dsh-ssh-tui 0.7.4 → 0.8.1

package/lib/tui.js

@@ -32,22 +32,26 @@ import { buildReviewUserMessage, parseReviewOutput, reviewSystemPrompt } from '.
 import { loadProviderCatalog, mergeProviderEntries } from './provider-catalog.js';
 import { catalogContextWindow, catalogWindowIndex, suggestedRouteContextWindow, } from './context-window.js';
 import { formatFooterCwd } from './session-list.js';
+import { pruneBlankSessions } from './session-list.js';
 import { collectDiag, formatDiag } from './diag.js';
 import { ApprovalVerdictCache, cacheableShape, verdictKey } from './approval-cache.js';
 import { collectDoctor, doctorChecks, formatDoctorReport, rowsToRepair } from './doctor.js';
 import { colorDepth, downgradeSgr } from './color-depth.js';
 import { appendRow, lineModeEnabled, lineModeLines } from './line-mode.js';
 import { keymapReport, resolveKeymap } from './keymap.js';
+import { classifyAuthFailure, isReasoningReplayFailure } from './auth-failure.js';
+import { resolveTheme, setActiveTheme, themeByName, themeEmphasisToken, themeExtraToken, themeNames, themeToken, } from './theme.js';
 import { presetLabel, profileFromArgv } from './preset-label.js';
 import { flattenGroups, groupPresets, optionMatches } from './preset-picker.js';
 import { isRefusal, planCopy, planDelete, planMetadata, presetDirectory, } from './preset-authoring.js';
 import { ensureRosterRows, planDuplicateRepair, planRosterRepair, formsRowsDeclared, rosterPatchPath, rosterRows, writePatchWithBackup, ALL_ROSTER_ROWS, } from './preset-rows.js';
 import { SessionStatsTracker, statsRowOf } from './stats.js';
-import { QUESTION_OPTION_KEYS, applyQuestionFilter, backspaceQuestionFilter, clearQuestionFilter, typeQuestionFilter, visibleQuestionIndexes, confirmAnswer, inspectClosesOn, moveQuestionCursor, optionsLength, questionOptionIndex, questionSubmit, selectQuestionOptionByKey, } from './dialogs.js';
+import { QUESTION_OPTION_KEYS, applyQuestionFilter, backspaceQuestionFilter, clearQuestionFilter, typeQuestionFilter, visibleQuestionIndexes, confirmAnswer, inspectClosesOn, moveQuestionCursor, optionsLength, questionOptionIndex, initialQuestionSelection, questionOptionMarker, questionSubmit, selectQuestionOptionByKey, } from './dialogs.js';
 import { commandSuggestions, localizedCommands } from './commands.js';
 import { archiveStalePlans, boundTranscriptRows, findLivePlanRow, findMergeableToolRow, findToolRowByCallId, mergeToolCard, planShouldDefaultExpand, windowTranscript, } from './rows.js';
 import { detachFromSshSession, DisplayHost, isTuiHostProcess, resolveDshHome, sessionSockPath } from './display-sock.js';
 import { displayHomePath, envFileName, hostHasOwnConsole, IS_WINDOWS, restrictPathToUser, usesSigwinch, } from './platform.js';
+import { asciiFallbackEnabled } from './platform.js';
 import { bracketedPasteSequence, mouseDisableSequence, mouseEnableSequence, terminalCapabilities, } from './terminal-caps.js';
 import { sameSessionRoute, sessionRouteInput } from './session-route.js';
 import { GATEWAY_PROTOCOL_SUFFIX, GATEWAY_PROTOCOL_ENDPOINT, GATEWAY_PROTOCOL_PREFERENCE, advertisedProtocols, baseProviderIdOf, declaredProtocol, gatewayModelTable, gatewayServesModel, siblingProviderId, splitModelsByProtocol, } from './gateway-protocol.js';
@@ -62,7 +66,7 @@ import { displayToolName, subagentCourtesyName } from './job-label.js';
 import { clearWaitingMarker, notifyCommand, notifyTargetCommand, notifyTargetLabel, parseNotifyTarget, runNotify, writeWaitingMarker, } from './question-wait.js';
 import { changesFileLine, changesHeader, changesRemainderLine, changesSummaryVisible, renderChangesDiff, workspaceChangesOf, } from './workspace-changes.js';
 import { UserQuestionError, } from '@deepseek-ai/dsh-user-questions';
-import { clipAnsiToWidth, hrefAtColumn, osc52Clipboard, paintedLinkHits, cursorVisualPosition, displayWidth, foldInputView, fmtElapsedCompact, highlightAnsiNeedle, searchContains, lastCodePoints, padToWidth, sliceCodePoints, paintSegmentedLine, renderMarkdownLines, repeatToWidth, sanitizeTerminalText, shimmerText, stripAnsi, truncate, truncateToWidth, waitCardCopy, wrap, wrapSegmented, wrapWaitDetails, } from './term-text.js';
+import { clipAnsiToWidth, cursorVisualPosition, displayWidth, fmtElapsedCompact, foldInputView, highlightAnsiNeedle, hrefAtColumn, lastCodePoints, osc52Clipboard, padToWidth, paintSegmentedLine, paintedLinkHits, renderMarkdownLines, repeatToWidth, sanitizeTerminalText, searchContains, setAmbiguousWidthMeasured, setAmbiguousWidthReserve, shimmerText, sliceCodePoints, stripAnsi, truncate, truncateToWidth, waitCardCopy, wrap, wrapSegmented, wrapWaitDetails, } from './term-text.js';
 import { clampSelection, offsetAfterColumn, offsetAtColumn, selectionSpans, selectionText, } from './selection.js';
 import { captureHangupSignals, advancePaintedRows, composePaintFrame, composePaintOutput, frameByteBudget, detectSshSession, formatLinkQualityChip, HANGUP_CANCEL_TIMEOUT_MS, ignoreFurtherHangupSignals, isEscapePrefix, isHangupErrno, linkQualityOf, parseCursorPositionReply, PICKER_WINDOW, pickerWindowStart, probeTerminalRttMs, releaseHangupSignals, resolvePaintIntervalMs, toolBodyLineLimit, waitUntilIdleOrTimeout, RTT_HISTORY, medianRtt, } from './paint.js';
 import { TerminalInputGuard } from './terminal-input.js';
@@ -230,6 +234,21 @@ function isModelsStep(step) {
 const COMPACTION_STALE_MS = 15 * 60_000;
 /** How many `<family>\0<model>` → row decisions are remembered. */
 const FAMILY_OWNER_CACHE_MAX = 512;
+/** Lifecycle handle for a mounted interactive terminal channel. */
+/**
+ * Row fields the display rendering reads, for the per-row render cache.
