@visual-z/xeno 0.8.1 → 0.8.3

package/src/store/search.ts

@@ -18,9 +18,12 @@ import { lstat, readdir, readFile } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
 import { Worker } from "node:worker_threads";
 import { assertNever } from "../core/exhaustive.ts";
+import { jsPatternFromRipgrep } from "../core/regex-dialect.ts";
 import { buildFileIndex, gitIgnored } from "./file-index.ts";
 import { DEFAULT_IGNORE } from "./workspace.ts";
 import { blobAddress } from "./blobs.ts";
+import { configDir } from "./config.ts";
+import { findRipgrep } from "./tool-binaries.ts";
 import { previewSearchObservation, type SearchObservation } from "../core/search-observation.ts";
 import { failureDiagnostic, failureFromError, READ_ATTEMPTED, NOT_STARTED } from "../core/tool-failure.ts";
 import type { ToolDiagnostic } from "../core/tool-contract.ts";
@@ -459,7 +462,7 @@ function rgText(value: Record<string, unknown>): string {
 }
 
 async function grepRipgrep(opts: GrepOpts, abs: string, limit: number): Promise<SearchResult | null> {
-  const rg = findOnPath("rg");
+  const rg = findRipgrep(configDir());
   if (rg === null) return null;
   const args = [
     "--json",
@@ -491,8 +494,9 @@ function compareMatch(a: MatchLine, b: MatchLine): number {
 }
 
 async function grepWalk(opts: GrepOpts, abs: string, kind: "file" | "dir", rel: string, limit: number): Promise<SearchResult> {
+  const pattern = jsPatternFromRipgrep(opts.pattern);
   try {
-    new RegExp(opts.pattern);
+    new RegExp(pattern);
   } catch (err) {
     return searchFailure("invalid_input", `invalid regex: ${(err as Error).message}`);
   }
@@ -538,7 +542,7 @@ async function grepWalk(opts: GrepOpts, abs: string, kind: "file" | "dir", rel:
       // Reserve the worst-case formatted hits before matching, never discard already observed hits.
       const reservation = Buffer.byteLength(text) + lines.length * (Buffer.byteLength(fileRel) + String(MAX_FILE_BYTES).length + 3);
       if (capturedBytes + reservation > budget) { reasons.push({ code: "capture_budget", path: fileRel }); break; }
-      const matched = await matcher.match(opts.pattern, "", lines, deadline - performance.now(), opts.signal);
+      const matched = await matcher.match(pattern, "", lines, deadline - performance.now(), opts.signal);
       if (matched === "cancelled") { reasons.push({ code: "cancelled", path: fileRel }); break; }
       if (matched === "timeout") {
         reasons.push({ code: "match_timeout", path: fileRel });
@@ -580,11 +584,11 @@ export async function grep(opts: GrepOpts): Promise<SearchResult> {
       return grepWalk(opts, opts.path, target.kind, target.rel, limit);
     case "ripgrep": {
       const got = await grepRipgrep(opts, opts.path, limit);
-      if (got === null) return searchFailure("environment_missing", "ripgrep is not on PATH");
+      if (got === null) return searchFailure("environment_missing", "ripgrep is not on PATH or in xeno's bin directory");
       return got;
     }
     case "auto": {
-      if (findOnPath("rg") !== null) {
+      if (findRipgrep(configDir()) !== null) {
         const got = await grepRipgrep(opts, opts.path, limit);
         if (got !== null) return got;
       }

