aegiscode 6.2.0 → 6.3.1

package/README.md

@@ -48,12 +48,50 @@ export AEGIS_API_KEY="aegis_..."
 
 ```bash
 aegiscode                        # interactive session
+aegiscode --continue             # skip onboarding, resume the last session
 aegiscode "why is the sky blue"  # one-shot, prints the answer and the tokens
 aegiscode -p "..." --json        # machine-readable
 echo "q" | aegiscode -p -        # prompt on stdin
 aegiscode -m deepseek/deepseek-v4-flash -p "..."   # pin a model
 ```
 
+## First run
+
+A genuine first run walks the reference's onboarding before the session starts —
+the order is `aegiscodex-dev`'s:
+
+```
+────────────────────────────────────────────────────────────────────────────────
+Accessing workspace:
+/home/you/project
+
+Quick safety check: Is this a project you created or one you trust? …
+AEGIS Code will be able to read, edit, and execute files here.
+
+Security guide
+
+❯ 1.Yes, I trust this folder
+  2.No, exit
+
+Enter to confirm · Esc to cancel
+```
+
+then the theme picker (the reference's 7 rows — Auto, Dark/Light, plus
+colourblind-friendly and ANSI-only variants, each previewed as a real diff in
+that palette), then the welcome screen with the mark, a **Tips for getting
+started** box and a **What's new** box. The chosen row is written to
+`~/.aegiscode/config.json`, so `Welcome back!` is what you get next time and the
+picker never reappears.
+
+Declining the trust check **ends the process** rather than continuing — the
+folder you just refused to vouch for is not read, edited or executed in.
+`--continue` skips onboarding entirely.
+
+Preferences survive a restart: model, effort, theme and vim mode are restored on
+launch, and an explicit flag (`-m`, `--light`) always outranks the stored value.
+
+## Use
+
 In a session, plain text is a prompt. `/help` lists commands, grouped by
 category, the way `aegiscodex-dev` does. The registry is that client's, ported
 command for command — 75 entries across nine categories:
@@ -93,7 +131,7 @@ alternate-screen frame of header rule, transcript viewport, spinner/effort line,
 input line and status line, driven by a raw key stream.
 
 ```
-╭───────────────────────────── AEGIS Code v6.2.0 ─────────────────────────────╮
+╭───────────────────────────── AEGIS Code v6.3.0 ─────────────────────────────╮
 ❯ summarise what changed in the token accounting
 ● Three things changed, and one of them was costing you money:
 
@@ -138,9 +176,14 @@ What the loop does, in the order a turn happens:
   transcript live (and scrolling up is anchored to an absolute line index, so an
   arriving delta does not drag the reader back to the bottom); everything else
   you type is replayed into the input line afterwards.
-- **Overlays**: `/` the palette, `alt+p` the model picker, `/effort` the effort
-  picker, `/resume` the session list, `?` the shortcut grid, and a centred
-  Yes/No dialog when a mutating tool needs approval.
+- **Overlays**: `/` the palette (fuzzy-ranked, with `Tab` to complete to the
+  highlighted command), `alt+p` the model picker, `/effort` the effort picker,
+  `/resume` the session list, `?` the shortcut grid, `ctrl+o` permissions, and a
+  centred Yes/No dialog when a mutating tool needs approval. `Esc` closes an
+  overlay, and clears the input line when nothing is open.
+- **Every turn is persisted** to `~/.aegiscode/history.jsonl`, with a transcript
+  checkpoint alongside it, so `/resume`, `/cost`, `/clear` and `/rewind` all have
+  something real to read. On exit the session prints how to come back to it.