+ *
+ * Kept next to the cache's fingerprint rather than beside the row type: the list
+ * only has to be complete for *rendering* purposes, and a single place makes it
+ * obvious what to extend when the rendering starts reading something new.
+ */
+const SCALAR_KEY_FIELDS = [
+    'kind', 'text', 'summary', 'detail', 'header', 'title', 'output', 'planMarkdown',
+    'blockedReason', 'diff', 'command', 'expanded', 'archived', 'status', 'phase', 'signal',
+    'more', 'startedAt', 'endedAt', 'flipUntil', 'modelProvider', 'provider', 'model', 'id', 'callId',
+];
+/** Row fields holding structures the rendering walks; compared one level deep. */
+const NESTED_KEY_FIELDS = ['todos', 'sources', 'intent'];
 /**
  * A short duration in the shortest useful unit: `12s` / `3m` / `1h`.
  * Locale-neutral on purpose — it reads the same in both catalogs.
@@ -281,10 +300,6 @@ const LINE_MODE_INSPECT_LINES = 80;
  * a changed word is marked without stepping outside the muted palette. The
  * fills they lighten live in `styleLine` (`diff-add` / `diff-del`).
  */
-const DIFF_EMPHASIS_SGR = {
-    'diff-add': '38;2;198;232;190;48;2;34;72;44',
-    'diff-del': '38;2;246;206;206;48;2;86;34;34',
-};
 const STALL_WARNING_MS = 60000;
 /** Bytes already queued for the terminal before a frame is skipped instead. */
 const STDOUT_BACKLOG_BYTES = 32 * 1024;
@@ -681,6 +696,149 @@ export class SshTui {
     commandSuggestions = [];
     suggestionIndex = 0;
     focusedRow = null;
+    /**
+     * The active palette. Roles resolve through `theme.ts`, so switching themes is
+     * a repaint, not a re-render — no row holds a colour of its own.
+     */
+    theme = resolveTheme(undefined);
+    /**
+     * Rendered display lines per row, keyed by the row object.
+     *
+     * Every frame used to re-render the whole transcript — markdown parsing, card
+     * layout, wrapping and clipping for thousands of rows — to show the twenty on
+     * screen. Measured on a 5000-row session that was ~550 ms per frame, which is
+     * what "rendering feels slower the longer the session runs" was: a keystroke
+     * costs the same as a full repaint because both redo all of it.
+     *
+     * The cache is `WeakMap`-keyed on the row object, so a replaced row starts a new
+     * entry and an unreferenced one is collected. What each entry stores is a
+     * *fingerprint* of every input the row's rendering depends on plus the lines it
+     * produced; a row whose fingerprint is unchanged replays instead of re-rendering,
+     * which is the common case — during a turn only the streaming row changes.
+     */
+    displayRowCache = new WeakMap();
+    /** Fingerprint of the state that affects *every* row's rendering. */
+    displayBaseKey(width) {
+        return [
+            width,
+            String(this.isCompactView()),
+            this.showReasoning === true ? 'r' : '-',
+            this.searchIndex,
+            this.searchHits.length,
+            this.theme.name,
+            this.colorDepth,
+            this.focusedRow === null ? '' : String(this.focusedRow.kind ?? 'block'),
+            String(this.paintTailBudget),
+            this.pendingReveal === undefined ? '' : String(this.pendingReveal),
+            asciiFallbackEnabled() ? 'ascii' : 'utf8',
+        ].join('|');
+    }
+    /**
+     * Fingerprint of one tool burst.
+     *
+     * A burst is a *group of tool rows drawn inside the reply above them*, so the
+     * reply's cached lines contain cards belonging to rows the reply's own
+     * fingerprint never sees. Without this, the reply kept replaying its cached
+     * burst: a finished tool went on saying "processing" and the stale card stayed
+     * on screen beside the live one — the residue a reader reported twice.
