acuvo-code 0.3.5 → 0.4.0

package/ENTERPRISE.md

@@ -188,8 +188,8 @@ copy, but it *is* a place a process starts, and this is a list of those. Six and
 are the numbers to quote. Counting is the first thing a reviewer does.
 
 ⚠️ **This said "18 shipped files", then "41", then "90", then "101", then "108", and every
-one went stale in turn.** The package ships **119 files — 117 in `lib/`, 2 in
-`bin/` — about 77604 lines**, with **235 test files** beside them (counted 2026-08-22).
+one went stale in turn.** The package ships **120 files — 118 in `lib/`, 2 in
+`bin/` — about 77954 lines**, with **236 test files** beside them (counted 2026-08-22).
 
 ⭐ **AND THE 108 WENT STALE IN THE MOST INSTRUCTIVE WAY POSSIBLE: THREE OF THE FILES IT
 MISSED WERE REACHABLE FROM NOTHING.** `wiring-reach.test.mjs` was naming

package/bin/acuvo.mjs

@@ -1489,10 +1489,25 @@ ${formatBoard(listed)}
    * chat loop owns the invitation, and neither should own both.
    */
   const { openingScreen } = await import('../lib/banner.mjs');
+  /**
+   * ── ⭐⭐ THE BRAND NAME, NOT THE VENDOR'S ────────────────────────────────────
+   *
+   * Roman: *"the model shouldn't say deepseek, it should say like Acuvo."*
+   *
+   * ⭐ AND THE WHOLE MAPPING ALREADY EXISTED. `lib/acuvo-models.mjs` has shipped
+   * `Acuvo Flash`, `Acuvo Pro`, `Acuvo Review` and `Acuvo Vision` for days, with
+   * `labelForModelId` written specifically for this — and the banner, the first
+   * thing every user reads, asked nothing and printed the raw vendor slug. One
+   * caller in the whole package used it. Built, correct, and unreached.
+   *
+   * ⚠️ It falls back to the raw id for a model we did not ship, deliberately:
+   * printing "Acuvo Something" over a model somebody chose themselves would be
+   * a lie in the one place that has to be true.
+   */
   const banner = openingScreen({
     version: pkgVersion,
     workspace: shortenRoot(executor.root),
-    model: config.model,
+    model: labelForModelId(config.model),
     billing,
     canRun: mode,
     interactive: false,

