@visual-z/xeno 0.1.0

package/src/apps/shell.ts

@@ -0,0 +1,2353 @@
+/**
+ * Interactive loop and one-shot runner.
+ *
+ * The live UI is pi's TuiMainScreen (D19): the transcript sits in the
+ * activity area and a collapse may clear terminal scrollback. A pipe or
+ * CI run never constructs it — `-p` output is parsed by scripts.
+ */
+
+import { basename, dirname, join } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { assertNever } from "../core/exhaustive.ts";
+import type { LogEvent } from "../core/events.ts";
+import { projectTranscript, type TranscriptItem } from "../core/transcript.ts";
+import { fileReferences } from "../core/file-references.ts";
+import { readNodeHistory } from "../store/restore.ts";
+import { Transcript } from "../tui/transcript.ts";
+import type { Handoff } from "../core/handoff.ts";
+import { projectContext, type FrozenPrefix } from "../core/project.ts";
+import { shouldCut, DEFAULT_BOUNDARY, type BoundaryConfig, type BoundaryDecision } from "../core/boundary.ts";
+import { anchoredCount, estimateTokens, type Anchor, type TokenCounter } from "../core/tokens.ts";
+import type { RestorePoint, RewindMode, LoopEvent } from "../runtime/loop.ts";
+import { createProvider, findModelByPattern, groupedModels, loadCatalog } from "../runtime/catalog.ts";
+import { outputTokenBudget, type Effort, type ModelSpec } from "../runtime/model.ts";
+import { equivalentCost, reportedCost } from "../runtime/usage.ts";
+import type { ProviderConfig } from "../runtime/provider.ts";
+import { describeMissingCredential, envLabel, ensureFreshCredential, storedIsOAuth } from "../runtime/auth.ts";
+import {
+  SUBSCRIPTION_NOTICE, SUBSCRIPTION_OPTIONS, isSubscriptionLogin, subscriptionById,
+  loginGitHubCopilot, generatePKCE, generateState, anthropicAuthorizeUrl, openaiCodexAuthorizeUrl,
+  startCallbackServer, exchangeAnthropicCode, exchangeOpenAICode, parseAuthorizationInput,
+  ANTHROPIC_CALLBACK_PORT, ANTHROPIC_CALLBACK_PATH, ANTHROPIC_REDIRECT_URI,
+  OPENAI_CALLBACK_PORT, OPENAI_CALLBACK_PATH, OPENAI_REDIRECT_URI,
+  type CallbackServer, type OAuthCredential, type SubscriptionId,
+} from "../runtime/oauth.ts";
+import { writeAuthFile } from "../store/auth-store.ts";
+import { authPath } from "../store/config.ts";
+import { modelsPath, readModelsText, writeModelsFile } from "../store/models.ts";
+import {
+  buildFileIndex, indexTruncationNote, type FileIndex,
+} from "../store/file-index.ts";
+import { currentBranch } from "../store/git-branch.ts";
+import { saveTrust, trustPath } from "../store/trust.ts";
+import type { PermissionRequest } from "../core/permissions.ts";
+import type { ApprovalChoice } from "../runtime/tools.ts";
+import { approvalHeading, approvalItems, choiceFromValue } from "./approve.ts";
+import { readCursor, writeCursor, listNodes, readNode } from "../store/log.ts";
+import {
+  createSession, findSessionByPrefix, listSessions, truncationNote, type ListedSession,
+} from "../store/sessions.ts";
+import { Editor } from "../tui/editor.ts";
+import type { Key } from "../tui/keys.ts";
+import { editorBindings, encodeKey, keyMatches } from "../tui/input.ts";
+import { interactiveAutocomplete } from "./completions.ts";
+import { Container, createInteractiveTui, Lines, PiText, MarkdownBlock, thinkingBorderColor } from "../tui/host.ts";
+import type { TuiMainScreen } from "../tui/host.ts";
+import { Settings } from "../tui/settings.ts";
+import { SelectList, type SelectItem } from "../tui/select.ts";
+import { TreeList, renderTree, treeFromPoints, type TreeNode, type NodeParent } from "../tui/tree.ts";
+import { renderStatus, type StatusState } from "../tui/statusline.ts";
+import { nextDelivery, type Phase, type QueuedMessage, type QueueKind } from "../core/queue.ts";
+import { cycle } from "../core/cycle.ts";
+import { usableColumns, type Terminal } from "../tui/terminal.ts";
+import { ANSI, IDENTITY, PLAIN_ATTRS, createStyle, paint, type Style } from "../tui/style.ts";
+import { defaultKeymap, listBindings, type ActionId } from "../core/keymap.ts";
+import { builtinTheme } from "../core/theme.ts";
+import { writeUserSettings } from "../store/resources.ts";
+import { colorEnabled } from "./render.ts";
+import { renderToolView } from "../tui/toolview.ts";
+import { lastAssistantText, toHtml, toJsonl } from "../core/export.ts";
+import { toJsonEvent } from "../core/json-event.ts";
+import { COMMANDS, commandDefinition, parseCommand, type Command } from "./commands.ts";
+import {
+  expandInput,
+} from "./input.ts";
+import {
+  describeError, firstLine, formatEvent, indent, stdinIsTty, stdoutIsTty, wrap,
+} from "./render.ts";
+import {
+  createSessionFor, retryHandler, whyNot, splitModelPatterns, runModelsRefresh, type App,
+} from "./startup.ts";
+
+const HINT = `type a prompt, or ${COMMANDS.map((command) => `/${command.name}`).join(" ")}`;
+const OAUTH_PASTE = "\0oauth";
+
+function parseLine(app: App, text: string): Command {
+  return parseCommand(text, app.slash);
+}
+
+/**
+ * Inputs maybeCut reads when it decides whether to cut. The gauge must use
+ * this same set -- a second estimate would disagree with the actual cut.
+ */
+export interface BudgetInput {
+  readonly frozen: FrozenPrefix;
+  readonly handoff: Handoff | null;
+  readonly events: readonly LogEvent[];
+  readonly anchor: Anchor | null;
+  readonly counter?: TokenCounter;
+  readonly boundary?: Partial<BoundaryConfig>;
+  /** maybeCut only runs at a turn boundary; the prompt is that boundary. */
+  readonly atTurnBoundary?: boolean;
+}
+
+export interface ContextBudget {
+  readonly used: number;
+  readonly trigger: number;
+  readonly inherited: number;
+  readonly decision: BoundaryDecision;
+}
+
+/**
+ * The numbers the status gauge shows, computed the same way maybeCut does:
+ * anchoredCount for the current projection, inheritedTokens from the empty
+ * node, shouldCut for whether a cut is actually possible. The TUI must not
+ * recompute the work floor.
+ */
+export function contextBudget(input: BudgetInput): ContextBudget {
+  const counter = input.counter ?? estimateTokens;
+  const projected = projectContext({
+    frozen: input.frozen,
+    handoff: input.handoff,
+    events: input.events,
+  });
+  const { tokens } = anchoredCount(
+    projected.messages,
+    projected.system,
+    input.anchor,
+    counter,
+    input.frozen.tools,
+  );
+  const floor = projectContext({
+    frozen: input.frozen,
+    handoff: input.handoff,
+    events: [],
+  });
+  const inherited = counter.count(floor.messages, floor.system, input.frozen.tools);
+  const cfg = { ...DEFAULT_BOUNDARY, ...input.boundary };
+  const decision = shouldCut({
+    tokens,
+    inheritedTokens: inherited,
+    atTurnBoundary: input.atTurnBoundary ?? true,
+    ...(input.boundary ? { config: input.boundary } : {}),
+  });
+  return { used: tokens, trigger: cfg.triggerTokens, inherited, decision };
+}
+
+export function resolveEditorCommand(
+  env: { readonly [key: string]: string | undefined } = process.env,
+): string {
+  const visual = env["VISUAL"]?.trim();
+  if (visual !== undefined && visual.length > 0) return visual;
+  const editor = env["EDITOR"]?.trim();
+  if (editor !== undefined && editor.length > 0) return editor;
+  return "nano";
+}
+
+export type ExternalEditorResult =
+  | { ok: true; content: string }
+  | { ok: false; message: string };
+
+/**
+ * The only I/O in the editor-completion card. applyKey stays pure; this
+ * writes a temp file, runs $VISUAL/$EDITOR/nano, and deletes the file
+ * whether the editor saved or :cq'd. A non-zero exit is a discard — vim's
+ * :cq means "I do not want this" and stuffing the half-written file back
+ * would turn a cancel into an edit.
+ */
+export async function editInExternalEditor(input: {
+  readonly content: string;
+  readonly command: string;
+}): Promise<ExternalEditorResult> {
+  const dir = await mkdtemp(join(tmpdir(), "xeno-editor-"));
+  const filePath = join(dir, "prompt.md");
+  try {
+    await writeFile(filePath, input.content, "utf8");
+    const parts = input.command.trim().split(/\s+/).filter((p) => p.length > 0);
+    const bin = parts[0];
+    if (bin === undefined) {
+      return { ok: false, message: "external editor: no command; discarding changes" };
+    }
+    const proc = Bun.spawn([...parts, filePath], {
+      stdin: "inherit",
+      stdout: "inherit",
+      stderr: "inherit",
+    });
+    const code = await proc.exited;
+    if (code !== 0) {
+      return { ok: false, message: `external editor exited ${code}; discarding changes` };
+    }
+    const content = await readFile(filePath, "utf8");
+    return { ok: true, content };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, message: `external editor failed (${msg}); discarding changes` };
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** Scan once per workspace: a glob on every @ is the stall the card rejected. */
+const fileIndexes = new Map<string, FileIndex>();
+const indexNotes = new Set<string>();
+
+async function fileIndexFor(app: App, refresh = false): Promise<FileIndex> {
+  const hit = fileIndexes.get(app.workspace);
+  if (!refresh && hit !== undefined) return hit;
+  const built = await buildFileIndex(app.workspace);
+  fileIndexes.set(app.workspace, built);
+  const note = indexTruncationNote(built);
+  if (note !== null && !indexNotes.has(app.workspace)) {
+    indexNotes.add(app.workspace);
+    app.io.say(app.io.palette.yellow(`  ${note}`));
+  }
+  return built;
+}
+
+export async function runPrompt(app: App, prompt: string): Promise<void> {
+  const ok = await run(app, prompt);
+  printUsage(app);
+  // One-shot mode is scriptable, so a failed turn has to be a failed exit.
