aiur-cli 0.0.5 → 0.0.6

package/libexec/aiur-engine.sh

@@ -456,7 +456,7 @@ Usage: aiur [--interactive] [--no-dashboard] [--executor] [--pause] [--max-agent
        aiur status           show agent status
        aiur agents           show each agent's state + current activity
        aiur commands [<decision-id>] [--filter all|open|blocking|resolved] [--blocking] [--ticket <id>] [--search <text>] [--cursor <cursor>] [--limit <n>] [--json]
-       aiur executor-answer <decision-id> --expected-version <n> (--option <id>|--custom-response <text>) --rationale <text> --idempotency-key <key> [--executor-id <id>]
+       aiur executor-answer <decision-id> --expected-version <n> (--option <id>|--custom-response <text>) --rationale <text> --idempotency-key <key> [--supersede] [--executor-id <id>]
        aiur executor-escalate <decision-id> --expected-version <n> --reason <text> [--executor-id <id>]
        aiur executor-moot <decision-id> --expected-version <n> --reason-class <class> [--reason <text>] [--executor-id <id>]
        aiur units [--scope live|unfinished|all|none] [--condition active|alert|paused|queued|finished]... [--format auto|table|records] [--json]
@@ -468,6 +468,7 @@ Usage: aiur [--interactive] [--no-dashboard] [--executor] [--pause] [--max-agent
        aiur watch [--full|--changes] [--interval <secs>]  server-side status board
        aiur executor-listen [--topic <pattern>]  stream Executor events as JSON lines
        aiur executor-wait [--timeout <seconds>] [--json]  block until Executor work arrives
+       aiur executor-fast-forward <wake-id> [--as <id>]  acknowledge an externally covered wake prefix
        aiur executor-emit <topic> --payload <json>  publish an Executor event
        aiur executor-subscribe|executor-unsubscribe <pattern>
        aiur executor-subscriptions  list persistent Executor bindings
@@ -479,12 +480,11 @@ Usage: aiur [--interactive] [--no-dashboard] [--executor] [--pause] [--max-agent
        aiur upgrade [--force]   install the newer aiur-cli on your channel
        aiur pause | resume             flip the global pause switch (whole daemon)
        aiur pause <ids|--all> | resume <ids|--all>  per-agent pause/resume
-       aiur message <id> <text>  send Executor text to a running agent
+       aiur message <id> [--message-id ID] <text>  send Executor text to a running agent
        aiur --todo <ids...> [--only]  queue tickets; optionally dequeue all other pending tickets
        aiur findings [--unfiled] [--slugs] [--scope aiur|repo]  inspect host-local findings
        aiur findings --record <json> --repo <owner/repo>  append one validated finding
        aiur findings --digest [--scope aiur|repo]  generate the promoted Markdown digest
-       aiur guard-pr-deletions [base-branch]  refuse PRs with excessive untouched deletions
        aiur ask <title> [--body <text>|--body-file <path>] [--urgency low|normal|high] [--blocking]
        aiur ask --done <id> [--note <text>]  create or resolve an operator request
        aiur asks [--open|--all] [--json]  inspect current-repository operator requests
@@ -588,31 +588,84 @@ run_asks() {
 # mode=foreground attaches the UI and tears down on exit; mode=background leaves
 # the detached tmux session running and returns.
 