+     */
+    static burstKey(groups) {
+        const one = (rows) => rows.map(row => {
+            const loose = row;
+            const output = typeof loose.output === 'string' ? loose.output.length : 0;
+            return `${String(loose.callId ?? '')}/${String(loose.status ?? '')}/${output}`;
+        }).join(',');
+        return `${one(groups.edits)}#${one(groups.calls)}`;
+    }
+    /**
+     * Whether a row's rendering depends on the clock.
+     *
+     * A running card draws a spinner and an elapsed time, and a streaming row is
+     * being appended to: their *fields* may not change between two frames while
+     * their lines must. Such a row gets a tick in its cache key, so it re-renders
+     * every frame and becomes cacheable again once it settles. A frozen spinner was
+     * the alternative — and, once the same card was also drawn live elsewhere, the
+     * duplicate a reader actually reported.
+     */
+    static isLiveRow(row) {
+        const loose = row;
+        if (String(loose.kind ?? '').startsWith('streaming'))
+            return true;
+        if (loose.status === 'running')
+            return true;
+        if (loose.endedAt === undefined && loose.startedAt !== undefined)
+            return true;
+        const flipUntil = loose.flipUntil;
+        return typeof flipUntil === 'number' && flipUntil > Date.now();
+    }
+    /**
+     * Fingerprint of everything one row's rendering reads.
+     *
+     * Written by hand rather than hashing the object: the rendering reads a known
+     * set of fields, and a generic walk would cost more per frame than the render
+     * it is meant to avoid. Scalar fields are compared by value; nested arrays the
+     * rendering walks (todos, sources, intent) get a shallow signature of their own
+     * scalars, because those are updated in place.
+     *
+     * The list is a contract: a field the rendering starts reading must be added
+     * here, or a frame replays stale lines. A test mutates one field in place and
+     * asserts the next frame notices, which is the pattern to copy for a new field.
+     */
+    static rowKey(row) {
+        const loose = row;
+        let key = '';
+        for (const field of SCALAR_KEY_FIELDS) {
+            const value = loose[field];
+            key += typeof value === 'string' ? `${value.length}:${value.charCodeAt(0)}:${value.charCodeAt(value.length - 1)};`
+                : value === undefined ? '-;'
+                    : `${String(value)};`;
+        }
+        for (const field of NESTED_KEY_FIELDS) {
+            const value = loose[field];
+            if (value === undefined) {
+                key += '-;';
+                continue;
+            }
+            if (!Array.isArray(value)) {
+                key += `o${Object.keys(value).length};`;
+                continue;
+            }
+            key += `a${value.length}:`;
+            // Bounded: a list longer than this changes its length when it changes, and
+            // walking hundreds of items per frame would defeat the cache.
+            for (const item of value.slice(0, 24)) {
+                if (item === null || typeof item !== 'object') {
+                    key += String(item) + ',';
+                    continue;
+                }
+                for (const [name, inner] of Object.entries(item)) {
+                    key += name + '=' + (typeof inner === 'string' ? inner.length : String(inner)) + ',';
+                }
+                key += '|';
+            }
+            key += ';';
+        }
+        return key;
+    }
+    static rowRendersEqual(row, entry, key) {
+        return entry !== undefined && entry.key === key;
+    }
+    /**
+     * The text of the last prompt the user sent, kept so an opted-in retry can
+     * send the same thing again after a provider-side auth failure. Cleared when
+     * the retry fires, which is what bounds it to one attempt per user message.
+     */
+    /**
+     * Whether this session ever saw the reader's input.
+     *
+     * A fresh launch creates a session before anything is typed; quitting straight
+     * away leaves an artifact the TUI hides but other profiles' menus list. On the
+     * way out, a session that never saw input is deleted (see `session-blank.ts`).
+     */
+    sawUserInput = false;
+    lastUserText = '';
+    /** Set on every turn/start; a retry consumes it. */
+    authRetryArmed = false;
     pendingMessages = new Map();
     lastActivity = Date.now();
     lastIdleCtrlCAt = 0;
@@ -859,6 +1017,11 @@ export class SshTui {
         // The palette the terminal can take, decided once: a truecolor pair on an
         // 8-colour terminal is not a cosmetic loss, it is the wrong colour.
         this.colorDepth = config.color === false ? 'none' : colorDepth(process.env);
+        // The theme is a live setting: `DSH_TUI_THEME` wins for one launch, the
+        // `ssh-tui` settings section remembers the user's choice across them.
+        // Publish as well as store: the footer, plan dock, tool cards and markdown
+        // renderers have no session handle and read the active palette.
+        this.theme = setActiveTheme(process.env.DSH_TUI_THEME ?? this.readThemeName());
         this.color = this.colorDepth !== 'none';
         this.lastSessionRoute = config.restoredRoute;
         this.maxToolOutputLines = Math.max(1, config.maxToolOutputLines ?? 6);
@@ -1268,7 +1431,10 @@ export class SshTui {
             addDisplay(this.selectLine(styled, this.focusedRow === anchor), anchor);
             // A collapsed burst is all the reader sees, so the two things that decide
             // whether to expand belong on it: which files moved, and what failed.
