howtofixcli 0.7.7 → 0.7.9

package/dist/ui.js

@@ -1,4751 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { basename, join, resolve } from "node:path";
-import { catchInterrupt, isInterrupt } from "./interrupt.js";
-import { explainMiss, summarizeCacheUsage } from "./cache-report.js";
-import { copyToClipboard, SessionManager } from "@netrodev/hxf-coding-agent";
-import { CombinedAutocompleteProvider, Container, Editor, matchesKey, ProcessTerminal, ScrollView, KeybindingsManager, setKeybindings, TUI_KEYBINDINGS, SelectList, TuiAltScreen, truncateToWidth, VStack, visibleWidth, wrapTextWithAnsi, } from "@netrodev/hxf-tui";
-import { APP_TITLE, APP_VERSION, INIT_TEMPLATE } from "./brand.js";
-import { dropDcpState, dropSnapshot, runDcpCommand } from "./dcp/index.js";
-import { stripDcpMarkers } from "./dcp/ids.js";
-import { readClipboardText } from "./clipboard.js";
-import { TreeSelectorComponent, initTheme } from "@netrodev/hxf-coding-agent";
-import { getKeybindings } from "@netrodev/hxf-tui";
-import { Spring, pulse, ripple, shimmer, spectrum, waitTone } from "./anim.js";
-import { checkpointDiff, createCheckpoint, dropSession, listCheckpoints, openStore, restoreCheckpoint, sweepExpired } from "./checkpoint.js";
-import { expandFileReferences } from "./at-file.js";
-import { FeedView, itemsFromMessages, upsertNote, upsertUserTurn, userTextOf } from "./feed.js";
-import { deadChannelModel, diagnoseGatewayFailure } from "./gateway-errors.js";
-import { createSpendCap, spendCapMessage } from "./spend-cap.js";
-import { flashLevel, LEVEL_RAMP, levelFlash, levelInk } from "./level-style.js";
-import { fg, ink } from "./theme.js";
-import { levelCeiling, nextLevel, prevLevel, THINKING_LEVELS } from "./thinking.js";
-import { loadUsageSegment } from "./usage-segment.js";
-import { loginWithBrowser, PANEL_URL } from "./oauth-login.js";
-import { loadAccountCredential, loginWithCredential, parseCredentialInput, saveAccountCredential, } from "./account-credential.js";
-import { checkCliCheckin, claimCliCheckin, formatQuotaUsd } from "./cli-checkin.js";
-import { accessTokenIsFresh, cliCredentialsPath, readCliCredential, refreshTokenIsUsable, renewCliCredentialIfNeeded, writeCliCredential, } from "./cli-credentials.js";
-import { contextLine, costSegment, paintLevel, quotaLines, sessionLine, withSpinner } from "./hud-line.js";
-import { listRuns, runs, sendMail, setRunFinishedHandler, showRun, summarizeRun } from "./agents.js";
-import { setAsker } from "./tools.js";
-import { formatToolCall, formatToolResult, detailsOf, spinnerFrame, toolResultDetail, toolResultFull } from "./tool-render.js";
-import { orderModelsForDefault } from "./model-resolve.js";
-import { activityText, emptyActivity, firstLine, withLayer, withRetry } from "./activity.js";
-import { groupPhases, POP_MS, formatProgressView } from "./workflow-progress.js";
-import { setWorkflowControls } from "./workflow.js";
-import { HOWTOFIX_CONSOLE_URL, HOWTOFIX_PROVIDERS, applyCompat, checkAccount, checkUsage, countNewModels, findLiveModels, isHowtofixProvider, looksLikeToken, newProviderEntry, probeModel, loadCatalog, maskToken, mergeModels, } from "./howtofix-account.js";
-import { openInBrowser } from "./browser.js";
-import { HOOKS_FILE, loadHooks, runHooksFor } from "./hooks.js";
-import { AGENT_DIR, WORKFLOWS_DIR } from "./paths.js";
-import { readWorkbenchSettings, rightClickPastesHere as rightClickPasteEnabled, writeAgentsSetting, writeRightClickPasteSetting, writeStringSetting, writeWorkbenchSetting } from "./settings.js";
-import { agentConcurrency, MAX_AGENT_CONCURRENCY } from "./agent-limiter.js";
-import { PROXY_SETTING_KEY, configuredProxy, environmentProxy, installProxy, validateProxyUrl } from "./proxy.js";
-import { autoUpdateEnabled } from "./update.js";
-import { formatSkillList, skillInvocation } from "./skills.js";
-import { bundledPresetsDir, categoriesOf, defaultInstallRoot, hubCategories, hubFind, hubIn, installFrom, installFromDirectory, installFromHub, isPresetDisabled, listCatalog, presetSize, presetsIn, readHub, removeInstalled, } from "./presets.js";
-import { addMcpServers, describeMcpServer, mcpHubCategories, mcpHubFind, mcpHubIn, missingEnvFor, removeMcpServers, readMcpHub, serverSpecFromEntry, } from "./preset-mcp.js";
-import { readGlobalMcpServers } from "./mcp-config.js";
-import { McpLifecycle } from "./mcp-lifecycle.js";
-import { applyView, createWorkflowView, filterAgents, filterLabel, saveScript, viewFooter, WORKFLOW_KEY_TOGGLE, workflowAction, } from "./workflow-view.js";
-import { clipDiff, commitAll, fullDiff, hasChanges, isGitRepo, undoLastCommit } from "./git.js";
-import { APPROVAL_LABELS, APPROVAL_MODES, isDangerousBypass, setApprovalMode, setApprovalPrompt, setDangerousBypass } from "./permissions.js";
-import { resetLoopGuard } from "./loop-guard.js";
-import { GOAL_ENTRY, applyGoalOp, currentGoal, formatGoal, goalSegment, setMirror } from "./goal.js";
-import { currentPlanFile, currentPlanSnapshot, enterPending, planActive, planSegment, transition, userExit } from "./plan-mode.js";
-import { workbenchUI } from "./extensions.js";
-import { writeFileAtomicSync } from "./fs-atomic.js";
-const editorTheme = {
-    borderColor: () => "",
-    selectList: {
-        selectedPrefix: (text) => fg(text, ink.accent),
-        selectedText: (text) => fg(text, ink.text, { bold: true }),
-        description: (text) => fg(text, ink.mute),
-        scrollInfo: (text) => fg(text, ink.dim),
-        noMatch: (text) => fg(text, ink.mute),
-    },
-};
-/**
- * The key the viewport walks the layout tree by.
- *
- * `hxf-tui` does not re-export it from the package root, and importing the module
- * path directly fails at runtime (`dist/` ships `.js`; only the `.d.ts` exists
- * under that name). It is defined with `Symbol.for`, so the global symbol
- * registry hands back the same symbol the SDK uses — no internal path, no
- * duplicated protocol.
- */
-const LAYOUT_NODE = Symbol.for("@netrodev/hxf-tui/layout-node");
-/**
- * The layout tree of `component`, or `undefined` when it is a leaf.
- *
- * `hxf-tui` reaches these through a non-exported `Symbol.for` key, so the read is
- * narrowed by checking the shape rather than by asserting it.
- */
-function layoutNodeOf(component) {
-    if (typeof component !== "object" || component === null)
-        return undefined;
-    const reader = component[LAYOUT_NODE];
-    return typeof reader === "function" ? reader.call(component) : undefined;
-}
-const execFileAsync = promisify(execFile);
-/**
- * The branch and dirty marker for the HUD.
- *
- * Asynchronous on purpose. Each call spawns `git` twice, and this used to run
- * synchronously from the event handler on every tool start and tool end: on
- * Windows a process spawn costs an order of magnitude more than on Linux
- * (CreateProcess plus a Defender scan of the image), so a run with many tool
- * calls spent its time blocked in `execFileSync` — the screen arrived in bursts,
- * which is the "patah-patah" a Windows user sees. Measured on Linux: 1.3 ms for
- * `rev-parse` and 6.5 ms for `status` per spawn, with the same work far costlier
- * on Windows. Nothing in the HUD needs the value synchronously.
- *
- * Returns the *fresh* marker or null when the spawn fails, so a caller can leave
- * the previous value alone instead of blanking the footer on a transient error.
- */
-async function readGit(cwd) {
-    try {
-        const { stdout: branchOut } = await execFileAsync("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"], {
-            encoding: "utf8",
-        });
-        const branch = branchOut.trim();
-        if (!branch || branch === "HEAD")
-            return "";
-        const { stdout: statusOut } = await execFileAsync("git", ["-C", cwd, "status", "--porcelain"], {
-            encoding: "utf8",
-        });
-        return `git:(${branch}${statusOut.trim() ? "*" : ""})`;
-    }
-    catch {
-        return null;
-    }
-}
-export class Hud {
-    folder;
-    model;
-    git;
-    /**
-     * The meter's target. It is what `/stats` and the transcript say; the drawn
-     * value lags it by a spring so a jump from 8% to 40% reads as movement rather
-     * than as a different number in the same place.
-     */
-    percent = 0;
-    meter = new Spring(0);
-    /**
-     * The layered activity line; see `activity.ts` for why it is not a string.
-     *
-     * The branch this was merged from replaced it with a plain string written from
-     * sixteen places, each owning the whole row — the exact shape `activity.ts`
-     * exists to prevent (a finished run erasing a prompt that was waiting for the
-     * user). The layers are kept; the animation is theirs.
-     */
-    activity = emptyActivity();
-    /**
-     * Whether a run is in flight. The spinner and the seconds counter show only
-     * while this is true: they are a clock, and a clock that is not running is a
-     * frozen glyph.
-     */
-    live = false;
-    /**
-     * When the current run began, for the seconds counter beside the model.
-     * `beginRun()` sets it, so it never depends on comparing labels — every run
-     * starts with the same one.
-     */
-    activitySince = Date.now();
-    thinking = "medium";
-    /**
-     * The highest level the current model actually reaches the provider with
-     * (`levelCeiling`), or `undefined` when it reports none — then `atCeiling()`
-     * is false for every level and the shimmer stays dark.
