells.
+export function renderStatusLines(p            , ui    )           {
   const s = styleOf(ui);
+  const room = ui.columns - 1;
   const sep = ui.unicode ? " · " : " | ";
-  const notes = info.notesChars > 0 ? `AGENTS.md loaded (${groupDigits(info.notesChars)} chars)` : "no AGENTS.md";
-  const balance = balanceLine(info.balance).replace(" · ", sep);
-  const balancePaint = (t        ) => (info.balance.kind === "ok" ? sage(s, t) : stone(s, t));
-  const rows                                                 = [
-    ["Tier", `${info.tier.id} (${info.tier.display})`, (t) => boneBold(s, t)],
-    ["Workspace", oneLine(shortenHome(info.cwd, info.home)), (t) => t],
-    ["Notes", notes, (t) => t],
-    ["Balance", balance, balancePaint],
-  ];
-  const version = oneLine(info.version);
-  const title = `Synqa. CLI v${version}`;
-  const labelW = Math.max(...rows.map((r) => r[0].length)) + 2;
-  const minBox = 30;
-  if (!ui.unicode || ui.columns < minBox) {
-    const room = ui.columns - 1;
-    const head = fit(`[S.] ${title}`, room, ui);
-    const first = head.startsWith("[S.] ")
-      ? terracotta(s, "[S.]") + " " + paintTitle(s, head.slice(5))
-      : boneBold(s, head);
-    return [first, ...rows.map(([l, v, p]) => {
-      const text = fit(`  ${pad(l, labelW)}${v}`, room, ui);
-      const lead = 2 + labelW;
-      return text.length <= lead ? stoneBold(s, text) : stoneBold(s, text.slice(0, lead)) + p(text.slice(lead));
-    })];
+  const home = shortenHome(p.cwd, p.home);
+  const ws = home === "~" ? "~" : oneLine(home.split(/[\\/]/).filter(Boolean).pop() ?? home);
+                                                                     
+  const st = (t        ) => stone(s, t);
+  const head = p.provider ? [p.provider.name, p.provider.model].filter(Boolean).map((x) => oneLine(x          )).join(sep) : p.tier.display;
+  const parts         = [{ k: "tier", t: head, paint: (t) => terracottaBold(s, t) }];
+  if (p.mode) parts.push({ k: "mode", t: oneLine(p.mode), paint: st });
+  if (p.effort !== "default") parts.push({ k: "effort", t: `${p.effort} effort`, paint: st });
+  parts.push({ k: "ws", t: Array.from(ws).slice(0, 32).join(""), paint: st });
+  const ctxMax = p.contextMax ?? CONTEXT_TOKENS;
+  if (p.contextTokens) parts.push({ k: "ctx", t: `ctx ${Math.min(100, Math.round((100 * p.contextTokens) / ctxMax))}%`, paint: st });
+  if (p.routing && p.routing !== "?") parts.push({ k: "routing", t: Array.from(oneLine(p.routing)).slice(0, 12).join(""), paint: st });
+  parts.push({ k: "tokens", t: `${groupDigits(p.tokens)} tokens`, paint: st });
+  if (p.updateHint) parts.push({ k: "update", t: oneLine(p.updateHint), paint: (t) => sage(s, t) });
+  const right = p.balance && p.balance.kind === "ok" ? `${formatUsd(p.balance.account.creditRemaining)} credit` : "";
+  const kept = parts.slice();
+  let showRight = right !== "";
+  const leftW = () => kept.reduce((w, x, i) => w + textWidth(x.t) + (i ? sep.length : 0), 0);
+  const fits = () => leftW() + (showRight ? 2 + textWidth(right) : 0) <= room;
+  // Dropped first to last: routing, ctx, workspace, effort, the balance, then tokens.
+  for (const k of ["update", "routing", "ctx", "ws", "effort", "mode", "right", "tokens"]) {
+    if (fits()) break;
+    if (k === "right") { showRight = false; continue; }
+    const i = kept.findIndex((x) => x.k === k);
+    if (i > 0) kept.splice(i, 1);
   }
-  const tile = ui.columns >= 46;
-  const left = tile ? TILE_W + TILE_GAP : 0;
-  const natural = Math.max(textWidth(title) + 4, left + Math.max(...rows.map((r) => labelW + textWidth(r[1])))) + 4;
-  const width = Math.min(natural, ui.columns - 1);
-  const inner = width - 4; // "│ " ... " │"
-  const edge = (t        ) => stone(s, t);
-  const top = (() => {
-    const t = fit(title, width - 6, ui);
-    const fill = width - 5 - textWidth(t); // "╭─ " + title + " " + fill + "╮"
-    return edge("╭─ ") + paintTitle(s, t) + edge(" " + "─".repeat(Math.max(0, fill)) + "╮");
-  })();
-  const mono = tile ? monogram(s) : [];
-  const body = rows.map(([label, value, paint], i) => {
-    const lead = tile ? (mono[i] ?? " ".repeat(TILE_W)) + " ".repeat(TILE_GAP) : "";
-    const v = fit(value, inner - left - labelW, ui);
-    const gap = " ".repeat(Math.max(0, inner - left - labelW - textWidth(v)));
-    return edge("│") + " " + lead + stoneBold(s, pad(label, labelW)) + paint(v) + gap + " " + edge("│");
-  });
-  const bottom = edge("╰" + "─".repeat(width - 2) + "╯");
-  return [top, ...body, bottom];
+  let line = kept.map((x) => x.paint(x.t)).join(dim(s, sep));
+  if (!fits()) line = terracottaBold(s, fit(head, room, ui));
+  else if (showRight) line += " ".repeat(Math.max(2, room - leftW() - textWidth(right))) + sage(s, right);
+  return [line, keyHints(ui)];
+}
+
+// "/ commands · ↑↓ history · esc clear · ctrl+c quit": keys bold, labels dim, cut to fit.
+export function keyHints(ui    )         {
+  const s = styleOf(ui);
+  const room = ui.columns - 1;
+  const hints                          = [["/", "commands"], [ui.unicode ? "↑↓" : "up/down", "history"], ["tab", "complete"], ["ctrl+c", "quit"]];
+  const sep = ui.unicode ? " · " : " | ";
+  const kept = hints.slice();
+  const w = () => kept.reduce((n, [k, l], i) => n + k.length + 1 + l.length + (i ? sep.length : 0), 0);
+  while (kept.length > 1 && w() > room) kept.splice(kept.length - 2, 1);
+  if (w() > room) return dim(s, fit("/ for commands", room, ui));
+  return kept.map(([k, l]) => bold(s, k) + " " + dim(s, l)).join(dim(s, sep));
 }
 