-            if (kind === 'edits') {
+            // The breakdown is for a burst that touched *several* files: with one
+            // file the header below already carries its path and its diffstat, and
+            // repeating them printed the same line twice.
+            if (kind === 'edits' && groups.edits.length > 1) {
                 const stats = compactFileStats(groups.edits);
                 const shown = stats.slice(0, MAX_COMPACT_FILE_STATS);
                 const parts = shown.map(stat => `${stat.path} ${diffStatToken(stat.add, stat.del)}`.trim());
@@ -1280,7 +1446,9 @@ export class SshTui {
                 }
             }
             for (const line of compactFailureLines(items)) {
-                addDisplay(this.styleLine('error', truncateToWidth(`    ${line}`, width)), anchor);
+                // Same grammar as the header: the state ball is what marks a line as a
+                // tool's, and a failure that is only red text loses that reading.
+                addDisplay(this.styleLine('error', truncateToWidth(`    ● ${line}`, width)), anchor);
             }
             return;
         }
@@ -2069,6 +2237,15 @@ export class SshTui {
             onRtt: (rttMs) => {
                 this.applyProbedRtt(rttMs);
             },
+            onMetrics: metrics => {
+                // The relay measured the terminal this session is displayed on. Adopt it
+                // and repaint from scratch: every cached line was measured with the old
+                // table, so a diff against them would compare different widths.
+                setAmbiguousWidthMeasured(metrics.wide);
+                setAmbiguousWidthReserve(metrics.reserve);
+                this.forceFullPaint = true;
+                this.markDirty();
+            },
             onDetach: (info) => {
                 this.handleDisplayDetach(info);
             },
@@ -3210,7 +3387,74 @@ export class SshTui {
             && this.rows.length > this.paintTailBudget + 8;
         const historyStart = skipMiddle ? Math.max(0, this.rows.length - this.paintTailBudget) : 0;
         let paintedLeadingCompact = skipMiddle;
+        // Per-row render cache. A row whose fingerprint is unchanged replays its
+        // lines instead of re-rendering them, which is what turns a frame from
+        // "parse every markdown block in the transcript" into "parse the one that
+        // changed". The base key covers the state every row reads (width, view mode,
+        // focus, search, theme, ascii fallback); the row key covers its own fields.
+        const displayBase = this.displayBaseKey(width);
+        // The row body has several `continue`s, so its cache entry is written when the
+        // *next* row starts (and once after the loop) rather than at every exit.
+        let pendingFinish;
+        const flushPending = () => {
+            const finish = pendingFinish;
+            pendingFinish = undefined;
+            finish?.();
+        };
+        // Two of the row body's inputs come from *other* rows: whether this is still
+        // in the "leading" stretch of a compact view (which flips once an assistant
+        // or user row has been painted) and whether the row is folded into a tool
+        // burst rendered by the reply above it. Leaving them out of the cache key is
+        // what put a second copy of a running card on screen — the stale entry
+        // replayed lines for a row that now renders inside its reply's burst.
+        let leadingPhase = skipMiddle;
+        // One tick per frame, shared by every live row: coarse enough not to churn a
+        // key mid-frame, fine enough that a spinner or an elapsed time moves.
+        const liveTick = Math.floor(Date.now() / 200);
         for (let rowIndex = 0; rowIndex < this.rows.length; rowIndex += 1) {
+            flushPending();
+            const cachedRow = this.rows[rowIndex];
+            const inBurst = compact && cachedRow !== undefined && compactBurstByReply.has(cachedRow);
+            let cacheKey;
+            if (cachedRow !== undefined && !skipMiddle) {
+                const live = SshTui.isLiveRow(cachedRow);
+                // The burst belongs to this row's rendering even though its rows are
+                // elsewhere in the transcript, so its content is part of the key.
+                const burst = inBurst ? compactBurstByReply.get(cachedRow) : undefined;
+                const leadingBurst = compact && !leadingPhase && (cachedRow.kind === 'assistant' || cachedRow.kind === 'user')
+                    ? compactBursts.find(candidate => candidate.after === undefined)
+                    : undefined;
+                const burstKey = burst === undefined && leadingBurst === undefined
+                    ? '-'
+                    : `${burst === undefined ? '' : SshTui.burstKey(burst.groups)}|${leadingBurst === undefined ? '' : SshTui.burstKey(leadingBurst.groups)}`;
+                cacheKey = `${displayBase}|${rowIndex === 4 ? 'fold' : ''}|${leadingPhase ? 'lead' : '-'}|${live ? `t${liveTick}` : 'settled'}|${burstKey}|${SshTui.rowKey(cachedRow)}`;
+                const entry = this.displayRowCache.get(cachedRow);
+                if (SshTui.rowRendersEqual(cachedRow, entry, cacheKey)) {
+                    for (const line of entry.lines)
+                        display.push(line);
+                    for (const ref of entry.refs)
+                        displayRefs.push(ref);
+                    for (const gutter of entry.gutters)
+                        displayGutters.push(gutter);
+                    // The body flips this flag when it paints an assistant/user row; the
+                    // replay has to do the same or the next row's key would lie.