-     */
-    ceiling = undefined;
-    usage = "";
-    /**
-     * What this session has cost so far, in USD - the number `/stats` prints,
-     * mirrored onto the row so the answer is visible without asking. It is
-     * written by the sampler below rather than read during a draw: a frame is
-     * rendered many times a second while the spinner runs, and the stats behind
-     * this number aggregate every entry in the session.
-     */
-    cost = 0;
-    /**
-     * True while the permission gate is off for this session. Drawn on its own
-     * HUD row, in warning colour, because a run with no refusals must not look
-     * like an ordinary one.
-     */
-    skipPermissions = false;
-    constructor(cwd, modelLabel) {
-        this.folder = basename(cwd);
-        this.model = modelLabel.split("/").at(-1) || "no-model";
-        // Filled in asynchronously; see `readGit`. The constructor runs before the
-        // first frame, and blocking it on two git spawns delayed startup on Windows.
-        this.git = "";
-    }
-    invalidate() { }
-    /** True while the meter is still settling, so the clock can outlive the run. */
-    settling() {
-        return this.meter.moving;
-    }
-    /**
-     * True while the HUD sits on the model's highest supported level — the only
-     * moment the ceiling shimmer may run. An `undefined` ceiling means the model
-     * reported no supported level at all: the feature is off for it, not pinned
-     * to `max`.
-     */
-    atCeiling() {
-        return this.ceiling !== undefined && this.thinking === this.ceiling;
-    }
-    /**
-     * When the level last changed, so the new one can flash once as it appears.
-     *
-     * A level change is often a single keypress and the level is a word: without a
-     * flash, raising it from `low` to `high` in a run of presses is invisible until
-     * you stop and read. `0` means "never changed in this session", which is not the
-     * same as "changed a long time ago" — the first frame must not flash.
-     */
-    levelChangedAt = 0;
-    /** Record a level change. Called wherever `thinking` is assigned. */
-    setThinking(level) {
-        if (level === this.thinking)
-            return;
-        this.thinking = level;
-        this.levelChangedAt = Date.now();
-    }
-    /** How far through the level's entry flash we are, 0 when it has settled. */
-    levelFlashAmount() {
-        if (this.levelChangedAt === 0)
-            return 0;
-        return flashLevel(Date.now() - this.levelChangedAt);
-    }
-    /**
-     * True while a level change is still flashing.
-     *
-     * The clock in `renderHud` keeps asking for frames while this holds, because the
-     * flash is the only thing moving and a frame that is never requested is a flash
-     * that never plays. It is deliberately *not* `atCeiling()`-style permanent: a
-     * level that is merely set does not animate, so an idle session still costs
-     * nothing.
-     */
-    flashing() {
-        return this.levelFlashAmount() > 0;
-    }
-    /** The level styled for this frame: its colour, rippled on a fresh change. */
-    levelText(now) {
-        // At the ceiling the word carries the whole ramp as a moving spectrum. The
-        // band runs across every level's colour, so the top of the ladder is drawn as
-        // the ladder rather than as a badge for its top rung — and it is the one
-        // effect here that keeps running, because being at the ceiling is a standing
-        // fact rather than an event.
-        //
-        // It used to sweep between the level's own colour and its lighter twin, which
-        // was measured to be wrong in two ways. On a model whose ceiling equals the
-        // default level the word was drawn grey on every frame, so a user who never
-        // changed the level never saw a colour at all; and a two-colour sweep says
-        // nothing about the rungs below, which is the thing a ceiling is.
-        if (this.atCeiling())
-            return spectrum(this.thinking, LEVEL_RAMP, now);
-        // Below the ceiling a change is an event: one band of light crosses the word
-        // and leaves it in its own colour. `flashLevel` owns the curve — the ripple
-        // takes progress, not a clock — so the effect and the frame tick that drives
-        // it stay in agreement about when it is over.
-        const age = this.levelChangedAt === 0 ? Number.POSITIVE_INFINITY : now - this.levelChangedAt;
-        if (flashLevel(age) <= 0)
-            return paintLevel(this.thinking, this.thinking);
-        return ripple(this.thinking, { rest: levelInk(this.thinking), lit: levelFlash(this.thinking) }, 1 - flashLevel(age));
-    }
-    /** The drawn value springs toward whatever `percent` was last set to. */
-    meterValue() {
-        if (this.meter.value !== this.percent)
-            this.meter.set(this.percent);
-        return this.meter.step();
-    }
-    /**
-     * Begin a run: the spinner starts turning and the seconds start from zero.
-     * Called by the workbench when a prompt is submitted or a run starts, so the
-     * clock never depends on the label text happening to differ.
-     */
-    beginRun() {
-        this.live = true;
-        this.activitySince = Date.now();
-    }
-    /**
-     * How long the current run has been going, for the spinner beside the model.
-     * This is also what the activity label's colour ramps on: a run that has
-     * produced nothing for a minute is worth a different colour from one that just
-     * started.
-     */
-    waitedMs() {
-        return Date.now() - this.activitySince;
-    }
-    /**
-     * Snap to the current target. Used when the session behind the HUD is
-     * replaced: the new session's numbers are a new baseline, not a destination,
-     * so sliding from the old session's meter would be a lie.
-     */
-    abandonAnimations() {
-        this.meter.snap(this.percent);
-    }
-    render(width) {
-        const now = Date.now();
-        // A session that has not used any context yet draws a plain zero: springing
-        // to zero on the first frame would make a fresh HUD animate for no reason.
-        const shown = this.percent === 0 && this.meter.value === 0 ? 0 : this.meterValue();
-        // One line carries the whole footer: the spinner and how long it has been
-        // waiting, the model, the thinking level, then the folder, branch and meter.
-        // There is no separate settings row and no standing activity row — both were
-        // a second and third line saying less than this one.
-        // At the ceiling the level word is swept by the band — colours only, so
-        // the row keeps exactly the width it has below the ceiling.
-        const level = this.levelText(now);
-        const session = sessionLine(this.model, level, this.folder, this.git);
-        const lines = [
-            truncateToWidth(`${withSpinner(session, this.live ? spinnerFrame() : "", this.live ? this.waitedMs() : undefined)}  ${contextLine(shown, this.usage, costSegment(this.cost))}`, width),
-        ];
-        // The plan and goal sit under the session line: they explain what the run is
-        // for, and both outlive a compaction that would drop the original message.
-        // Plan comes first — it gates what the run is allowed to do.
-        // Above the plan and goal: it changes what every run is allowed to do, so it
-        // is read before what the run is for.
-        if (this.skipPermissions) {
-            lines.push(truncateToWidth(fg("Permissions OFF — critical commands and the repeat guard are not enforced", ink.bad), width));
-        }
-        const plan = planSegment();
-        if (plan)
-            lines.push(truncateToWidth(fg(plan, ink.warn), width));
-        const goal = goalSegment(currentGoal());
-        if (goal)
-            lines.push(truncateToWidth(fg(goal, ink.accent), width));
-        // The activity row is ALWAYS rendered, even when it is empty. The feed is
-        // given `rows - footerHeight` lines, so a row that appears when a turn starts
-        // and disappears when it ends resizes the transcript twice per turn — the
-        // answer the user is reading visibly shrinks by a line and grows back.
-        // The plan and goal rows above are not reserved: they change on a deliberate
-        // command, not mid-turn.
-        const activityLine = activityText(this.activity, spinnerFrame(), now);
-        const painted = this.live
-            ? shimmer(activityLine, { base: waitTone(this.waitedMs(), ink.mute, ink.warn, ink.bad), bright: ink.text, charMs: 45 }, now)
-            : fg(activityLine, waitTone(this.waitedMs(), ink.mute, ink.warn, ink.bad));
-        lines.push(truncateToWidth(painted, width));
-        return lines;
-    }
-}
-/**
- * A pinned block, wired live.
- *
- * The draw function has to be called on every paint: a selector's selection
- * moves without the block changing shape, so a snapshot of the lines would
- * freeze the highlight where it first drew it.
- */
-export class PinnedBlock {
-    draw;
-    constructor(draw) {
-        this.draw = draw;
-    }
-    render(width) {
-        return this.draw(width);
-    }
-    invalidate() { }
-}
-export class Dock {
-    editor;
-    hud;
-    focused = false;
-    constructor(editor, hud) {
-        this.editor = editor;
-        this.hud = hud;
-    }
-    invalidate() {
-        this.editor.invalidate();
-    }
-    render(width) {
-        const inner = Math.max(10, width - 4);
-        const body = this.editor.render(inner).filter((line) => visibleWidth(line) > 0);
-        const rows = body.length > 0 ? body : [""];
-        const bar = "─".repeat(Math.max(0, width - 2));
-        const boxed = rows.map((line) => {
-            const gap = Math.max(0, inner - visibleWidth(line));
-            return `│ ${line}${" ".repeat(gap)} │`;
-        });
-        // The pinned widgets are not drawn here: they are their own component in the
-        // footer, above this dock. Drawing them here as well put every pinned panel
-        // on screen twice — and the copy added by `rebuildFooter` was a *snapshot*
-        // taken when the footer shape last changed, so a workflow panel appeared
-        // frozen at its first live frame (`0/2 agents · idle 0s`) next to the live
-        // one. One owner, one copy.
-        return [`┌${bar}┐`, ...boxed, `└${bar}┘`, ...this.hud.render(width)];
-    }
-    handleInput(data) {
-        this.editor.handleInput(data);
-    }
-}
-// The default-model ordering lives in `model-resolve.ts` now: the session needs
-// it too, to start on a model the account can actually reach, and the session
-// importing the workbench would be the wrong direction.
-export { orderModelsForDefault } from "./model-resolve.js";
-/**
- * A picker shown in place of the input dock: full width, same frame as the dock.
- *
- * It used to be capped at 76 columns, so on a wide terminal the dialog sat in the
- * middle as a narrow stamp with most of the row empty, and a long command in it
-
- * The picker box. `urgent` is the approval dialog: the one picker whose frame
- * breathes, because it is the one that is blocking the run.
- *
- * `detail` is for a dialog whose body is the decision itself — the approval
- * prompt. The select list renders one line per row and truncates a description
- * to whatever fits beside the label, which silently cut a shell command in half:
- * the user was asked to approve something they could not read. A detail block is
- * printed under the rows instead, wrapped to the box.