package/lib/acuvo-models.mjs

@@ -1,141 +1,141 @@
-/**
- * ── ⭐⭐ OUR MODELS HAVE OUR NAMES ───────────────────────────────────────────
- *
- * Everywhere a user could see a model, they saw `deepseek/deepseek-v4-flash-0731`.
- * That is somebody else's product name in the middle of ours, and it is wrong
- * for three separate reasons:
- *
- *   1. **It sells the wrong thing.** A buyer comparing us to Claude Code sees
- *      "Sonnet vs Opus" against "deepseek-v4-flash-0731", and concludes we are
- *      a wrapper. The work that makes this good — the harness, the pin, the
- *      independent reviewer, the budget — is ours and is invisible in that name.
- *   2. **It leaks a decision we must be free to change.** The day a better or
- *      cheaper model appears, `--model deepseek/...` is in scripts, CI configs
- *      and muscle memory. A name we own is a name we can re-point.
- *   3. **It exposes a supplier to be approached directly.** Our margin comes
- *      from the harness and the routing, not from secrecy — but there is no
- *      reason to print the supplier list on the product.
- *
- * ⚠️ AND IT IS NOT A LIE. The underlying id is always one command away
- * (`acuvo doctor` prints it, the audit log records it, `--json` carries it), and
- * `resolveModelName` accepts a raw vendor id unchanged so nothing existing
- * breaks. Renaming is branding; hiding would be dishonesty, and this package
- * does not get to have a `refusedCommitPath` and also a secret supplier.
- *
- * ── ⚠️ TWO OF THESE ARE NOT USER-SELECTABLE, ON PURPOSE ─────────────────────
- *
- * The reviewer and the vision model are INFRASTRUCTURE. A user choosing the
- * model that reviews their work can (accidentally or otherwise) pick the same
- * one that wrote it, which turns an independent check into self-review — the
- * exact defect `chooseRefuteModel` exists to prevent. They are listed here so
- * the catalogue is complete and honest, and marked `internal` so no menu offers
- * them.
- */
-
-/**
- * ⭐ THE ONE MAPPING. Every other module asks this file rather than embedding a
- * vendor id, so re-pointing a name is a one-line change here.
- */
-export const ACUVO_MODELS = Object.freeze({
-  'acuvo-flash': Object.freeze({
-    name: 'acuvo-flash',
-    label: 'Acuvo Flash',
-    id: 'deepseek/deepseek-v4-flash-0731',
-    role: 'build',
-    internal: false,
-    /** Measured on our own 13-task bench, 2026-08-15. */
-    blurb: 'The default. 12 of 13 on our bench for 1.5 cents. Fast, and cheap enough that verifying everything is affordable.',
-  }),
-  'acuvo-pro': Object.freeze({
-    name: 'acuvo-pro',
-    label: 'Acuvo Pro',
-    id: 'deepseek/deepseek-v4-pro-0813',
-    role: 'build',
-    internal: false,
-    blurb: 'The strong model. Costs 1.2x Flash on a long warm session and 6x on a short cold one — worth it for hard, sustained work.',
-  }),
-  /**
-   * ⚠️ INTERNAL. See the header: a user who could point the reviewer at their
-   * own builder would silently convert an independent check into self-review.
-   */
-  'acuvo-review': Object.freeze({
-    name: 'acuvo-review',
-    label: 'Acuvo Review',
-    id: 'qwen/qwen3.7-flash',
-    role: 'review',
-    internal: true,
-    blurb: 'Reviews the builder\'s work from a different model family, so its blind spots are not the same ones.',
-  }),
-  'acuvo-vision': Object.freeze({
-    name: 'acuvo-vision',
-    label: 'Acuvo Vision',
-    id: 'qwen/qwen3.7-flash',
-    role: 'vision',
-    internal: true,
-    blurb: 'Looks at rendered pages and images.',
-  }),
-});
-
-/** The names a user may choose between — the `/model` menu. */
-export function selectableModels() {
-  return Object.values(ACUVO_MODELS).filter((m) => !m.internal);
-}
-
-/**
- * Resolve whatever the user typed into a provider model id.
- *
- * ⚠️ A RAW VENDOR ID PASSES THROUGH UNCHANGED, and that is deliberate rather
- * than lazy: every existing script, CI file and test that names
- * `deepseek/deepseek-v4-flash-0731` keeps working, and anyone who wants a model
- * we have never heard of can still use it. Renaming must not become a gate.
- *
- * @param {string} input `acuvo-pro`, `Acuvo Pro`, or a raw vendor id
- * @returns {{ ok: true, id: string, model: object|null } | { ok: false, error: string }}
- */
-export function resolveModelName(input) {
-  const raw = String(input ?? '').trim();
-  if (!raw) return { ok: false, error: 'no model named' };
-
-  const key = raw.toLowerCase().replace(/\s+/g, '-');
-  const hit = ACUVO_MODELS[key];
-  if (hit) {
-    if (hit.internal) {
-      return {
-        ok: false,
-        error: `${hit.label} is chosen for you — it ${hit.role === 'review' ? 'reviews the builder\'s work, and letting you point it at the builder\'s own model would turn an independent check into self-review' : 'is used internally'}. Pick from: ${selectableModels().map((m) => m.name).join(', ')}.`,
-      };
-    }
-    return { ok: true, id: hit.id, model: hit };
-  }
-
-  /**
-   * ⚠️ A vendor id is recognised by its slash. Anything else that is not a
-   * known name is a TYPO, and a typo must not be silently posted to a provider
-   * as a model id — that costs a round trip to learn "no endpoints found".
-   */
-  if (raw.includes('/')) {
-    const known = Object.values(ACUVO_MODELS).find((m) => m.id === raw);
-    return { ok: true, id: raw, model: known ?? null };
-  }
-  return {
-    ok: false,
-    error: `"${raw}" is not a model this understands. Choose ${selectableModels().map((m) => m.name).join(' or ')}, or give a full provider id like deepseek/deepseek-v4-flash-0731.`,
-  };
-}
-
-/**
- * The Acuvo name for a provider id, for anything a user reads.
- *
- * ⚠️ FALLS BACK TO THE RAW ID rather than inventing a name. A model we did not
- * ship is still a model somebody is running, and printing "Acuvo Something" over
- * it would be a lie in the one place — the receipt — that has to be true.
- */
-export function labelForModelId(id) {
-  const hit = Object.values(ACUVO_MODELS).find((m) => m.id === String(id ?? ''));
-  return hit ? hit.label : String(id ?? '');
-}
-
-/** One line per selectable model, for `--help` and the `/model` menu. */
-export function formatModelMenu() {
-  return selectableModels().map((m) => `  ${m.name.padEnd(12)} ${m.label.padEnd(12)} ${m.blurb}`);