+  if (!ok) process.exit(1);
+}
+
+export async function runRepl(app: App): Promise<void> {
+  if (stdinIsTty() && stdoutIsTty()) {
+    await runTui(app);
+  } else {
+    await runLines(app);
+  }
+}
+
+async function runLines(app: App): Promise<void> {
+  const C = app.io.palette;
+  app.io.say(C.dim(HINT));
+  /** Set by `/login <provider>`; the next line typed is the key, not a prompt. */
+  let awaitingKeyFor: string | null = null;
+  for await (const line of console) {
+    const text = line.trim();
+    if (awaitingKeyFor !== null) {
+      const provider = awaitingKeyFor;
+      awaitingKeyFor = null;
+      if (text.length === 0) {
+        if (provider === OAUTH_PASTE) await cancelPendingOAuth();
+        app.io.say(C.dim("  cancelled\n"));
+        continue;
+      }
+      if (provider === OAUTH_PASTE) {
+        if (pendingOAuth === null || pendingOAuth.done) {
+          const outcome = await execute(app, parseLine(app, text), null);
+          if (outcome === "quit") break;
+          if (typeof outcome === "object") awaitingKeyFor = outcome.login;
+          continue;
+        }
+        await completeOAuthPaste(app, text);
+        continue;
+      }
+      await login(app, provider, text);
+      continue;
+    }
+    if (!text) continue;
+    const outcome = await execute(app, parseLine(app, text), null);
+    if (outcome === "quit") break;
+    if (typeof outcome === "object") awaitingKeyFor = outcome.login;
+  }
+  printUsage(app);
+}
+
+async function runTui(app: App): Promise<void> {
+  const C = app.io.palette;
+  app.io.say(C.dim(HINT));
+  const tui = new Tui(app);
+  const previousSay = app.io.say;
+  app.io.say = (line) => tui.writeLine(line);
+  await tui.syncTranscript();
+  tui.attach();
+  app.askSlot.current = (request) => tui.ask(request);
+  tui.paint();
+  try {
+    while (true) {
+      const data = await tui.nextInput();
+      const result = await tui.applyInput(data).catch((error: unknown) => {
+        tui.writeLine(app.io.palette.red(describeError(error)));
+        return "continue" as const;
+      });
+      if (result === "quit") { await tui.settle(); break; }
+    }
+  } finally {
+    await cancelPendingOAuth();
+    await tui.screen.terminal.drainInput();
+    tui.detach();
+    delete app.askSlot.current;
+    app.io.say = previousSay;
+    printUsage(app);
+  }
+}
+
+type Outcome = "continue" | "quit" | { login: string };
+
+async function execute(app: App, command: Command, tui: Tui | null): Promise<Outcome> {
+  switch (command.kind) {
+    case "quit":
+      return "quit";
+    case "usage":
+      printUsage(app);
+      return "continue";
+    case "state":
+      printState(app);
+      return "continue";
+    case "help":
+      printHelp(app);
+      return "continue";
+    case "hotkeys":
+      printHotkeys(app);
+      return "continue";
+    case "settings":
+      return applySettingsCommand(app, command.field, command.value, tui);
+    case "session":
+      await printSession(app);
+      return "continue";
+    case "model":
+      if (command.pattern !== undefined) {
+        await switchByPattern(app, command.pattern);
+        return "continue";
+      }
+      if (tui) {
+        tui.openModelSelect();
+        return "continue";
+      }
+      printModels(app);
+      return "continue";
+    case "thinking":
+      return applyThinkingCommand(app, command.level, tui);
+    case "login": {
+      if (command.provider === undefined) {
+        if (tui) { tui.openLoginSelect(); return "continue"; }
+        const C = app.io.palette;
+        const providers = [...new Set(app.catalog.map((m) => m.provider))];
+        app.io.say(C.bold("\nlogin"));
+        app.io.say(C.bold("  API keys"));
+        for (const p of providers) {
+          app.io.say(`  ${p.padEnd(12)}${C.dim(envLabel(p))}`);
+        }
+        app.io.say(C.bold("  Subscriptions"));
+        for (const s of SUBSCRIPTION_OPTIONS) {
+          app.io.say(`  ${s.id.padEnd(16)}${C.dim(s.label)}`);
+        }
+        app.io.say(C.dim("\n  /login <provider> then paste the key. Empty line cancels."));
+        app.io.say(C.dim("  /login claude-pro|codex|github-copilot starts a subscription login.\n"));
+        return "continue";
+      }
+      if (isSubscriptionLogin(command.provider)) {
+        return startSubscriptionLogin(app, command.provider, tui);
+      }
+      const C = app.io.palette;
+      // The editor paints a mask; this sentence has to match that, because
+      // "it will be visible here" is how a secret ends up in a screenshot.
+      app.io.say(C.yellow(`  paste the ${command.provider} key and press enter. It is not shown.`));
+      app.io.say(C.dim("  a value starting with ! runs as a command; $VAR reads the environment."));
+      app.io.say(C.dim("  empty line cancels."));
+      return { login: command.provider };
+    }
+    case "logout": {
+      await logout(app, command.provider);
+      return "continue";
+    }
+    case "back": {
+      if (command.arg === undefined) { await printBack(app); return "continue"; }
+      const points = await app.session.restorePoints();
+      const i = Number(command.arg);
+      const point = Number.isInteger(i) ? points[i - 1] : undefined;
+      if (!point) {
+        app.io.say(app.io.palette.red(`  no such point: ${command.arg}. /back lists them.`));
+        return "continue";
+      }
+      await printRewind(app, point, command.mode, command.confirm);
+      await tui?.syncTranscript();
+      return "continue";
+    }
+    case "tree":
+      if (tui) {
+        await tui.openTreeSelect();
+        return "continue";
+      }
+      await printTree(app);
+      return "continue";
+    case "new":
+      await openNewSession(app, tui ?? undefined);
+      return "continue";
+    case "resume":
+      if (command.id !== undefined) {
+        await resumeSession(app, command.id, tui ?? undefined);
+        return "continue";
+      }
+      if (tui) {
+        await tui.openResumeSelect();
+        return "continue";
+      }
+      await printSessionList(app);
+      return "continue";
+    case "name":
+      await nameSession(app, command.name, tui ?? undefined);
+      return "continue";
+    case "export":
+      await exportSession(app, command.file);
+      return "continue";
+    case "copy":
+      await copyLastReply(app);
+      return "continue";
+    case "fork":
+      if (tui && command.arg === undefined) { await tui.openForkSelect(); return "continue"; }
+      await forkSession(app, command.arg);
+      await tui?.syncTranscript();
+      return "continue";
+    case "clone":
+      await cloneSession(app);
+      await tui?.syncTranscript();
+      return "continue";
+    case "trust":
+      await trustProject(app, command.target);
+      return "continue";
+    case "models-refresh":
+      await refreshModels(app);
+      return "continue";
+    case "unknown":
+      app.io.say(app.io.palette.yellow(`  unknown command: ${command.input}. /help lists them.`));
+      return "continue";
+    case "prompt":
+      await run(app, command.text, tui?.signal, tui ?? undefined);
+      app.io.say("");
+      return "continue";
+    default:
+      return assertNever(command, "execute");
+  }
+}
+
+async function handleLine(app: App, text: string, tui: Tui): Promise<Outcome> {
+  if (tui.awaitingKeyFor !== null) {
+    const provider = tui.awaitingKeyFor;
+    tui.awaitingKeyFor = null;
+    tui.editor.setSecret(false);
+    if (text.length === 0) {
+      if (provider === OAUTH_PASTE) await cancelPendingOAuth();
+      app.io.say(app.io.palette.dim("  cancelled\n"));
+      return "continue";
+    }
+    if (provider === OAUTH_PASTE) {
+      await completeOAuthPaste(app, text);
+      return "continue";
+    }
+    await login(app, provider, text);
+    return "continue";
+  }
+  const outcome = await execute(app, parseLine(app, text), tui);
+  if (typeof outcome === "object") {
+    tui.awaitingKeyFor = outcome.login;
+    tui.editor.setSecret(true);
+  }
+  return outcome;
+}
+
+function printUsage(app: App): void {
+  const C = app.io.palette;
+  const t = app.session.totals;
+  const spec = app.session.provider.config.spec;
+  const rates = spec.rates;
+  app.io.say(C.bold("\nusage"));
+  app.io.say(`  requests          ${t.requests}`);
+  app.io.say(`  prompt tokens     ${t.prompt_tokens.toLocaleString()}`);
+  app.io.say(`    uncached        ${t.input_tokens.toLocaleString()}`);
+  if (rates === undefined) {
+    app.io.say(`    cache write     ${t.cache_creation_input_tokens.toLocaleString()}  (unknown)`);
+    app.io.say(`    cache read      ${t.cache_read_input_tokens.toLocaleString()}  (unknown)`);
+  } else {
+    // The multiples come from the model that actually ran. They used to be
+    // Anthropic's, printed verbatim beside a DeepSeek total, where the write
+    // rate is 0 and the read rate is a third of what the label claimed.
+    app.io.say(
+      `    cache write     ${t.cache_creation_input_tokens.toLocaleString()}  ` +
+        `(${rates.write}x${rates.write === 0 ? ", not billed" : ""})`,
+    );
+    app.io.say(`    cache read      ${t.cache_read_input_tokens.toLocaleString()}  (${rates.read.toFixed(3)}x)`);
+  }
+  app.io.say(`  output tokens     ${t.output_tokens.toLocaleString()}`);
+  const rate = (t.cache_hit_rate * 100).toFixed(1);
+  const rateColour = t.cache_hit_rate > 0.7 ? C.green : t.cache_hit_rate > 0.3 ? C.yellow : C.red;
+  app.io.say(`  cache hit rate    ${rateColour(rate + "%")}`);
+  if (rates !== undefined) {
+    const cost = equivalentCost(t, rates);
+    app.io.say(
+      `  input equivalent  ${Math.round(cost.input_equivalent).toLocaleString()} ` +
+        C.dim(`(vs ${Math.round(cost.uncached_equivalent).toLocaleString()} uncached, ` +
+          `${cost.savings_ratio.toFixed(2)}x saved)`),
+    );
+  }
+  const dollars = reportedCost(t, spec.price);
+  if (dollars.kind === "unknown") {
+    app.io.say(`  cost              unknown`);
+  } else if (dollars.kind === "usd") {
+    app.io.say(`  cost              $${dollars.amount.toFixed(4)}`);
+  } else if (dollars.kind === "partial") {
+    // `known` is not a complete bill. Printing it on the usd path would
+    // look like cache had been free.
+    app.io.say(`  cost              $${dollars.known.toFixed(4)}  (cache not counted)`);
+  } else {
+    return assertNever(dollars, "printUsage");
+  }
+  app.io.say(`  wall clock        ${(t.ms / 1000).toFixed(1)}s`);
+  app.io.say("");
+}
+
+function printState(app: App): void {
+  const C = app.io.palette;
+  const s = app.session.state;
+  app.io.say(C.bold("\nstate"));
+  app.io.say(`  node              ${s.node}  (depth ${s.depth})`);
+  app.io.say(`  events in node    ${s.events.length}`);
+  if (s.handoff) {
+    const h = s.handoff;
+    app.io.say(`  completed         ${h.state.completed.length}`);
+    app.io.say(`  unverified        ${h.state.unverified_claims.length}`);
+    app.io.say(`  in flight         ${h.state.in_flight.length}`);
+    app.io.say(`  blocked           ${h.state.blocked.length}`);
+    app.io.say(
+      `  gates             ${h.verification.map((v) => `${v.gate}=${v.status}`).join(" ") || "none"}`,
+    );
+    app.io.say(`  no progress for   ${h.budget.nodes_without_progress} node(s)`);
+  } else {
+    app.io.say(C.dim("  no handoff yet (still in the first node)"));
+  }
+  app.io.say("");
+}
+
+function printHotkeys(app: App): void {
+  const C = app.io.palette;
+  const map = app.ui?.keymap ?? defaultKeymap();
+  const enabled = app.session.config.frozen.tools.length;
+  app.io.say(C.bold("\nhotkeys"));
+  app.io.say(`  tools enabled               ${enabled}`);
+  for (const row of listBindings(map)) {
+    app.io.say(`  ${row.action.padEnd(28)}${row.keys.join(", ")}`);
+  }
+  app.io.say("");
+}
+
+async function applySettingsCommand(
+  app: App,
+  field: string | undefined,
+  value: string | undefined,
+  tui: Tui | null,
+): Promise<Outcome> {
+  if (field !== undefined && value !== undefined) {
+    await commitSetting(app, field, value, tui);
+    return "continue";
+  }
+  if (tui) {
+    tui.openSettings(field);
+    return "continue";
+  }
+  const s = app.ui?.settings;
+  app.io.say(app.io.palette.bold("\nsettings"));
+  app.io.say(`  theme             ${s?.theme ?? "dark"}`);
+  app.io.say(`  thinking          ${s?.thinking ?? app.providerConfig.effort}`);
+  app.io.say(`  statusBar         ${s?.statusBar === false ? "off" : "on"}`);
+  app.io.say(app.io.palette.dim("  /settings <theme|thinking|statusBar> <value> to change.\n"));
+  return "continue";
+}
+
+async function commitSetting(app: App, field: string, value: string, tui: Tui | null): Promise<void> {
+  const C = app.io.palette;
+  const key = field.toLowerCase();
+  if (app.ui === undefined) {
+    app.io.say(C.yellow("  settings are not available in this session"));
+    return;
+  }
+  if (key === "theme") {
+    const theme = value === "dark" || value === "light" ? builtinTheme(value) : app.ui.theme;
+    if (value === "dark" || value === "light") {
+      app.ui.theme = theme;
+      app.ui.style = colorEnabled() ? createStyle(theme.colors) : IDENTITY;
+    } else {
+      app.io.say(C.yellow("  theme must be dark or light (a path is --theme / file)"));
+      return;
+    }
+    app.ui.settings = { ...app.ui.settings, theme: value };
+    app.ui.userOverrides = { ...app.ui.userOverrides, theme: value };
+    await writeUserSettings({ theme: value });
+    app.io.say(C.dim(`  theme ${value}`));
+    tui?.paint();
+    return;
+  }
+  if (key === "thinking") {
+    const effort = asEffort(value);
+    if (effort === undefined) {
+      app.io.say(C.yellow("  thinking must be low|medium|high|xhigh|max"));
+      return;
+    }
+    if (!applyThinking(app, effort, tui)) return;
+    app.ui.settings = { ...app.ui.settings, thinking: effort };
+    app.ui.userOverrides = { ...app.ui.userOverrides, thinking: effort };
+    await writeUserSettings({ thinking: effort });
+    return;
+  }
+  if (key === "statusbar" || key === "status") {
+    const on = value === "on" || value === "true" || value === "1";
+    const off = value === "off" || value === "false" || value === "0";
+    if (!on && !off) {
+      app.io.say(C.yellow("  statusBar must be on or off"));
+      return;
+    }
+    app.ui.settings = { ...app.ui.settings, statusBar: on };
+    app.ui.userOverrides = { ...app.ui.userOverrides, statusBar: on };
+    await writeUserSettings({ statusBar: on });
+    app.io.say(C.dim(`  statusBar ${on ? "on" : "off"}`));
+    tui?.paint();
+    return;
+  }
+  app.io.say(C.yellow(`  unknown setting: ${field}`));
+}
+
+function asEffort(value: string): import("../runtime/model.ts").Effort | undefined {
+  if (value === "low" || value === "medium" || value === "high" || value === "xhigh" || value === "max") {
+    return value;
+  }
+  return undefined;
+}
+
+const EFFORTS: readonly Effort[] = ["low", "medium", "high", "xhigh", "max"];
+
+/**
+ * null in thinkingLevelMap means the model does not have that level.