package/src/store/secrets.ts

@@ -0,0 +1,44 @@
+/**
+ * The per-session vault behind `[[xeno-secret-N]]` placeholders (S.9).
+ *
+ * A separate append-only file, never a log event: projections, handoffs,
+ * exports and history pages read the log, so a value kept here cannot reach a
+ * model request or a shared transcript. 0600 like every session file. It is
+ * read back at start so a placeholder written by an earlier run still expands
+ * after a restart.
+ */
+import { copyFile, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { durableAppend } from "./atomic.ts";
+import type { SecretEntry } from "../core/secrets.ts";
+
+export const SECRETS_FILE = "secrets.jsonl";
+
+export async function readVault(dir: string): Promise<SecretEntry[]> {
+  let text: string;
+  try { text = await readFile(join(dir, SECRETS_FILE), "utf8"); }
+  catch (error) { if ((error as { code?: string }).code === "ENOENT") return []; throw error; }
+  const entries: SecretEntry[] = [];
+  for (const line of text.split("\n")) {
+    if (!line) continue;
+    // A torn final line from a crash loses that one entry; its placeholder then
+    // stays literal rather than expanding to something else.
+    try {
+      const value = JSON.parse(line) as Partial<SecretEntry>;
+      if (Number.isSafeInteger(value.n) && typeof value.value === "string" && typeof value.rule === "string" &&
+        !entries.some(entry => entry.n === value.n)) entries.push({ n: value.n!, value: value.value, rule: value.rule });
+    } catch { /* see above */ }
+  }
+  return entries;
+}
+
+export async function appendVault(dir: string, entries: readonly SecretEntry[]): Promise<void> {
+  if (entries.length === 0) return;
+  await durableAppend(join(dir, SECRETS_FILE), entries.map(entry => JSON.stringify(entry) + "\n").join(""));
+}
+
+/** A fork's log carries the parent's placeholders, so it needs their values. */
+export async function copyVault(from: string, to: string): Promise<void> {
+  try { await copyFile(join(from, SECRETS_FILE), join(to, SECRETS_FILE)); }
+  catch (error) { if ((error as { code?: string }).code !== "ENOENT") throw error; }
+}

package/src/store/sessions.ts

@@ -35,6 +35,7 @@ import {
   readCursor,
   readCursorAt,
   readNode,
+  forkedAt,
   writeCursor,
   setParentSession,
   type Manifest,
@@ -44,6 +45,7 @@ import { replayContext } from "./replay.ts";
 import { recoverCut } from "./recovery.ts";
 import { planSessionEntry, type SessionEntryFlags } from "../core/session-entry.ts";
 import { assertNever } from "../core/exhaustive.ts";
+import type { LogEvent } from "../core/events.ts";
 import { resolveHistoryPosition } from "./session-position.ts";
 import { importSessionArchive } from "./session-archive.ts";
 
@@ -86,6 +88,10 @@ export type ListedSession =
       workspace?: string;
       parent_session?: string;
       text?: string;
+      /** Details only: whether any node holds a user event (fix-skip-empty-sessions). */
+      conversation?: boolean;
+      /** Details only, forks only: when the copy was made (fix-fork-start-time). */
+      forked_at?: string;
     }
   | {
       ok: false;
@@ -370,8 +376,7 @@ export async function resolveLogDir(
       return { logDir: created.path, created: true };
     }
     case "continue": {
-      const { sessions } = await listSessions(workspace, opts.sessionDir, Infinity);
-      const newest = sessions.find((s) => s.ok);
+      const newest = await newestConversation(workspace, opts.sessionDir);
       if (newest !== undefined) return { logDir: newest.path, created: false };
       break;
     }
@@ -399,7 +404,8 @@ export async function readListed(id: string, path: string, details?: { workspace
     if ((err as { code?: string }).code === "ENOENT") {
       return {
         ok: true, id, path,
-        name: null, model: null, node: null, events: 0, updated_at: null, ...(details ? { workspace: details.workspace } : {}),
+        name: null, model: null, node: null, events: 0, updated_at: null,
+        ...(details ? { workspace: details.workspace, conversation: await hasConversation(path) } : {}),
       };
     }
     return { ok: false, id, path, error: `${path} could not be read: ${(err as Error).message}` };
@@ -414,7 +420,8 @@ export async function readListed(id: string, path: string, details?: { workspace
   if (cursor === undefined) {
     return {
       ok: true, id, path,
-      name: null, model: null, node: null, events: 0, updated_at: null, ...(details ? { workspace: details.workspace } : {}),
+      name: null, model: null, node: null, events: 0, updated_at: null,
+      ...(details ? { workspace: details.workspace, conversation: await hasConversation(path) } : {}),
     };
   }
 