- *
- * Exported so `scripts/check-approval-pulse.mjs` can assert that the animated
- * frame keeps every line at the same visible width as the still one.
- */
-export function pickerPanel(list, title, width, urgent = false, detail = []) {
-    // The box spans the terminal: a long command belongs on one line when the
-    // screen has room, and a centred 72-column box made the user read a wrapped
-    // command in a dialog that was already asking for a decision.
-    const box = Math.max(24, width);
-    const inner = box - 4;
-    // Every row is built at exactly `inner + 4` columns: `│ ` + content + padding
-    // + ` │`. Rows are padded, never sliced — slicing assumed one border glyph at
-    // each end and quietly walked the right border in by a column per row.
-    const line = (content, paint) => {
-        const clipped = visibleWidth(content) > inner ? truncateToWidth(content, inner, "…") : content;
-        const padded = `${clipped}${" ".repeat(Math.max(0, inner - visibleWidth(clipped)))}`;
-        return `│ ${paint ? paint(padded) : padded} │`;
-    };
-    const bar = "─".repeat(box - 2);
-    const rows = [line(` ${title}`), ...list.render(inner).map((row) => line(row))];
-    // The keys, spelled out. A picker that can be typed into has to say so: a
-    // list of rows invites the arrow keys, and nothing about it suggests that a
-    // word would narrow it. Left unpainted on purpose — the still panel adds no
-    // escape sequences of its own, which is what lets it be diffed per frame.
-    rows.push(line("  type to filter · ↑↓ move · enter select · esc cancel"));
-    // The detail block is wrapped here, to this box's inner width, so its rows are
-    // the same width as the ones above it. A blank row separates the choice from
-    // the evidence for it, and the reason is muted so the command stays the
-    // loudest thing on the panel.
-    const wrapped = detail.flatMap((entry) => (entry === "" ? [""] : wrapTextWithAnsi(entry, inner)));
-    const body = wrapped.length > 0 ? [line(""), ...wrapped.map((row) => line(row, (text) => fg(text, ink.mute)))] : [];
-    if (!urgent)
-        return ["", `┌${bar}┐`, ...rows, ...body, `└${bar}┘`];
-    // The approval dialog is the one surface that blocks the run, so its frame
-    // breathes: the motion is the thing that says "this one is waiting on you".
-    // Only the two border columns and the rules are repainted — the content keeps
-    // its own colours, so the selected option does not lose its emphasis.
-    const frame = pulse(ink.line, ink.warn, Date.now(), 1400);
-    const edge = fg("│", frame);
-    const rule = (left, right) => fg(`${left}${bar}${right}`, frame);
-    const content = [...rows, ...body].map((row) => `${edge}${row.slice(1, -1)}${edge}`);
-    return ["", rule("┌", "┐"), ...content, rule("└", "┘")];
-}
-/**
- * The approval prompt's body, in the order the decision is made: why the call
- * needs approval, then what it actually is. The title already names the tool, so
- * a second `Allow tool: bash` line is dropped — the tool was named twice and the
- * command, which is the decision, sat furthest down.
- *
- * It returns *content* lines, not box rows: the panel is the only thing that
- * knows the box width. A body that formatted its own rows used a slightly
- * different inner width (two columns short) and walked the right border in —
- * which is what put a ragged edge on the dialog.
- */
-export function approvalDetail(title, message) {
-    const lines = message.split("\n").filter(Boolean);
-    const reason = lines.filter((line) => line.startsWith("Reason:"));
-    const rest = lines.filter((line) => !line.startsWith("Reason:") && !line.startsWith("Allow tool:"));
-    // A non-approval title is not already on the panel, so it heads the block.
-    const heading = title.endsWith(" wants to run") ? [] : [title];
-    return [...heading, ...reason, ...(rest.length > 0 ? ["", ...rest] : [])];
-}
-function contextPercent(session) {
-    const usage = session.getContextUsage();
-    if (usage?.percent !== null && usage?.percent !== undefined)
-        return Math.min(100, Math.round(usage.percent));
-    const model = session.model;
-    const last = [...session.state.messages].reverse().find((message) => message.role === "assistant")?.usage;
-    // An assistant entry can carry a partial or absent `usage` — a stream that was
-    // interrupted, or a provider that reports nothing. `undefined / n` is `NaN`,
-    // which used to reach the meter as `NaN%`. Treat an unusable number as "no
-    // reading" rather than rendering it.
-    const total = last?.totalTokens;
-    if (!model || typeof total !== "number" || !Number.isFinite(total) || model.contextWindow <= 0)
-        return 0;
-    return Math.min(100, Math.round((total / model.contextWindow) * 100));
-}
-export function slashCommands(session) {
-    const names = [
-        ["init", "write project notes to AGENTS.md"],
-        ["model", "choose a model"],
-        ["providers", "list providers"],
-        ["thinking", "set thinking level"],
-        ["approval", "set what needs approval"],
-        ["settings", "turn permission checks on or off"],
-        ["connect", "sign in with email:password (or a base64 credential), or paste a key"],
-        ["sync", "re-sync models from howtofix.id"],
-        ["usage", "show the account's quota and what it has spent"],
-        ["update", "install the newest release"],
-        ["login", "save a provider API key"],
-        ["logout", "remove a provider"],
-        ["new", "start a new session"],
-        ["resume", "resume another session"],
-        ["compact", "compact the session"],
-        ["name", "name this session"],
-        ["stats", "session tokens and cost, cache hit rate and misses"],
-        ["rtk", "compress long tool output before the model reads it"],
-        ["diff", "show the working tree diff"],
-        ["commit", "stage everything and commit"],
-        ["undo", "undo the last commit"],
-        ["rewind", "go back to an earlier message (Esc Esc)"],
-        ["review", "ask the agent to review the diff"],
-        ["tools", "list active tools"],
-        ["skills", "list loaded skills"],
-        ["preset", "browse, install and remove preset skill bundles"],
-        ["roblox", "show RoToolbox activation, MCP and manager status"],
-        ["proxy", "route requests through a proxy, or show the current one"],
-        ["export", "write the transcript to a markdown file"],
-        ["copy", "copy the last answer to the clipboard"],
-        ["agents", "show spawned agents"],
-        ["goal", "set or view this session's goal"],
-        ["plan", "toggle plan mode (design before editing)"],
-        ["workflow", "show or clear the pinned workflow panel"],
-        ["dcp", "dynamic context pruning: on | off | status | blocks | stats | context | decompress <bN> | sweep"],
-        ["context", "what the next request carries, and what pruning saved"],
-        ["decompress", "reopen one compressed block, e.g. /decompress b2"],
-        ["sweep", "close compressed blocks no ref resolves"],
-        ["session", "show the current model"],
-        ["help", "list commands"],
-        ["quit", "quit"],
-        ["exit", "quit (alias)"],
-    ];
-    const commands = names.map(([name, description]) => ({ name, description }));
-    for (const prompt of session.promptTemplates)
-        commands.push({ name: prompt.name, description: prompt.description });
-    for (const command of session.extensionRunner.getRegisteredCommands()) {
-        commands.push({ name: command.invocationName, description: command.description });
-    }
-    return commands;
-}
-/**
- * Build the live two-pane panel for a workflow call from its partial result.
- *
- * Returns `undefined` for any other tool, so the feed keeps its normal `└`
- * summary. The panel is a closure over the render width because the pane layout
- * is width-dependent and the feed only learns the width at draw time.
- *
- * Exported so `scripts/check-workflow-panel.mjs` can assert the wiring against
- * the real function rather than a copy of it.
- */
-/**
- * Build the live two-pane panel for a workflow call from its partial result.
- *
- * Returns `undefined` for any other tool, so the feed keeps its normal `└`
- * summary. The panel is a closure over the render width because the pane layout
- * is width-dependent and the feed only learns the width at draw time.
- *
- * Exported so `scripts/check-workflow-panel.mjs` can assert the wiring against
- * the real function rather than a copy of it.
- */
-export function workflowRunOf(toolName, result) {
-    if (toolName !== "workflow")
-        return undefined;
-    const details = detailsOf(result);
-    if (typeof details.name !== "string" || !Array.isArray(details.steps))
-        return undefined;
-    return details;
-}
-export function workflowPanel(toolName, result) {
-    const run = workflowRunOf(toolName, result);
-    return run ? workflowPanelFromRun(run) : undefined;
-}
-/**
- * The pinned form of a workflow panel: the same two-pane view the feed keeps in
- * its scrollback, rendered for the live surface above the editor.
- *
- * This is the answer to "does the panel get buried when I type something else?".
- * A panel drawn only in the feed scrolls away with the transcript — that is what
- * a transcript is. Claude Code solves it the same way: the running agents live in
- * a surface that is not a message. So the feed copy stays (it scrolls, and can be
- * read back later) and this copy stays pinned until the next run replaces it.
- */
-export function workflowPanelFromRun(run, view, keysActive = false) {
-    return (width) => formatProgressView(run, [], width, view?.selectedPhase, view ? panelOptions(run, view, keysActive) : undefined);
-}
-/** The view-driven options the two-pane renderer takes. */
-function panelOptions(run, view, keysActive) {
-    return {
-        filter: (agents) => filterAgents(agents, view.filter),
-        footerText: viewFooter(view, run.endedAt === undefined, keysActive),
-        filterLabel: filterLabel(view.filter),
-        drill: view.expanded,
-    };
-}
-/**
- * Take the transcript's scroll keys away from the viewport.
- *
- * `TuiAltScreen` registers its own input listener in the constructor and consumes
- * `pageUp`, `pageDown`, `home` and `end` before any listener the app adds — its
- * listener is registered first, and a consumed event is not passed on. It scrolls
- * the *primary scroll view*, which here is the pane: the pane draws exactly one
- * viewport of rows, so the viewport has nothing to scroll and the keys did
- * nothing at all. Measured: PageUp and PageDown moved the view by zero while the
- * wheel worked, because the wheel reaches `pane.handleMouse` instead.