-}
+/**
+ * ── ⭐⭐ OUR MODELS HAVE OUR NAMES ───────────────────────────────────────────
+ *
+ * Everywhere a user could see a model, they saw `deepseek/deepseek-v4-flash-0731`.
+ * That is somebody else's product name in the middle of ours, and it is wrong
+ * for three separate reasons:
+ *
+ *   1. **It sells the wrong thing.** A buyer comparing us to Claude Code sees
+ *      "Sonnet vs Opus" against "deepseek-v4-flash-0731", and concludes we are
+ *      a wrapper. The work that makes this good — the harness, the pin, the
+ *      independent reviewer, the budget — is ours and is invisible in that name.
+ *   2. **It leaks a decision we must be free to change.** The day a better or
+ *      cheaper model appears, `--model deepseek/...` is in scripts, CI configs
+ *      and muscle memory. A name we own is a name we can re-point.
+ *   3. **It exposes a supplier to be approached directly.** Our margin comes
+ *      from the harness and the routing, not from secrecy — but there is no
+ *      reason to print the supplier list on the product.
+ *
+ * ⚠️ AND IT IS NOT A LIE. The underlying id is always one command away
+ * (`acuvo doctor` prints it, the audit log records it, `--json` carries it), and
+ * `resolveModelName` accepts a raw vendor id unchanged so nothing existing
+ * breaks. Renaming is branding; hiding would be dishonesty, and this package
+ * does not get to have a `refusedCommitPath` and also a secret supplier.
+ *
+ * ── ⚠️ TWO OF THESE ARE NOT USER-SELECTABLE, ON PURPOSE ─────────────────────
+ *
+ * The reviewer and the vision model are INFRASTRUCTURE. A user choosing the
+ * model that reviews their work can (accidentally or otherwise) pick the same
+ * one that wrote it, which turns an independent check into self-review — the
+ * exact defect `chooseRefuteModel` exists to prevent. They are listed here so
+ * the catalogue is complete and honest, and marked `internal` so no menu offers
+ * them.
+ */
+
+/**
+ * ⭐ THE ONE MAPPING. Every other module asks this file rather than embedding a
+ * vendor id, so re-pointing a name is a one-line change here.
+ */
+export const ACUVO_MODELS = Object.freeze({
+  'acuvo-flash': Object.freeze({
+    name: 'acuvo-flash',
+    label: 'Acuvo Flash 1',
+    id: 'deepseek/deepseek-v4-flash-0731',
+    role: 'build',
+    internal: false,
+    /** Measured on our own 13-task bench, 2026-08-15. */
+    blurb: 'The default. 12 of 13 on our bench for 1.5 cents. Fast, and cheap enough that verifying everything is affordable.',
+  }),
+  'acuvo-pro': Object.freeze({
+    name: 'acuvo-pro',
+    label: 'Acuvo Pro 1',
+    id: 'deepseek/deepseek-v4-pro-0813',
+    role: 'build',
+    internal: false,
+    blurb: 'The strong model. Costs 1.2x Flash on a long warm session and 6x on a short cold one — worth it for hard, sustained work.',
+  }),
+  /**
+   * ⚠️ INTERNAL. See the header: a user who could point the reviewer at their
+   * own builder would silently convert an independent check into self-review.
+   */
+  'acuvo-review': Object.freeze({
+    name: 'acuvo-review',
+    label: 'Acuvo Review 1',
+    id: 'qwen/qwen3.7-flash',
+    role: 'review',
+    internal: true,
+    blurb: 'Reviews the builder\'s work from a different model family, so its blind spots are not the same ones.',
+  }),
+  'acuvo-vision': Object.freeze({
+    name: 'acuvo-vision',
+    label: 'Acuvo Vision 1',
+    id: 'qwen/qwen3.7-flash',
+    role: 'vision',
+    internal: true,
+    blurb: 'Looks at rendered pages and images.',
+  }),
+});
+
+/** The names a user may choose between — the `/model` menu. */
+export function selectableModels() {
+  return Object.values(ACUVO_MODELS).filter((m) => !m.internal);
+}
+
+/**
+ * Resolve whatever the user typed into a provider model id.
+ *
+ * ⚠️ A RAW VENDOR ID PASSES THROUGH UNCHANGED, and that is deliberate rather
+ * than lazy: every existing script, CI file and test that names
+ * `deepseek/deepseek-v4-flash-0731` keeps working, and anyone who wants a model
+ * we have never heard of can still use it. Renaming must not become a gate.
+ *
+ * @param {string} input `acuvo-pro`, `Acuvo Pro`, or a raw vendor id
+ * @returns {{ ok: true, id: string, model: object|null } | { ok: false, error: string }}
+ */
+export function resolveModelName(input) {
+  const raw = String(input ?? '').trim();
+  if (!raw) return { ok: false, error: 'no model named' };
+
+  const key = raw.toLowerCase().replace(/\s+/g, '-');
+  const hit = ACUVO_MODELS[key];
+  if (hit) {
+    if (hit.internal) {
+      return {
+        ok: false,
+        error: `${hit.label} is chosen for you — it ${hit.role === 'review' ? 'reviews the builder\'s work, and letting you point it at the builder\'s own model would turn an independent check into self-review' : 'is used internally'}. Pick from: ${selectableModels().map((m) => m.name).join(', ')}.`,
+      };
+    }
+    return { ok: true, id: hit.id, model: hit };
+  }
+
+  /**
+   * ⚠️ A vendor id is recognised by its slash. Anything else that is not a
+   * known name is a TYPO, and a typo must not be silently posted to a provider
+   * as a model id — that costs a round trip to learn "no endpoints found".
+   */
+  if (raw.includes('/')) {
+    const known = Object.values(ACUVO_MODELS).find((m) => m.id === raw);
+    return { ok: true, id: raw, model: known ?? null };
+  }
+  return {
+    ok: false,
+    error: `"${raw}" is not a model this understands. Choose ${selectableModels().map((m) => m.name).join(' or ')}, or give a full provider id like deepseek/deepseek-v4-flash-0731.`,
+  };
+}
+
+/**
+ * The Acuvo name for a provider id, for anything a user reads.
+ *
+ * ⚠️ FALLS BACK TO THE RAW ID rather than inventing a name. A model we did not
+ * ship is still a model somebody is running, and printing "Acuvo Something" over
+ * it would be a lie in the one place — the receipt — that has to be true.
+ */
+export function labelForModelId(id) {
+  const hit = Object.values(ACUVO_MODELS).find((m) => m.id === String(id ?? ''));
+  return hit ? hit.label : String(id ?? '');
+}
+
+/** One line per selectable model, for `--help` and the `/model` menu. */
+export function formatModelMenu() {
+  return selectableModels().map((m) => `  ${m.name.padEnd(12)} ${m.label.padEnd(12)} ${m.blurb}`);
+}