-# Load operator/machine credentials before repo-local settings. Since each file
-# only fills unset names, shell exports win first, then ~/.aiur/.env, then ./.env.
+# Dotenv precedence: shell exports win, then ./.env, then ~/.aiur/.env. Each
+# file only fills names that are still unset, so the repo-local file (the more
+# specific scope) is read first and the machine-wide file only fills its gaps.
+# A blank value is a placeholder, not a setting: `aiur init` scaffolds
+# `GITHUB_TOKEN=` and `.env.example` renders every name blank, so a blank line
+# neither exports nor shadows anything.
+#
+# GitHub credentials are one group. A repo `.env` that sets any member has
+# chosen that repository's auth mode, so none of the global file's members may
+# leak in beside it: a global GITHUB_APP_* triple filling the gaps around a
+# repo-local GITHUB_TOKEN would outrank that token and force the daemon onto an
+# App that is not installed on the repo (#2638).
+GITHUB_CREDENTIAL_ENV_NAMES="GITHUB_TOKEN GITHUB_APP_ID GITHUB_APP_INSTALLATION_ID GITHUB_APP_PRIVATE_KEY_PATH GITHUB_APP_PRIVATE_KEY"
+
 load_dotenv() {
-  load_dotenv_file "$HOME/.aiur/.env"
+  local global_skip=""
+  if dotenv_file_sets_github_credential ".env"; then
+    global_skip="github_credentials"
+  fi
   load_dotenv_file ".env"
+  load_dotenv_file "$HOME/.aiur/.env" "$global_skip"
+}
+
+github_credential_env_name() {
+  case " $GITHUB_CREDENTIAL_ENV_NAMES " in
+    *" $1 "*) return 0 ;;
+  esac
+  return 1
+}
+
+# Parses one dotenv line into DOTENV_KEY / DOTENV_VAL. Returns 1 for blank,
+# comment, malformed, and blank-valued lines so callers skip them. Shared by
+# the loader and the credential-group probe so both agree on what counts.
+parse_dotenv_line() {
+  local line="$1" key val
+  DOTENV_KEY="" DOTENV_VAL=""
+  line="${line#"${line%%[![:space:]]*}"}"
+  case "$line" in '' | '#'*) return 1 ;; esac
+  [ "${line#*=}" = "$line" ] && return 1
+  key="${line%%=*}"
+  key="${key%"${key##*[![:space:]]}"}"
+  case "$key" in '' | *[!A-Za-z0-9_]*) return 1 ;; esac
+  val="${line#*=}"
+  val="${val#"${val%%[![:space:]]*}"}"
+  case "$val" in
+    \"*\") val="${val#\"}" && val="${val%\"}" ;;
+    \'*\') val="${val#\'}" && val="${val%\'}" ;;
+  esac
+  [ -n "$val" ] || return 1
+  DOTENV_KEY="$key"
+  DOTENV_VAL="$val"
+}
+
+# True when the file sets any GitHub credential name to a non-blank value.
+dotenv_file_sets_github_credential() {
+  local file="$1" line
+  [ -f "$file" ] || return 1
+  while IFS= read -r line || [ -n "$line" ]; do
+    parse_dotenv_line "$line" || continue
+    if github_credential_env_name "$DOTENV_KEY"; then
+      return 0
+    fi
+  done <"$file"
+  return 1
 }
 
+# Usage: load_dotenv_file <file> [github_credentials]
+# The optional second argument skips the GitHub credential group.
 load_dotenv_file() {
-  local file="$1" line key val
+  local file="$1" skip="${2:-}" line
   [ -f "$file" ] || return 0
   while IFS= read -r line || [ -n "$line" ]; do
-    line="${line#"${line%%[![:space:]]*}"}"
-    case "$line" in '' | '#'*) continue ;; esac
-    [ "${line#*=}" = "$line" ] && continue
-    key="${line%%=*}"
-    key="${key%"${key##*[![:space:]]}"}"
-    case "$key" in '' | *[!A-Za-z0-9_]*) continue ;; esac
-    val="${line#*=}"
-    val="${val#"${val%%[![:space:]]*}"}"
-    case "$val" in
-      \"*\") val="${val#\"}" && val="${val%\"}" ;;
-      \'*\') val="${val#\'}" && val="${val%\'}" ;;
-    esac
-    [ -n "${!key+x}" ] && continue
-    export "$key=$val"
+    parse_dotenv_line "$line" || continue
+    if [ "$skip" = "github_credentials" ] && github_credential_env_name "$DOTENV_KEY"; then
+      continue
+    fi
+    [ -n "${!DOTENV_KEY+x}" ] && continue
+    export "$DOTENV_KEY=$DOTENV_VAL"
   done <"$file"
 }
 
@@ -754,6 +807,16 @@ run_session() {
   scrub_run_only_env
   export AIUR_DEFAULT_DASHBOARD_HOST="$(default_dashboard_host)"
 
+  # The BEAM lives in tmux, but a fresh foreground run belongs to this shell:
+  # it waits on the UI attach and owns the teardown trap. Hand its pid to the
+  # pane watchdog so a hard-killed launcher cannot leave agents running.
+  # A detached run has no such owner; discard any inherited stale value.
+  if [ "$mode" = "foreground" ]; then
+    export AIUR_LAUNCHER_PID="$$"
+  else
+    unset AIUR_LAUNCHER_PID
+  fi
+
   # The daemon's `Aiur.Upgrade` check uses the CLI package version (not the mix
   # version) as the "installed" version, so an npm install's notice names what
   # the user actually has. `run_version` sets the same var for `--version`.
@@ -870,7 +933,7 @@ run_session() {
       AIUR_TMUX_SESSION AIUR_TMUX_SOCKET AIUR_TMUX_CONF AIUR_BIN \
       AIUR_SESSION_TMPFILE AIUR_AGENT_TMPFILE AIUR_WORKSPACE_ROOT_FILE AIUR_ALERT_LEDGER_PATH_FILE \
       ELIXIR_ERL_OPTIONS AIUR_LOGS_ROOT AIUR_OPENCODE_BRIDGE_PORT AIUR_DEFAULT_DASHBOARD_HOST AIUR_DEBUG \
-      AIUR_OPERATOR_PID AIUR_NOFILE_SOFT_LIMIT ERL_CRASH_DUMP ERL_CRASH_DUMP_SECONDS \
+      AIUR_OPERATOR_PID AIUR_LAUNCHER_PID AIUR_NOFILE_SOFT_LIMIT ERL_CRASH_DUMP ERL_CRASH_DUMP_SECONDS \
       AIUR_BG_STATE_DIR AIUR_CLI_VERSION; do
       if [ -n "${!v:-}" ]; then printf 'export %s=%q\n' "$v" "${!v}"; fi
     done
@@ -937,6 +1000,20 @@ run_session() {
     exit 1
   fi
 