 
 Anything that is not a real terminal — a pipe, `-p`, a CI run — stays a linear
 transcript written once to scrollback, so output remains pipeable and

package/bin/aegiscode.js

@@ -35,6 +35,7 @@ Options:
       --width <cols>      force a render width (useful for piping/logs)
       --yolo              skip tool-approval prompts (exec/writeFile/editFile
                            run without asking) — same as the in-session /yolo
+  -c, --continue          skip onboarding and resume the most recent session
   -h, --help              this text
   -v, --version           print the version
 
@@ -54,6 +55,7 @@ function parseArgs(argv) {
     light: false,
     width: null,
     yolo: false,
+    continue: false,
     prompt: null,
     help: false,
     version: false,
@@ -109,6 +111,10 @@ function parseArgs(argv) {
       case '--yolo':
         opts.yolo = true;
         break;
+      case '-c':
+      case '--continue':
+        opts.continue = true;
+        break;
       case '--width':
         opts.width = Number(next());
         break;
@@ -180,6 +186,7 @@ async function main(argv = process.argv.slice(2)) {
     width: opts.width ? () => opts.width : undefined,
     interactive: !prompt && Boolean(process.stdin.isTTY),
     confirmMode: !opts.yolo,
+    continue: opts.continue,
   });
 
   if (prompt) return app.runOnce(prompt, { json: opts.json });
@@ -190,7 +197,12 @@ async function main(argv = process.argv.slice(2)) {
     );
     return 2;
   }
-  return app.runInteractive();
+  const code = await app.runInteractive();
+  // The reference leaves a resume hint on exit; without one there is no way to
+  // discover that a session was persisted at all (`/resume` lists them, but a
+  // user who just quit is not looking at a command list).
+  process.stdout.write(`\nResume this session with:\n  aegiscode --continue   (or /resume for the list)\n`);
+  return code;
 }
 
 if (require.main === module) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegiscode",
   "productName": "AEGIS Code",
-  "version": "6.2.0",
+  "version": "6.3.1",
   "description": "aegiscode — the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
   "author": {
     "name": "AEGIS Code",

package/src/app.js

@@ -23,11 +23,14 @@ const os = require('node:os');
 const { randomUUID } = require('node:crypto');
 const { createTools, createClient, usageTokens } = require('./deps.js');
 const { createEngine } = require('./engine.js');
-const { GLYPH, VERBS, themeOf, RESET } = require('./theme.js');
+const { GLYPH, VERBS, themeOf, RESET, THEME_TABLE } = require('./theme.js');
 const { LiveRegion, termWidth, w } = require('./screen.js');
 const { parseLine, COMMANDS, visibleCommands } = require('./commands.js');
-const { updateConfig, loadPermissions } = require('./config.js');
-const { readSessionTranscript } = require('./history.js');
+const { updateConfig, loadPermissions, loadConfig, configExists } = require('./config.js');
+const { normalizeModelCatalog, pickerEntries, catalogIds } = require('./models.js');
+const { appendHistory, readSessionTranscript, readOwnSessions } = require('./history.js');
+const { snapshotCheckpoint } = require('./checkpoint.js');
+const screens = require('./screens.js');
 const chatflow = require('./chatflow.js');
 const overlays = require('./overlays.js');
 const render = require('./render.js');
@@ -86,7 +89,7 @@ function createApp(options = {}) {
     model: opts.model,
     effort: 'high',
     thinking: false,
-    themeIndex: opts.light ? 0 : 1,
+    themeIndex: opts.light ? 2 : 1,
     vim: false,
     stream: opts.stream,
     cwd: process.cwd(),
@@ -144,6 +147,71 @@ function createApp(options = {}) {
     }
   }
 
+  // ── the AEGIS Cloud model catalog ──────────────────────────────────────────
+  //
+  // `/model` (and the alt+p chord that dispatches it) reads the pinnable ids
+  // from the server, and `state().models` is where it looks. That path had no
+  // source at all: `commands.js` calls `c.loadModels()` inside a `try {} catch
+  // {}`, `c.loadModels` was never defined on either command context, and
+  // `buildState()` hardcoded `models: []` — so the TypeError was swallowed and
+  // both `/model` and the picker reported "no models advertised" on a perfectly
+  // healthy account, forever. The ids themselves are the server's (see
+  // models.js), fetched here and cached, because the pool adds and retires
+  // providers without a client release.
+  const MODEL_CACHE_MS = 5 * 60_000;
+  const modelCache = { at: 0, models: [] };
+
+  /**
+   * Fetch (or return the cached) model catalog. Rejects when the account cannot
+   * read it at all — no key, offline, or a server error — which callers treat as
+   * "nothing to offer" rather than retrying per keystroke.