package/lib/chat.mjs

@@ -22,6 +22,7 @@
  */
 
 import { createInterface } from 'node:readline';
+import { readBoxedLine } from './input-box.mjs';
 import { EXIT_INTERRUPTED } from './interrupt.mjs';
 import { parseSlash, runSlashCommand } from './slash.mjs';
 import { estimateMessagesTokens } from './compact.mjs';
@@ -319,7 +320,23 @@ export async function runChat({
   const queued = interactive ? null : await readAllLines(input);
   let queueIndex = 0;
 
-  const rl = interactive ? createInterface({ input, output, terminal: true }) : null;
+  /**
+   * ── ⚠️⚠️ READLINE IS GONE FROM THE INTERACTIVE PATH, AND IT HAD TO GO ──────
+   *
+   * `input-box.mjs` now owns the keyboard. Leaving the readline interface
+   * attached to the SAME stream was not merely redundant — both it and the box
+   * saw every Ctrl-C, so `onInterrupt` fired TWICE for one keypress. Measured,
+   * not theorised: a single `\x03` produced `['interrupt', 'interrupt']`.
+   *
+   * ⭐ A DOUBLE INTERRUPT IS NOT A COSMETIC BUG. The second Ctrl-C is the one
+   * that QUITS — so one press would have armed and fired the escape hatch in the
+   * same instant, ending a session the user meant only to nudge.
+   *
+   * The Node-internals note below about `question()` swallowing Ctrl-C is kept
+   * because it is why the box reads raw keys itself rather than asking readline
+   * for a line. It is history now, not a live constraint.
+   */
+  const rl = null;
   const state = { closed: false };
   /**
    * ⚠️ ATTACHED ONCE, NOT PER QUESTION — and the per-question version is why the
@@ -350,6 +367,8 @@ export async function runChat({
    * to the model; this is the variable that makes the verb real.
    */
   let pendingInject = null;
+  /** Lines the user has submitted this session — the box's Up/Down history. */
+  const typed = [];
 