+ * An absent map or absent entry is passthrough, not a missing level.
+ * Never treat null as "nearest neighbour" — that silently changes a
+ * deliberate slower/dearer choice (feat-model-and-thinking).
+ */
+function effortSupported(spec: ModelSpec, level: Effort): boolean {
+  const map = spec.thinkingLevelMap;
+  if (map === undefined) return true;
+  if (!(level in map)) return true;
+  return map[level] !== null;
+}
+
+/**
+ * Effort is a request parameter on the current provider. Switching it
+ * must not cut: a cut drops the prefix cache, and thinking blocks stay
+ * valid because the model did not change.
+ */
+function applyThinking(app: App, level: Effort, tui: Tui | null): boolean {
+  const C = app.io.palette;
+  if (!effortSupported(app.providerConfig.spec, level)) {
+    app.io.say(
+      C.yellow(
+        `  ${level} is not supported by ${app.providerConfig.spec.id}; thinking unchanged`,
+      ),
+    );
+    return false;
+  }
+  app.providerConfig = { ...app.providerConfig, effort: level };
+  if (app.credential.ok) {
+    app.session.provider = makeProvider(app, app.providerConfig, app.credential.key);
+  }
+  if (app.ui !== undefined) {
+    app.ui.settings = { ...app.ui.settings, thinking: level };
+  }
+  app.io.say(C.dim(`  thinking ${level}`));
+  tui?.paint();
+  return true;
+}
+
+function applyThinkingCommand(app: App, level: string | undefined, tui: Tui | null): Outcome | Promise<Outcome> {
+  if (level !== undefined) {
+    const effort = asEffort(level);
+    if (effort === undefined) {
+      app.io.say(app.io.palette.yellow("  thinking must be low|medium|high|xhigh|max"));
+      return "continue";
+    }
+    applyThinking(app, effort, tui);
+    return "continue";
+  }
+  if (tui) {
+    tui.openThinkingSelect();
+    return "continue";
+  }
+  printThinking(app);
+  return "continue";
+}
+
+function printThinking(app: App): void {
+  const C = app.io.palette;
+  const spec = app.providerConfig.spec;
+  app.io.say(C.bold("\nthinking"));
+  for (const level of EFFORTS) {
+    const supported = effortSupported(spec, level);
+    const here = level === app.providerConfig.effort;
+    const mark = !supported ? C.dim("  -- ") : here ? C.cyan(" now ") : C.green("    ");
+    const note = supported ? "" : C.dim("  unsupported");
+    app.io.say(`  ${mark}  ${level}${note}`);
+  }
+  app.io.say(C.dim("\n  /thinking <level> to switch. Shift+Tab cycles supported levels.\n"));
+}
+
+function cycleThinking(app: App, tui: Tui | null): void {
+  const supported = EFFORTS.filter((level) => effortSupported(app.providerConfig.spec, level));
+  const next = cycle(supported, app.providerConfig.effort, 1);
+  if (next === undefined) return;
+  applyThinking(app, next, tui);
+}
+
+async function cycleScopedModel(app: App, dir: 1 | -1): Promise<void> {
+  const C = app.io.palette;
+  const fromFlag = splitModelPatterns(app.args.models);
+  const names = fromFlag.length > 0 ? fromFlag : [...(app.ui?.settings.scopedModels ?? [])];
+  if (names.length === 0) {
+    app.io.say(C.dim("  no scoped models. Pass --models a,b or set scopedModels."));
+    return;
+  }
+  const ids: string[] = [];
+  for (const pattern of names) {
+    const found = findModelByPattern(pattern, app.catalog);
+    if (found.ok && !ids.includes(found.spec.id)) ids.push(found.spec.id);
+  }
+  if (ids.length === 0) {
+    app.io.say(C.yellow("  --models matched nothing"));
+    return;
+  }
+  const next = cycle(ids, app.providerConfig.spec.id, dir);
+  if (next === undefined || next === app.providerConfig.spec.id) return;
+  await switchByPattern(app, next);
+}
+
+function printHelp(app: App): void {
+  const C = app.io.palette;
+  app.io.say(C.bold("\ncommands"));
+  for (const command of COMMANDS) {
+    const hint = "argumentHint" in command ? ` ${command.argumentHint}` : "";
+    app.io.say(`  /${(command.name + hint).padEnd(34)} ${command.description}`);
+  }
+  app.io.say('  @file or @"file name"  attach a project file anywhere in the prompt');
+  app.io.say("  !cmd              run in the workspace and send stdout/stderr/exit to the model");
+  app.io.say("  !!cmd             run without sending output");
+  app.io.say("");
+}
+
+async function printSession(app: App): Promise<void> {
+  const C = app.io.palette;
+  const cursor = await readCursor(app.logDir);
+  app.io.say(C.bold("\nsession"));
+  app.io.say(`  id                ${basename(app.logDir)}`);
+  app.io.say(`  name              ${cursor?.name ?? "(unnamed)"}`);
+  app.io.say(`  path              ${app.logDir}`);
+  app.io.say(`  node              ${app.session.state.node}`);
+  app.io.say(`  events            ${app.session.state.events.length}`);
+  app.io.say(`  model             ${app.providerConfig.spec.id}`);
+  printUsage(app);
+}
+
+async function printSessionList(app: App): Promise<void> {
+  const C = app.io.palette;
+  const { sessions, truncated } = await listSessions(app.workspace, sessionDirOf(app));
+  const note = truncationNote(truncated);
+  app.io.say(C.bold("\nsessions"));
+  if (note) app.io.say(C.yellow(`  ${note}`));
+  if (sessions.length === 0) {
+    app.io.say(C.dim("  none yet -- /new starts one"));
+    app.io.say("");
+    return;
+  }
+  for (const s of sessions) {
+    if (!s.ok) {
+      app.io.say(C.red(`  ${s.id}  unreadable  ${s.error}`));
+      continue;
+    }
+    const here = s.path === app.logDir ? C.cyan(" now ") : "     ";
+    const label = (s.name ?? s.id).padEnd(24);
+    app.io.say(`  ${here} ${label}${C.dim(`${s.events} events  ${s.model ?? ""}`)}`);
+  }
+  app.io.say(C.dim("\n  /resume <id> to switch\n"));
+}
+
+/**
+ * Lists somewhere to go back to, newest last, numbered for typing.
+ *
+ * Numbered rather than addressed by node and event id: the address is an
+ * implementation detail and nobody can type `e00017`. The numbering is of
+ * the list as printed, so it is re-read on every command rather than
+ * remembered -- a rewind changes the ancestry and with it the list.
+ */
+async function printBack(app: App): Promise<void> {
+  const C = app.io.palette;
+  const points = await app.session.restorePoints();
+  app.io.say(C.bold("\nsomewhere to go back to") + C.dim("  (newest last)"));
+  if (points.length === 0) {
+    app.io.say(C.dim("  nothing yet -- no exchange has changed a file"));
+  }
+  points.forEach((p, i) => {
+    const n = String(i + 1).padStart(2);
+    const files = `${p.changed} file${p.changed === 1 ? "" : "s"}`;
+    // Off-path entries are branches this session has left, usually by
+    // rewinding. Listed, because a node that survives on disk and cannot be
+    // found again is lost in every sense that matters to a person.
+    const mark = p.onPath ? "  " : C.yellow("↩ ");
+    app.io.say(`  ${C.bold(n)} ${mark} ${C.dim(files.padEnd(9))}${firstLine(p.prompt, 60)}`);
+  });
+  if (points.some((p) => !p.onPath)) {
+    app.io.say(C.dim(`\n  ${C.yellow("↩")} left behind by an earlier /back -- still reachable`));
+  }
+  app.io.say(C.dim("\n  /back <n>            move the files and the conversation"));
+  app.io.say(C.dim("  /back <n> files      move the files, keep what was learned"));
+  app.io.say(C.dim("  /back <n> context    move the conversation, keep the code"));
+  // Restated from the write-ups rather than left for the person to work
+  // out, because picking wrong is how a rewind makes things worse: the
+  // documented trap is keeping bad code with no memory of writing it.
+  app.io.say(C.dim("\n  code broken + model confused -> plain /back"));
+  app.io.say(C.dim("  code broken, model was right -> files"));
+  app.io.say(C.dim("  code fine, model went wrong   -> context\n"));
+}
+
+/**
+ * Non-tty /tree: the same layout as the live view, committed to scrollback.
+ * Jumping still needs the TUI; this is so a pipe can see the structure.