+   * @returns {Promise<Array<{id:string,label:string,note:string}>>}
+   */
+  async function loadModels({ force = false } = {}) {
+    const fresh = modelCache.models.length && Date.now() - modelCache.at < MODEL_CACHE_MS;
+    if (!force && fresh) return modelCache.models;
+    const data = await client.listModels();
+    modelCache.models = normalizeModelCatalog(data && data.models);
+    modelCache.at = Date.now();
+    return modelCache.models;
+  }
+
+  /**
+   * A pinned model id the server does not advertise is a *silent* fallback: the
+   * pool answers from its own default with no error, so the pin looks honoured
+   * while the reply came from another model — and the cost is attributed to the
+   * model that was pinned. Two shipped defaults did exactly that: `sonnet`
+   * (written into config.json by onboarding, merged in from DEFAULT_CONFIG, and
+   * never advertised by AEGIS Cloud) and any `provider/model` spelling a user
+   * typed by hand. Clears such a pin once, says so, and leaves the server's own
+   * default in its place.
+   *
+   * Best-effort and offline-safe: a catalog that cannot be read clears nothing.
+   */
+  async function validatePinnedModel() {
+    const pinned = commandCtx.model;
+    if (!pinned) return null;
+    let models;
+    try {
+      models = await loadModels();
+    } catch {
+      return null;
+    }
+    if (!models.length) return null;
+    if (catalogIds(models).has(String(pinned).toLowerCase())) return null;
+    commandCtx.model = null;
+    updateConfig({ model: null, currentModelId: null });
+    emit(
+      render.renderNotice(
+        ctx(),
+        'warn',
+        `pinned model "${pinned}" is not advertised by AEGIS Cloud — pin cleared, ` +
+          'the pool will choose; /models lists what you can pin.'
+      )
+    );
+    return pinned;
+  }
+
   function bannerLines() {
     return render.renderBanner(ctx(), {
       width: width(),
@@ -382,6 +450,7 @@ function createApp(options = {}) {
     try {
       res = await ask(prompt, { history });
     } catch (e) {
+      persistTurn(prompt, { text: '', error: e.message }, 'error');
       emit(render.renderTurn(ctx(), { role: 'error', text: e.message }, width()));
       return;
     }
@@ -389,6 +458,7 @@ function createApp(options = {}) {
     if (res.text) transcript.push({ role: 'assistant', text: res.text });
 
     const tokens = recordTurn(res);
+    persistTurn(prompt, res, res.interrupted ? 'stopped' : res.error ? 'error' : 'done');
 
     const spend = await refreshSpend();
 
@@ -513,7 +583,9 @@ function createApp(options = {}) {
       plan: session.plan || null,
       account: session.account || null,
       permissions: { mode: rules.defaultMode, rules },
-      models: [],
+      // The selectable (pickable) catalog, not the raw payload: alias tiers are
+      // dropped, live ids only (see models.js pickerEntries).
+      models: pickerEntries(modelCache.models),
       commands: visibleCommands(),
       transcript: transcript.slice(),
       sessions: [],
@@ -598,10 +670,19 @@ function createApp(options = {}) {
     }
   }
 
+  /**
+   * The theme picker. On a real terminal this is the onboarding screen; anywhere
+   * else (`/theme` in a pipe, a test with no TTY) it stays the light/dark toggle
+   * it has always been, so a non-interactive caller never blocks on a key.
+   */
   async function showThemePicker() {
-    commandCtx.light = !commandCtx.light;
-    commandCtx.themeIndex = commandCtx.light ? 0 : 1;
-    emit(render.renderNotice(ctx(), 'ok', `theme: ${commandCtx.light ? 'light' : 'dark'}`));
+    if (options.readline || !process.stdin.isTTY || !process.stdout.isTTY || options.chatflow === false) {
+      commandCtx.light = !commandCtx.light;
+      commandCtx.themeIndex = commandCtx.light ? 2 : 1;
+      emit(render.renderNotice(ctx(), 'ok', `theme: ${commandCtx.light ? 'light' : 'dark'}`));
+      return commandCtx.themeIndex;
+    }
+    return screens.showThemePicker(commandCtx);
   }
 
   /** Build the FROZEN command context `c` a handler runs against. */
@@ -620,6 +701,10 @@ function createApp(options = {}) {
       runPrompt: (text) => runPrompt(text),
       ask: (text) => ask(text),
       runTool: (name, args) => runTool(name, args),
+      // The AEGIS catalog fetch `/model` and alt+p expect (see loadModels).