   try {
     for (;;) {
@@ -374,12 +393,19 @@ export async function runChat({
        * because `columns` is `undefined` when stdout is not a TTY and enormous
        * when someone maximises on an ultrawide.
        */
-      const width = Math.max(40, Math.min(100, (output.columns ?? process.stdout.columns ?? 80) - 1));
-      if (interactive) output.write(`\n╭${'─'.repeat(width - 1)}\n`);
-      const line = interactive
-        ? await ask(rl, '│ › ', state)
-        : (queueIndex < queued.length ? queued[queueIndex++] : null);
-      if (interactive && line !== null) output.write(`╰${'─'.repeat(width - 1)}\n`);
+      let line;
+      if (interactive) {
+        output.write('\n');
+        const got = await readBoxedLine({
+          input,
+          output,
+          history: typed,
+          onInterrupt,
+        });
+        line = got.value;
+      } else {
+        line = queueIndex < queued.length ? queued[queueIndex++] : null;
+      }
       // Echo a piped prompt so a scripted transcript reads like a session.
       if (!interactive && line !== null && line.trim()) output.write(`› ${line.trim()}
 `);
@@ -389,6 +415,9 @@ export async function runChat({
       if (line === null) break;
       const task = line.trim();
       if (!task) continue;
+      // ⚠️ Deduped against the PREVIOUS entry only: pressing Up should walk
+      // distinct instructions, not scroll through five copies of `npm test`.
+      if (typed[typed.length - 1] !== task) typed.push(task);
       if (QUIT.has(task.toLowerCase())) break;
 