@@ -423,15 +430,18 @@ export async function readListed(id: string, path: string, details?: { workspace
   // bad tree is the same shape as a list that throws for one bad file.
   const events = (await readNode(path, cursor.node)).events.length;
   const text: string[] = [];
+  let conversation = false;
   if (details) for (const node of await listNodes(path)) {
     if (details.signal?.aborted) break;
     const read = await readNode(path, node);
     if (read.corrupt.length) throw new Error(`${path} has corrupt events`);
     for (const event of read.events) {
+      if (userActivity(event)) conversation = true;
       if (event.t === "user") text.push(event.text);
       else if (event.t === "assistant") for (const block of event.blocks) if (block.type === "text") text.push(block.text);
     }
   }
+  const forked = details ? await forkedAt(path) : null;
   return {
     ok: true,
     id,
@@ -441,11 +451,44 @@ export async function readListed(id: string, path: string, details?: { workspace
     node: cursor.node,
     events,
     updated_at: cursor.updated_at,
-    ...(details ? { workspace: cursor.workspace ?? details.workspace, text: text.join("\n"),
-      ...(manifest.parent_session ? { parent_session: manifest.parent_session } : {}) } : {}),
+    ...(details ? { workspace: cursor.workspace ?? details.workspace, text: text.join("\n"), conversation,
+      ...(manifest.parent_session ? { parent_session: manifest.parent_session } : {}),
+      ...(forked === null ? {} : { forked_at: forked }) } : {}),
   };
 }
 
+/**
+ * A session the user opened and left without a word still has a header,
+ * cursor and manifest: Session.start writes them before the first message.
+ * Pi avoids such files by not persisting until a message exists; xeno keeps
+ * its write order and filters on read instead, like Codex's resume picker,
+ * so -c and the pickers land on a conversation (fix-skip-empty-sessions).
+ * A shell command the user ran counts: it is their activity, not setup.
+ */
+function userActivity(event: LogEvent): boolean {
+  return event.t === "user" || event.t === "user_bash";
+}
+
+/**
+ * Stops at the first node holding user activity, so a real session costs one
+ * node read. An unreadable node counts as activity: hiding a session we
+ * cannot judge would silently skip it, while opening it reports the error.
+ */
+export async function hasConversation(path: string): Promise<boolean> {
+  for (const node of await listNodes(path)) {
+    try { if ((await readNode(path, node)).events.some(userActivity)) return true; }
+    catch { return true; }
+  }
+  return false;
+}
+
+/** What -c continues: the newest readable session the user actually spoke in. */
+export async function newestConversation(workspace: string, sessionDir?: string): Promise<Extract<ListedSession, { ok: true }> | undefined> {
+  const { sessions } = await listSessions(workspace, sessionDir, Infinity);
+  for (const session of sessions) if (session.ok && await hasConversation(session.path)) return session;
+  return undefined;
+}
+
 function byRecordedTime(a: ListedSession, b: ListedSession): number {
   const ta = a.ok ? a.updated_at : null;
   const tb = b.ok ? b.updated_at : null;