+                    if (compact && (cachedRow.kind === 'assistant' || cachedRow.kind === 'user'))
+                        leadingPhase = true;
+                    continue;
+                }
+            }
+            const markStart = { line: display.length, ref: displayRefs.length, gutter: displayGutters.length };
+            const finishRow = () => {
+                if (cacheKey === undefined || cachedRow === undefined)
+                    return;
+                this.displayRowCache.set(cachedRow, {
+                    key: cacheKey,
+                    lines: display.slice(markStart.line),
+                    refs: displayRefs.slice(markStart.ref),
+                    gutters: displayGutters.slice(markStart.gutter),
+                });
+            };
+            pendingFinish = finishRow;
             if (skipMiddle && rowIndex >= 4 && rowIndex < historyStart) {
                 if (rowIndex === 4)
                     addDisplay(this.styleLine('system', t('history.folded')));
@@ -3448,6 +3692,13 @@ export class SshTui {
                 }
             }
         }
+        // Close the last row's cache entry here, and only here: everything below
+        // belongs to no row. Flushing after the live tail instead stored the tail in
+        // the last row's entry, so every later frame replayed a copy of the wait card
+        // at the elapsed time of the frame that stored it — a "processing" line
+        // frozen at 0s next to the live one, and a new copy each time another row
+        // became the last one.
+        flushPending();
         if (this.streaming !== undefined) {
             if (!compact && this.showReasoning && this.streaming.reasoning !== '') {
                 const block = this.streamingReasoning ??= { kind: 'streaming-reasoning', expanded: false };
@@ -3700,7 +3951,9 @@ export class SshTui {
                     const option = options[index];
                     if (option === undefined)
                         continue;
-                    const marker = d.selected.has(index) ? '●' : '○';
+                    // `●` follows the cursor: it is the row Enter submits. Ticked rows in a
+                    // multi-select list show `✓` so both facts stay visible at once.
+                    const marker = questionOptionMarker(d, index);
                     const key = QUESTION_OPTION_KEYS[index] ?? '↕';
                     const focused = index === d.cursor ? '›' : ' ';
                     const recommended = option.label === approve ? t('dialog.recommended') : '';
@@ -3751,7 +4004,9 @@ export class SshTui {
             suggestionLines.push(this.styleLine('system', fitLine(`  ${t('suggest.moreBelow', { count: this.commandSuggestions.length - suggestionEnd })}`)));
         }
         const promptPlain = this.color ? '❯ ' : '> ';
-        const prompt = this.color ? `\x1b[36m${promptPlain.trimEnd()}\x1b[0m ` : promptPlain;
+        const prompt = this.color
+            ? `\x1b[${themeExtraToken(this.theme, 'accent')}m${promptPlain.trimEnd()}\x1b[0m `
+            : promptPlain;
         const promptWidth = displayWidth(promptPlain);
         const masked = this.dialog?.kind === 'onboarding' && this.onboarding?.step === 'key';
         const inputTextWidth = Math.max(1, width - promptWidth);
@@ -3922,11 +4177,11 @@ export class SshTui {
         let statusLine = this.styleLine('system', statusText);
         if (this.color && this.contextPressure !== undefined) {
             const ring = formatContextPressureRing(this.contextPressure.percent);
-            statusLine = statusLine.replace(ring, `\x1b[${contextPressureRingColor(this.contextPressure.level)}m${ring}\x1b[0m\x1b[90m`);
+            statusLine = statusLine.replace(ring, `\x1b[${contextPressureRingColor(this.contextPressure.level)}m${ring}\x1b[0m\x1b[${themeToken(this.theme, 'system')}m`);
         }
         if (this.color) {
             const chip = identity.find(part => part.startsWith('sub:')) ?? '';
-            statusLine = paintFooterSubagentChip(statusLine, chip, footerSubagentForeign(footer), this.mutedSgr() || '90', this.colorDepth);
+            statusLine = paintFooterSubagentChip(statusLine, chip, footerSubagentForeign(footer), this.mutedSgr() || themeToken(this.theme, 'system'), this.colorDepth);
         }
         // The strip: one loss order for the groups a narrow terminal can do without.
         // Health leads because it is the only group that reports a broken install;
@@ -4582,31 +4837,17 @@ export class SshTui {
         return code === '' ? ' │ ' : `\x1b[${code}m │ `;
     }
     mutedSgr() {
-        return this.color ? downgradeSgr('90', this.colorDepth) : '';
+        return this.color ? downgradeSgr(themeToken(this.theme, 'system'), this.colorDepth) : '';
     }
     styleLine(kind, text) {
         const safe = sanitizeTerminalText(text);
         if (!this.color)
             return safe;
-        const requested = kind === 'user' ? '36' :
-            kind === 'assistant' ? '37' :
-                kind === 'reasoning' ? '2;3' :
-                    kind === 'brand' ? '1;38;2;77;107;253' :
-                        kind === 'tool' || kind === 'tool-result' ? '37' :
-                            // Codex-like: muted add/del that blend into the terminal background.