+  # Each instance has its own tmux socket. Publish the executable shipped next
+  # to this engine before the TUI opens a chat pane; tmux receives the path as
+  # one argument, including when the npm install directory contains spaces.
+  if [ "$mode" = "foreground" ]; then
+    local ctrlc_helper="$engine_dir/aiur-pane-ctrlc"
+    if [ ! -x "$ctrlc_helper" ] ||
+       ! "$tmux_bin" -L "$socket" -f "$conf" set-option -g @aiur_ctrlc "$ctrlc_helper"; then
+      "$tmux_bin" -L "$socket" -f "$conf" kill-session -t "$session" 2>/dev/null || true
+      rm -f "${launch_tempfiles[@]}" 2>/dev/null || true
+      release_aiur_launch_lock "$launch_lock"
+      die "aiur pane control helper is unavailable at $ctrlc_helper"
+    fi
+  fi
+
   # Title the agent-list pane (the only pane in the fresh session). The conf's
   # `pane-border-status`/`pane-border-format` render it; PaneManager titles the
   # chat panes it opens. Best-effort — a missing title just shows the default.
@@ -1350,7 +1427,8 @@ agent_pid_matches() {
 # never touching the Executor’s own default tmux. Headless agents (claude/codex
 # app-servers spawned via Port) are bare OS processes that reparent to init on a
 # BEAM crash; kill-server can't see them, so they're reaped from the pidfile by
-# process tree, comm-guarded against pid reuse. Idempotent.
+# process tree, checking the recorded command. A recycled pid with a matching
+# command is still possible (#2844). Idempotent.
 reap_aiur_agents() {
   local socket="$1" pidfile="${2:-}"
   local tmux_bin
@@ -1482,6 +1560,7 @@ write_aiur_instance_record() {
     printf 'AIUR_RECORD_INSTANCE_KEY=%q\n' "$AIUR_INSTANCE_KEY"
     printf 'AIUR_RECORD_SESSION=%q\n' "$session"
     printf 'AIUR_RECORD_SOCKET=%q\n' "$socket"
+    printf 'AIUR_RECORD_AGENT_TMPFILE=%q\n' "${AIUR_AGENT_TMPFILE:-}"
     printf 'AIUR_RECORD_WORKSPACE_ROOT_FILE=%q\n' "${AIUR_WORKSPACE_ROOT_FILE:-}"
     printf 'AIUR_RECORD_PROJECT_ROOT=%q\n' "$root"
     printf 'AIUR_RECORD_PROJECT_ROOT_SOURCE=%q\n' "${AIUR_PROJECT_ROOT_SOURCE:-}"
@@ -1721,6 +1800,31 @@ workspace_root_file_from_instance_record() {
   printf '%s\n' "$AIUR_RECORD_WORKSPACE_ROOT_FILE"
 }
 