package/src/store/tool-binaries.ts

@@ -0,0 +1,90 @@
+/**
+ * xeno's own copy of ripgrep, for machines that have none.
+ *
+ * Where it lives: `<configDir>/bin`, next to settings and auth, so one
+ * install serves every workspace. Who sees it: the grep tool (after PATH)
+ * and shell commands, whose PATH gets the directory appended -- appended so a
+ * user who later installs rg keeps theirs (core/command-contract.ts).
+ *
+ * The network fetch is injected: store owns the filesystem, the caller owns
+ * the request (as runtime/update-check.ts does for the registry).
+ */
+import { existsSync } from "node:fs";
+import { chmod, lstat, mkdir, mkdtemp, rename, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { ripgrepAsset, type RipgrepAsset } from "../core/ripgrep-release.ts";
+
+export function xenoBinDir(configDir: string): string {
+  return join(configDir, "bin");
+}
+
+function onPath(name: string, pathEnv: string): string | null {
+  for (const dir of pathEnv.split(process.platform === "win32" ? ";" : ":")) {
+    if (dir.length === 0) continue;
+    const candidate = join(dir, name);
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/** The user's rg first, then xeno's; null when neither exists. */
+export function findRipgrep(configDir: string, pathEnv = process.env["PATH"] ?? ""): string | null {
+  const own = join(xenoBinDir(configDir), "rg");
+  return onPath("rg", pathEnv) ?? (existsSync(own) ? own : null);
+}
+
+export type ProvisionResult =
+  | { ok: true; path: string; installed: boolean }
+  | { ok: false; error: string };
+
+export interface ProvisionOptions {
+  configDir: string;
+  fetchBytes: (url: string, signal?: AbortSignal) => Promise<Uint8Array>;
+  /** Defaults to the user's PATH; injected so tests are not decided by the machine. */
+  path?: string;
+  /** Defaults to the pinned build for this platform. */
+  asset?: RipgrepAsset | null;
+  signal?: AbortSignal;
+}
+
+/**
+ * Installs the pinned ripgrep unless one is already reachable.
+ *
+ * Nothing becomes visible until it is proven: the archive is hashed before
+ * extraction, only the one member is extracted, and the executable reaches
+ * `bin/rg` by rename, so a crash or a mismatch never leaves a partial or
+ * unverified binary where the shell would find it.
+ */
+export async function provisionRipgrep(options: ProvisionOptions): Promise<ProvisionResult> {
+  const existing = findRipgrep(options.configDir, options.path);
+  if (existing !== null) return { ok: true, path: existing, installed: false };
+  const asset = options.asset === undefined ? ripgrepAsset(process.platform, process.arch) : options.asset;
+  if (asset === null) return { ok: false, error: `no pinned ripgrep build for ${process.platform} ${process.arch}` };
+
+  const bin = xenoBinDir(options.configDir);
+  await mkdir(bin, { recursive: true });
+  // Inside bin, so the final rename stays on one filesystem and is atomic.
+  const stage = await mkdtemp(join(bin, ".rg-install-"));
+  try {
+    const bytes = await options.fetchBytes(asset.url, options.signal);
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (digest !== asset.sha256) return { ok: false, error: `ripgrep archive sha256 ${digest} does not match pinned ${asset.sha256}` };
+    const archive = join(stage, "rg.tar.gz");
+    await writeFile(archive, bytes);
+    const extracted = Bun.spawnSync(["tar", "-xzf", archive, "-C", stage, asset.member], { stdout: "ignore", stderr: "pipe" });
+    if (extracted.exitCode !== 0) return { ok: false, error: `cannot extract ripgrep: ${extracted.stderr.toString().trim()}` };
+    const executable = join(stage, asset.member);
+    // The digest pins the archive, but chmod and rename follow what tar
+    // wrote; a member that is not a plain file is refused before either.
+    if (!(await lstat(executable)).isFile()) return { ok: false, error: "ripgrep archive member is not a regular file" };
+    await chmod(executable, 0o755);
+    const target = join(bin, "rg");
+    await rename(executable, target);
+    return { ok: true, path: target, installed: true };
+  } catch (error) {
+    return { ok: false, error: `cannot install ripgrep: ${error instanceof Error ? error.message : String(error)}` };
+  } finally {
+    await rm(stage, { recursive: true, force: true });
+  }
+}

package/src/store/worktree.ts

@@ -20,8 +20,10 @@
  *   is for cooperative branches, not adversarial ones.
  */
 
-import { mkdtemp, rm, realpath } from "node:fs/promises";
-import { join } from "node:path";
+import { mkdir, mkdtemp, rm, realpath } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { basename, join } from "node:path";
 import { tmpdir } from "node:os";
 
 /** Branch prefix, so a stale worktree is identifiable months later. */
@@ -37,6 +39,37 @@ export type CreateResult =
   | { ok: true; path: string; branch: string; snapshot: { head: string; tree: string } }
   | { ok: false; error: string };
 