- *
- * The keys are rebound to `[]` so the viewport no longer matches them, and the
- * workbench's own listener handles them against `feed.scrollOffset` — which is
- * what actually moves the transcript. `escape` is deliberately not rebound:
- * transcript search uses it.
- */
-function claimTranscriptScrollKeys() {
-    const manager = new KeybindingsManager(TUI_KEYBINDINGS, {
-        "tui.altScreen.pageUp": [],
-        "tui.altScreen.pageDown": [],
-        "tui.altScreen.halfPageUp": [],
-        "tui.altScreen.halfPageDown": [],
-        "tui.altScreen.top": [],
-        "tui.altScreen.bottom": [],
-    });
-    setKeybindings(manager);
-}
-export async function runWorkbench(options) {
-    const terminal = new ProcessTerminal();
-    /**
-     * The SDK's own right-click hook, filled in below.
-     *
-     * `TuiAltScreen` only calls it on Windows, where the terminal has already
-     * decided that a right click means paste: the callback is how the clipboard
-     * text reaches the editor. Without it the click is consumed by the SDK's
-     * handler and nothing happens — which is the "right click does not paste on
-     * Windows" report this exists to answer.
-     *
-     * It is assigned from inside `runWorkbench` because the editor does not exist
-     * yet here; the SDK only invokes it from a mouse event, long after this
-     * returns.
-     */
-    let pasteFromRightClick;
-    const tui = new TuiAltScreen(terminal, true, undefined, {
-        mouse: true,
-        onRightClickPaste: () => pasteFromRightClick?.(),
-    });
-    const feed = new FeedView();
-    const hud = new Hud(options.cwd, options.modelLabel);
-    // The gate is read at tool-call time, but the row is drawn every frame, so
-    // the HUD mirrors the setting instead of querying it on every render.
-    hud.skipPermissions = isDangerousBypass();
-    /**
-     * Take the checkpoint for the *next* turn, off the critical path.
-     *
-     * It used to run inside the Enter handler, so pressing Enter waited for a walk
-     * of the whole worktree before the prompt was even sent (measured 1.25s on a
-     * 60k-file directory, and the clock sat at the second it was pressed because
-     * `session.isStreaming` was still false). The state a checkpoint has to capture
-     * is "the worktree before the agent touches anything", and the moment the
-     * previous run settled is exactly that state — so the snapshot is taken at
-     * startup and again when each run settles, and Enter never waits for it.
-     */
-    const takeSnapshot = (prompt) => {
-        const at = Date.now();
-        void (async () => {
-            try {
-                const store = checkpointStore();
-                const sessionId = session.getSessionStats().sessionId;
-                // Retention sweep, once per process and off the critical path: sessions
-                // whose checkpoints are older than RETENTION_DAYS are dropped so the
-                // shadow repo does not grow for the life of the machine. The current
-                // session is kept whatever its age — see sweepExpired.
-                if (!retentionSwept) {
-                    retentionSwept = true;
-                    try {
-                        await sweepExpired(store, { keep: sessionId });
-                    }
-                    catch {
-                        // Housekeeping; a failed sweep leaves the store merely larger.
-                    }
-                }
-                const snapshot = await createCheckpoint(store, sessionId, prompt);
-                // Guarded so a slow snapshot cannot replace a newer turn's checkpoint.
-                if (snapshot && at >= latestCheckpointAt) {
-                    latestCheckpoint = snapshot;
-                    latestCheckpointAt = at;
-                }
-            }
-            catch {
-                // No shadow store (unwritable state dir): the session runs without
-                // checkpoints rather than failing the prompt.
-            }
-        })();
-    };
-    /**
-     * Refresh the branch/dirty marker without blocking, and only when a run is
-     * actually in flight — the marker is invisible while idle, so spawning git for
-     * it would be pure cost.
-     */
-    const refreshGitMarker = (force = false) => {
-        if (!force && !hud.live)
-            return;
-        void readGit(options.cwd).then((marker) => {
-            if (marker === null)
-                return;
-            hud.git = marker;
-            refresh();
-        });
-    };
-    const editor = new Editor(tui, editorTheme, { paddingX: 1 });
-    // Widgets pinned above the editor. A workflow panel is published here while a
-    // run is live so it cannot be buried by the next message, and the same block
-    // is still pushed into the feed so it can be read back in the scrollback.
-    const widgets = new Map();
-    const setWidget = (key, content) => {
-        if (content === undefined)
-            widgets.delete(key);
-        else if (typeof content === "function")
-            widgets.set(key, content);
-        else
-            widgets.set(key, () => content);
-    };
-    // Pinned content may be pre-rendered (a plain block, laid out for the width it
-    // was handed) or a draw function (the workflow panel, whose marks and elapsed
-    // time are functions of the clock). A draw function is called per frame with
-    // the live width, so it is the one form that resizes and animates.
-    const widgetWidth = () => Math.max(20, terminal.columns);
-    /**
-     * The run whose phase marks may still be popping. The panel is drawn from the
-     * clock, so the workbench has to know when the last mark is done: it asks the
-     * run record, not the painted text, whether a phase finished moments ago.
-     */
-    let poppingRun;
-    let poppingUntil = 0;
-    /**
-     * The workflow panel's interactive state. It is created here rather than in
-     * `workflow-view.ts` so it survives a run ending: the user keeps looking at the
-     * finished panel, and their phase/filter choice is still there.
-     */
-    const workflowView = createWorkflowView();
-    let currentRun;
-    let stopWorkflow = null;
-    let workflowPinned = false;
-    /** The run the user dismissed with Esc, so a late event cannot pin it back. */
-    let workflowDismissed;
-    /** True only while the user has handed the panel the keyboard with Ctrl+F. */
-    let workflowKeysActive = false;
-    /** The script behind the current run, kept so `s` can write it to disk.
-     *  Only set when the run was started from inline `code`: a run started from a
-     *  `path` is already a file the user chose, and copying it would drift. */
-    let savedScript;
-    /** Redraw the pinned panel from the current run and view. */
-    const drawWorkflow = () => {
-        if (!currentRun || !workflowPinned)
-            return;
-        setWidget("workflow", (width) => workflowPanelFromRun(currentRun, workflowView, workflowKeysActive)(width));
-    };
-    /** Give the keyboard back to the editor and drop the panel. */
-    const unpinWorkflow = () => {
-        // Remember *which* run was dismissed. A run's progress arrives as a stream of
-        // events, so an update can land after the user has already pressed Esc — and
-        // re-pinning then made the panel they just dismissed reappear. A new run has
-        // a new name, so this clears itself.
-        if (currentRun)
-            workflowDismissed = currentRun.name;
-        workflowPinned = false;
-        workflowKeysActive = false;
-        setWidget("workflow", undefined);
-    };
-    // The tool is built during session construction, before this screen exists, so
-    // the panel registers its hooks here instead of taking constructor arguments.
-    setWorkflowControls({
-        onStop: (stop) => {
-            stopWorkflow = stop;
-        },
-        isPaused: () => workflowView.paused,
-    });
-    const pinWorkflow = (run) => {
-        if (workflowDismissed === run.name)
-            return;
-        poppingRun = run;
-        const finishedAt = run.endedAt ?? Date.now();
-        poppingUntil = Math.max(poppingUntil, finishedAt + POP_MS);
-        currentRun = run;
-        workflowPinned = true;
-        setWidget("workflow", (width) => workflowPanelFromRun(run, workflowView, workflowKeysActive)(width));
-    };
-    const dock = new Dock(editor, hud);
-    let session = options.session;
-    let setCompressToolOutput = options.setCompressToolOutput;
-    let closed = false;
-    /**
-     * Sample the session's spend: mirror it onto the HUD row and hand it back to
-     * the caller that needs the same number.
-     *
-     * Called where the number changes - every session event (the same stream the
-     * budget cap and `--print` sample) and the binding of a session at startup
-     * and on `/new` / `/resume` - and deliberately nowhere else: the stats walk
-     * every entry of the session, which is affordable on an event and not on
-     * every frame of the spinner.
-     */
-    const syncCost = () => {
-        const cost = session.getSessionStats().cost;
-        hud.cost = cost;
-        return cost;
-    };
-    /**
-     * `--max-budget-usd`, live for as long as this workbench is.
-     *
-     * Sampled at the end of every session event — the same stream the print path
-     * samples, so both modes stop at the same dollar — and at the top of
-     * `sendTask`, which is where a cap that fired between turns refuses the next
-     * one. `capAnnounced` keeps the notice singular: `check()` is called on every
-     * event, and a note per event would bury the transcript in copies.
-     */
-    const spendCap = createSpendCap(options.maxBudgetUsd);
-    let capAnnounced = false;
-    /** Announce the cap once and cut the run that crossed it. */
-    const enforceSpendCap = () => {
-        const hit = spendCap.check(syncCost());
-        if (hit === undefined || capAnnounced)
-            return;
-        capAnnounced = true;
-        // Mid-turn: stop spending. Between turns there is nothing to abort, and the
-        // refusal in `sendTask` is what stops the next prompt.
-        if (session.isStreaming)
-            void session.abort();
-        note("budget", spendCapMessage(hit.spent, hit.limit));
-    };
-    /**
-     * The ceiling belongs to the model, so it is recomputed wherever the model
-     * can change: session start, a swap, and every path that calls `setModel`.
-     * A missed site would leave the shimmer decided by the previous model, which
-     * is exactly the lie the ceiling exists to prevent.
-     */
-    const syncCeiling = () => {
-        hud.ceiling = levelCeiling(session.model);
-    };
-    /**
-     * The credential pair behind the current sign-in, when this install has one.
-     *
-     * Read once at startup and kept in memory: every renewal rewrites the file, so
-     * re-reading it would only ever see what this process just wrote. `undefined`
-     * means the install predates the pair (a hand-pasted key), in which case there
-     * is nothing to renew and the old behaviour stands.
-     */
-    let cliCredential = readCliCredential(AGENT_DIR);
-    /**
-     * Guards against two prompts refreshing at once.
-     *
-     * The server rotates the refresh secret on every use, so a second concurrent
-     * renewal would present a spent token and — because the server cannot tell a
-     * race from theft — revoke the device. Serialising here is what keeps a busy
-     * session from logging itself out.