       /**

package/lib/input-box.mjs

@@ -0,0 +1,299 @@
+/**
+ * ── ⭐⭐⭐ A PERSISTENT INPUT BOX, BECAUSE READLINE CANNOT DRAW ONE ──────────
+ *
+ * Roman, repeatedly: *"the box that I am typing in right now needs to be real."*
+ *
+ * ── ⚠️⚠️ WHY READLINE WAS NEVER GOING TO WORK, MEASURED ─────────────────────
+ *
+ * Pre-drawing a four-sided box and asking `readline.question()` to type inside
+ * it produces this on the very first keystroke:
+ *
+ *     \x1b[1G\x1b[0J
+ *
+ * Column 1, then **clear to end of screen**. Readline owns everything from the
+ * cursor down and erases it to redraw the line — so the bottom border and the
+ * right edge are gone before the user has typed a second character. No amount of
+ * re-drawing wins that fight; it repaints on every key.
+ *
+ * ⭐ SO THE ANSWER IS TO OWN THE RENDER. This is a small raw-mode line editor:
+ * it reads keys, keeps the buffer, and paints three lines itself. That is what
+ * every terminal app with a real input box does, and it is why they can have one.
+ *
+ * ── ⚠️ WHAT IT MUST NOT LOSE ────────────────────────────────────────────────
+ *
+ * A half-built line editor is WORSE than a plain prompt: backspace that does
+ * nothing, or an arrow key that prints `^[[D`, makes the tool feel broken in a
+ * way `› ` never did. So the keys people actually use are all handled —
+ * backspace, delete, left/right, home/end, word-left/right, history up/down,
+ * Ctrl-C, Ctrl-D, Ctrl-U/K/W — and each is tested.
+ */
+
+const ESC = '\x1b';
+const CSI = `${ESC}[`;
+
+/** Keys that are not text. Kept as one table so the handler stays readable. */
+const KEY = Object.freeze({
+  ENTER: '\r',
+  NEWLINE: '\n',
+  BACKSPACE: '\x7f',
+  BACKSPACE_ALT: '\b',
+  CTRL_C: '\x03',
+  CTRL_D: '\x04',
+  CTRL_U: '\x15',
+  CTRL_K: '\x0b',
+  CTRL_W: '\x17',
+  CTRL_A: '\x01',
+  CTRL_E: '\x05',
+});
+
+/**
+ * Visible width of a string, ignoring ANSI. Deliberately simple: this package
+ * has no dependencies and a full grapheme/east-asian-width implementation is a
+ * library. It is correct for the ASCII and box characters we draw, and errs by
+ * over-counting a wide glyph rather than under — which wraps early rather than
+ * overflowing the border.
+ */
+export function visibleWidth(s) {
+  return String(s ?? '').replace(/\x1b\[[0-9;]*[A-Za-z]/g, '').length;
+}
+
+/**
+ * Render the three lines of the box for a given buffer.
+ *
+ * Exported so the layout can be asserted without a terminal — the render and
+ * the key handling are separately testable, which is the only way a thing like
+ * this stays correct.
+ *
+ * @returns {{lines: string[], cursorColumn: number}} 1-based cursor column
+ */
+export function renderBox({ value = '', cursor = 0, columns = 80, prompt = '› ' } = {}) {
+  const width = Math.max(20, Math.min(100, columns - 1));
+  const inner = width - 2;
+  const promptWidth = visibleWidth(prompt);
+
+  /**
+   * ⚠️ THE VIEW SCROLLS, THE BUFFER DOES NOT. A long line must not wrap — a
+   * wrapped line pushes the bottom border down and the box stops being a box.
+   * So the buffer is windowed around the cursor and the border stays put, which
+   * is what every real input does.
+   */
+  const room = inner - promptWidth - 1;
+  let start = 0;
+  if (cursor > room) start = cursor - room;
+  const shown = value.slice(start, start + room);
+
+  const body = `${prompt}${shown}`;
+  const pad = ' '.repeat(Math.max(0, inner - visibleWidth(body)));
+
+  return {
+    lines: [
+      `╭${'─'.repeat(width - 2)}╮`,
+      `│${body}${pad}│`,
+      `╰${'─'.repeat(width - 2)}╯`,
+    ],
+    // 1-based: the │, then the prompt, then however far into the shown text.
+    cursorColumn: 1 + 1 + promptWidth + (cursor - start),
+  };
+}
+
+/**
+ * Apply one keypress to the editor state.
+ *
+ * ⚠️ PURE, AND THAT IS THE WHOLE POINT. Every key can be tested without a TTY,
+ * without timing, and without a terminal to inspect afterwards. The half of this
+ * module that touches the terminal does nothing but paint what this returns.
+ *
+ * @returns {{value, cursor, historyIndex, done?: 'submit'|'cancel'|'eof'}}
+ */
+export function applyKey(state, key) {
+  const { value, cursor, history = [], historyIndex = history.length } = state;
+  /**
+   * ⚠️ `history` IS CARRIED THROUGH, AND ITS ABSENCE WAS A REAL BUG. The first
+   * version returned only `{value, cursor, historyIndex}` — so the history array
+   * was dropped by the FIRST keystroke, and pressing Up afterwards silently did
+   * nothing. It looked like the history feature was unimplemented rather than
+   * like state was being lost, which is exactly the kind of bug a pure function
+   * makes visible and a stateful one hides.
+   */
+  const keep = (over = {}) => ({ value, cursor, history, historyIndex, draft: state.draft, ...over });
+
+  if (key === KEY.ENTER || key === KEY.NEWLINE) return keep({ done: 'submit' });
+  if (key === KEY.CTRL_C) return keep({ done: 'cancel' });
+  /**
+   * ⚠️ Ctrl-D IS EOF ONLY ON AN EMPTY LINE. On a line with text it is
+   * forward-delete — collapsing the two would exit the session when someone
+   * meant to delete a character, which is a data-loss-shaped surprise.
+   */
+  if (key === KEY.CTRL_D) {
+    if (value.length === 0) return keep({ done: 'eof' });
+    return keep({ value: value.slice(0, cursor) + value.slice(cursor + 1) });
+  }
+
+  if (key === KEY.BACKSPACE || key === KEY.BACKSPACE_ALT) {
+    if (cursor === 0) return keep();
+    return keep({ value: value.slice(0, cursor - 1) + value.slice(cursor), cursor: cursor - 1 });
+  }
+
+  if (key === KEY.CTRL_U) return keep({ value: value.slice(cursor), cursor: 0 });
+  if (key === KEY.CTRL_K) return keep({ value: value.slice(0, cursor) });
+  if (key === KEY.CTRL_A) return keep({ cursor: 0 });
+  if (key === KEY.CTRL_E) return keep({ cursor: value.length });
+
+  if (key === KEY.CTRL_W) {
+    const upto = value.slice(0, cursor);
+    const cut = upto.replace(/\s*\S+$/, '');
+    return keep({ value: cut + value.slice(cursor), cursor: cut.length });
+  }
+
+  // Arrows and Home/End arrive as escape sequences.
+  if (key === `${CSI}D`) return keep({ cursor: Math.max(0, cursor - 1) });
+  if (key === `${CSI}C`) return keep({ cursor: Math.min(value.length, cursor + 1) });