+ */
+async function printTree(app: App): Promise<void> {
+  const nodes = await treeNodesFor(app);
+  const style = app.ui?.style ?? IDENTITY;
+  for (const line of renderTree(nodes, { index: 0, filter: "all" }, 80, style)) {
+    app.io.say(line);
+  }
+}
+
+async function treeNodesFor(app: App): Promise<TreeNode[]> {
+  const points = await app.session.restorePoints();
+  const parents = await loadNodeParents(app.logDir);
+  const messages = new Map<string, TreeNode[]>();
+  for (const node of parents.keys()) {
+    const { events } = await readNode(app.logDir, node);
+    const turns = points.filter((point) => point.node === node);
+    let turn = -1;
+    for (const event of events) {
+      if (event.t === "user") { turn++; continue; }
+      const point = turns[turn];
+      if (!point) continue;
+      const target = `${point.node}:${point.atEvent}`;
+      const labels = event.t === "assistant" ? event.blocks.map((block) =>
+        block.type === "tool_use" ? `tool · ${block.name}` : `${block.type === "text" ? "assistant" : "thinking"} · ${firstLine(block.text, 120)}`)
+        : event.t === "tool_result" ? [`tool result · ${event.ok ? "ok" : "failed"} · ${firstLine(event.content, 100)}`]
+        : event.t === "cut" ? [`context boundary · ${event.reason}`] : [];
+      const children = messages.get(target) ?? [];
+      labels.forEach((prompt, i) => children.push({ id: `${node}:${event.id}:${i}`, target, prompt,
+        onPath: point.onPath, current: false, kind: "other", children: [] }));
+      messages.set(target, children);
+    }
+  }
+  const enrich = (nodes: readonly TreeNode[]): TreeNode[] => nodes.map((node) => ({ ...node,
+    children: [...(messages.get(node.id) ?? []), ...enrich(node.children)] }));
+  return enrich(treeFromPoints(points, parents, app.session.state.node));
+}
+
+async function loadNodeParents(logDir: string): Promise<Map<number, NodeParent>> {
+  const map = new Map<number, NodeParent>();
+  for (const id of await listNodes(logDir)) {
+    const { header } = await readNode(logDir, id);
+    if (header === null) continue;
+    if (header.parent === null) {
+      map.set(id, null);
+      continue;
+    }
+    map.set(
+      id,
+      header.parent.at_event === undefined
+        ? { node: header.parent.node }
+        : { node: header.parent.node, at_event: header.parent.at_event },
+    );
+  }
+  return map;
+}
+
+/**
+ * Goes back: the files and the conversation move together.
+ *
+ * Preview first, always. The half of this that nobody asked for is the
+ * deletion of everything the target did not have -- including a file a
+ * person wrote by hand while the session sat idle -- and that half is
+ * invisible in the request.
+ */
+async function printRewind(
+  app: App,
+  point: RestorePoint,
+  mode: RewindMode,
+  confirmed: boolean,
+): Promise<void> {
+  const C = app.io.palette;
+  const label = firstLine(point.prompt, 60);
+  const plan = await app.session.previewRewind(point);
+  if (!plan.ok) {
+    app.io.say(C.red(`\n  cannot go back: ${plan.error}\n`));
+    return;
+  }
+
+  const what =
+    mode === "both" ? "the files and the conversation"
+    : mode === "files" ? "the files only"
+    : "the conversation only";
+  app.io.say(C.bold("\ngo back to") + `  ${label}` + C.dim(`  (${what})`));
+
+  if (mode === "context") {
+    // Nothing on disk changes, so listing what the target HAD would read
+    // like a plan to write it. What matters is the gap the model is about
+    // to be told about.
+    const extra = plan.willDelete;
+    app.io.say(C.dim(`    no file is touched`));
+    for (const p of extra.slice(0, 20)) app.io.say(C.yellow(`    stays   ${p}  (not in that context)`));
+    if (extra.length > 20) app.io.say(C.yellow(`    ... ${extra.length - 20} more`));
+  } else {
+    for (const p of plan.willWrite.slice(0, 20)) app.io.say(C.dim(`    keep    ${p}`));
+    if (plan.willWrite.length > 20) app.io.say(C.dim(`    ... ${plan.willWrite.length - 20} more`));
+    for (const p of plan.willDelete.slice(0, 20)) app.io.say(C.red(`    delete  ${p}`));
+    if (plan.willDelete.length > 20) app.io.say(C.red(`    ... ${plan.willDelete.length - 20} more`));
+  }
+
+  if (!confirmed) {
+    app.io.say(C.yellow('\n  nothing changed. add "confirm" to go back.'));
+    if (mode === "both") {
+      app.io.say(C.dim("  the turns after this point stop being what the model sees."));
+      app.io.say(C.dim("  They are not deleted -- this list will still offer them."));
+    } else {
+      app.io.say(C.dim("  the two will disagree afterwards. The model is told which"));
+      app.io.say(C.dim("  paths, and to re-read before editing -- it is not left to"));
+      app.io.say(C.dim("  work it out from a context that no longer matches disk."));
+    }
+    app.io.say("");
+    return;
+  }
+
+  const done = await app.session.rewind(point, mode);
+  if (!done.ok) {
+    app.io.say(C.red(`\n  could not go back: ${done.error}\n`));
+    return;
+  }
+  if (done.unrecoverable.length > 0) {
+    app.io.say(C.red(`\n  restore not applied: missing content for ${done.unrecoverable.join(", ")}`));
+    app.io.say(C.dim(`  ${done.note}\n`));
+    return;
+  }
+  app.io.say(
+    C.green(`\n  back at node ${done.node}`) +
+      C.dim(
+        mode === "context"
+          ? "  no file touched"
+          : `  ${done.restored.length} restored, ${done.removed.length} removed`,
+      ),
+  );
+  if (done.unrecoverable.length > 0) {
+    app.io.say(C.red(`  content no longer stored: ${done.unrecoverable.join(", ")}`));
+  }
+  app.io.say(C.dim(indent(wrap(done.note, 72), "  ")));
+  app.io.say("");
+}
+
+function printModels(app: App): void {
+  const C = app.io.palette;
+  app.io.say(C.bold("\nmodels"));
+  for (const group of groupedModels(app.catalog)) {
+    app.io.say(C.bold(`  ${group.provider}`));
+    for (const spec of group.models) {
+      const got = app.credentialOf(spec);
+      const here = spec.id === app.providerConfig.spec.id;
+      const mark = here ? C.cyan(" now ") : got.ok ? C.green("ready") : C.dim("  -- ");
+      app.io.say(`    ${mark}  ${spec.id.padEnd(28)}${C.dim(spec.name.padEnd(28))}${whyNot(spec, got, app.auth, C)}`);
+    }
+  }
+  app.io.say(C.dim("\n  /model <id> to switch. Switching cuts this node so the next"));
+  app.io.say(C.dim("  model starts from a handoff, not from this model's thinking blocks.\n"));
+}
+
+async function refreshModels(app: App): Promise<void> {
+  const C = app.io.palette;
+  const result = await runModelsRefresh({
+    fetch: globalThis.fetch,
+    write: writeModelsFile,
+  });
+  if (!result.ok) {
+    app.io.say(C.yellow(`  ${result.reason}`));
+    app.io.say(C.dim("  existing models.json left unchanged\n"));
+    return;
+  }
+  const userFile = await readModelsText();
+  const loaded = loadCatalog({ userText: userFile.text });
+  app.catalog = loaded.models;
+  for (const warning of loaded.warnings) app.io.say(C.yellow(`  ${warning}`));
+  app.io.say(
+    C.green(`  added ${result.added}, changed ${result.changed} (${result.count} total) → ${modelsPath()}`),
+  );
+  app.io.say(C.dim(`  ${app.catalog.length} reachable after overlay\n`));
+}
+
+/** Stores a key under a provider, 0600, after saying what is about to happen. */
+async function login(app: App, provider: string, key: string): Promise<void> {
+  const C = app.io.palette;
+  if (!app.catalog.some((m) => m.provider === provider)) {
+    app.io.say(C.red(`  unknown provider: ${provider}`));
+    app.io.say(C.dim(`  known: ${[...new Set(app.catalog.map((m) => m.provider))].join(", ")}\n`));
+    return;
+  }
+  app.auth[provider] = { type: "api_key", key };
+  await writeAuthFile(app.auth);
+  // The editor masked the paste. Printing `key` here would be the only
+  // remaining way it reaches scrollback.
+  app.io.say(C.green(`  stored ${provider} in ${authPath()}`) + C.dim("  (mode 0600)"));
+  const ready = app.catalog.filter((m) => m.provider === provider && app.credentialOf(m).ok);
+  if (ready.length === 0) {
+    app.io.say(C.yellow("  stored, but it still does not resolve -- check the value.\n"));
+    return;
+  }
+  app.io.say(C.dim(`  now ready: ${ready.map((m) => m.id).join(", ")}`));
+  await adoptCredential(app, ready);
+  app.io.say(C.dim("  this session can send now.\n"));
+}
+
+async function logout(app: App, provider: string | undefined): Promise<void> {
+  const C = app.io.palette;
+  if (provider === undefined) {
+    const names = Object.keys(app.auth);
+    if (names.length === 0) {
+      app.io.say(C.dim("  nothing stored\n"));
+      return;
+    }
+    app.io.say(C.bold("\nlogout"));
+    for (const name of names) app.io.say(`  ${name}`);
+    app.io.say(C.dim("\n  /logout <provider>\n"));
+    return;
+  }
+  if (app.auth[provider] === undefined) {
+    app.io.say(C.dim(`  no stored credential for ${provider}\n`));
+    return;
+  }
+  delete app.auth[provider];
+  await writeAuthFile(app.auth);
+  app.io.say(C.green(`  removed ${provider} from ${authPath()}\n`));
+}
+
+function providerOAuthOpts(app: App, spec: ModelSpec): { oauth: true } | undefined {
+  if (app.args.apiKey.length > 0) return undefined;
+  return storedIsOAuth(app.auth, spec.provider) ? { oauth: true } : undefined;
+}
+
+function makeProvider(app: App, config: ProviderConfig, key: string) {
+  return createProvider(config, key, retryHandler(app.io), providerOAuthOpts(app, config.spec));
+}
+
+interface PendingOAuth {
+  id: SubscriptionId;
+  provider: string;
+  state: string;
+  verifier: string;
+  redirectUri: string;
+  exchange: "anthropic" | "openai";
+  server: CallbackServer;
+  done: boolean;
+  tui: Tui | null;
+}
+
+let pendingOAuth: PendingOAuth | null = null;
+
+async function cancelPendingOAuth(): Promise<void> {
+  const pending = pendingOAuth;
+  pendingOAuth = null;
+  if (pending === null) return;
+  pending.done = true;
+  await pending.server.close();
+}
+
+async function storeOAuth(app: App, provider: string, credential: OAuthCredential): Promise<void> {
+  const C = app.io.palette;
+  app.auth[provider] = credential;
+  await writeAuthFile(app.auth);
+  app.io.say(C.green(`  stored ${provider} in ${authPath()}`) + C.dim("  (mode 0600)"));
+  const ready = app.catalog.filter((m) => m.provider === provider && app.credentialOf(m).ok);
+  if (ready.length === 0) {
+    app.io.say(C.dim("  stored. No catalog model uses this provider yet.\n"));
+    return;
+  }
+  app.io.say(C.dim(`  now ready: ${ready.map((m) => m.id).join(", ")}`));
+  await adoptCredential(app, ready);
+  app.io.say(C.dim("  this session can send now.\n"));
+}
+
+async function finishOAuthCode(app: App, pending: PendingOAuth, code: string): Promise<void> {
+  if (pending.done) return;
+  pending.done = true;
+  pendingOAuth = null;
+  if (pending.tui) {
+    pending.tui.awaitingKeyFor = null;
+    pending.tui.editor.setSecret(false);
+  }
+  try {
+    const credential =
+      pending.exchange === "anthropic"
+        ? await exchangeAnthropicCode({
+            code,
+            state: pending.state,
+            verifier: pending.verifier,
+            redirectUri: pending.redirectUri,
+            fetch: globalThis.fetch,
+          })
+        : await exchangeOpenAICode({
+            code,
+            verifier: pending.verifier,
+            redirectUri: pending.redirectUri,
+            fetch: globalThis.fetch,
+          });
+    await storeOAuth(app, pending.provider, credential);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "token exchange failed";
+    app.io.say(app.io.palette.red(`  ${message}`));
+    app.io.say(app.io.palette.dim("  nothing was stored.\n"));
+  } finally {
+    await pending.server.close();
+  }
+}
+
+async function completeOAuthPaste(app: App, input: string): Promise<void> {
+  const pending = pendingOAuth;
+  if (pending === null || pending.done) return;
+  const parsed = parseAuthorizationInput(input);
+  if (parsed.state !== undefined && parsed.state !== pending.state) {
+    app.io.say(app.io.palette.red("  OAuth state mismatch"));
+    await cancelPendingOAuth();
+    return;
+  }
+  if (!parsed.code) {
+    app.io.say(app.io.palette.red("  Missing authorization code"));
+    await cancelPendingOAuth();
+    return;
+  }
+  await finishOAuthCode(app, pending, parsed.code);
+}
+
+function tryOpenBrowser(url: string): void {
+  try {
+    Bun.spawn(["open", url], { stdout: "ignore", stderr: "ignore", stdin: "ignore" });
+  } catch {
+    // Printed URL is the fallback.