+agent_pidfile_from_instance_record() {
+  load_aiur_instance_record "$(aiur_instance_record_path)" || return 1
+  if [ -n "${AIUR_RECORD_AGENT_TMPFILE:-}" ]; then
+    printf '%s\n' "$AIUR_RECORD_AGENT_TMPFILE"
+    return 0
+  fi
+
+  # Records written before the pidfile field still carry the handoff created
+  # by the same launcher: aiur-PID-workspace-root and aiur-PID-agents share a
+  # runtime directory. Derive that one file only when the old path has the
+  # exact launch shape under this runtime root; never scan other instances.
+  local session_root="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}" handoff pid
+  session_root="${session_root%/}"
+  [ -n "$session_root" ] || session_root=/
+  handoff="${AIUR_RECORD_WORKSPACE_ROOT_FILE:-}"
+  case "$handoff" in
+    "$session_root"/aiur-*-workspace-root) ;;
+    *) return 1 ;;
+  esac
+  pid="${handoff#"$session_root"/aiur-}"
+  pid="${pid%-workspace-root}"
+  [[ "$pid" =~ ^[0-9]+$ ]] || return 1
+  printf '%s/aiur-%s-agents\n' "$session_root" "$pid"
+}
+
 # Background watchdog that survives the BEAM. Polls for the release BEAM by
 # command pattern and, once it has SEEN the BEAM and then the BEAM disappears
 # (orderly halt OR :emfile-style crash), reaps every agent. Polling the pattern
@@ -2037,6 +2141,7 @@ load_aiur_instance_record() {
   AIUR_RECORD_INSTANCE_KEY=""
   AIUR_RECORD_SESSION=""
   AIUR_RECORD_SOCKET=""
+  AIUR_RECORD_AGENT_TMPFILE=""
   AIUR_RECORD_WORKSPACE_ROOT_FILE=""
   AIUR_RECORD_PROJECT_ROOT=""
   AIUR_RECORD_PROJECT_ROOT_SOURCE=""
@@ -2531,7 +2636,8 @@ cmd_reset_budget() {
 # The text is base64-encoded for the RPC hop so arbitrary content (quotes,
 # backslashes, `#{}`, newlines) survives without Elixir-string escaping.
 cmd_message() {
-  local usage="aiur: message expects an issue ID and text (e.g. aiur message 44 \"ship it\")"
+  local usage="aiur: message expects an issue ID and text (e.g. aiur message 44 \"ship it\" or aiur message 44 --message-id ID \"ship it\")"
+  local message_id="" message_id_given=0
 
   local issue="${1:-}"
   if [ -z "$issue" ] || [[ ! "$issue" =~ ^[0-9]+$ ]]; then
@@ -2540,6 +2646,26 @@ cmd_message() {
   fi
   shift
 
+  # `--message-id ID` names this send, so a retry after an unknown outcome
+  # returns the first copy instead of queueing a second one (#2717).
+  case "${1:-}" in
+    --message-id)
+      [ "$#" -gt 1 ] || { echo "aiur: message --message-id requires a value" >&2; exit 64; }
+      message_id="$2"
+      message_id_given=1
+      shift 2
+      ;;
+    --message-id=*)
+      message_id="${1#--message-id=}"
+      message_id_given=1
+      shift
+      ;;
+  esac
+  if [ "$message_id_given" = 1 ] && [[ ! "$message_id" =~ ^[A-Za-z0-9._:-]{1,128}$ ]]; then
+    echo "aiur: message --message-id must be 1-128 letters, digits, '.', '_', ':' or '-' (it cannot be empty)" >&2
+    exit 64
+  fi
+
   local text="$*"
   if [ -z "$text" ]; then
     echo "$usage" >&2
@@ -2548,7 +2674,11 @@ cmd_message() {
 
   local encoded
   encoded="$(printf '%s' "$text" | base64 | tr -d '\n')"
-  run_control_rpc "Aiur.AgentControlCLI.message(\"$issue\", Base.decode64!(\"$encoded\"))"
+  if [ -n "$message_id" ]; then
+    run_control_rpc "Aiur.AgentControlCLI.message(\"$issue\", Base.decode64!(\"$encoded\"), \"$message_id\")"
+  else
+    run_control_rpc "Aiur.AgentControlCLI.message(\"$issue\", Base.decode64!(\"$encoded\"))"
+  fi
 }
 
 # `aiur agents` — concise one-line-per-agent state + current activity from a
@@ -2617,7 +2747,7 @@ encode_control_value() {
 # These are explicit trusted-Executor mutations, deliberately separate from
 # the read-only `commands` catalog. Revisions remain dashboard-owned.
 cmd_executor_answer() {
-  local decision_id="${1:-}" expected_version="" option_id="" custom_response="" rationale="" idempotency_key="" executor_id="aiur-cli" arg
+  local decision_id="${1:-}" expected_version="" option_id="" custom_response="" rationale="" idempotency_key="" executor_id="aiur-cli" supersede=0 arg
   if [ -z "$decision_id" ] || [[ "$decision_id" = -* ]]; then
     echo "aiur: executor-answer expects exactly one decision ID" >&2
     exit 64
@@ -2639,6 +2769,7 @@ cmd_executor_answer() {
       --idempotency-key=*) idempotency_key="${arg#--idempotency-key=}" ;;
       --executor-id) [ "$#" -gt 1 ] || { echo "aiur: executor-answer --executor-id requires a value" >&2; exit 64; }; shift; executor_id="$1" ;;
       --executor-id=*) executor_id="${arg#--executor-id=}" ;;
+      --supersede) supersede=1 ;;
       -*) echo "aiur: executor-answer received an unknown option: $arg" >&2; exit 64 ;;
       *) echo "aiur: executor-answer expects exactly one decision ID" >&2; exit 64 ;;
     esac
@@ -2663,6 +2794,9 @@ cmd_executor_answer() {
   opts="$opts, rationale: Base.decode64!(\"$(encode_control_value "$rationale")\")"
   opts="$opts, idempotency_key: Base.decode64!(\"$(encode_control_value "$idempotency_key")\")"
   opts="$opts, executor_id: Base.decode64!(\"$(encode_control_value "$executor_id")\")"
+  if [ "$supersede" -eq 1 ]; then
+    opts="$opts, supersede: true"
+  fi
   local AIUR_CONTROL_ATTEMPT_CONTEXT="decision ID ${decision_id} with expected version ${expected_version}"
   run_control_rpc "Aiur.AgentControlCLI.executor_answer([$opts])"
 }
@@ -3050,6 +3184,33 @@ cmd_executor_roster() {
   run_control_rpc "Aiur.AgentControlCLI.executor_roster(json: $json_arg)"
 }
 