-     */
-    let refreshInFlight;
-    /**
-     * Renew the access token if it is about to expire, and hand the fresh key to
-     * the runtime.
-     *
-     * Called before each prompt rather than on a timer: a prompt is exactly when a
-     * dead key hurts, and a timer would fire during idle time when the renewal
-     * cannot help. A failed renewal is deliberately silent — the stored access
-     * token may still be valid, the relay is the authority on whether it works, and
-     * an error on every prompt would be noise. Only a terminal refusal (the panel
-     * says the sign-in is gone) is reported, once, because then nothing will work
-     * until the user signs in again.
-     */
-    const ensureFreshCredential = async () => {
-        if (!cliCredential || !refreshTokenIsUsable(cliCredential))
-            return false;
-        if (accessTokenIsFresh(cliCredential))
-            return false;
-        refreshInFlight ??= (async () => {
-            try {
-                // The shared helper owns the order (renew, then persist the rotated
-                // secret before anything else can happen); this only adds the
-                // serialisation above and the runtime override below.
-                const outcome = await renewCliCredentialIfNeeded(AGENT_DIR, cliCredential);
-                if (!outcome.renewed) {
-                    if (outcome.message)
-                        note("connect", outcome.message);
-                    return false;
-                }
-                cliCredential = outcome.credential;
-                if (outcome.message)
-                    note("connect", outcome.message);
-                await session.modelRuntime.setRuntimeApiKey("howtofix", outcome.credential.accessToken);
-                return true;
-            }
-            catch {
-                // A network failure is not a reason to stop the turn: the key in hand may
-                // still work, and the next prompt tries again.
-                return false;
-            }
-            finally {
-                refreshInFlight = undefined;
-            }
-        })();
-        return await refreshInFlight;
-    };
-    // One checkpoint per submitted prompt, in a shadow git repo beside the user's
-    // own history. A read-only session never pays for it: the store is created
-    // lazily on the first prompt that is actually snapshotted.
-    let checkpoints;
-    const checkpointStore = () => (checkpoints ??= openStore(options.cwd));
-    /** Newest checkpoint, so the last turn can be offered without reading meta. */
-    let latestCheckpoint;
-    /** The prompt of the turn in flight, so the settled snapshot can be named. */
-    let lastSubmitted = "";
-    /** When the newest checkpoint was *asked for*, so a slow one cannot win a race. */
-    let latestCheckpointAt = 0;
-    /** Whether this process has already run the one-time retention sweep. */
-    let retentionSwept = false;
-    /**
-     * The rewind selector: a box over the transcript that moves through the
-     * session's own tree.
-     *
-     * This is the SDK's `TreeSelectorComponent`, not a menu of my own. It already
-     * has what a session tree needs — the active path marked, branch folding, a
-     * filter, a search — and it is what the harness itself uses for `/tree`. A
-     * hand-rolled list of prompts could only ever be a worse version of it, and
-     * the tree is the honest model of a session that has already been rewound
-     * once (its branches are still there).
-     */
-    let treeSelector;
-    /**
-     * The entry ids the selector is showing, top to bottom.
-     *
-     * Built by walking the tree and applying the same rule the selector's default
-     * view does: a `session_info`, `usage`, label, model-change or thinking-level
-     * row is bookkeeping and is hidden. An index built from `getTree()` alone
-     * counts those rows, so it is offset from the list the user sees — which is
-     * what made a one-step `↑` look like a wrap.
-     */
-    const shownIds = () => {
-        const hidden = new Set(["session_info", "usage", "label", "context_edit", "custom", "model_change", "thinking_level_change"]);
-        const ids = [];
-        const walk = (nodes) => {
-            for (const node of nodes) {
-                if (!hidden.has(node.entry.type))
-                    ids.push(node.entry.id);
-                walk(node.children);
-            }
-        };
-        walk(session.sessionManager.getTree());
-        return ids;
-    };
-    /**
-     * `TreeSelectorComponent` paints through the SDK's theme registry, which has to
-     * be initialised or its `theme.get` throws. HowToFix paints with its own
-     * palette in `theme.ts`, so this is the one place the SDK's theme is needed —
-     * and `initTheme()` with no argument falls back to the system theme rather than
-     * failing when a theme file is missing.
-     */
-    /**
-     * The selector's keybindings.
-     *
-     * `TreeSelectorComponent` matches `app.tree.*` and `app.message.copy`, which
-     * are defined in the SDK's own keybinding table — a table the published
-     * package does not export and never installs into `hxf-tui`'s global registry.
-     * So every one of them resolved to no key at all: page-up/down, the label and
-     * copy keys, and all six filters were dead, and the header advertised
-     * `←/→ page` while nothing listened for it.
-     *
-     * These are registered here with keys the workbench has not already claimed.
-     * The SDK's defaults collide with global actions — its `ctrl+d` is "filter:
-     * default" but ours is "quit", and its `ctrl+l` is "filter: labeled-only" but
-     * ours is "scroll to bottom" — so the filter keys move to `alt+f`/`alt+1..5`,
-     * and folding keeps the arrow keys the header already promises.
-     */
-    let selectorKeysReady = false;
-    const ensureSelectorKeys = () => {
-        if (selectorKeysReady)
-            return;
-        selectorKeysReady = true;
-        const current = getKeybindings().getResolvedBindings();
-        setKeybindings(new KeybindingsManager(TUI_KEYBINDINGS, {
-            ...current,
-            "app.tree.foldOrUp": ["alt+left", "ctrl+left"],
-            "app.tree.unfoldOrDown": ["alt+right", "ctrl+right"],
-            "app.tree.editLabel": ["shift+l"],
-            "app.tree.toggleLabelTimestamp": ["shift+t"],
-            "app.message.copy": ["ctrl+x"],
-            "app.tree.filter.default": ["alt+0"],
-            "app.tree.filter.noTools": ["alt+1"],
-            "app.tree.filter.userOnly": ["alt+2"],
-            "app.tree.filter.labeledOnly": ["alt+3"],
-            "app.tree.filter.all": ["alt+4"],
-            "app.tree.filter.cycleForward": ["alt+f"],
-            "app.tree.filter.cycleBackward": ["alt+shift+f"],
-        }));
-    };
-    /** The SDK theme, initialised once, on the first selector. */
-    let themeReady = false;
-    const ensureTheme = () => {
-        if (themeReady)
-            return;
-        themeReady = true;
-        initTheme();
-    };
-    /**
-     * Open the selector; the pane is pinned like the workflow panel.
-     *
-     * The guard is on the *filtered* tree, not on `getTree().length`. A fresh
-     * session still has a `session_info` node, so a length check passes and the
-     * user is shown an empty `No entries found (0/0)` box that Enter cannot act on
-     * (the selected node is `undefined`). The selector hides bookkeeping entries
-     * in its default view, so "has a visible node" is the only honest predicate —
-     * and it is only knowable after the component is built.
-     */
-    const openRewind = () => {
-        const tree = session.sessionManager.getTree();
-        if (tree.length === 0) {
-            note("rewind", "nothing to rewind to yet");
-            return;
-        }
-        if (checkpointStore().disabled) {
-            // Say why, instead of opening a selector whose "code too" choice cannot
-            // keep its promise: checkpoints are off outside a git work tree, where
-            // there is no uncommitted work to restore.
-            note("rewind", "conversation rewind only; this directory is not a git repository");
-        }
-        ensureTheme();
-        ensureSelectorKeys();
-        // The component derives its visible row count as `floor(terminalHeight / 2)`,
-        // and that count is also the page step for `←`/`→`. Passing the panel height
-        // directly made the step half the panel — so paging jumped about eleven rows
-        // at a time and felt like it was skidding past the entry you wanted. Passing
-        // twice the height makes the step match what is on screen.
-        const panelRows = Math.max(8, Math.floor(terminal.rows * 0.6));
-        const selector = new TreeSelectorComponent(tree, session.sessionManager.getLeafId(), panelRows * 2, (entryId) => {
-            closeRewind();
-            void onPickEntry(entryId);
-        }, () => closeRewind());
-        if (!selector.getTreeList().getSelectedNode()) {
-            note("rewind", "nothing to rewind to yet");
-            return;
-        }
-        treeSelector = selector;
-        treeSelector.focused = true;
-        setWidget("rewind", (width) => treeSelector?.render(width) ?? []);
-        refresh();
-    };
-    const closeRewind = () => {
-        treeSelector = undefined;
-        setWidget("rewind", undefined);
-        refresh();
-    };
-    /**
-     * What picking an entry does.
-     *
-     * A message carries the turn; anything else in the tree (a tool result, a
-     * model change) is navigable too, since the selector offers the whole tree.
-     * When the entry is a user message it is paired with its checkpoint by
-     * position, which is what makes "restore the code too" possible.
-     */
-    const onPickEntry = async (entryId) => {
-        const store = checkpointStore();
-        const prompts = session.getUserMessagesForForking();
-        const index = prompts.findIndex((prompt) => prompt.entryId === entryId);
-        const checkpoint = index >= 0 ? listCheckpoints(store, session.getSessionStats().sessionId)[index] : undefined;
-        const changed = checkpoint ? (await checkpointDiff(store, checkpoint)).length : 0;
-        if (changed === 0) {
-            await runRewind(entryId, undefined, "conversation");
-            return;
-        }
-        // Code is only offered when there is code to take back, so the question is
-        // never asked with one possible answer.
-        choose(`Rewind to this point? ${changed} file(s) differ`, [
-            { value: "both", label: "conversation and code", description: `drop the messages after this point and restore ${changed} file(s)` },
-            { value: "conversation", label: "conversation only", description: "drop the messages after this point, leave the files alone" },
-            { value: "code", label: "code only", description: `restore ${changed} file(s), keep the conversation` },
-        ], (action) => void runRewind(entryId, checkpoint, action));
-    };
-    /** Apply one rewind choice, then report what actually happened. */
-    const runRewind = async (entryId, checkpoint, action) => {
-        const parts = [];
-        if ((action === "both" || action === "conversation") && !session.isStreaming) {
-            try {
-                // `navigateTree` moves the session's leaf, so the next turn continues from
-                // that point rather than from the end of the transcript.