+export interface CreateOptions {
+  /**
+   * Where the checkout goes. Default: a fresh temp directory, which suits a
+   * writing branch that lives for one subtask. A model-entered worktree is
+   * kept across sessions, so it names a stable parent and its own leaf.
+   */
+  location?: { parent: string; leaf: string };
+  /** Carry the parent's uncommitted files (default, as a branch needs). */
+  includeChanges?: boolean;
+}
+
+/**
+ * The stable home of model-entered worktrees for one repository.
+ *
+ * Under xeno's config directory rather than the project: inside `.xeno` it
+ * would collide with the rule that session state is never edited, and a
+ * sibling directory leaves xeno's checkouts in the user's project tree (Codex
+ * keeps its worktrees under its own home for the same reason). The digest of
+ * the repository path keeps two clones with the same name apart.
+ */
+export function persistentWorktreeParent(configDir: string, repo: string): string {
+  const digest = createHash("sha256").update(repo).digest("hex").slice(0, 8);
+  return join(configDir, "worktrees", `${basename(repo)}-${digest}`);
+}
+
+/** The repository's main checkout: `git worktree list` always lists it first. */
+export async function mainWorktree(dir: string): Promise<string | null> {
+  const listed = await listWorktrees(dir).catch(() => []);
+  return listed[0]?.path ?? null;
+}
+
 export type RemoveResult =
   | { ok: true }
   | { ok: false; error: string; dirty: boolean };
@@ -61,7 +94,7 @@ export async function isGitRepo(dir: string): Promise<boolean> {
   return git(dir, ["rev-parse", "--git-dir"]).code === 0;
 }
 
-export async function createWorktree(repo: string, name: string): Promise<CreateResult> {
+export async function createWorktree(repo: string, name: string, options: CreateOptions = {}): Promise<CreateResult> {
   // Refused rather than degraded. Falling back to the shared directory is the
   // exact failure isolation exists to prevent: parallel writing branches
   // would overwrite each other with nothing to indicate isolation was never
@@ -107,13 +140,24 @@ export async function createWorktree(repo: string, name: string): Promise<Create
   } finally { await rm(scratch, { recursive: true, force: true }); }
 
   const branch = `${WORKTREE_BRANCH_PREFIX}${name}`;
-  const created = await mkdtemp(join(tmpdir(), `xeno-wt-${name}-`));
-  // Resolved through symlinks, because git reports the real path and a
-  // caller comparing the two would never match. On macOS /var is a symlink
-  // to /private/var, so every temp path differs by default.
-  const path = await realpath(created);
-  // mkdtemp created it; git worktree add needs the path not to exist.
-  await rm(path, { recursive: true, force: true });
+  if (git(repo, ["rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]).code === 0) {
+    return { ok: false, error: `branch ${branch} already exists; choose another name or work in its existing checkout` };
+  }
+  let path: string;
+  if (options.location) {
+    await mkdir(options.location.parent, { recursive: true });
+    // Resolved for the same reason as the temp path below.
+    path = join(await realpath(options.location.parent), options.location.leaf);
+    if (existsSync(path)) return { ok: false, error: `${path} already exists; choose another name` };
+  } else {
+    const created = await mkdtemp(join(tmpdir(), `xeno-wt-${name}-`));
+    // Resolved through symlinks, because git reports the real path and a
+    // caller comparing the two would never match. On macOS /var is a symlink
+    // to /private/var, so every temp path differs by default.
+    path = await realpath(created);
+    // mkdtemp created it; git worktree add needs the path not to exist.
+    await rm(path, { recursive: true, force: true });
+  }
 
   // --lock in the same call: locking afterwards leaves a window in which a
   // concurrent prune can remove the worktree that was just created.
@@ -121,6 +165,7 @@ export async function createWorktree(repo: string, name: string): Promise<Create
   if (add.code !== 0) {
     return { ok: false, error: `git worktree add failed: ${add.stderr.trim()}` };
   }
+  if (options.includeChanges === false) return { ok: true, path, branch, snapshot: { head: head.stdout.trim(), tree: git(path, ["rev-parse", "HEAD^{tree}"]).stdout.trim() } };
   // Only this freshly created disposable checkout is reset. The child index
   // carries the parent's uncommitted input, so normal diff/inspection still sees it.
   const hydrate = git(path, ["read-tree", "--reset", "-u", tree]);

package/src/tui/ui/image-size.ts

@@ -26,9 +26,13 @@ export function imageCells(pixels: { readonly width: number; readonly height: nu
   return { cols: Math.max(1, Math.min(capCols, cols)), rows: Math.max(1, Math.min(capRows, rows)) };
 }
 