+cmd_executor_fast_forward() {
+  local wake_id="${1:-}" as="" arg
+  [ -n "$wake_id" ] || { echo "aiur: executor-fast-forward expects a positive wake id" >&2; exit 64; }
+  shift
+  [[ "$wake_id" =~ ^[1-9][0-9]*$ ]] || { echo "aiur: executor-fast-forward expects a positive wake id" >&2; exit 64; }
+
+  while [ "$#" -gt 0 ]; do
+    arg="$1"
+    case "$arg" in
+      --as)
+        shift
+        [ "$#" -gt 0 ] && [ -n "${1:-}" ] || { echo "aiur: executor-fast-forward --as requires a consumer id" >&2; exit 64; }
+        as="$1"
+        ;;
+      --as=*)
+        as="${arg#--as=}"
+        [ -n "$as" ] || { echo "aiur: executor-fast-forward --as requires a consumer id" >&2; exit 64; }
+        ;;
+      *) echo "aiur: executor-fast-forward accepts <wake-id> and --as <id>" >&2; exit 64 ;;
+    esac
+    shift
+  done
+
+  executor_validate_consumer_id "$as" "executor-fast-forward"
+  run_control_rpc "Aiur.AgentControlCLI.executor_fast_forward($wake_id, [$(executor_as_keyword "$as")])"
+}
+
 cmd_executor_claim() {
   local as="" arg
   while [ "$#" -gt 0 ]; do
@@ -3347,8 +3508,9 @@ cmd_stop() {
   export RELEASE_NODE ERL_EPMD_ADDRESS
   resolve_control_identity_from_records
 
-  local workspace_root_file
+  local workspace_root_file agent_pidfile
   workspace_root_file="$(workspace_root_file_from_instance_record 2>/dev/null || true)"
+  agent_pidfile="$(agent_pidfile_from_instance_record 2>/dev/null || true)"
 
   local tmux_bin
   tmux_bin="$(command -v tmux || true)"
@@ -3407,16 +3569,13 @@ cmd_stop() {
     "$tmux_bin" -L "$socket" kill-server 2>/dev/null || true
   fi
 
-  # Belt-and-suspenders for a mid-turn stop: sweep any headless agent (this run
-  # or a prior crashed one) still recorded in a pidfile. comm-guarded, so a
-  # recycled pid is spared. Empty socket: the kill-server above already ran.
-  local session_root agentfile
-  session_root="${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}"
-  for agentfile in "$session_root"/aiur-*-agents; do
-    [ -e "$agentfile" ] || continue
-    reap_aiur_agents "" "$agentfile"
-    rm -f "$agentfile" 2>/dev/null || true
-  done
+  # Belt-and-suspenders for this run's headless agents after the BEAM exits.
+  # The instance record owns its pidfile; a global sweep can kill live agents
+  # belonging to another instance that shares the runtime directory.
+  if [ -n "$agent_pidfile" ] && [ -e "$agent_pidfile" ]; then
+    reap_aiur_agents "" "$agent_pidfile"
+    rm -f "$agent_pidfile" 2>/dev/null || true
+  fi
 
   reap_stale_manual_smoke 0
   sweep_dead_tmux_sockets
@@ -3902,10 +4061,6 @@ aiur_engine_main() {
     findings)
       run_findings "$@"
       ;;
-    guard-pr-deletions)
-      shift
-      "$engine_dir/guard-pr-deletions.sh" "$@"
-      ;;
     ask | asks)
       run_asks "$@"
       ;;
@@ -3996,6 +4151,10 @@ aiur_engine_main() {
       shift
       cmd_executor_roster "$@"
       ;;
+    executor-fast-forward)
+      shift
+      cmd_executor_fast_forward "$@"
+      ;;
     executor-claim)
       shift
       cmd_executor_claim "$@"