+  }
+}
+
+async function startSubscriptionLogin(app: App, id: string, tui: Tui | null): Promise<Outcome> {
+  const C = app.io.palette;
+  const sub = subscriptionById(id);
+  if (sub === undefined) return "continue";
+  app.io.say(C.yellow(`  ${SUBSCRIPTION_NOTICE}`));
+  if (sub.id === "github-copilot") {
+    try {
+      const credential = await loginGitHubCopilot({
+        notify: (message) => app.io.say(`  ${message}`),
+        prompt: async () => "",
+        fetch: globalThis.fetch,
+        signal: new AbortController().signal,
+      });
+      await storeOAuth(app, sub.provider, credential);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "login failed";
+      app.io.say(C.red(`  ${message}\n`));
+    }
+    return "continue";
+  }
+  await cancelPendingOAuth();
+  const pkce = await generatePKCE();
+  const state = generateState();
+  const anthropic = sub.id === "claude-pro";
+  const url = anthropic
+    ? anthropicAuthorizeUrl({ challenge: pkce.challenge, state })
+    : openaiCodexAuthorizeUrl({ challenge: pkce.challenge, state });
+  let server: CallbackServer;
+  try {
+    server = await startCallbackServer({
+      expectedState: state,
+      host: "127.0.0.1",
+      port: anthropic ? ANTHROPIC_CALLBACK_PORT : OPENAI_CALLBACK_PORT,
+      path: anthropic ? ANTHROPIC_CALLBACK_PATH : OPENAI_CALLBACK_PATH,
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "could not bind callback port";
+    app.io.say(C.yellow(`  ${message}`));
+    app.io.say(C.dim("  paste the redirect URL after signing in.\n"));
+    // Still allow paste without a server: we just won't get a browser callback.
+    server = {
+      host: "127.0.0.1",
+      port: 0,
+      waitForCode: () => new Promise(() => {}),
+      close: async () => {},
+    };
+  }
+  app.io.say(`  ${url}`);
+  app.io.say(C.dim("  complete login in the browser, or paste the redirect URL. It is not shown."));
+  tryOpenBrowser(url);
+  const pending: PendingOAuth = {
+    id: sub.id,
+    provider: sub.provider,
+    state,
+    verifier: pkce.verifier,
+    redirectUri: anthropic ? ANTHROPIC_REDIRECT_URI : OPENAI_REDIRECT_URI,
+    exchange: anthropic ? "anthropic" : "openai",
+    server,
+    done: false,
+    tui,
+  };
+  pendingOAuth = pending;
+  void pending.server.waitForCode().then(async (got) => {
+    if (!got.ok || pending.done) return;
+    await finishOAuthCode(app, pending, got.code);
+  });
+  return { login: OAUTH_PASTE };
+}
+
+/**
+ * Make the just-stored key the one the next prompt uses, without a restart.
+ *
+ * Same model: swap the adapter in place (no thinking blocks to isolate).
+ * Placeholder session that never sent: swap onto an unlocked model in place
+ * so the first prompt is the first event, not a cut of an empty node.
+ * Already talking to a different live model: /model is the cut.
+ */
+async function adoptCredential(app: App, ready: readonly ModelSpec[]): Promise<void> {
+  const C = app.io.palette;
+  const currentGot = app.credentialOf(app.providerConfig.spec);
+  if (currentGot.ok) {
+    app.session.provider = makeProvider(app, app.providerConfig, currentGot.key);
+    app.credential = currentGot;
+    return;
+  }
+  const spec = ready[0];
+  if (spec === undefined) return;
+  const got = app.credentialOf(spec);
+  if (!got.ok) return;
+  if (app.credential.ok) {
+    await switchToModel(app, spec);
+    return;
+  }
+  const nextConfig: ProviderConfig = {
+    spec,
+    maxTokens: outputTokenBudget(spec),
+    effort: app.providerConfig.effort,
+    thinkingDisplay: app.providerConfig.thinkingDisplay,
+  };
+  app.session.provider = makeProvider(app, nextConfig, got.key);
+  app.providerConfig = nextConfig;
+  app.credential = got;
+  const cursor = await readCursor(app.logDir);
+  if (cursor !== null) {
+    await writeCursor(app.logDir, {
+      ...cursor,
+      model: spec.id,
+      updated_at: app.session.clock.now(),
+    });
+  }
+  app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
+}
+
+async function switchByPattern(app: App, pattern: string): Promise<void> {
+  const C = app.io.palette;
+  const found = findModelByPattern(pattern, app.catalog);
+  if (!found.ok) {
+    app.io.say(C.red(`  ${found.reason}`));
+    return;
+  }
+  await switchToModel(app, found.spec);
+}
+
+async function switchToModel(app: App, spec: ModelSpec): Promise<void> {
+  const C = app.io.palette;
+  if (spec.id === app.providerConfig.spec.id) {
+    app.io.say(C.dim(`  already on ${spec.id}`));
+    return;
+  }
+  const got = app.credentialOf(spec);
+  if (!got.ok) {
+    app.io.say(C.red(`\n  ${got.reason}\n`));
+    if (!got.reason.includes("/login")) {
+      app.io.say(C.dim(`  ${describeMissingCredential(spec.provider)}\n`));
+    }
+    return;
+  }
+  const nextConfig: ProviderConfig = {
+    spec,
+    maxTokens: outputTokenBudget(spec),
+    effort: app.providerConfig.effort,
+    thinkingDisplay: app.providerConfig.thinkingDisplay,
+  };
+  const next = makeProvider(app, nextConfig, got.key);
+  app.io.say(C.yellow("  switching cuts this node so the next model starts from a handoff,"));
+  app.io.say(C.yellow("  not from this model's thinking blocks."));
+  try {
+    await app.session.switchModel(next);
+  } catch (err) {
+    app.io.say(C.red(`  cannot switch: ${describeError(err)}`));
+    return;
+  }
+  app.providerConfig = nextConfig;
+  app.credential = got;
+  app.io.say(C.green(`  now ${spec.name}`) + C.dim(`  ${spec.id}`));
+}
+
+function sessionDirOf(app: App): string | undefined {
+  return (app.args.sessionDir ?? "").length > 0 ? app.args.sessionDir : undefined;
+}
+
+async function openNewSession(app: App, tui?: Tui): Promise<void> {
+  const C = app.io.palette;
+  const created = await createSession(app.workspace, undefined, sessionDirOf(app));
+  const switched = await adoptLogDir(app, created.path);
+  if (!switched) {
+    app.io.say(C.red(`  cannot start a new session`));
+    return;
+  }
+  if (tui) { tui.sessionName = null; await tui.syncTranscript(); }
+  app.io.say(C.green(`  new session ${created.id}`) + C.dim(`  ${created.path}`));
+}
+
+async function resumeSession(app: App, idOrPath: string, tui?: Tui): Promise<void> {
+  const C = app.io.palette;
+  const found = await findSessionByPrefix(app.workspace, idOrPath, sessionDirOf(app));
+  if (!found.ok) {
+    app.io.say(C.red(`  ${found.reason}. /resume lists them.`));
+    return;
+  }
+  if (found.session.path === app.logDir) {
+    app.io.say(C.dim("  already in this session"));
+    return;
+  }
+  const switched = await adoptLogDir(app, found.session.path);
+  if (!switched) {
+    app.io.say(C.red(`  cannot resume`));
+    return;
+  }
+  if (tui) { tui.sessionName = found.session.name ?? null; await tui.syncTranscript(); }
+  app.io.say(C.green(`  resumed ${found.session.name ?? found.session.id}`) + C.dim(`  ${found.session.path}`));
+}
+
+async function adoptLogDir(app: App, logDir: string): Promise<boolean> {
+  const next = createSessionFor({
+    args: app.args,
+    workspace: app.workspace,
+    logDir,
+    blobDir: app.blobDir,
+    system: app.system,
+    providerConfig: app.providerConfig,
+    credential: app.credential,
+    io: app.io,
+    askSlot: app.askSlot,
+    ...(providerOAuthOpts(app, app.providerConfig.spec) ? { oauth: true } : {}),
+  });
+  try {
+    await next.start();
+  } catch (err) {
+    app.io.say(app.io.palette.red(`  ${describeError(err)}`));
+    return false;
+  }
+  app.session = next;
+  app.logDir = logDir;
+  return true;
+}
+
+async function transcriptEvents(app: App): Promise<LogEvent[]> {
+  const history = await readNodeHistory(app.logDir, app.session.state.node);
+  if (!history.ok) throw new Error(history.error);
+  return history.nodes.flatMap((node) => node.events);
+}
+
+async function exportSession(app: App, file?: string): Promise<void> {
+  const C = app.io.palette;
+  const events = await transcriptEvents(app);
+  const defaultPath = join(app.workspace, `${basename(app.logDir)}.html`);
+  const dest = file !== undefined && file.length > 0 ? file : defaultPath;
+  const abs = dest.startsWith("/") ? dest : join(app.workspace, dest);
+  const html = abs.toLowerCase().endsWith(".jsonl") === false;
+  const body = html
+    ? toHtml(events, {
+        title: basename(app.logDir),
+        exportedAt: app.session.clock.now(),
+        sessionId: basename(app.logDir),
+      })
+    : toJsonl(events);
+  try {
+    await writeFile(abs, body, "utf8");
+  } catch (err) {
+    app.io.say(C.red(`  cannot write ${abs}: ${describeError(err)}`));
+    return;
+  }
+  app.io.say(C.green(`  exported ${abs}`));
+}
+
+async function copyLastReply(app: App): Promise<void> {
+  const C = app.io.palette;
+  const text = lastAssistantText(await transcriptEvents(app));
+  if (text === null) {
+    app.io.say(C.dim("  no assistant reply to copy yet"));
+    return;
+  }
+  const copied = copyToClipboard(text);
+  if (copied) {
+    app.io.say(C.green("  copied last assistant reply"));
+    return;
+  }
+  app.io.say(C.yellow("  no clipboard command (tried pbcopy, wl-copy, xclip). Printing it instead:"));
+  app.io.say(text);
+}
+
+/**
+ * System clipboard without an npm package. Missing binaries are a fallback
+ * that prints the text, not a silent no-op.
+ */
+function copyToClipboard(text: string): boolean {
+  const cmds: string[][] = [
+    ["pbcopy"],
+    ["wl-copy"],
+    ["xclip", "-selection", "clipboard"],
+  ];
+  for (const cmd of cmds) {
+    try {
+      const proc = Bun.spawnSync({
+        cmd,
+        stdin: Buffer.from(text),
+        stdout: "ignore",
+        stderr: "ignore",
+      });
+      if (proc.exitCode === 0) return true;
+    } catch {
+      // Try the next binary.