+      // Wired on the app's context so the chatflow's `Object.assign`-based
+      // context inherits it too — one definition, both hosts.
+      loadModels: (o) => loadModels(o),
       refreshSpend: () => refreshSpend(),
       state: () => buildState(),
       setInput: () => {},
@@ -827,8 +912,43 @@ function createApp(options = {}) {
     return tokens;
   }
 
-  /** One line of session accounting, for ctrl+t and the meta row. */
-  function tokenSummary() {
+  /**
+   * Persist one finished exchange: the history row and a transcript checkpoint.
+   *
+   * `appendHistory` and `snapshotCheckpoint` were both dead code — nothing ever
+   * called them, so `history.jsonl` was never created. Every consumer of it
+   * degraded silently rather than loudly: `/resume` could never find a stored
+   * session, `/cost` summed zero rows, `/clear`'s prune was a no-op, and
+   * `/rewind` always answered "No checkpoints yet". The session loop is the only
+   * place that sees the prompt *and* its reply, so it is the place that writes.
+   *
+   * Best-effort by construction: the two writers swallow their own failures, and
+   * accounting must never be able to break a turn.
+   */
+  function persistTurn(prompt, res, status = 'done') {
+    try {
+      const usage = res && res.usage;
+      appendHistory({
+        sessionId: commandCtx.sessionId,
+        prompt,
+        reply: (res && res.text) || '',
+        status,
+        usage: usage
+          ? {
+              input: Number(usage.input_tokens ?? usage.prompt_tokens ?? 0) || 0,
+              output: Number(usage.output_tokens ?? usage.completion_tokens ?? 0) || 0,
+              cacheRead: Number(usage.cache_read_input_tokens ?? 0) || 0,
+              cacheWrite: Number(usage.cache_creation_input_tokens ?? 0) || 0,
+            }
+          : null,
+      });
+      snapshotCheckpoint(commandCtx.sessionId, transcript);
+    } catch {
+      /* persistence is best-effort */
+    }
+  }
+
+  /** One line of session accounting, for ctrl+t and the meta row. */  function tokenSummary() {
     return (
       `${fmtTokens(session.tokens)} tok ` +
       `(${fmtTokens(session.inputTokens)} in / ${fmtTokens(session.outputTokens)} out) · ` +
@@ -868,10 +988,13 @@ function createApp(options = {}) {
       TOOLS,
       ask: (prompt, o) => ask(prompt, o),
       makeCommandContext: () => makeCommandContext(),
+      loadModels: (o) => loadModels(o),
       buildState: () => buildState(),
       dispatchLine: (line, c) => handleLine(line, c),
       refreshSpend: () => refreshSpend(),
       updateConfig: (patch) => updateConfig(patch),
+      showThemePicker: () => showThemePicker(),
+      persistTurn: (prompt, res, status) => persistTurn(prompt, res, status),
       visibleCommands: () => visibleCommands(),
       tokensFor: (usage) => usageTokens(usage),
       recordTurn: (res) => recordTurn(res),
@@ -926,6 +1049,43 @@ function createApp(options = {}) {
     });
   }
 
+  /**
+   * Restore persisted preferences into the live context. The reference does this
+   * at startup (`main.js:290-296`); this client never called `loadConfig()` on
+   * launch at all, so a model or effort chosen in a previous session was written
+   * to disk and then ignored on the next run.
+   *
+   * An explicit CLI flag always wins over the stored value — `aegiscode -m x`
+   * must mean `x`, not "x unless the config disagrees".
+   */
+  function restorePrefs() {
+    // An embedded/injected readline is a programmatic caller: it gets a
+    // deterministic context rather than whatever happens to be on disk.
+    if (options.readline) return;
+    // A fresh install has no expressed preference to restore. Applying
+    // DEFAULT_CONFIG here would silently pin the user to a model they never
+    // chose, which is the opposite of "remember what I picked".