package/libexec/aiur-pane-ctrlc

@@ -0,0 +1,135 @@
+#!/usr/bin/env sh
+# Opencode pane Ctrl+C bridge. Bound to `C-c` for non-agent-list panes in
+# aiur.tmux.conf. Asks Aiur what a Ctrl+C should do for the agent painted
+# into this pane (drain a queued message, pause an idle agent, or close
+# the pane when already paused) and acts on the answer.
+#
+# The whole point is safe degradation: if Aiur is unreachable, the URL is
+# unset, or anything else goes wrong, we fall back to plain `kill-pane`,
+# which is exactly the pre-bridge behaviour. The 3-state UX is a pure
+# enhancement layered on top — a failure here never strands the Executor
+# with a pane they cannot close.
+#
+# Args:
+#   $1  tmux pane id (e.g. "%9")
+#   $2  control base URL (e.g. "http://127.0.0.1:4000"), may be empty
+#
+# Runs inside tmux `run-shell`, so `$TMUX` is set and a bare `tmux`
+# command targets the same server/socket.
+set -u
+
+pane_id="${1:-}"
+control_url="${2:-}"
+# Optional action: "hide" skips the 3-state interrupt query and goes
+# straight to hide-with-kill-fallback (the Ctrl+Q binding's path).
+mode="${3:-interrupt}"
+
+# Always-on breadcrumb so a Ctrl+C that closes a pane leaves evidence of which
+# branch ran — the tmux binding and this helper are otherwise invisible to
+# aiur.log. One line per press; pane id and outcome only, never the URL.
+log_ctrlc() {
+  printf '%s ctrlc pane_id=%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$pane_id" "$1" \
+    >> "${TMPDIR:-/tmp}/aiur-ctrlc.log" 2>/dev/null || true
+}
+
+close_pane() {
+  log_ctrlc "action=close_pane reason=${1:-degraded}"
+  [ -n "$pane_id" ] && tmux kill-pane -t "$pane_id" 2>/dev/null
+  exit 0
+}
+
+# Closing a chat pane must never kill the opencode-attach process — ask
+# Aiur to HIDE the pane (move it to the warm window, slot binding kept)
+# so reopening swaps the same pane back instantly. Only when the hide
+# call fails (Aiur down, unknown pane) does this degrade to kill-pane.
+hide_pane() {
+  if [ -n "$control_url" ]; then
+    # shellcheck disable=SC2086
+    if curl -fsS -m 2 \
+      -H 'X-Aiur-Request: 1' \
+      -H 'Origin: http://127.0.0.1' \
+      --data-urlencode "pane_id=${pane_id}" \
+      $auth_args \
+      "${control_url}/api/v1/pane/hide" >/dev/null 2>&1; then
+      log_ctrlc "action=hide_pane reason=${1:-requested}"
+      exit 0
+    fi
+  fi
+
+  close_pane "hide_failed_${1:-requested}"
+}
+
+# No pane to act on, or no idea where Aiur is listening: degrade to close.
+[ -z "$pane_id" ] && exit 0
+
+# Loopback dashboards bind without auth; only attach credentials when the
+# Executor has explicitly configured them for a non-loopback bind.
+auth_args=""
+if [ -n "${AIUR_DASHBOARD_USERNAME:-}" ] && [ -n "${AIUR_DASHBOARD_PASSWORD:-}" ]; then
+  auth_args="--user ${AIUR_DASHBOARD_USERNAME}:${AIUR_DASHBOARD_PASSWORD}"
+fi
+
+# Ctrl+Q path: unconditional hide (kill only as fallback).
+[ "$mode" = "hide" ] && hide_pane "ctrl_q"
+
+[ -z "$control_url" ] && close_pane "no_control_url"
+
+# The interrupt timeout MUST exceed the orchestrator's own 5s
+# GenServer.call timeout: that call serializes behind the single