+    }
+  }
+  return false;
+}
+
+async function forkSession(app: App, arg?: string): Promise<void> {
+  const C = app.io.palette;
+  const points = await app.session.restorePoints();
+  if (arg === undefined) {
+    app.io.say(C.bold("\nfork from a user turn") + C.dim("  (newest last)"));
+    if (points.length === 0) {
+      app.io.say(C.dim("  nothing yet -- send a prompt first"));
+      app.io.say("");
+      return;
+    }
+    points.forEach((p, i) => {
+      const n = String(i + 1).padStart(2);
+      app.io.say(`  ${C.bold(n)}  ${firstLine(p.prompt, 60)}`);
+    });
+    app.io.say(C.dim("\n  /fork <n>  copies up to that turn into a new session\n"));
+    return;
+  }
+  const i = Number(arg);
+  const point = Number.isInteger(i) ? points[i - 1] : undefined;
+  if (!point) {
+    app.io.say(C.red(`  no such turn: ${arg}. /fork lists them.`));
+    return;
+  }
+  await spawnForkedSession(app, point.atEvent, `forked at ${firstLine(point.prompt, 40)}`);
+}
+
+async function cloneSession(app: App): Promise<void> {
+  await spawnForkedSession(app, undefined, "cloned");
+}
+
+async function spawnForkedSession(app: App, untilEvent: string | undefined, label: string): Promise<void> {
+  const C = app.io.palette;
+  const created = await createSession(app.workspace, undefined, sessionDirOf(app));
+  try {
+    await app.session.fork(created.path, untilEvent);
+  } catch (err) {
+    app.io.say(C.red(`  cannot fork: ${describeError(err)}`));
+    return;
+  }
+  const switched = await adoptLogDir(app, created.path);
+  if (!switched) return;
+  app.io.say(C.green(`  ${label} → ${created.id}`) + C.dim(`  ${created.path}`));
+}
+
+async function trustProject(app: App, target: "here" | "parent" | "never"): Promise<void> {
+  const C = app.io.palette;
+  const dir = target === "parent" ? dirname(app.workspace) : app.workspace;
+  const trusted = target !== "never";
+  await saveTrust(dir, trusted);
+  app.io.say(
+    C.green(`  ${trusted ? "trusted" : "will not trust"} ${dir}`) +
+      C.dim(`  saved in ${trustPath()}`),
+  );
+  app.io.say(
+    C.dim("  restart to load or skip .xeno/settings.json. Trust does not affect tool execution."),
+  );
+}
+
+async function nameSession(app: App, name: string, tui?: Tui): Promise<void> {
+  const C = app.io.palette;
+  if (name.length === 0) {
+    app.io.say(C.dim("  /name <name>"));
+    return;
+  }
+  // Name lives on the cursor. sessions.ts has no setter -- writeCursor is
+  // the store function that actually holds it, and it keeps a name across
+  // the loop's own cursor rewrites.
+  const cursor = await readCursor(app.logDir);
+  if (cursor === null) {
+    app.io.say(C.red("  no cursor to name yet"));
+    return;
+  }
+  await writeCursor(app.logDir, { ...cursor, name });
+  if (tui) tui.sessionName = name;
+  app.io.say(C.green(`  named ${name}`));
+}
+
+/** Runs a prompt. Returns false if the turn failed, having already said why. */
+async function run(app: App, prompt: string, signal?: AbortSignal, tui?: Tui): Promise<boolean> {
+  if (!app.credential.ok) {
+    // Must not call session.send: that records a user event before the
+    // request, and a refused prompt is not a turn.
+    const C = app.io.palette;
+    app.io.say(C.yellow("  no credential yet -- this prompt was not sent."));
+    app.io.say(C.dim("  export an API key, or /login <provider>.\n"));
+    return false;
+  }
+
+  const fresh = await ensureFreshCredential(
+    app.providerConfig.spec,
+    app.auth,
+    app.args.apiKey.length > 0 ? app.args.apiKey : undefined,
+    app.effects,
+    {
+      fetch: globalThis.fetch,
+      now: () => Date.now(),
+      persist: async (next) => {
+        const entry = next[app.providerConfig.spec.provider];
+        if (entry !== undefined) app.auth[app.providerConfig.spec.provider] = entry;
+        await writeAuthFile(app.auth);
+      },
+    },
+  );
+  if (!fresh.ok) {
+    const C = app.io.palette;
+    app.io.say(C.red(`  ${fresh.reason}`));
+    app.io.say(C.dim("  this prompt was not sent.\n"));
+    return false;
+  }
+  if (!app.credential.ok || fresh.key !== app.credential.key) {
+    app.credential = fresh;
+    app.session.provider = makeProvider(app, app.providerConfig, fresh.key);
+  }
+
+  const needsIndex = fileReferences(prompt).length > 0;
+  const index: FileIndex = needsIndex
+    ? await fileIndexFor(app)
+    : { paths: [], truncated: false };
+  const expanded = await expandInput(prompt, {
+    workspace: app.workspace,
+    index,
+    say: (text) => app.io.say(text),
+  });
+  if (!expanded.send) return true;
+  try {
+    await runTurn(app, expanded.message, signal, tui);
+    return true;
+  } catch (error) {
+    tui?.discardStream();
+    // The session survives. Everything up to this turn is on disk, the next
+    // prompt starts from it, and killing the process over one failed request
+    // would throw away work that is still perfectly good.
+    const C = app.io.palette;
+    app.io.say(C.red(`\n  request failed: ${describeError(error)}`));
+    app.io.say(C.dim("  nothing was lost -- the log is intact. Try again, or /usage.\n"));
+    return false;
+  }
+}
+
+export interface TurnSurface {
+  /** Interactive UI projects committed log events; stream-only consumers omit this. */
+  syncTranscript?(): Promise<void>;
+  pushDelta(kind: "text" | "thinking", text: string): void;
+  commitStream(): void;
+  discardStream(): void;
+  /** Tool/thinking events that stay in the live region until commit. */
+  pushEvent?(e: LoopEvent): void;
+  /**
+   * Called by send() at a pairable after_tools moment. Returns already
+   * expanded text, or null. Expansion happens here, not at enqueue —
+   * the model is editing files while the line waits.
+   */
+  pullQueued?(phase: Phase): Promise<string | null>;
+}
+
+export async function runTurn(
+  app: Pick<App, "session" | "io"> & { readonly ui?: App["ui"]; readonly args?: App["args"] },
+  prompt: string,
+  signal?: AbortSignal,
+  tui?: TurnSurface,
+): Promise<void> {
+  // A pipe cannot unwrite bytes. Non-tty / -p therefore does not stream:
+  // deltas and discard are ignored, and the final block prints once.
+  let live = false;
+  let skipFinal = false;
+  const json = app.args?.mode === "json";
+  const pull = tui?.pullQueued?.bind(tui);
+  for await (const e of app.session.send(prompt, signal, pull)) {
+    if (json) {
+      const payload = toJsonEvent(e, app.session.clock.now());
+      if (payload !== null) process.stdout.write(`${JSON.stringify(payload)}\n`);
+      continue;
+    }
+    if (tui?.syncTranscript) {
+      if (e.kind === "text_delta" || e.kind === "thinking_delta") {
+        tui.pushDelta(e.kind === "text_delta" ? "text" : "thinking", e.text ?? "");
+      } else {
+        if (e.kind === "discard") tui.discardStream();
+        await tui.syncTranscript();
+        if (["assistant_text", "thinking", "tool_call", "done", "cut"].includes(e.kind)) tui.commitStream();
+        if (e.kind === "snapshot_failed" || e.kind === "undeclared_change" || e.kind === "stop_and_ask") {
+          for (const line of formatEvent(e, app.io.palette, usableColumns(process.stdout.columns), {}, app.ui?.style)) app.io.say(line);
+        }
+      }
+      continue;
+    }
+    if (e.kind === "text_delta" || e.kind === "thinking_delta") {
+      if (tui !== undefined) {
+        live = true;
+        tui.pushDelta(e.kind === "thinking_delta" ? "thinking" : "text", e.text ?? "");
+      }
+      continue;
+    }
+    if (e.kind === "discard") {
+      live = false;
+      skipFinal = false;
+      tui?.discardStream();
+      continue;
+    }
+    // Per-round, not per-turn: a tool-using turn streams again after each
+    // tool_result. A latch that stays set would skip commitStream on later
+    // rounds and dropLive would then erase the only copy.
+    if (live && tui !== undefined) {
+      tui.commitStream();
+      live = false;
+      skipFinal = true;
+    }
+    if (skipFinal && (e.kind === "assistant_text" || e.kind === "thinking")) continue;
+    if (skipFinal && e.kind !== "usage") skipFinal = false;
+    if (
+      tui !== undefined &&
+      tui.pushEvent !== undefined &&
+      (e.kind === "tool_call" || e.kind === "tool_result" || e.kind === "thinking")
+    ) {
+      tui.pushEvent(e);
+      continue;
+    }
+    if (e.kind === "assistant_text" && app.io.answer !== undefined) {
+      app.io.answer(e.text ?? "");
+      continue;
+    }
+    for (const line of formatEvent(
+      e,
+      app.io.palette,
+      usableColumns(process.stdout.columns),
+      {},
+      app.ui?.style,
+    )) {
+      app.io.say(line);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// TUI
+// ---------------------------------------------------------------------------
+
+export class Tui {
+  readonly term: Terminal;
+  editor: Editor;
+  /** Not yet delivered. Retracting a line must leave no trace in `.xeno/`. */
+  queue: QueuedMessage[] = [];
+  select: SelectList | null = null;
+  settings: Settings | null = null;
+  tree: TreeList | null = null;
+  screen: TuiMainScreen;
+  private readonly chat: Container;
+  private noticeDir: string;
+  private readonly transcript = new Transcript();
+  private transcriptItems: TranscriptItem[] = [];
+  private historyNode = -1;
+  private historyDir = "";
+  private ancestors: LogEvent[] = [];
+  private historyLength = -1;
+  private liveMarkdown: MarkdownBlock | null = null;
+  private liveStyle: Style | null = null;
+  private readonly live: Container;
+  private readonly editorBox: Container;
+  private readonly footerBox: Container;
+  liveRows = 0;
+  abort: AbortController | null = null;
+  inflight = false;
+  awaitingKeyFor: string | null = null;
+  streamThinking = "";
+  streamText = "";
+  flushed = 0;
+  toolsExpanded = false;
+  thinkingExpanded = false;
+  sessionName: string | null;
+  private onPick: ((item: SelectItem) => Promise<void>) | null = null;
+  private onTreePick: ((node: TreeNode) => Promise<void>) | null = null;
+  /** Which selector Ctrl+S should persist. Other lists ignore Ctrl+S. */
+  private selectKind: "model" | "thinking" | "other" = "other";
+  private approvalResolve: ((choice: ApprovalChoice) => void) | null = null;
+  private inputs: string[] = [];
+  private wake: (() => void) | null = null;
+  private attached = false;
+  private lastInterrupt = 0;
+  private lastEscape = 0;
+  private pasting = false;
+  private turn: Promise<void> | null = null;
+  readonly app: App;
+  /** Read once: a git spawn on every keystroke would stall the live region. */
+  private readonly branch: string | null;
+
+  constructor(app: App, term?: Terminal) {
+    this.app = app;
+    this.historyDir = app.logDir;
+    this.noticeDir = app.logDir;
+    this.screen = createInteractiveTui(term);
+    this.term = this.screen.terminal;
+    this.editor = new Editor({ tui: this.screen });
+    this.editor.bindings = editorBindings((app.ui?.keymap ?? defaultKeymap()).byAction);
+    this.editor.setAutocompleteProvider(interactiveAutocomplete(app, async (refresh) => (await fileIndexFor(app, refresh)).paths));
+    this.editor.onInput = (data) => { this.inputs.push(data); this.wake?.(); };
+    this.chat = new Container();
+    this.live = new Container();
+    this.editorBox = new Container();
+    this.footerBox = new Container();
+    this.screen.addChild(this.transcript);
+    this.screen.addChild(this.chat);
+    this.transcriptItems = projectTranscript(app.session.state.events);
+    this.screen.addChild(this.live);
+    this.screen.addChild(this.editorBox);
+    this.screen.addChild(this.footerBox);
+    this.sessionName = app.args.sessionName || null;
+    // Before attach: a hung git must not freeze an already-captured tty.