+    if (!configExists()) return;
+    let cfg;
+    try {
+      cfg = loadConfig();
+    } catch {
+      return;
+    }
+    if (!opts.model && cfg.model) commandCtx.model = cfg.model;
+    if (cfg.effort) commandCtx.effort = cfg.effort;
+    if (typeof cfg.vim === 'boolean') commandCtx.vim = cfg.vim;
+    if (cfg.lastRecap) commandCtx.lastRecap = cfg.lastRecap;
+    // THEME_TABLE lives in theme.js, not screens.js: reading it off the screens
+    // module yielded undefined, and only on a *second* launch (the first has no
+    // config to restore, so this branch never ran) — so the very first run
+    // appeared to work and every run after it died on startup.
+    if (!opts.light && typeof cfg.themeIndex === 'number' && THEME_TABLE[cfg.themeIndex]) {
+      commandCtx.themeIndex = cfg.themeIndex;
+      commandCtx.light = !!THEME_TABLE[cfg.themeIndex].light;
+    }
+  }
+
   /**
    * Interactive entry point. On a real terminal this is the full chatflow
    * (alternate screen, header, transcript viewport, spinner, effort line,
@@ -940,9 +1100,35 @@ function createApp(options = {}) {
       process.stdin.isTTY &&
       process.stdout.isTTY;
     if (tty) {
+      restorePrefs();
+      // Onboarding runs in the normal buffer, before the session takes the
+      // alternate screen — the reference's order. A declined trust check must
+      // abort: the reference returns without ever reaching `session(ctx)`.
+      const onboard = await screens.runOnboarding(commandCtx, {
+        continue: !!options.continue,
+        seen: options.seen || configExists,
+        save: (patch) => updateConfig(patch),
+      });
+      if (!onboard.ok) return 0;
+      // A stored pin the platform does not advertise routes elsewhere in
+      // silence (see validatePinnedModel) — checked once, here, where the user
+      // can act on it. Not on `-p`: a network round-trip ahead of the first
+      // token would be a startup cost bought for a warning no script watches.
+      await validatePinnedModel();
+      // `--continue` must load the last session *before* the loop starts, and
+      // it has to be read here rather than captured at construction: the
+      // history file is written by the loop itself.
+      if (options.continue) {
+        const last = readOwnSessions(1)[0];
+        if (last) {
+          commandCtx.continueSession = last.id;
+          await resumeSession({ id: last.id });
+        }
+      }
       await chatflow.runSession(makeHost());
       return 0;
     }
+    restorePrefs();
     return runLinearRepl();
   }
 
@@ -963,7 +1149,12 @@ function createApp(options = {}) {
     refreshSpend,
     bannerLines,
     makeHost,
+    loadModels,
+    validatePinnedModel,
     recordTurn,
+    persistTurn,
+    restorePrefs,
+    sessionId: () => commandCtx.sessionId,
     tokenSummary,
     resumeSession,
     makeCommandContext,

package/src/chatflow.js

@@ -207,7 +207,12 @@ function statusLine(state, cols, ctx) {
   return padLine(left, cols);
 }
 
-/** The `?` shortcuts grid. */
+/**
+ * The `?` shortcuts grid. Every row advertised here is a key this CLI actually
+ * handles — the reference sheet also lists chords this host never wired up
+ * (shift+tab, `\`+return, `@`, ctrl+z/v/g…), and a cheat-sheet of dead keys is
+ * worse than none. Add a row only alongside its handler in `handleKey`.