-/** Rows for pictures in the transcript: a quarter of the terminal, 4–12. Assumed, between OpenCode (≤8) and Grok (≤20). */
+/**
+ * Rows for pictures in the transcript: half the terminal, 4–20 (feat-tui-image-full-size).
+ * A quarter left a screenshot's text unreadable; 20 is Grok's ceiling, past which one picture
+ * pushes the conversation off screen. Assumed, not measured. Full size is a click away.
+ */
 export function transcriptImageRows(terminalRows: number): number {
-  return Math.max(4, Math.min(12, Math.floor(terminalRows / 4)));
+  return Math.max(4, Math.min(20, Math.floor(terminalRows / 2)));
 }
 
 /** Rows for the attachment strip above the input box: a sixth of the terminal, 3–6. Assumed. */

package/src/tui/ui/items.ts

@@ -8,7 +8,9 @@
 export type ToolStatus = "pending" | "ok" | "error";
 
 /** A picture the view may draw: its blob address, name and pixel size (from the log's ImageRef). */
-export interface ImageView { readonly sha256: string; readonly name: string; readonly width: number; readonly height: number }
+export interface ImageView { readonly sha256: string; readonly name: string; readonly width: number; readonly height: number;
+  /** The blob a click opens when it differs from `sha256`: what was attached, before any reduction for the model. */
+  readonly full?: string }
 
 export type ViewItem =
   | { readonly kind: "user"; readonly id: string; readonly rev: string; readonly text: string; readonly images?: readonly ImageView[]; readonly interrupted?: boolean }

package/src/tui/ui/pictures.ts

@@ -8,6 +8,10 @@
  * pictures are off, or the terminal can only draw block characters, the
  * row is a single muted line: `▣ shot.png · 1280×720   +2 more`.
  *
+ * A click on a drawn picture asks the source to open its full-size original
+ * (docs/tasks/feat-tui-image-full-size.md): a thumbnail cannot show a
+ * screenshot's text, the system viewer can.
+ *
  * The view never reads a file: the app's source loads and verifies bytes.
  */
 import { BoxRenderable, ImageRenderable, type CliRenderer, type ImageRenderProtocol, type NativeImage } from "@opentui/core";
@@ -28,6 +32,8 @@ export interface PictureSource {
   readonly reason?: string;
   /** The decoded picture for a blob, shared by every node that shows it, or its preparation failure. */
   load(sha256: string): Promise<PictureLoad>;
+  /** Show a blob at full size outside the terminal; absent where nothing can (tests, print mode). */
+  open?(sha256: string): void;
 }
 
 export type PictureLoad = { readonly kind: "ready"; readonly image: NativeImage } |
@@ -72,7 +78,7 @@ export class Pictures extends BoxRenderable {
         const size = imageCells(image, Math.min(each, source.widthCells), options.maxRows, source.cell);
         const picture = new ImageRenderable(ctx, { id: `${id}-${image.sha256.slice(0, 8)}-${serial++}`, width: size.cols, height: size.rows,
           fit: "fit", protocol: source.protocol, flexShrink: 0,
-          onLoad: () => { states[index] = "decoded"; if (!caption.isDestroyed) paintCaption(); },
+          onLoad: () => { states[index] = source.open ? "click to open" : "decoded"; if (!caption.isDestroyed) paintCaption(); },
           onError: () => { states[index] = "preview failed: decode"; picture.visible = false; if (!caption.isDestroyed) paintCaption(); } });
         void source.load(image.sha256).then(result => {
           if (picture.isDestroyed) return;
@@ -82,6 +88,13 @@ export class Pictures extends BoxRenderable {
           if (picture.isDestroyed) return;
           picture.visible = false; states[index] = "preview failed: decode"; paintCaption();
         });
+        const open = source.open;
+        if (open) {
+          // Same rule as a tool card's head: press and release on one cell is a click; anything else is a selection.
+          let down: { x: number; y: number } | undefined;
+          picture.onMouseDown = event => { down = { x: event.x, y: event.y }; };
+          picture.onMouseUp = event => { if (down && down.x === event.x && down.y === event.y && picture.image) open(image.full ?? image.sha256); down = undefined; };
+        }
         pictures.push(picture);
         row.add(picture);
       }