+    this.branch = currentBranch(app.workspace);
+  }
+
+  get style(): Style {
+    return this.app.ui?.style ?? ANSI;
+  }
+
+  get signal(): AbortSignal | undefined {
+    return this.abort?.signal;
+  }
+
+  writeLine(line: string): void {
+    if (this.noticeDir !== this.app.logDir) { this.chat.clear(); this.noticeDir = this.app.logDir; }
+    this.chat.addChild(new PiText(line, 0, 0));
+    this.paint();
+  }
+
+  dropLive(): void {
+    this.live.clear();
+    this.liveRows = 0;
+  }
+
+  private markdownStyle(): Style {
+    return this.app.io.palette.bold("\0") === "\0" ? IDENTITY : this.style;
+  }
+
+  private clearStream(): void {
+    this.streamThinking = "";
+    this.streamText = "";
+    this.flushed = 0;
+  }
+
+  pushDelta(kind: "text" | "thinking", text: string): void {
+    if (kind === "thinking") this.streamThinking += text;
+    else this.streamText += text;
+    this.paintStream();
+  }
+
+  discardStream(): void {
+    this.clearStream();
+    this.dropLive();
+    if (this.inflight) this.paintStream();
+    else this.paint();
+  }
+
+  commitStream(): void {
+    // A stream is never durable history. syncTranscript replaces it from the log.
+    this.clearStream();
+    this.paint();
+  }
+
+  async syncTranscript(): Promise<void> {
+    const session = this.app.session;
+    const dir = this.app.logDir;
+    const node = session.state.node;
+    if (dir !== this.historyDir || node !== this.historyNode) {
+      const history = await readNodeHistory(dir, node);
+      if (!history.ok) {
+        this.chat.clear();
+        this.chat.addChild(new PiText("Cannot load complete session history: " + history.error, 0, 0));
+        this.paint();
+        return;
+      }
+      if (this.app.session !== session || this.app.logDir !== dir) return;
+      if (this.historyDir !== dir) {
+        if (this.noticeDir !== dir) this.chat.clear();
+        this.noticeDir = dir;
+        this.queue = [];
+        this.clearStream();
+        this.editor.applyExternal("");
+        this.sessionName = (await readCursor(dir))?.name ?? null;
+      }
+      this.ancestors = history.nodes.filter((entry) => entry.node !== node).flatMap((entry) => entry.events);
+      this.historyDir = dir;
+      this.historyNode = node;
+      this.historyLength = -1;
+    }
+    if (this.historyLength !== session.state.events.length) {
+      this.transcriptItems = projectTranscript([...this.ancestors, ...session.state.events]);
+      this.historyLength = session.state.events.length;
+    }
+    this.paint();
+  }
+
+  paintStream(): void {
+    this.rebuildLive();
+    this.rebuildChrome();
+    this.renderScreen();
+  }
+
+  paint(): void {
+    const colored = this.markdownStyle() !== IDENTITY;
+    this.editor.borderColor = thinkingBorderColor(this.app.providerConfig.effort, colored, this.style);
+    this.rebuildLive();
+    this.rebuildChrome();
+    this.renderScreen();
+  }
+
+  private renderScreen(): void {
+    this.transcript.update(this.transcriptItems, this.markdownStyle(), this.toolsExpanded, this.thinkingExpanded);
+    if (this.attached) this.screen.requestRender();
+    else this.screen.renderNow();
+  }
+
+  private rebuildLive(): void {
+    this.live.clear();
+    const style = this.markdownStyle();
+    if (this.streamThinking.length > 0) {
+      this.live.addChild(
+        new Lines((width) =>
+          renderToolView({ kind: "thinking", text: this.streamThinking }, this.thinkingExpanded, width, style),
+        ),
+      );
+    }
+    if (this.streamText.length > 0) {
+      if (this.liveStyle !== style || this.liveMarkdown === null) {
+        this.liveStyle = style;
+        this.liveMarkdown = new MarkdownBlock(this.streamText, style);
+      }
+      this.liveMarkdown.setText(this.streamText);
+      this.live.addChild(this.liveMarkdown);
+    }
+  }
+
+  private rebuildChrome(): void {
+    const inner = this.tree ?? this.select ?? this.settings ?? this.editor;
+    inner.setStyle(this.style);
+    inner.onInput = this.editor.onInput;
+    this.editorBox.clear();
+    this.editorBox.addChild(inner);
+    this.screen.setFocus(inner);
+    this.footerBox.clear();
+    this.footerBox.addChild(new Lines((width) => this.statusLines(width)));
+  }
+
+  private statusLines(width: number): string[] {
+    if (this.app.ui?.settings.statusBar === false) return [];
+    const attrs = { ...PLAIN_ATTRS, status: true };
+    return renderStatus(this.statusState(), width).map((line) => paint(line, attrs, this.style));
+  }
+
+  private statusState(): StatusState {
+    const s = this.app.session;
+    const budget = contextBudget({
+      frozen: s.config.frozen,
+      handoff: s.state.handoff,
+      events: s.state.events,
+      anchor: s.state.anchor,
+      atTurnBoundary: !this.inflight,
+      ...(s.config.counter ? { counter: s.config.counter } : {}),
+      ...(s.config.boundary ? { boundary: s.config.boundary } : {}),
+    });
+    const t = s.totals;
+    const cost = reportedCost(t, this.app.providerConfig.spec.price);
+    return {
+      cwd: this.app.workspace,
+      branch: this.branch,
+      tokens: budget.used,
+      triggerTokens: budget.trigger,
+      model: this.app.providerConfig.spec.id,
+      thinking: this.app.providerConfig.effort,
+      cut: budget.decision.cut,
+      reason: budget.decision.reason,
+      ...(this.sessionName ? { sessionName: this.sessionName } : {}),
+      home: homedir(),
+      inputTokens: t.input_tokens,
+      outputTokens: t.output_tokens,
+      cacheRead: t.cache_read_input_tokens,
+      cacheWrite: t.cache_creation_input_tokens,
+      ...(t.prompt_tokens > 0 ? { cacheHitRate: t.cache_hit_rate * 100 } : {}),
+      ...(cost.kind === "usd" ? { cost: cost.amount } : cost.kind === "partial" ? { cost: cost.known } : {}),
+      ...(this.queue.length > 0 ? { queued: this.queue.length } : {}),
+    };
+  }
+
+  openSettings(field?: string): void {
+    if (field !== undefined) { this.openSettingValues(field); return; }
+    const settings = this.app.ui?.settings;
+    this.settings = new Settings([
+      { id: "theme", label: "Theme", currentValue: settings?.theme ?? "dark", values: ["dark", "light"], description: "Apply the palette to the editor, menus and complete history." },
+      { id: "thinking", label: "Thinking", currentValue: this.app.providerConfig.effort, values: EFFORTS.filter((effort) => effortSupported(this.app.providerConfig.spec, effort)), description: "Reasoning effort for the next turn." },
+      { id: "statusBar", label: "Status bar", currentValue: settings?.statusBar === false ? "off" : "on", values: ["on", "off"], description: "Workspace, usage and distance to the next context boundary." },
+    ], this.style);
+    this.paint();
+  }
+
+  openLoginSelect(): void {
+    const providers = [...new Set(this.app.catalog.map((model) => model.provider))];
+    this.select = new SelectList([
+      ...SUBSCRIPTION_OPTIONS.map((option) => ({ value: option.id, label: option.id, description: option.label })),
+      ...providers.map((provider) => ({ value: provider, label: provider, description: "API key" })),
+    ], { style: this.style, title: "Login · choose a provider" });
+    this.onPick = async (item) => { await handleLine(this.app, "/login " + item.value, this); };
+    this.paint();
+  }
+
+  async openForkSelect(): Promise<void> {
+    const points = await this.app.session.restorePoints();
+    this.select = new SelectList(points.flatMap((point, i) => point.onPath ? [{ value: String(i + 1), label: firstLine(point.prompt, 120), description: "node " + point.node }] : []),
+      { style: this.style, title: "Fork · choose a completed exchange", emptyMessage: "No exchanges on this branch yet" });
+    this.onPick = async (item) => { await forkSession(this.app, item.value); await this.syncTranscript(); };
+    this.paint();
+  }
+
+  private openSettingValues(field: string): void {
+    const key = field.toLowerCase();
+    let items: SelectItem[] = [];
+    if (key === "theme") {
+      items = [
+        { value: "dark", label: "dark" },
+        { value: "light", label: "light" },
+      ];
+    } else if (key === "thinking") {
+      items = ["low", "medium", "high", "xhigh", "max"].map((v) => ({ value: v, label: v }));
+    } else if (key === "statusbar" || key === "status") {
+      items = [
+        { value: "on", label: "on" },
+        { value: "off", label: "off" },
+      ];
+    } else {
+      this.app.io.say(this.app.io.palette.yellow(`  unknown setting: ${field}`));
+      this.paint();
+      return;
+    }
+    this.select = new SelectList(items, { style: this.style, title: "Setting · " + field });
+    this.selectKind = "other";
+    this.onPick = async (item) => {
+      await commitSetting(this.app, key === "status" ? "statusBar" : field, item.value, this);
+    };
+    this.paint();
+  }
+
+  openModelSelect(): void {
+    const items: SelectItem[] = [];
+    for (const spec of this.app.catalog) {
+      const got = this.app.credentialOf(spec);
+      const here = spec.id === this.app.providerConfig.spec.id;
+      items.push({
+        value: spec.id,
+        label: spec.id,
+        description: `${spec.provider} · ${spec.name}${here ? "  ✓ current" : got.ok ? "  ready" : "  login required"}`,
+      });
+    }
+    this.select = new SelectList(items, { style: this.style, title: "Model", selectedValue: this.app.providerConfig.spec.id, hint: "↑↓ select · Enter apply · Ctrl+S save default · Esc cancel" });
+    this.selectKind = "model";
+    this.onPick = async (item) => {
+      const spec = this.app.catalog.find((m) => m.id === item.value);
+      if (spec !== undefined) await switchToModel(this.app, spec);
+    };
+    this.app.io.say(this.app.io.palette.dim("  switching cuts this node so the next model starts from a handoff"));
+    this.paint();
+  }
+
+  openThinkingSelect(): void {
+    const spec = this.app.providerConfig.spec;
+    const current = this.app.providerConfig.effort;
+    const items: SelectItem[] = EFFORTS.map((level) => {
+      const supported = effortSupported(spec, level);
+      const here = level === current;
+      return {
+        value: level,
+        label: level,
+        description: !supported ? "unsupported" : here ? "now" : "",
+      };
+    });
+    this.select = new SelectList(items, { style: this.style, title: "Thinking", selectedValue: current, hint: "↑↓ select · Enter apply · Ctrl+S save default · Esc cancel" });
+    this.selectKind = "thinking";
+    this.onPick = async (item) => {
+      const effort = asEffort(item.value);
+      if (effort === undefined) return;
+      applyThinking(this.app, effort, this);
+    };
+    this.paint();
+  }
+
+  private async saveSelectDefault(): Promise<void> {
+    if (this.select === null) return;
+    const item = this.select.state.items[this.select.state.selected];
+    if (item === undefined) return;
+    const C = this.app.io.palette;
+    if (this.selectKind === "model") {
+      // Patch only this key: dumping merged settings would freeze today's defaults.
+      await writeUserSettings({ defaultModel: item.value });
+      if (this.app.ui !== undefined) {
+        this.app.ui.userOverrides = { ...this.app.ui.userOverrides, defaultModel: item.value };
+        this.app.ui.settings = { ...this.app.ui.settings, defaultModel: item.value };
+      }
+      this.app.io.say(C.green(`  saved default model ${item.value}`));
+      return;
+    }
+    if (this.selectKind === "thinking") {
+      const effort = asEffort(item.value);
+      if (!effort || !effortSupported(this.app.providerConfig.spec, effort)) {
+        this.app.io.say(C.yellow("  Cannot save an unsupported thinking level."));
+        return;
+      }
+      await writeUserSettings({ defaultThinking: item.value });
+      if (this.app.ui !== undefined) {
+        this.app.ui.userOverrides = { ...this.app.ui.userOverrides, defaultThinking: item.value };
+        this.app.ui.settings = { ...this.app.ui.settings, defaultThinking: item.value };
+      }
+      this.app.io.say(C.green(`  saved default thinking ${item.value}`));
+    }
+  }
+
+  async openResumeSelect(): Promise<void> {
+    const { sessions, truncated } = await listSessions(this.app.workspace, sessionDirOf(this.app));
+    const note = truncationNote(truncated);
+    if (note) this.app.io.say(this.app.io.palette.yellow(`  ${note}`));
+    const ok = sessions.filter((s): s is Extract<ListedSession, { ok: true }> => s.ok);
+    if (ok.length === 0) {
+      this.app.io.say(this.app.io.palette.dim("  no sessions yet"));
+      return;
+    }
+    this.select = new SelectList(
+      ok.map((s) => ({
+        value: s.path,
+        label: s.name ?? s.id,
+        description: [s.model ?? "", s.updated_at ?? "", `${s.events} events`].filter((x) => x.length > 0).join("  "),
+      })),
+      { style: this.style, title: "Resume session", selectedValue: this.app.logDir },
+    );
+    this.selectKind = "other";
+    this.onPick = async (item) => {
+      await resumeSession(this.app, item.value, this);
+    };
+    this.paint();
+  }
+
+  /**
+   * Live-region tree. Selection is UI state; Enter calls Session.rewind
+   * rather than a second restore implementation. If a turn is in flight,
+   * the existing AbortSignal fires first — same path Escape already uses.