-                const result = await session.navigateTree(entryId);
-                if (result.cancelled) {
-                    note("rewind", "conversation rewind cancelled");
-                    return;
-                }
-                parts.push("conversation rewound");
-                // The feed mirrors the session, so it is rebuilt from the new branch.
-                feed.items = itemsFromMessages(session.state.messages);
-                if (result.editorText) {
-                    // The original prompt goes back in the editor: the usual next step is to
-                    // re-send or edit it.
-                    editor.setText(result.editorText);
-                    parts.push("prompt restored to the editor");
-                }
-            }
-            catch (cause) {
-                error(`conversation rewind failed: ${cause instanceof Error ? cause.message : String(cause)}`);
-                return;
-            }
-        }
-        if ((action === "both" || action === "code") && checkpoint) {
-            const restored = await restoreCheckpoint(checkpointStore(), checkpoint);
-            if (!restored.ok) {
-                error(`code rewind failed: ${restored.output}`);
-                return;
-            }
-            parts.push(restored.output);
-            if (restored.removed.length > 0)
-                parts.push(`removed ${restored.removed.length} file(s)`);
-            // The tree under the agent changed, so the branch/dirty marker is stale.
-            refreshGitMarker();
-        }
-        note("rewind", parts.join("\n") || "nothing to do");
-        refresh();
-    };
-    // The constructor could not await, so the marker starts empty and lands here.
-    refreshGitMarker(true);
-    // The first prompt has no previous run to settle, so its checkpoint is taken
-    // here, while the session is still starting up.
-    takeSnapshot("session start");
-    if (options.note)
-        feed.items.push({ id: "note", kind: "note", title: "note", body: options.note });
-    feed.items.push(...itemsFromMessages(session.state.messages));
-    hud.percent = contextPercent(session);
-    syncCost();
-    hud.abandonAnimations();
-    hud.setThinking(session.thinkingLevel);
-    syncCeiling();
-    editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommands(session), options.cwd));
-    void loadUsageSegment(session).then((segment) => {
-        if (!segment)
-            return;
-        hud.usage = segment;
-        tui.requestRender();
-    });
-    /**
-     * Tell the reader about a newer release, and install it when they asked.
-     *
-     * Silence is the default for one case only: the check answered and the copy is
-     * current, where "you are up to date" on every start is noise. A check that
-     * *failed* now speaks, because staying silent about it made a broken lookup look
-     * exactly like a working one — the update simply never appeared and nothing said
-     * why. An install the reader asked for always speaks, including when it failed.
-     */
-    const checkAndMaybeInstallUpdate = async (request) => {
-        const { checkForUpdate, checkFailedNote, installUpdate } = await import("./update.js");
-        const check = await checkForUpdate(request.current);
-        if (!check.available) {
-            const failed = checkFailedNote(check);
-            if (failed)
-                note("update", failed);
-            else if (request.install)
-                note("update", check.message);
-            return;
-        }
-        if (!request.install) {
-            note("update", `${check.message}. run /update to install it.`);
-            return;
-        }
-        activity("note", `installing HowToFix ${check.latest}…`);
-        const result = await installUpdate({ version: check.latest });
-        activity("note", undefined);
-        note("update", result.message);
-        refresh();
-    };
-    // Ask about a newer release only after the workbench is on screen: the check
-    // is a network call, and nothing about opening a session should wait on it.
-    if (options.update)
-        void checkAndMaybeInstallUpdate(options.update);
-    let picker = null;
-    let pickerTitle = "";
-    /** True for the approval dialog: the one picker whose frame breathes. */
-    let pickerUrgent = false;
-    /** Body lines shown under the picker rows — the command being approved. */
-    let pickerDetail = [];
-    /**
-     * How to close the open picker as "dismissed".
-     *
-     * `/new` and `/resume` call `session.dispose()` on the session being left while
-     * a picker can still be open on it (an approval dialog whose promise is held by
-     * the tool that asked). Dismissing first runs the picker's own `onDismiss`, so
-     * the tool sees a cancel instead of a promise that will never settle, and the
-     * stale list does not stay painted over the new session.
-     */
-    let dismissPicker;
-    /**
-     * The footer is rebuilt from components, not from rendered lines, so anything
-     * that changes which parts show (a picker opening, a workflow panel pinning)
-     * goes through here before the redraw.
-     */
-    let rebuildFooter = () => { };
-    const refresh = () => {
-        rebuildFooter();
-        tui.requestRender();
-    };
-    /** Set one layer of the activity line. See `activity.ts` for the layering. */
-    const activity = (layer, text) => {
-        hud.activity = withLayer(hud.activity, layer, text);
-    };
-    /** Set the retry layer: which attempt is waiting, and when it fires. */
-    const activityRetry = (retry) => {
-        hud.activity = withRetry(hud.activity, retry);
-    };
-    const toolCounts = new Map();
-    const failedTools = new Set();
-    const toolLine = () => [...toolCounts].map(([name, count]) => `${failedTools.has(name) ? "!" : "✓"} ${name} ×${count}`).join(" | ");
-    const showTools = () => {
-        const text = toolLine();
-        // No tools yet is not an empty tally: it is the absence of one, so the run
-        // layer shows through instead of an empty floor.
-        activity("tally", text || undefined);
-    };
-    const choose = (title, items, onPick, onDismiss, urgent = false, detail = []) => {
-        const list = new SelectList(items, 8, editorTheme.selectList);
-        list.onSelect = (item) => {
-            picker = null;
-            dismissPicker = undefined;
-            onPick(item.value);
-        };
-        list.onCancel = () => {
-            picker = null;
-            dismissPicker = undefined;
-            onDismiss?.();
-            refresh();
-        };
-        dismissPicker = () => list.onCancel?.();
-        pickerTitle = title;
-        pickerUrgent = urgent;
-        pickerDetail = detail;
-        picker = list;
-        pickerSeq += 1;
-        refresh();
-    };
-    const note = (title, body) => {
-        // `upsertNote` replaces this note's own predecessor instead of stacking a
-        // copy: asking `/dcp status` twice used to draw the same line twice.
-        feed.items = upsertNote(feed.items, { id: `cmd-${Date.now()}-${feed.items.length}`, kind: "note", title, body });
-        activity("tally", undefined);
-        refresh();
-    };
-    // A run started with `background: true` has no caller left to report to, so it
-    // announces itself here when it settles. Foreground runs are already in the
-    // tool result, and announcing those too would print everything twice.
-    setRunFinishedHandler((run) => {
-        if (!run.background)
-            return;
-        note("agent", `${summarizeRun(run)}\nread it with /agents ${run.id}`);
-    });
-    /**
-     * The channel behind one id is down; find a channel that is up and hand the
-     * user the picker instead of a list to guess from.
-     *
-     * The hint under the failure tells the user `/model` lists the models that
-     * answer. That claim is only useful once the CLI has checked it: on a
-     * gateway-wide outage the picker would just be a wall of the same dead ids,
-     * so the probes decide whether to open it at all. They cost one token each,
-     * run four at a time in parallel, and skip the id that just failed — its
-     * answer is already in.
-     */
-    let channelOfferInFlight = false;
-    const offerLiveChannel = (deadId) => {
-        if (channelOfferInFlight)
-            return;
-        channelOfferInFlight = true;
-        void (async () => {
-            try {
-                const available = (await session.modelRuntime.getAvailable()).filter((model) => isHowtofixProvider(model.provider));
-                const configured = new Set(available.map((model) => model.provider));
-                const target = HOWTOFIX_PROVIDERS.find((provider) => configured.has(provider));
-                // Only a howtofix run can be probed with the gateway's own probes, and
-                // without the stored key there is nothing to probe *with*.
-                const key = target ? (await session.modelRuntime.getAuth(target))?.auth?.apiKey : undefined;
-                if (!key)
-                    return;
-                const ordered = orderModelsForDefault(available.map((model) => model.id));
-                const { live, probed } = await findLiveModels(ordered, key, { exclude: deadId, limit: 4 });
-                if (live.length === 0)
-                    return; // gateway-wide outage: the hint above is all there is to say
-                const openable = picker === null;
-                note("gateway", `${live.length} of ${probed.length} probed models answer right now (${live.join(", ")}); ${openable ? "the model picker is open below" : "switch with /model"}.`);
-                if (openable)
-                    void runSlash("/model");
-            }
-            catch {
-                // Offering a live model is a courtesy, never a second failure.
-            }
-            finally {
-                channelOfferInFlight = false;
-            }
-        })();
-    };
-    const error = (body) => {
-        feed.items.push({ id: `err-${Date.now()}-${feed.items.length}`, kind: "error", title: "failed", body });
-        // A gateway sentence the README's Troubleshooting section already explains
-        // is worth showing as the fix, next to the failure: in the TUI that README
-        // is not open, so the raw sentence is all the user gets. An unrecognized
-        // message diagnoses to nothing and this stays exactly what it was.
-        const fix = diagnoseGatewayFailure(body);
-        if (fix !== undefined)
-            note("gateway", fix);
-        // "no live channel" is the one failure whose fix can be *done* for the
-        // user: probe the other candidates, and open the picker if any answer.
-        const deadId = deadChannelModel(body);
-        if (deadId !== undefined)
-            offerLiveChannel(deadId);
-        activity("tally", undefined);
-        refresh();
-    };
-    /**
-     * The one path that changes the thinking level: `/thinking` (picker or
-     * argument) and the ctrl+t / ctrl+shift+t hotkeys all come through it, so
-     * the HUD segment, the activity line and the ceiling shimmer cannot diverge
-     * between the two ways of asking.
-     */
-    const setThinking = (level) => {
-        // Persist: the level is a preference, not a property of this conversation.
-        // Without it the choice lived only in the session transcript, so the next
-        // start came up on the default and the user's "high" was gone.
-        session.setThinkingLevel(level, { persist: true });
-        hud.setThinking(level);
-        syncCeiling();
-        activity("note", `thinking ${level}`);
-        refresh();
-    };
-    /** Approval dialog: block the tool call until the user picks allow or deny. */
-    setApprovalPrompt((title, message) => {
-        const { promise, resolve: settle } = Promise.withResolvers();
-        // The prompt body carries the decision: which tool, where it came from, why
-        // it needs approval, and the concrete arguments. It used to be flattened
-        // into the selected row's description, which the select list truncates to
-        // whatever fits — so a long shell command was cut down to "this is a..." and
-        // the user approved something they could not read. It is printed under the
-        // rows instead, in full and in decision order.