 // ---------------------------------------------------------------- spinner
@@ -282,10 +351,22 @@ export function renderBanner(info            , ui    )           {
                                                      
                                     
                       
+                                                                                 
   
 
 const CR_ERASE = "\r\x1b[2K";
 
+// The thinking mark: [S] with the dot bobbing . then middle dot, ring-less dot, middle dot. Every frame
+// is exactly four cells wide and one line, so nothing around it ever shifts.
+const BOB_UNI = [".", "\u00b7", "\u02d9", "\u00b7"];
+const BOB_ASCII = [".", ",", "\x27", ","];
+export const THINKING_FPS = 8;
+export const THINKING_INTERVAL_MS = 125; // 8 frames per second, only while waiting for the first token
+export function thinkingFrame(i        , ui    )         {
+  const bob = ui.unicode ? BOB_UNI : BOB_ASCII;
+  return `[S${bob[((i % bob.length) + bob.length) % bob.length]          }]`;
+}
+
 export class Spinner {
           out            ;
           o                ;
@@ -314,7 +395,7 @@ export class Spinner {
       (h                          ).unref?.();
       return h;
     });
-    this.timer = set(() => this.draw(), this.o.intervalMs ?? 80);
+    this.timer = set(() => this.draw(), this.o.intervalMs ?? THINKING_INTERVAL_MS);
   }
 
   elapsedText()         {
@@ -323,8 +404,7 @@ export class Spinner {
   }
 
           draw()       {
-    const g = glyphs(this.o.ui);
-    const f = g.spin[this.frame++ % g.spin.length]          ;
+    const f = (this.o.frameFn ?? ((i        ) => thinkingFrame(i, this.o.ui)))(this.frame++);
     const st = styleOf(this.o.ui);
     const text = fit(`${f} waiting ${this.elapsedText()}`, this.o.ui.columns - 1, this.o.ui);
     // The frame is terracotta, the rest stone. fit() keeps the frame first, so the split is safe.