+   */
+  async openTreeSelect(): Promise<void> {
+    this.select = null;
+    this.onPick = null;
+    const points = await this.app.session.restorePoints();
+    const nodes = await treeNodesFor(this.app);
+    this.tree = new TreeList(nodes, { style: this.style });
+    this.onTreePick = async (node) => {
+      const point = points.find((p) => `${p.node}:${p.atEvent}` === (node.target ?? node.id));
+      if (point === undefined) return;
+      if (this.inflight) { await this.settle(); this.returnQueueToEditor(); }
+      const done = await this.app.session.rewind(point, "context");
+      await this.syncTranscript();
+      const C = this.app.io.palette;
+      if (!done.ok) {
+        this.app.io.say(C.red(`\n  could not go back: ${done.error}\n`));
+        return;
+      }
+      this.app.io.say(
+        C.green(`\n  back at node ${done.node}`) +
+          C.dim(`  ${done.restored.length} restored, ${done.removed.length} removed`),
+      );
+      if (done.note.length > 0) this.app.io.say(C.dim(`  ${done.note}`));
+      this.app.io.say("");
+    };
+    this.paint();
+  }
+
+  async nextInput(): Promise<string> {
+    while (this.inputs.length === 0) {
+      await new Promise<void>((resolve) => { this.wake = resolve; });
+      this.wake = null;
+    }
+    return this.inputs.shift()!;
+  }
+
+  attach(): void {
+    this.attached = true;
+    this.rebuildChrome();
+    this.screen.start();
+  }
+
+  detach(): void {
+    this.attached = false;
+    this.screen.stop();
+  }
+
+  async settle(): Promise<void> {
+    this.abort?.abort();
+    await this.turn;
+  }
+
+  ask(request: PermissionRequest): Promise<ApprovalChoice> {
+    return new Promise((resolve) => {
+      this.app.io.say(approvalHeading(request));
+      this.select = new SelectList(approvalItems(request), { style: this.style, title: "Tool approval", search: false });
+      this.approvalResolve = resolve;
+      this.onPick = async (item) => {
+        resolve(choiceFromValue(item.value));
+      };
+      this.paint();
+    });
+  }
+
+  private boundAction(data: string): ActionId | undefined {
+    return Object.entries((this.app.ui?.keymap ?? defaultKeymap()).byKey)
+      .find(([chord]) => keyMatches(data, chord))?.[1];
+  }
+
+  private async openExternalEditor(): Promise<void> {
+    const attached = this.attached;
+    if (attached) this.screen.stop();
+    if (attached && process.stdin.isTTY) process.stdin.setRawMode(false);
+    try {
+      const result = await editInExternalEditor({ content: this.editor.state.text, command: resolveEditorCommand() });
+      if (result.ok) this.editor.applyExternal(result.content);
+      else this.app.io.say(result.message);
+    } finally {
+      if (attached) this.screen.start();
+      this.paint();
+    }
+  }
+
+  /** Programmatic compatibility; live stdin always enters as Pi raw input. */
+  async applyKey(key: Key): Promise<"continue" | "quit"> { return this.applyInput(encodeKey(key)); }
+
+  async applyInput(data: string): Promise<"continue" | "quit"> {
+    const action = this.boundAction(data);
+    // Modal ownership precedes application shortcuts, including during a turn.
+    if (this.settings) {
+      for (const change of this.settings.acceptInput(data)) await commitSetting(this.app, change.id, change.value, this);
+      if (this.settings.cancelled) this.settings = null;
+      this.paint();
+      return "continue";
+    }
+    if (this.tree) {
+      const state = this.tree.acceptInput(data);
+      if (state.cancelled || state.confirmed) {
+        const pick = this.onTreePick;
+        this.tree = null;
+        this.onTreePick = null;
+        if (state.confirmed && pick) await pick(state.confirmed);
+      }
+      this.paint();
+      return "continue";
+    }
+    if (this.select) {
+      if (action === "app.saveDefault" && !this.approvalResolve) await this.saveSelectDefault();
+      else {
+        const state = this.select.acceptInput(data);
+        if (state.cancelled || state.confirmed) {
+          const pick = this.onPick, approval = this.approvalResolve;
+          this.select = null;
+          this.onPick = null;
+          this.approvalResolve = null;
+          this.selectKind = "other";
+          if (state.confirmed && pick) { await pick(state.confirmed); await this.syncTranscript(); }
+          else approval?.("deny");
+        }
+      }
+      this.paint();
+      return "continue";
+    }
+    if (data.includes("\x1b[200~")) this.pasting = true;
+    if (this.pasting) {
+      this.editor.acceptInput(data);
+      if (data.includes("\x1b[201~")) this.pasting = false;
+      this.paint();
+      return "continue";
+    }
+    if (this.editor.autocompleteVisible && (keyMatches(data, "escape") || keyMatches(data, "up") || keyMatches(data, "down") || keyMatches(data, "tab"))) {
+      this.editor.acceptInput(data);
+      this.paint();
+      return "continue";
+    }
+    if (action === "app.exit" || keyMatches(data, "ctrl+c")) {
+      if (this.inflight) { this.abort?.abort(); this.returnQueueToEditor(); }
+      else if (this.editor.state.text.length > 0) this.editor.applyExternal("");
+      else if (Date.now() - this.lastInterrupt < 1000) return "quit";
+      else this.app.io.say("  Press Ctrl+C again to exit, or Ctrl+D on an empty prompt.");
+      this.lastInterrupt = Date.now();
+      this.paint();
+      return "continue";
+    }
+    if (keyMatches(data, "ctrl+d") && this.editor.state.text.length === 0) return "quit";
+    if (action === "app.interrupt") {
+      if (this.awaitingKeyFor !== null) {
+        if (this.awaitingKeyFor === OAUTH_PASTE) await cancelPendingOAuth();
+        this.awaitingKeyFor = null;
+        this.editor.setSecret(false);
+      } else if (this.inflight) { this.abort?.abort(); this.returnQueueToEditor(); }
+      else if (this.editor.state.text.length === 0 && Date.now() - this.lastEscape < 500) await this.openTreeSelect();
+      this.lastEscape = Date.now();
+      this.paint();
+      return "continue";
+    }
+    if (action === "app.message.dequeue") { this.recallLast(); this.paint(); return "continue"; }
+    if (action === "app.toggleTools") { this.toolsExpanded = !this.toolsExpanded; this.paint(); return "continue"; }
+    if (action === "app.toggleThinking") { this.thinkingExpanded = !this.thinkingExpanded; this.paint(); return "continue"; }
+    if (action === "app.externalEditor") { await this.openExternalEditor(); return "continue"; }
+    if (!this.inflight) {
+      if (action === "app.model") { this.openModelSelect(); return "continue"; }
+      if (action === "app.cycleModel" || action === "app.cycleModelReverse") {
+        await cycleScopedModel(this.app, action === "app.cycleModel" ? 1 : -1); this.paint(); return "continue";
+      }
+      if (action === "app.cycleThinking") { cycleThinking(this.app, this); return "continue"; }
+    }
+    if (this.inflight && action === "app.message.followUp") {
+      const text = this.editor.state.text;
+      this.editor.applyExternal("");
+      return this.submitLine(text, "followup");
+    }
+    const state = this.editor.acceptInput(data);
+    if (state.submitted !== null) return this.submitLine(state.submitted, "steering");
+    this.paint();
+    return "continue";
+  }
+
+  private async submitLine(text: string, queueKind: QueueKind): Promise<"continue" | "quit"> {
+    const line = text.trim();
+    this.paint();
+    if (this.awaitingKeyFor !== null) {
+      await handleLine(this.app, line, this);
+      return "continue";
+    }
+    if (!line) return "continue";
+    const command = parseLine(this.app, line);
+    if (command.kind !== "prompt") {
+      if (this.inflight && commandDefinition(line)?.busy === "idle") {
+        this.app.io.say("  This command needs an idle session. Press Esc to interrupt the current turn first.");
+        this.editor.applyExternal(line);
+        return "continue";
+      }
+      const result = await handleLine(this.app, line, this);
+      await this.syncTranscript();
+      this.paint();
+      return result === "quit" ? "quit" : "continue";
+    }
+    if (this.inflight) this.enqueue({ kind: queueKind, text: command.text });
+    else this.turn = this.runPromptTurn(command.text).catch((error: unknown) => {
+      this.app.io.say(this.app.io.palette.red(describeError(error)));
+    });
+    this.paint();
+    return "continue";
+  }
+
+  private async runPromptTurn(text: string): Promise<void> {
+    this.abort = new AbortController();
+    this.inflight = true;
+    try {
+      await run(this.app, text, this.abort.signal, this);
+      if (!this.abort.signal.aborted) await this.drainFollowUps();
+      this.app.io.say("");
+    } finally {
+      await this.syncTranscript();
+      this.commitStream();
+      this.abort = null;
+      fileIndexes.delete(this.app.workspace);
+      this.inflight = false;
+      this.clearStream();
+      this.paint();
+    }
+  }
+
+  /**
+   * send() calls this at after_tools. Expansion is here because the
+   * files the user named may have changed while the line waited.
+   */
+  async pullQueued(phase: Phase): Promise<string | null> {
+    const item = nextDelivery(this.queue, phase);
+    if (item === null) return null;
+    this.queue = this.queue.filter((m) => m !== item);
+    this.paintStream();
+    return this.expandQueued(item.text);
+  }
+
+  private async expandQueued(text: string): Promise<string | null> {
+    const needsIndex = fileReferences(text).length > 0;
+    const index: FileIndex = needsIndex
+      ? await fileIndexFor(this.app)
+      : { paths: [], truncated: false };
+    const expanded = await expandInput(text, {
+      workspace: this.app.workspace,
+      index,
+      say: (line) => this.app.io.say(line),
+    });
+    return expanded.send ? expanded.message : null;
+  }
+
+  private async drainFollowUps(): Promise<void> {
+    while (this.abort !== null && !this.abort.signal.aborted) {
+      const item = nextDelivery(this.queue, "turn_end");
+      if (item === null) break;
+      this.queue = this.queue.filter((m) => m !== item);
+      this.paintStream();
+      await run(this.app, item.text, this.abort.signal, this);
+    }
+  }
+
+  private enqueue(item: QueuedMessage): void {
+    this.queue.push(item);
+  }
+
+  private recallLast(): void {
+    const last = this.queue.pop();
+    if (last === undefined) return;
+    const draft = this.editor.state.text;
+    const text = draft.length > 0 ? `${last.text}\n${draft}` : last.text;
+    this.editor.applyExternal(text);
+  }
+
+  private returnQueueToEditor(): void {
+    if (this.queue.length === 0) return;
+    const draft = this.editor.state.text;
+    const parts = this.queue.map((m) => m.text);
+    if (draft.trim().length > 0) parts.push(draft);
+    this.queue = [];
+    this.editor.applyExternal(parts.join("\n"));
+  }
+}