+  if (key === `${CSI}H` || key === `${CSI}1~`) return keep({ cursor: 0 });
+  if (key === `${CSI}F` || key === `${CSI}4~`) return keep({ cursor: value.length });
+  if (key === `${CSI}3~`) return keep({ value: value.slice(0, cursor) + value.slice(cursor + 1) });
+
+  /**
+   * History. ⚠️ The index may sit one PAST the end — that position is "the line
+   * I was typing", so walking up and back down returns what you had rather than
+   * silently eating it.
+   */
+  if (key === `${CSI}A`) {
+    if (historyIndex === 0 || history.length === 0) return keep();
+    const i = historyIndex - 1;
+    /**
+     * ⚠️ THE DRAFT IS SAVED ON THE WAY UP. Leaving it behind means a half-typed
+     * line is destroyed by a single Up press — the user glances at what they ran
+     * before, comes back, and their sentence is gone. Losing typed input to a
+     * navigation key is the least forgivable bug a line editor can have.
+     */
+    const draft = historyIndex === history.length ? value : state.draft;
+    return keep({ value: history[i], cursor: history[i].length, historyIndex: i, draft });
+  }
+  if (key === `${CSI}B`) {
+    if (historyIndex >= history.length) return keep({ draft: state.draft });
+    const i = historyIndex + 1;
+    const next = i === history.length ? (state.draft ?? '') : history[i];
+    return keep({ value: next, cursor: next.length, historyIndex: i, draft: state.draft });
+  }
+
+  /**
+   * ⚠️ EVERYTHING ELSE CONTROL-SHAPED IS DROPPED, NOT INSERTED. An unhandled
+   * escape sequence typed into the buffer shows the user `^[[5~` and looks like
+   * the tool is broken — the one impression a new line editor cannot afford.
+   */
+  if (key.startsWith(ESC)) return keep();
+  if (key.length === 1 && key < ' ') return keep();
+
+  return keep({ value: value.slice(0, cursor) + key + value.slice(cursor), cursor: cursor + key.length });
+}
+
+/**
+ * Split a raw chunk into keys. A paste arrives as one chunk and an arrow key as
+ * three bytes, so neither "one byte per key" nor "one chunk per key" is right.
+ */
+export function splitKeys(chunk) {
+  const s = String(chunk);
+  const keys = [];
+  for (let i = 0; i < s.length; i += 1) {
+    if (s[i] === ESC) {
+      const m = /^\x1b\[[0-9;]*[A-Za-z~]/.exec(s.slice(i));
+      if (m) { keys.push(m[0]); i += m[0].length - 1; continue; }
+    }
+    keys.push(s[i]);
+  }
+  return keys;
+}
+
+/**
+ * Draw the box and park the cursor inside it.
+ *
+ * ⚠️ THE CURSOR IS HIDDEN WHILE PAINTING. Without it, the cursor visibly darts
+ * to the end of each border as it is written — which reads as a flicker and is
+ * the difference between a rendered box and a drawn one.
+ */
+export function paint(output, state, { first = false } = {}) {
+  const { lines, cursorColumn } = renderBox(state);
+  const up = first ? '' : `${CSI}3A`;
+  output.write(
+    `${CSI}?25l${up}\r${CSI}0J${lines.join('\n')}\n` +
+    `${CSI}2A\r${CSI}${cursorColumn}G${CSI}?25h`,
+  );
+}
+
+/**
+ * ── ⭐⭐⭐ THE ONLY PART THAT TOUCHES A TERMINAL ─────────────────────────────
+ *
+ * Reads one line inside the box. Everything decision-shaped lives in `applyKey`
+ * and `renderBox`, which are pure and fully tested; this function does nothing
+ * but move bytes and paint what they return.
+ *
+ * @returns {Promise<{value: string|null, reason: 'submit'|'cancel'|'eof'}>}
+ */
+export function readBoxedLine({ input, output, history = [], onInterrupt = null, prompt = '› ' }) {
+  return new Promise((resolve) => {
+    let state = { value: '', cursor: 0, history, historyIndex: history.length, draft: '' };
+    const columns = () => output.columns ?? process.stdout.columns ?? 80;
+
+    /**
+     * ⚠️ RAW MODE IS RESTORED ON EVERY EXIT PATH, INCLUDING THE UNHAPPY ONES.
+     * A process that leaves the terminal in raw mode hands the user a shell with
+     * no echo and no line editing — they have to type `reset` blind. That is the
+     * single worst thing a CLI can do to somebody's session.
+     */
+    let finished = false;
+    const finish = (value, reason) => {
+      if (finished) return;
+      finished = true;
+      input.off('data', onData);
+      input.off('end', onEnd);
+      try { input.setRawMode?.(false); } catch { /* not a TTY any more */ }
+      output.write('\n');
+      resolve({ value, reason });
+    };
+
+    const onEnd = () => finish(null, 'eof');
+
+    const onData = (chunk) => {
+      for (const key of splitKeys(chunk)) {
+        const next = applyKey(state, key);
+        if (next.done === 'submit') {
+          state = next;
+          // Repaint once so the committed line is what stays on screen.
+          paint(output, { ...state, columns: columns() });
+          return finish(state.value, 'submit');
+        }
+        if (next.done === 'cancel') {
+          /**
+           * ⚠️ Ctrl-C ON A NON-EMPTY LINE CLEARS IT; on an empty one it means
+           * "stop". Anything else makes the first Ctrl-C — the one people press
+           * to abandon a sentence — quit the whole session.
+           */
+          /**
+           * ⚠️⚠️ Ctrl-C NEVER ENDS THE READ — it clears the line and hands the
+           * event on. The first version finished with `cancel` on an empty line,
+           * which ended the session on the FIRST press: there was then no prompt
+           * for a second Ctrl-C to arrive at, so the "press again to quit"
+           * escape hatch could never fire. `onInterrupt` owns that decision (see
+           * `interrupt.mjs`), and it can only own it if it keeps being called.
+           *
+           * ⭐ It is also what every shell does: Ctrl-C gives you a fresh line.
+           * Quitting is `exit`, or Ctrl-D on an empty one.
+           */
+          state = { ...state, value: '', cursor: 0, historyIndex: history.length, draft: '' };
+          onInterrupt?.();
+          paint(output, { ...state, columns: columns() });
+          continue;
+        }
+        if (next.done === 'eof') return finish(null, 'eof');
+        state = next;
+        paint(output, { ...state, columns: columns() });
+      }
+    };
+
+    try { input.setRawMode?.(true); } catch { /* not a TTY */ }
+    input.resume?.();
+    paint(output, { ...state, columns: columns() }, { first: true });
+    input.on('data', onData);
+    input.once('end', onEnd);
+  });
+}