package/src/tui/ui/screen.ts

@@ -31,7 +31,7 @@ import { screenLayout, sidebarContentWidth, type ScreenLayout } from "./layout.t
 import { greetingLines, mascotFrame, MASCOT_FRAME_MS, MASCOT_FRAMES, type Greeting } from "./mascot.ts";
 import { MessageList, type MessageFeatures } from "./messages.ts";
 import { Motion } from "./motion.ts";
-import { contextLabel, goalLabel, modeLabels, sidebarLines, speedText, topbarRow, type Line, type StatusModel } from "./status.ts";
+import { contextLabel, goalLabel, idleActivityLabel, modeLabels, sidebarLines, speedText, topbarRow, type Line, type StatusModel } from "./status.ts";
 import { DEFAULT_CELL, stripImageRows } from "./image-size.ts";
 import { formatElapsed } from "./duration.ts";
 import { Pictures, type PictureSource } from "./pictures.ts";
@@ -105,6 +105,8 @@ export class Screen {
   private readonly activity = new Motion();
   private spin = 0;
   private busySince = 0;
+  /** The last turn's wall time, shown beside its outcome until the next turn starts. */
+  private lastTurnMs: number | undefined;
   private lastEvent = 0;
   private activityMs = ACTIVITY_MS;
   private animations = true;
@@ -337,7 +339,8 @@ export class Screen {
   setDock(state: DockState): void {
     const wasBusy = this.dockState.busy;
     this.dockState = state;
-    if (state.busy && !wasBusy) this.busySince = Date.now();
+    if (state.busy && !wasBusy) { this.busySince = Date.now(); this.lastTurnMs = undefined; }
+    if (!state.busy && wasBusy) this.lastTurnMs = Date.now() - this.busySince;
     this.syncActivity();
     this.paintEdges();
   }
@@ -393,7 +396,7 @@ export class Screen {
       const { above, below } = this.composer.overflow;
       if (above) left = [{ segs: [{ text: `↑ ${above} more`, role: "muted" }], priority: 1 }];
       if (below && !this.toastText) right.push({ segs: [{ text: `↓ ${below} more`, role: "muted" }], priority: 2 });
-      if (!above && this.status?.activity) left = [{ segs: [{ text: this.status.activity.label, role: this.status.activity.state === "error" ? "error" : this.status.activity.state === "blocked" ? "warning" : "muted" }], priority: 1, min: 4 }];
+      if (!above && this.status?.activity) left = [idleActivityLabel(this.status.activity, this.lastTurnMs)];
     }
     this.topEdge.setRows([edgeLine({ width, corners: ["╭", "╮"], role, left, right })]);
     const bottomLeft: Label[] = [...(this.status ? modeLabels(this.status) : []), ...(d.model ? [

package/src/tui/ui/status.ts

@@ -385,3 +385,19 @@ export function wrap(text: string, width: number, lines: number): string[] {
   kept[lines - 1] = `${displayWidth(last) + 1 <= w ? last : cells(last, w - 1).trimEnd()}…`;
   return kept;
 }
+
+/**
+ * The input box's top-edge label while no turn runs: the outcome in its own
+ * colour, then how long the last turn took (Codex "Worked for 2m 5s", Claude
+ * Code "Cooked for 1m 6s"). A plain grey "Turn finished" read the same as
+ * "nothing happened" (fix-finished-turn-status).
+ */
+export function idleActivityLabel(activity: NonNullable<StatusModel["activity"]>, turnMs?: number): Label {
+  const tone = activity.state === "done" ? { glyph: "✓", role: "success" as const }
+    : activity.state === "error" ? { glyph: "✗", role: "error" as const }
+    : activity.state === "blocked" ? { glyph: activity.label === "Stopped" ? "■" : "", role: "warning" as const }
+    : { glyph: "", role: "muted" as const };
+  const text = activity.label === "Stopped" && activity.detail ? `Stopped · ${activity.detail}` : activity.label;
+  return { segs: [...(tone.glyph ? [{ text: tone.glyph, role: tone.role }, { text: " ", role: "muted" as const }] : []), { text, role: tone.role },
+    ...(turnMs !== undefined ? [{ text: ` · ${formatElapsed(turnMs)}`, role: "muted" as const }] : [])], priority: 1, min: 4, shrink: tone.glyph ? 2 : 0 };
+}