+# Orchestrator mailbox, so under load the reply can take seconds. A
+# shorter curl timeout abandons a call that would have succeeded and then
+# (below) degraded to a destructive kill — exactly the race that reset a
+# live conversation when Ctrl+C was pressed on a busy agent.
+# shellcheck disable=SC2086
+response="$(
+  curl -fsS -m 8 \
+    -H 'X-Aiur-Request: 1' \
+    -H 'Origin: http://127.0.0.1' \
+    --data-urlencode "pane_id=${pane_id}" \
+    $auth_args \
+    "${control_url}/api/v1/pane/interrupt" 2>/dev/null
+)"
+curl_status=$?
+
+# Curl failed: distinguish "aiur busy" from "aiur unreachable" so a slow
+# call never costs the Executor their live pane. Exit 28 is a timeout —
+# the dashboard is alive and the interrupt is almost certainly still
+# being processed server-side, so KEEP THE PANE OPEN (killing it here is
+# what broke the opencode pipe, tripped :repl_gone, and re-dispatched a
+# fresh session). Any other non-zero (connection refused, DNS, HTTP
+# error) means aiur is unreachable or erroring: degrade to a
+# non-destructive hide (session + attach survive); hide_pane itself falls
+# back to kill only if the hide call also fails.
+if [ "$curl_status" -ne 0 ]; then
+  if [ "$curl_status" -eq 28 ]; then
+    log_ctrlc "action=keep_open reason=curl_timeout"
+    exit 0
+  fi
+  hide_pane "curl_failed_${curl_status}"
+fi
+
+# opencode owns the interrupt for codex/opencode agents: forward its native
+# interrupt key (Esc) to the pane so it drains its queued Executor message and
+# keeps working. Aiur mutates no state on this reply; the keystroke is the
+# whole effect. Pane stays open.
+case "$response" in
+  *send_interrupt*)
+    tmux send-keys -t "$pane_id" Escape 2>/dev/null
+    log_ctrlc "action=send_interrupt response=${response}"
+    exit 0
+    ;;
+esac
+
+# The agent handled the keypress (interrupted its REPL turn or paused). Leave
+# the pane open so the Executor stays in the conversation.
+case "$response" in
+  *interrupted* | *pause_requested* | *paused*)
+    log_ctrlc "action=keep_open response=${response}"
+    exit 0
+    ;;
+esac
+
+# close_pane, an error, or any unexpected body: hide the pane (the
+# paused agent's session and attach process stay alive; reopen swaps the
+# same pane back). Kill only when the hide call itself fails.
+hide_pane "response=${response}"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiur-cli",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "AI Unit Runtime for Executors.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/aiur-team/aiur",
@@ -18,7 +18,7 @@
   "files": [
     "bin/aiur.js",
     "libexec/aiur-engine.sh",
-    "libexec/guard-pr-deletions.sh",
+    "libexec/aiur-pane-ctrlc",
     "scripts/postinstall.mjs",
     "share/aiur.tmux.conf"
   ],
@@ -35,8 +35,8 @@
   ],
   "opencodeVersion": "1.17.10",
   "optionalDependencies": {
-    "aiur-cli-linux-x64": "0.0.5",
-    "aiur-cli-linux-arm64": "0.0.5",
-    "aiur-cli-darwin-arm64": "0.0.5"
+    "aiur-cli-linux-x64": "0.0.6",
+    "aiur-cli-linux-arm64": "0.0.6",
+    "aiur-cli-darwin-arm64": "0.0.6"
   }
 }