-                            kind === 'diff-add' ? '38;2;122;168;116;48;2;18;42;24' :
-                                kind === 'diff-del' ? '38;2;196;122;122;48;2;48;20;20' :
-                                    kind === 'diff-path' ? '1;36' :
-                                        kind === 'todo-done' ? '2;32' :
-                                            kind === 'todo-active' ? '1;36' :
-                                                kind === 'todo-failed' ? '31' :
-                                                    kind === 'todo-skipped' ? '2;33' :
-                                                        kind === 'todo-pending' ? '90' :
-                                                            kind === 'plan-dock' ? '38;5;180' :
-                                                                kind === 'subagent-header' ? '38;5;141' :
-                                                                    kind === 'diag' ? '2;36' :
-                                                                        kind === 'error' ? '31' :
-                                                                            '90';
+        // Roles, not colours: `theme.ts` owns the palette, this method owns the
+        // escaping. Primary text and tool output carry an empty token on purpose —
+        // they take the terminal's own foreground, which is the only choice that is
+        // readable on both light and dark terminals.
+        const requested = themeToken(this.theme, kind);
         const code = downgradeSgr(requested, this.colorDepth);
         // Nothing left to paint: the text stands on its own.
         if (code === '')
@@ -4624,7 +4865,7 @@ export class SshTui {
      * the inverse video stays for that case.
      */
     styleEmphasisedPiece(kind, text) {
-        const requested = DIFF_EMPHASIS_SGR[kind];
+        const requested = themeEmphasisToken(this.theme, kind);
         if (requested !== undefined && this.color) {
             const code = downgradeSgr(requested, this.colorDepth);
             if (code !== '')
@@ -5053,11 +5294,17 @@ export class SshTui {
                 if (this.hostApprovalPolicy === 'never')
                     this.warnApprovalMismatch();
                 break;
+            case 'user/message':
+                this.sawUserInput = true;
+                break;
             case 'turn/start':
                 this.stalledWarningShown = false;
                 this.turnSawOutput = false;
                 this.turnSawReasoning = false;
                 this.llmRetry = undefined;
+                // One automatic retry per user message, and only for the failure class
+                // that is worth retrying (see `auth-failure.ts`).
+                this.authRetryArmed = true;
                 this.status = `turn ${event.data.turn} running`;
                 // A turn is about to spend on this route: make sure the session's record
                 // names it, whatever changed it (a preset, a settings edit, a resume).
@@ -5094,6 +5341,7 @@ export class SshTui {
                         : `idle (${reason.kind})`;
                 if (reason.kind === 'error') {
                     this.pushRow({ kind: 'error', text: t('turn.failed', { turn: event.data.turn, error: reason.error.message }) });
+                    this.reportAuthFailure(String(reason.error.message ?? ''));
                 }
                 if (reason.kind === 'completed' && !this.replaying && !this.turnSawOutput) {
                     // The provider ended the turn without an answer. Some gateways map a
@@ -6614,7 +6862,7 @@ export class SshTui {
         this.removeQueuedDialog(dialog);
         dialog.resolve('cancel');
     }
-    openQuestion(question, index, total, resolve, reject, preselected, matchKeys) {
+    openQuestion(question, index, total, resolve, reject, preselected, matchKeys, onCursor) {
         // A list opens with its first option already chosen: Enter then answers that
         // default for a single- and a multi-select question alike, instead of
         // coming back with an empty selection. Esc stays the explicit cancel, and a
@@ -6623,14 +6871,26 @@ export class SshTui {
         const initial = preselected !== undefined && preselected >= 0 && preselected < optionCount
             ? preselected
             : optionCount > 0 ? 0 : -1;
+        // A single-select list opens with its first option chosen, so Enter answers
+        // that default (and moving the highlight moves the `●`).
+        //
+        // A **multi-select** list must open with nothing chosen. It used to inherit
+        // the same default, and the result was the worst kind of mis-answer: the
+        // reader moved the highlight to the row they wanted, pressed Enter, and got
+        // the first row — because `●` still sat on it. `questionSubmit` already
+        // falls back to the highlighted row when nothing is marked, which is exactly
+        // the "this one" the reader meant; the inherited selection was what kept that
+        // fallback from firing. The caller can still pass an explicit preselection.
+        const initialSelection = initialQuestionSelection(question, preselected);
         const dialog = {
             kind: 'questions',
             question,
             index,
             total,
-            selected: new Set(initial >= 0 ? [initial] : []),
+            selected: new Set(initialSelection),
             cursor: initial >= 0 ? initial : 0,
             ...(matchKeys === undefined ? {} : { matchKeys }),
+            ...(onCursor === undefined ? {} : { onCursor }),
             resolve: (selection) => {
                 this.settleQuestion(dialog, () => resolve(selection));
             },
@@ -6642,9 +6902,9 @@ export class SshTui {
         return dialog;
     }
     /** Open one question dialog and await its answer (cancellation rejects). */
-    askQuestion(question, index = 0, total = 1, preselected, matchKeys) {
+    askQuestion(question, index = 0, total = 1, preselected, matchKeys, onCursor) {
         return new Promise((resolve, reject) => {
-            this.openQuestion(question, index, total, resolve, reject, preselected, matchKeys);
+            this.openQuestion(question, index, total, resolve, reject, preselected, matchKeys, onCursor);
         });
     }
     /** The stored llm-pi-ai profile for one provider route, when settings provide one. */
@@ -8034,6 +8294,221 @@ export class SshTui {
         this.markDirty();
     }
     /** /disconnect: pause (default) or continue the turn after SSH drop. */
+    /**
+     * Say where an auth failure came from, and retry it if the user asked for that.