-        choose(title, [
-            { value: "allow", label: "allow" },
-            { value: "deny", label: "deny" },
-        ], (value) => settle(value === "allow"), () => settle(false), true, approvalDetail(title, message));
-        return promise;
-    });
-    const extensionStatuses = new Map();
-    const bindUI = (target) => {
-        const uiContext = workbenchUI({
-            select: (title, options) => {
-                const { promise, resolve: settle } = Promise.withResolvers();
-                choose(title, options.map((option) => ({ value: option, label: option })), settle, 
-                // ESC must settle the promise, or the extension waits forever.
-                () => settle(undefined));
-                return promise;
-            },
-            confirm: (title, message) => {
-                const { promise, resolve: settle } = Promise.withResolvers();
-                choose(`${title} — ${message}`, [
-                    { value: "yes", label: "yes" },
-                    { value: "no", label: "no" },
-                ], (value) => settle(value === "yes"), () => settle(false));
-                return promise;
-            },
-            input: (title) => {
-                const { promise, resolve: settle } = Promise.withResolvers();
-                activity("prompt", title);
-                refresh();
-                editorSubmit = (value) => {
-                    editorSubmit = undefined;
-                    activity("prompt", undefined);
-                    settle(value);
-                    refresh();
-                };
-                return promise;
-            },
-            notify: (message, type) => {
-                if (type === "error")
-                    error(message);
-                else
-                    note("mcp", message);
-            },
-            setStatus: (key, text) => {
-                if (text === undefined)
-                    extensionStatuses.delete(key);
-                else
-                    extensionStatuses.set(key, text);
-                activity("note", [...extensionStatuses.values()].join(" | ") || undefined);
-                refresh();
-            },
-            // Extensions may pin a block above the editor. HowToFix does not need this
-            // for its own panels (the workflow pins itself), but it is the documented
-            // way for a plugin to keep something on screen, so it is routed rather
-            // than stubbed out.
-            setWidget: (key, content) => {
-                setWidget(key, content);
-                refresh();
-            },
-        });
-        // `bindExtensions` — not `extensionRunner.setUIContext` — is what emits
-        // `session_start`, and that is where the MCP extension connects its
-        // servers. Without it MCP never connected and codemode stayed inactive.
-        // The mode stays "print" so extensions use text commands instead of
-        // opening overlays the workbench cannot host.
-        void target
-            .bindExtensions({
-            uiContext,
-            mode: "print",
-            onError: (failure) => error(`${failure.event}: ${failure.error}`),
-        })
-            .catch((cause) => error(cause instanceof Error ? cause.message : String(cause)));
-    };
-    bindUI(session);
-    // The screen is a real layout tree, not a hand-sliced frame: the feed lives in
-    // a ScrollView so the viewport owns scrolling (wheel, PageUp/PageDown, `f`/`b`)
-    // and the dock is a sibling below it. The old `render` sliced the feed to the
-    // terminal height and returned exactly one screenful, so the TUI had nothing
-    // to scroll and the transcript could not be read back.
-    /** Everything below the feed: the pinned workflow panel (dock) and the HUD. */
-    const footer = new Container();
-    /**
-     * The transcript pane: the feed, clipped to the rows the footer leaves.
-     *
-     * `VStack.render` renders every child and then trims, and the layout hands a
-     * component a width but never a height — so the feed has to learn its own
-     * height from the terminal. Without it the feed returns the whole transcript,
-     * the scroll view's content is taller than its viewport, and the viewport
-     * scrolls the entire frame (footer included) instead of the transcript.
-     *
-     * It also owns the wheel. The viewport's own input listener runs first (it is
-     * registered in `TuiAltScreen`'s constructor) and consumes every wheel event,
-     * scrolling the frame; `handleMouse` returning `handled` is the documented way
-     * to stop that, and it is what keeps the dock and HUD fixed while the
-     * transcript moves.
-     */
-    const pane = {
-        invalidate: () => feed.invalidate(),
-        render: (width) => {
-            const footerRows = footer.render(Math.max(20, width)).length;
-            feed.viewportHeight = Math.max(1, Math.max(8, terminal.rows) - footerRows);
-            return feed.render(width);
-        },
-        handleMouse: (event) => {
-            if (rightClickPastesHere(event)) {
-                pasteFromClipboard();
-                return { handled: true };
-            }
-            // `wheelDelta` is already normalised: negative scrolls up (back in time).
-            const delta = event.type === "wheel" ? (event.wheelDelta ?? 0) : 0;
-            if (delta === 0)
-                return undefined;
-            feed.scrollOffset = Math.max(0, feed.scrollOffset - delta * 3);
-            refresh();
-            return { handled: true };
-        },
-    };
-    /**
-     * The scroll view is only a container here: it gives the pane a layout node
-     * the viewport can measure, while the scrolling itself is the feed's, driven
-     * by `pane.handleMouse`. Leaving `follow: "end"` on made the viewport snap the
-     * whole frame back to the bottom on every layout pass, so the transcript moved
-     * and the footer went with it.
-     */
-    const body = new ScrollView(pane, { follow: "none", overscroll: "contain" });
-    /**
-     * The feed grows into the rows the footer leaves; the footer keeps its own
-     * height.
-     *
-     * `grow` (not a fixed basis) is what keeps the footer pinned to the bottom of
-     * the frame: with numeric bases the footer floats up to sit right under the
-     * transcript while the transcript is short. The scroll view only scrolls the
-     * frame when its content is taller than its viewport, and `pane` renders
-     * exactly the viewport's worth of rows, so the frame stays put.
-     */
-    const layout = new VStack([
-        { component: body, grow: 1, shrink: 1 },
-        { component: footer, grow: 0, shrink: 0, basis: "auto" },
-    ]);
-    /**
-     * Which parts the footer currently holds. The footer is a component tree, so
-     * rebuilding it throws away the children and re-adds them; doing that on every
-     * `refresh()` (now 30 times a second while streaming) churned the layout for
-     * no reason and could blank the footer for a frame. The shape only changes when
-     * a picker opens or closes, or a workflow panel is pinned, so the rebuild is
-     * keyed on exactly that.
-     */
-    let footerShape = "";
-    /**
-     * Which picker is open, not merely that one is.
-     *
-     * A picker that opens another picker (`/settings` choosing a setting) replaces
-     * `picker` while it is already set. Keying on `picker ? "picker" : "dock"` left
-     * the shape unchanged, so `rebuildFooter` returned early and the footer kept
-     * rendering the list it captured before — the child picker received the keys
-     * while the parent stayed on screen. A sequence number makes the swap a new
-     * shape.
-     */
-    let pickerSeq = 0;
-    const footerKey = () => `${picker ? `picker:${pickerSeq}` : "dock"}|${[...widgets.keys()].join(",")}`;
-    rebuildFooter = () => {
-        const key = footerKey();
-        if (key === footerShape)
-            return;
-        footerShape = key;
-        footer.clear();
-        // A live component, not a `staticLine` snapshot: the pinned panel's phase
-        // marks and elapsed times are functions of the clock, so a captured copy
-        // freezes mid-animation — and a moved selection in the session tree repaints
-        // nothing. `PinnedBlock` calls the draw function on every paint.
-        for (const draw of widgets.values())
-            footer.addChild(new PinnedBlock(draw));
-        // Capture the list itself: closing the picker sets `picker = null`, and a
-        // component that closed over the *variable* then rendered `pickerPanel(null)`
-        // — which is the `Cannot read properties of null (reading 'render')` crash
-        // that hit every `ask` picker and every approval dialog.
-        const list = picker;
-        if (list) {
-            const title = pickerTitle;
-            const urgent = pickerUrgent;
-            const detail = pickerDetail;
-            footer.addChild({ render: (width) => pickerPanel(list, title, width, urgent, detail), invalidate: () => { } });
-        }
-        else
-            footer.addChild(dock);
-        // The footer's height is part of the layout, so a new shape is a new frame.
-        layout.invalidate();
-    };
-    rebuildFooter();
-    // The viewport reads the layout tree, not the rendered lines: it finds the
-    // scroll view under the cursor through `getLayoutNode`, and it sizes the frame
-    // from the same tree. A plain wrapper component with a `render()` returning
-    // lines is a *leaf* to that walker — no node means the whole screen is one
-    // flat component sized by its own content, the primary scroll view is never
-    // registered, and the wheel has nothing to scroll. So the root forwards its
-    // layout node to the stack it renders.
-    const screen = {
-        focused: false,
-        invalidate() {
-            feed.invalidate();
-            dock.invalidate();
-            picker?.invalidate();
-            layout.invalidate();
-        },
-        // The viewport walks the layout tree to find the scroll view under the
-        // cursor; a leaf component would leave the whole screen flat and the wheel
-        // with no target. `layout` is read per call because a new split replaces the
-        // stack instance.
-        [LAYOUT_NODE]: () => layoutNodeOf(layout),
-        render: (width) => layout.render(width),
-        handleMouse(event) {
-            if (!rightClickPastesHere(event))
-                return undefined;
-            pasteFromClipboard();
-            return { handled: true };
-        },
-        handleInput(data) {
-            // The selector and the picker are driven from the input listener, which is
-            // the only place that sees a key before the alt-screen viewport does. This
-            // root would double-handle every one of them: a forwarded `Escape` closed
-            // the selector, then this forwarded the same byte to the editor, which is
-            // what made `Esc Esc` flash the tree open and shut.
-            editor.handleInput(data);
-        },
-    };
-    tui.setLayoutRoot(screen);
-    tui.setFocus(screen);
-    let liveId = 0;
-    let liveBody = "";
-    /**
-     * The user asked for this run to stop.
-     *
-     * `agent_settled` carries no stop reason, so the only reliable record of "the
-     * user cancelled this" is the intent captured when the key was pressed. Without
-     * it the run stops and the screen says nothing, which reads as "the cancel did
-     * not work" even though it did.