package/share/aiur.tmux.conf

@@ -19,6 +19,15 @@ set -g mouse on
 # for the agent list pane's Shift+Enter "open in new pane" keybind.
 set -s extended-keys on
 set -as terminal-features "*:extkeys"
+# Advertise synchronized-output (DEC private mode 2026) support to tmux so
+# it presents each agent-list frame atomically to the attached client. The
+# renderer wraps every frame in `\e[?2026h … \e[?2026l`; without this
+# feature tmux applies the app's sync internally but still streams partial
+# cell updates to the outer terminal, so a multi-byte glyph (emoji, box
+# drawing, the 🔄 title / events `💬`) caught mid-repaint flashes as `?`
+# replacement chars just above the "oldest" divider. Modern terminals
+# (iTerm2, kitty, wezterm, Ghostty, recent xterm/VTE) all support 2026.
+set -as terminal-features "*:sync"
 set -g status off
 
 # Show each pane's title in a one-line top border. PaneManager sets every
@@ -58,9 +67,24 @@ bind-key -n M-Tab  select-pane -t :.0
 # tmux/tmux#882).
 set -gq @aiur_ctrlc ''
 set -gq @aiur_control_url ''
+# NB: reference `#{q:@aiur_ctrlc}` inline rather than via a `h=...; $h` shell
+# variable. tmux re-parses this double-quoted run-shell argument when if-shell
+# dispatches it and expands `$h` itself (to empty), so a shell-variable form
+# silently falls through to the `else` branch and raw-kills the pane. `q:`
+# shell-escapes installed paths, including quotes and whitespace.
 bind-key -n C-c if-shell -F '#{==:#{pane_index},0}' \
                  'kill-session' \
-                 'run-shell "h=\"#{@aiur_ctrlc}\"; if [ -x \"$h\" ]; then \"$h\" \"#{pane_id}\" \"#{@aiur_control_url}\"; else tmux kill-pane -t \"#{pane_id}\"; fi"'
+                 'run-shell "if [ -x #{q:@aiur_ctrlc} ]; then #{q:@aiur_ctrlc} \"#{pane_id}\" \"#{@aiur_control_url}\"; else tmux kill-pane -t \"#{pane_id}\"; fi"'
+
+# Ctrl+Q closes a chat pane WITHOUT touching agent state — no pause, and
+# the opencode-attach process survives: the helper asks Aiur to HIDE the
+# pane (move to the warm window), so reopening from the agent list swaps
+# the same pane back instantly. Degrades to kill-pane when the helper or
+# Aiur is unreachable. On the agent list itself (pane 0) it is a
+# deliberate no-op; do NOT mirror the C-c binding's pane-0 kill-session.
+bind-key -n C-q if-shell -F '#{==:#{pane_index},0}' \
+                 '' \
+                 'run-shell "if [ -x #{q:@aiur_ctrlc} ]; then #{q:@aiur_ctrlc} \"#{pane_id}\" \"#{@aiur_control_url}\" hide; else tmux kill-pane -t \"#{pane_id}\"; fi"'
 
 # Pane layout is owned exclusively by `Aiur.PaneManager`, which applies an
 # explicit `select-layout <string>` after every slot change. No

package/libexec/guard-pr-deletions.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-readonly deletion_threshold=50
-base_branch="${1:-${AIUR_BASE_BRANCH:-}}"
-
-if [[ -z "$base_branch" ]]; then
-  echo "guard-pr-deletions: base branch is required (argument or AIUR_BASE_BRANCH)" >&2
-  exit 2
-fi
-
-if ! git diff --quiet || ! git diff --cached --quiet; then
-  echo "guard-pr-deletions: tracked changes must be committed before checking PR deletions" >&2
-  exit 2
-fi
-
-if ! git fetch --quiet --no-tags origin "refs/heads/$base_branch"; then
-  echo "guard-pr-deletions: could not fetch origin/$base_branch; refusing to use a stale base" >&2
-  exit 2
-fi
-
-if ! base_sha="$(git rev-parse --verify 'FETCH_HEAD^{commit}')"; then
-  echo "guard-pr-deletions: fetched base commit is unavailable" >&2
-  exit 2
-fi
-
-scratch_dir="$(mktemp -d)"
-trap 'rm -rf "$scratch_dir"' EXIT
-
-git diff --diff-filter=D --name-only "$base_sha"..HEAD | LC_ALL=C sort -u >"$scratch_dir/deleted"
-deleted_count="$(wc -l <"$scratch_dir/deleted" | tr -d ' ')"
-
-if ((deleted_count <= deletion_threshold)); then
-  echo "guard-pr-deletions: $deleted_count untouched file deletions (limit: $deletion_threshold)"
-  exit 0
-fi
-
-branch_start="${AIUR_BRANCH_START_SHA:-}"
-
-if [[ -z "$branch_start" ]] && git rev-parse --verify --quiet 'refs/aiur/branch-start^{commit}' >/dev/null; then
-  branch_start="$(git rev-parse --verify 'refs/aiur/branch-start^{commit}')"
-fi
-
-if [[ -z "$branch_start" ]]; then
-  echo "guard-pr-deletions: refusing $deleted_count deletions because the workspace branch-start ref is unavailable" >&2
-  exit 1
-fi
-
-if ! git merge-base --is-ancestor "$branch_start" HEAD; then
-  echo "guard-pr-deletions: workspace branch-start $branch_start is not an ancestor of HEAD" >&2
-  exit 2
-fi
-
-git log --format= --name-only "$branch_start"..HEAD | sed '/^$/d' | LC_ALL=C sort -u >"$scratch_dir/touched"
-# Both inputs are sorted with LC_ALL=C, so comm must compare with the same
-# collation. Under a UTF-8 locale comm reads C-sorted input as unsorted (any
-# mix of upper- and lower-case initial paths, e.g. README.md beside src/...)
-# and its output on unsorted input is undefined -- it can drop rows, which
-# would make this guard under-count untouched deletions and fail open.
-LC_ALL=C comm -23 "$scratch_dir/deleted" "$scratch_dir/touched" >"$scratch_dir/untouched-deletions"
-
-untouched_count="$(wc -l <"$scratch_dir/untouched-deletions" | tr -d ' ')"
-
-if ((untouched_count > deletion_threshold)); then
-  echo "guard-pr-deletions: refusing PR with $untouched_count untouched file deletions (limit: $deletion_threshold)" >&2
-  sed -n '1,20p' "$scratch_dir/untouched-deletions" >&2
-  exit 1
-fi
-
-echo "guard-pr-deletions: $untouched_count untouched file deletions (limit: $deletion_threshold)"