+ */
 function shortcutsGrid(cols, ctx) {
   const t = themeOf(ctx);
   const cell = (a, b, c, d) => [
@@ -215,13 +220,12 @@ function shortcutsGrid(cols, ctx) {
     span('', '  '), span(t.white, c), span(t.gray, ' ' + d),
   ];
   return [
-    cell('/', 'for commands', 'shift + tab', 'to auto-accept'),
-    cell('?', 'for shortcuts', 'ctrl + c', 'to quit'),
-    cell('\\ + return', 'for newline', 'ctrl + o', 'for permissions'),
-    cell('@', 'for file paths', 'alt + p', 'to switch model'),
+    cell('/', 'for commands', '?', 'for shortcuts'),
+    cell('ctrl + c', 'to quit', 'ctrl + o', 'for permissions'),
+    cell('alt + p', 'to switch model', 'alt + t', 'to toggle thinking'),
     cell('esc', 'to interrupt a turn', 'ctrl + l', 'to clear the screen'),
-    [span('', '  '), span(t.white, 'ctrl + t'), span(t.gray, ' to show tokens'), span('', '  '), span(t.white, 'ctrl + r'), span(t.gray, ' to resume a session')],
-    [span('', '  '), span(t.white, '↑ / ↓'), span(t.gray, ' for history', span(' ', 1)), span('', '  '), span(t.white, 'tab'), span(t.gray, ' to complete a command')],
+    cell('ctrl + t', 'to show tokens', 'ctrl + r', 'to resume a session'),
+    cell('↑ / ↓', 'for history', 'tab', 'to complete a command'),
   ];
 }
 
@@ -787,6 +791,11 @@ async function runSession(host) {
       // Accounting: fold the turn's usage into the session tallies, ask the
       // ledger what it settled at, and show both — tokens beside €.
       host.recordTurn(result);
+      // Persist the finished exchange for /resume. Guarded: the test host stub
+      // deliberately omits persistTurn, and the accounting below must still run.
+      if (host.persistTurn) {
+        host.persistTurn(prompt, result, abortedFlag ? 'stopped' : (result && result.error) ? 'error' : 'done');
+      }
       let lastCost = null;
       try {
         const spend = await host.refreshSpend();
@@ -925,10 +934,11 @@ async function runSession(host) {
         render();
       },
       showThemePicker: () => {
-        ctx.light = !ctx.light;
-        ctx.themeIndex = ctx.light ? 0 : 1;
-        host.updateConfig({ themeIndex: ctx.themeIndex });
-        note(`theme: ${ctx.light ? 'light' : 'dark'}`);
+        // The app owns the real picker (the 7-row onboarding screen on a TTY,
+        // the light/dark toggle off one). The loop only repaints after it — the
+        // old inline toggle hardcoded themeIndex 0/1, which no longer names
+        // Light/Dark in theme.js's THEME_TABLE (2 is "Light mode").
+        if (host.showThemePicker) host.showThemePicker();
         render();
       },
     });
@@ -1023,6 +1033,23 @@ async function runSession(host) {
     return true;
   };
 
+  // The number of rows the active overlay currently renders, so DOWN can clamp
+  // the highlight to the last row instead of running off the end of the list.
+  const overlayRowCount = () => {
+    if (!overlay) return 0;
+    if (overlay.type === 'palette') {
+      return fuzzy.fuzzyRankWithAliases(
+        paletteQuery(overlay.query),
+        host.visibleCommands(),
+        (c) => c.name,
+        (c) => c.aliases || []
+      ).length;
+    }
+    if (overlay.type === 'model' || overlay.type === 'resume') return (overlay.items || []).length;
+    if (overlay.type === 'effort') return 3;
+    return 0;
+  };
+
   const handleOverlayKey = async (key) => {
     const type = overlay.type;
     if (key.name === KEY.ESC || key.name === KEY.CTRL_C) {
@@ -1035,6 +1062,24 @@ async function runSession(host) {
       render();
       return;
     }
+    if (key.name === KEY.TAB && type === 'palette') {
+      // Tab completes the query to the highlighted command, ranking with the
+      // same function the palette rendered with so the row completed is the
+      // row Enter would run. Nothing highlighted (no matches) → do nothing.
+      const list = fuzzy.fuzzyRankWithAliases(
+        paletteQuery(overlay.query),
+        host.visibleCommands(),
+        (c) => c.name,
+        (c) => c.aliases || []
+      );
+      const chosen = list[overlay.sel || 0];
+      if (chosen) {
+        overlay.query = chosen.name;
+        overlay.sel = 0;
+        render();
+      }
+      return;
+    }
     if (key.name === KEY.ENTER) {
       if (type === 'palette') {
         // Rank with the same function the palette rendered with, so the row
@@ -1092,7 +1137,8 @@ async function runSession(host) {
       return;
     }
     if (key.name === KEY.DOWN) {
-      overlay.sel = (overlay.sel || 0) + 1;
+      const max = Math.max(0, overlayRowCount() - 1);
+      overlay.sel = Math.min(max, (overlay.sel || 0) + 1);
       render();
       return;
     }
@@ -1132,6 +1178,22 @@ async function runSession(host) {
       await handleOverlayKey(key);
       return;
     }
+    // A bare '/' opens the palette and a bare '?' the shortcuts grid — the
+    // reference opens both on the keystroke (main.js:1542-1543), not after
+    // Enter. With text already in the line both insert literally, so '/model'
+    // and 'why?' still type.