+     *
+     * `code: "AUTH"` collapses two opposite situations (see `auth-failure.ts`), and
+     * the host does not retry either of them: a provider-side 401/403 that lasted
+     * 45 seconds killed two turns in a row on 2026-09-29 while the same key, model
+     * and route answered 200 straight afterwards. The hint costs nothing and the
+     * retry is opt-in, because resending a long session re-sends its whole context.
+     */
+    reportAuthFailure(message) {
+        if (this.replaying)
+            return;
+        // The reasoning-replay 400 is an upstream bug with its own workarounds, so it
+        // gets its own sentence rather than the auth advice.
+        if (isReasoningReplayFailure(message)) {
+            this.pushRow({ kind: 'system', text: t('auth.reasoningReplay') });
+            this.markDirty();
+            return;
+        }
+        const classified = classifyAuthFailure(message);
+        if (classified === undefined)
+            return;
+        void this.explainAuthFailure(classified);
+    }
+    async explainAuthFailure(classified) {
+        const provider = this.currentProviderId();
+        const envRef = provider === 'deepseek-official' ? 'DEEPSEEK_API_KEY' : envRefForId(provider);
+        const configured = (await this.resolveCredential(envRef)) !== undefined;
+        if (classified.origin === 'provider' && configured) {
+            this.pushRow({
+                kind: 'system',
+                text: t('auth.providerRejected', {
+                    env: envRef,
+                    status: classified.status === undefined ? '' : `HTTP ${classified.status}`,
+                }),
+            });
+        }
+        else {
+            this.pushRow({ kind: 'system', text: t('auth.credentialMissing', { env: envRef }) });
+        }
+        const retryable = classified.origin === 'provider' && configured
+            && this.retryProviderAuthEnabled() && this.authRetryArmed
+            && this.lastUserText !== '' && this.agent.status !== 'running';
+        if (!retryable) {
+            this.markDirty();
+            return;
+        }
+        this.authRetryArmed = false;
+        const text = this.lastUserText;
+        // Cleared first: the retry starts its own turn, and a second failure inside
+        // it must not fire another attempt.
+        this.lastUserText = '';
+        this.pushRow({ kind: 'system', text: t('auth.retryOnce') });
+        this.beginWait();
+        this.agent.followup(createUserMessage({
+            content: [{ type: 'text', text }],
+            source: { kind: 'user' },
+        }));
+        this.markDirty();
+    }
+    /** Whether the opt-in retry is on (`/retryauth`, the settings form, or the env). */
+    retryProviderAuthEnabled() {
+        const raw = String(process.env.DSH_TUI_RETRY_PROVIDER_AUTH ?? '').trim().toLowerCase();
+        if (['1', 'true', 'on', 'yes'].includes(raw))
+            return true;
+        if (['0', 'false', 'off', 'no'].includes(raw))
+            return false;
+        const saved = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
+        if (saved !== null && typeof saved === 'object' && !Array.isArray(saved)) {
+            const value = saved.retryProviderAuth;
+            if (typeof value === 'boolean')
+                return value;
+            const text = String(value ?? '').trim().toLowerCase();
+            if (['1', 'true', 'on', 'yes'].includes(text))
+                return true;
+            if (['0', 'false', 'off', 'no'].includes(text))
+                return false;
+        }
+        return false;
+    }
+    /** Whether anything the reader typed reached this session (used on exit). */
+    sessionHadUserInput() {
+        return this.sawUserInput;
+    }
+    /**
+     * `/cleanup [--dry-run]` — delete sessions that never saw user input.
+     *
+     * Every fresh start creates a session, so quitting without typing leaves an
+     * artifact behind. The picker hides those, but the web session list reads the
+     * same files without that filter, which is how an unused session still shows
+     * up in another profile's menu. This walks the whole history once and deletes
+     * the blank ones (the listing prunes as it resolves, which is the same rule the
+     * picker applies).
+     */
+    async runCleanupCommand(arg) {
+        const dryRun = arg.trim() === '--dry-run';
+        if (arg.trim() !== '' && !dryRun) {
+            this.pushRow({ kind: 'error', text: t('cleanup.usage') });
+            this.markDirty();
+            return;
+        }
+        const persistence = this.ctx.get('sessionPersistence');
+        if (persistence === undefined) {
+            this.pushRow({ kind: 'error', text: t('cleanup.unavailable') });
+            this.markDirty();
+            return;
+        }
+        this.pushRow({ kind: 'system', text: t(dryRun ? 'cleanup.scanning' : 'cleanup.working') });
+        this.markDirty();
+        const result = await pruneBlankSessions(persistence, String(this.agent.session.id), { dryRun });
+        this.pushRow({
+            kind: 'system',
+            text: t(dryRun ? 'cleanup.dryRun' : 'cleanup.done', {
+                pruned: String(result.pruned),
+                kept: String(result.kept),
+                unreadable: String(result.unreadable),
+            }),
+        });
+        this.markDirty();
+    }
+    /** The theme saved in the `ssh-tui` settings section, if any. */
+    readThemeName() {
+        const raw = readSettingsSection(this.ctx, UI_LOCALE_NAMESPACE);
+        if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+            return undefined;
+        const value = raw.theme;
+        const name = String(value ?? '').trim();
+        return name === '' ? undefined : name;
+    }
+    /**
+     * `/theme [name]` — list the palettes, or switch to one and remember it.