package/lib/plan.mjs

@@ -33,6 +33,8 @@
  * context is coldest, and it is measured rather than reasoned.
  */
 
+import { labelForModelId } from './acuvo-models.mjs';
+
 /**
  * Per-million prices, USD, from OpenRouter's per-model endpoint feed on
  * 2026-08-15, for the endpoint each model is PINNED to.
@@ -422,12 +424,25 @@ export function planGate({ plan, usedByModel = {}, model, projectedTokens = 0, l
   return { allowed: true, reason: 'ok', remaining, message: null };
 }
 
-/** Acuvo's name for a provider id, without importing the catalogue into the math. */
-function labelFor(id) {
-  if (id === 'deepseek/deepseek-v4-flash-0731') return 'Acuvo Flash';
-  if (id === 'deepseek/deepseek-v4-pro-0813') return 'Acuvo Pro';
-  return id;
-}
+/**
+ * ── ⚠️⚠️ THIS WAS A SECOND COPY OF THE BRAND MAP, AND IT DRIFTED ────────────
+ *
+ * It read: *"Acuvo's name for a provider id, without importing the catalogue
+ * into the math"* — and hardcoded `Acuvo Flash` / `Acuvo Pro`. The moment the
+ * labels were versioned in `acuvo-models.mjs`, this file kept printing the old
+ * names, in the messages a user sees when they run out of allowance. Two places
+ * naming the same product, one of them silently a version behind.
+ *
+ * ⭐ THE STATED REASON DID NOT HOLD. `acuvo-models.mjs` is a LEAF — it imports
+ * nothing — so pulling it in adds no dependency chain to "the math"; it is a
+ * frozen object. Avoiding the import bought nothing and cost a divergence.
+ *
+ * This is the fourth instance of the same shape found today: a mapping copied
+ * rather than imported, correct on the day it was written, wrong the first time
+ * the original changed.
+ */
+
+const labelFor = labelForModelId;
 
 /**
  * Tokens used per PROVIDER id, from audit records.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acuvo-code",
-  "version": "0.3.5",
+  "version": "0.4.0",
   "description": "Acuvo Code — the terminal client for the Acuvo capability registry. Zero dependencies, by design.",
   "type": "module",
   "bin": {