+    if (key.name === 'char' && !editor.buf) {
+      if (key.ch === '/') {
+        overlay = { type: 'palette', query: '', sel: 0 };
+        render();
+        return;
+      }
+      if (key.ch === '?') {
+        overlay = { type: 'shortcuts' };
+        render();
+        return;
+      }
+    }
     // vim normal-mode motions (only when the buffer is empty, so j/k do not
     // fight typed text).
     if (ctx.vim && !insertMode && !editor.buf && key.name === 'char') {
@@ -1258,7 +1320,17 @@ async function runSession(host) {
       return;
     }
     if (key.name === KEY.TAB) {
-      completeTab();
+      // completeTab cycles command names; when it finds nothing, flash the
+      // reference's hint in the idle line — the alt+t nudge on an empty buffer,
+      // a "Tab completes" reminder once text is typed (main.js:1598-1606).
+      // hintUntil/hintText were declared and rendered but never set.
+      if (!completeTab()) {
+        hintText = editor.buf ? 'Tab completes commands' : 'Use alt+t to toggle thinking';
+        hintUntil = Date.now() + 2500;
+        setTimeout(() => {
+          if (Date.now() >= hintUntil) render();
+        }, 2600);
+      }
       render();
       return;
     }
@@ -1274,7 +1346,9 @@ async function runSession(host) {
       return;
     }
     if (key.name === KEY.CTRL_W) {
-      editor.wordDelete();
+      // Word-rubout: step the cursor back a word, no deletion — the reference's
+      // Ctrl+W (main.js:1624). LineEditor.wordBack is the method that exists.
+      editor.wordBack();
       render();
       return;
     }
@@ -1292,6 +1366,12 @@ async function runSession(host) {
       await dispatch('/resume');
       return;
     }
+    if (key.name === KEY.CTRL_O) {
+      // Keybinding parity: Ctrl+O opens the permissions panel (main.js:1644),
+      // which /permissions already renders in this CLI.
+      await dispatch('/permissions');
+      return;
+    }
     if (key.name === KEY.PAGE_UP || key.name === KEY.PAGE_DOWN || key.name === 'wheel') {
       applyLiveScroll(key);
       return;
@@ -1300,6 +1380,27 @@ async function runSession(host) {
       await dispatch('/model');
       return;
     }
+    if (key.name === 'alt' && key.ch === 't') {
+      // Toggle extended thinking, using the same shape/value as /thinking so
+      // the chord and the command cannot disagree (commands.js: thinking).
+      const want = !(ctx.thinking === true);
+      ctx.thinking = want;
+      host.updateConfig({ thinking: want });
+      note(`Thinking blocks: ${want ? 'expanded' : 'collapsed'}`);
+      render();
+      return;
+    }
+    if (key.name === KEY.ESC) {
+      // A bare Esc on an idle line clears it (readline's rule; the reference
+      // clears the buffer, main.js:1675). The vim insert-mode Esc above is a
+      // distinct motion and must not be shadowed by this.
+      if (editor.buf) {
+        editor.buf = '';
+        editor.cursor = 0;
+        render();
+      }
+      return;
+    }
     if (key.name === KEY.CTRL_C) {
       if (editor.buf) {
         editor.buf = '';
@@ -1311,12 +1412,11 @@ async function runSession(host) {
       return;
     }
     if (key.name === KEY.CTRL_D) {
-      if (!editor.buf) {
-        await endSession();
-        return;
-      }
-      editor.delete();
-      render();
+      // Ctrl+D is EOF: it ends the session only on an empty line. With text in
+      // the buffer the reference never deletes-forward (main.js:1673), so a
+      // stray Ctrl+D must neither drop a character nor kill the session.
+      if (!editor.buf) await endSession();
+      return;
     }
   };