+     *
+     * Switching repaints from the row cache, so it costs one frame rather than a
+     * re-render of the transcript; `mono` exists for terminals where colour is the
+     * problem rather than the answer, and it keeps every difference as an
+     * attribute instead of throwing the difference away.
+     */
+    async runThemeCommand(arg) {
+        const wanted = arg.trim().toLowerCase();
+        if (wanted === '') {
+            // A picker, not a list: ↑/↓ paints the candidate palette straight away, so
+            // the reader judges it on their own transcript (and their own terminal)
+            // before committing. Esc restores what they had — the same browse-preview-
+            // revert flow Crush's theme picker offers, and the reason `onCursor` exists.
+            const names = themeNames();
+            const before = this.theme;
+            const apply = (name) => {
+                this.theme = setActiveTheme(name);
+                // Every cached line carries a token from the old palette: repaint from
+                // scratch rather than diffing against colours that no longer apply.
+                this.forceFullPaint = true;
+                this.markDirty();
+            };
+            let picked;
+            try {
+                const answer = await this.askQuestion({
+                    id: 'theme-pick',
+                    question: t('theme.pick'),
+                    options: names.map(name => ({ label: name, description: themeByName(name)?.name === before.name ? t('theme.currentTag') : '' })),
+                }, 0, 1, Math.max(0, names.indexOf(before.name)), undefined, cursor => {
+                    const name = names[cursor];
+                    if (name !== undefined)
+                        apply(name);
+                });
+                picked = answer.selected[0];
+            }
+            catch {
+                apply(before.name);
+                this.pushRow({ kind: 'system', text: t('theme.cancelled', { name: before.name }) });
+                this.markDirty();
+                return;
+            }
+            const next = themeByName(picked) ?? before;
+            apply(next.name);
+            await this.mergeUiSettings({ theme: next.name });
+            this.pushRow({ kind: 'system', text: t('theme.switched', { name: next.name }) });
+            this.markDirty();
+            return;
+        }
+        const next = themeByName(wanted);
+        if (next === undefined) {
+            this.pushRow({ kind: 'error', text: t('theme.unknown', { name: wanted, known: themeNames().join(', ') }) });
+            this.markDirty();
+            return;
+        }
+        this.theme = setActiveTheme(next.name);
+        await this.mergeUiSettings({ theme: next.name });
+        // A theme change touches every cached line, so the whole frame is stale.
+        this.forceFullPaint = true;
+        this.pushRow({ kind: 'system', text: t('theme.switched', { name: next.name }) });
+        this.markDirty();
+    }
+    /** `/retryauth [on|off]` — the setting that lets one provider 401/403 retry itself. */
+    async runRetryAuthCommand(arg) {
+        const id = arg.trim().toLowerCase();
+        if (id === '' || id === 'status') {
+            this.pushRow({
+                kind: 'system',
+                text: t('retryauth.status', {
+                    state: this.retryProviderAuthEnabled() ? t('retryauth.on') : t('retryauth.off'),
+                }),
+            });
+            this.markDirty();
+            return;
+        }
+        if (!['on', 'off'].includes(id)) {
+            this.pushRow({ kind: 'error', text: t('retryauth.usage') });
+            this.markDirty();
+            return;
+        }
+        const on = id === 'on';
+        await this.mergeUiSettings({ retryProviderAuth: on });
+        this.pushRow({ kind: 'system', text: t('retryauth.switched', { state: on ? t('retryauth.on') : t('retryauth.off') }) });
+        this.markDirty();
+    }
     async runDisconnectCommand(arg) {
         const direct = parseDisconnectPolicy(arg);
         let next = direct;
@@ -10401,6 +10876,8 @@ export class SshTui {
         this.history.push(text);
         this.historyIndex = this.history.length;
         this.historyDraft = '';
+        this.sawUserInput = true;
+        this.lastUserText = text;
         this.input = '';
         this.cursor = 0;
         this.inputFolded = false;
@@ -10563,6 +11040,24 @@ export class SshTui {
                     this.markDirty();
                 });
                 break;
+            case 'cleanup':
+                void this.runCleanupCommand(arg).catch((error) => {
+                    this.pushRow({ kind: 'error', text: t('cmd.failedNamed', { command: 'cleanup', error: errorChain(error) }) });
+                    this.markDirty();
+                });
+                break;
+            case 'theme':
+                void this.runThemeCommand(arg).catch((error) => {
+                    this.pushRow({ kind: 'error', text: t('cmd.failedNamed', { command: 'theme', error: errorChain(error) }) });
+                    this.markDirty();
+                });
+                break;
+            case 'retryauth':
+                void this.runRetryAuthCommand(arg).catch((error) => {
+                    this.pushRow({ kind: 'error', text: t('cmd.failedNamed', { command: 'retryauth', error: errorChain(error) }) });
+                    this.markDirty();
+                });
+                break;
             case 'copy':
                 this.copyFocusedCard(arg);
                 break;
@@ -11018,6 +11513,9 @@ export function mountTui(ctx, config) {
         disconnectPolicy() {
             return controller?.currentDisconnectPolicy() ?? 'pause';
         },
+        sessionHadUserInput() {
+            return controller?.sessionHadUserInput() ?? false;
+        },
     };
 }
 //# sourceMappingURL=tui.js.map