-     */
-    let userAborted = false;
-    /** What the gateway has said so far this run; see the stall guard below. */
-    let liveSawAnything = false;
-    /**
-     * The tool currently executing, so a stall notice can name it.
-     *
-     * A `task` call is silent by nature: its children run in the background and the
-     * parent's transcript shows one row. When one of those children is blocked on a
-     * provider limit, the parent shows a spinner and no progress, and a notice that
-     * only blames "the provider" sends the user to the wrong place.
-     */
-    let runningToolName;
-    /** Reasoning accumulated for the turn in flight, so it can be summarised. */
-    let thinkingBody = "";
-    let thinkingStartedAt = 0;
-    let liveStallWarned = false;
-    let liveRunStartedAt = Date.now();
-    /**
-     * True from the moment Enter is pressed until `session.prompt` is actually
-     * sent.
-     *
-     * The snapshot is awaited before the prompt, and `session.isStreaming` stays
-     * false for that whole window, so the repaint condition saw "nothing is
-     * happening" and stopped drawing: the clock froze at the second it was pressed
-     * and the screen stopped updating, which is exactly the "stuck at 1s and I
-     * cannot do anything" report. On a 60k-file directory that window is 16.4s.
-     */
-    let submitting = false;
-    const toolArgs = new Map();
-    /**
-     * Retire the "queued" marker on every message that has now been read.
-     *
-     * Called when the run picks the queue up. Marking by *content* rather than by
-     * the id the feed generated, because the same text can legitimately be sent
-     * twice and the older, already-read copy must not have its marker cleared by
-     * the newer one.
-     */
-    const markUserMessagesRead = () => {
-        const queued = new Set(session
-            .getSteeringMessages()
-            .map((message) => message.trim())
-            .filter(Boolean));
-        for (const item of feed.items) {
-            if (item.kind !== "user" || !item.pending)
-                continue;
-            if (!queued.has(item.body.trim()))
-                item.pending = undefined;
-        }
-    };
-    const handleEvent = (event) => {
-        // The queue is the only honest signal that a mid-run message has not been
-        // read yet. `agent_start` fires when the message is handed over, so the
-        // "queued" marker must be cleared before that branch runs — it lands here,
-        // at the top, and not inside `agent_start`, because `agent_start` also
-        // fires for a plain first prompt where nothing was ever queued.
-        if (event.type === "agent_start")
-            markUserMessagesRead();
-        if (event.type === "agent_start" || event.type === "turn_start") {
-            // A new run starts with a clean loop guard: repeating a call across two
-            // prompts is legitimate, and the guard only ever speaks for one run.
-            if (event.type === "agent_start")
-                resetLoopGuard();
-            // A fresh run start (a resumed agent, a follow-up, a retry) is a fresh
-            // wait: the spinner turns and the seconds count from zero.
-            if (!hud.live)
-                hud.beginRun();
-            liveBody = "";
-            liveSawAnything = false;
-            liveStallWarned = false;
-            liveRunStartedAt = Date.now();
-            thinkingBody = "";
-        }
-        else if (event.type === "message_update" && event.assistantMessageEvent.type === "thinking_delta") {
-            // The SDK streams the model's reasoning, and nothing used to read it: for a
-            // model that thinks for ten seconds the screen showed a spinner and the word
-            // "thinking" and nothing else, which reads as a hang. Show the tail of the
-            // stream so there is visible progress, and count it as progress so the stall
-            // notice does not fire while the model is genuinely working.
-            liveSawAnything = true;
-            if (thinkingBody === "")
-                thinkingStartedAt = Date.now();
-            thinkingBody += event.assistantMessageEvent.delta;
-            const id = `think-${liveId}`;
-            const current = feed.items.find((item) => item.id === id);
-            const tail = thinkingBody.split("\n").slice(-6).join("\n");
-            if (current)
-                current.body = tail;
-            else
-                feed.items.push({ id, kind: "note", title: "thinking", body: tail });
-        }
-        else if (event.type === "message_update" && event.assistantMessageEvent.type === "thinking_end") {
-            // Collapse it: reasoning is scaffolding, not the answer, and leaving it in
-            // full would push the transcript off the screen. One line says it happened
-            // and how much there was, the way Claude Code collapses it by default.
-            const id = `think-${liveId}`;
-            const item = feed.items.find((entry) => entry.id === id);
-            if (item) {
-                const seconds = Math.max(1, Math.round((Date.now() - thinkingStartedAt) / 1000));
-                item.title = "thought";
-                item.body = `${seconds}s · ${thinkingBody.length} chars of reasoning`;
-            }
-            thinkingBody = "";
-        }
-        else if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
-            liveSawAnything = true;
-            liveBody += event.assistantMessageEvent.delta;
-            // Stripped as it streams, not only when the turn ends: a marker the model
-            // imitates would otherwise be painted and then disappear, which reads as a
-            // glitch rather than as machinery being hidden.
-            const shown = stripDcpMarkers(liveBody);
-            const id = `live-${liveId}`;
-            const current = feed.items.find((item) => item.id === id);
-            if (current)
-                current.body = shown;
-            else
-                feed.items.push({ id, kind: "assistant", title: "HowToFix", body: shown });
-        }
-        else if (event.type === "tool_execution_start") {
-            // Show the call as soon as it starts, the way Claude Code does, instead
-            // of waiting for the transcript to be replayed.
-            toolArgs.set(event.toolCallId, event.args);
-            // A tool call is a new silent window. Without this, `liveSawAnything` was
-            // already true from the text the model streamed before the call, so a tool
-            // that runs for minutes — `task`, a long `bash` — produced no events and no
-            // notice: the screen sat on a live spinner with nothing moving, which is
-            // exactly the "parent looks stuck while the child is blocked" report a
-            // sibling harness shipped. Reset the flag and the clock so the stall notice
-            // speaks for the call itself.
-            liveSawAnything = false;
-            liveStallWarned = false;
-            liveRunStartedAt = Date.now();
-            // Upsert, not push: a long-running tool can publish an update before its
-            // start event is delivered, and that update already created this item.
-            // Pushing a second one gave the same call two rows — the workflow panel
-            // drawn twice, the older copy frozen at its last live frame (`0/2 agents
-            // · idle 0s`) because the end event settles only the first match.
-            const id = `tool-${event.toolCallId}`;
-            const body = formatToolCall(event.toolName, event.args);
-            const existing = feed.items.find((entry) => entry.id === id);
-            if (existing) {
-                existing.kind = "tool";
-                existing.title = event.toolName;
-                existing.body = body;
-                existing.live = true;
-            }
-            else {
-                feed.items.push({ id, kind: "tool", title: event.toolName, body, live: true });
-            }
-            runningToolName = event.toolName;
-            if (event.toolName === "task") {
-                const live = runs.filter((run) => run.status === "queued" || run.status === "running");
-                activity("note", live.map((run) => `${run.agent} ${run.status}`).join(" | ") || "agent running");
-            }
-        }
-        else if (event.type === "tool_execution_update") {
-            // A long-running tool publishes partial results here. The workflow tool
-            // sends its run record, so the two-pane view can be built from the live
-            // details instead of waiting for the run to finish.
-            const panel = workflowPanel(event.toolName, event.partialResult);
-            if (panel) {
-                // The item `tool_execution_start` created, not a second one: the end
-                // event looks up `tool-<id>` to settle the call, so an update that
-                // pushed `res-<id>` left an orphan behind — every workflow run drew its
-                // panel twice, the older copy frozen at whatever the last live update
-                // said (`0/2 agents · idle 0s`) while the run was already finished.
-                // The body stays the call line: the end event moves it to `call` and
-                // writes the result over `body`.
-                const id = `tool-${event.toolCallId}`;
-                const existing = feed.items.find((entry) => entry.id === id);
-                if (existing) {
-                    existing.panel = panel;
-                }
-                else {
-                    feed.items.push({
-                        id,
-                        kind: "tool",
-                        title: event.toolName,
-                        body: formatToolCall(event.toolName, toolArgs.get(event.toolCallId)),
-                        panel,
-                        live: true,
-                    });
-                }
-                // Pin the same view above the editor for as long as the run is live, so
-                // a message typed mid-run cannot bury it in the transcript. The pinned
-                // copy is a closure, not pre-rendered lines: the phase marks and the
-                // elapsed time are functions of the clock, and a frozen array would
-                // freeze them mid-animation.
-                const run = workflowRunOf(event.toolName, event.partialResult);
-                if (run && workflowDismissed !== run.name)
-                    pinWorkflow(run);
-                refresh();
-            }
-        }
-        else if (event.type === "tool_execution_end") {
-            hud.percent = contextPercent(session);
-            // Settle the live call, then hang the `⎿` summary under it.
-            const pending = feed.items.find((entry) => entry.id === `tool-${event.toolCallId}`);
-            if (pending) {
-                pending.live = false;
-                pending.body = formatToolCall(event.toolName, toolArgs.get(event.toolCallId));
-            }
-            toolArgs.delete(event.toolCallId);
-            // The call is over, so the next silent stretch is the provider's, not this
-            // tool's. Clearing it also stops a later stall notice from naming a tool
-            // that has already returned.
-            runningToolName = undefined;
-            liveSawAnything = true;
-            liveStallWarned = false;
-            // The tally is the floor of the activity line: it survives the run ending,
-            // so the turn's work stays readable after the spinner stops.
-            toolCounts.set(event.toolName, (toolCounts.get(event.toolName) ?? 0) + 1);
-            if (event.isError)
-                failedTools.add(event.toolName);
-            showTools();
-            const detail = toolResultDetail(event.toolName, event.result);
-            // The whole output, kept for the ctrl+e toggle. `detail` is the default
-            // slice; this is what the call actually returned.
-            const full = toolResultFull(event.toolName, event.result);
-            // A finished workflow replaces its own live panel with the final run, in
-            // both places: the feed copy and the pinned copy. The pinned copy staying
-            // up after the run ends is deliberate — it is the result the user was
-            // waiting for, and `/workflow` clears it when it is no longer wanted.
-            // The finished panel is pinned the same way as the live one: a draw
-            // function, so the completion mark animates even though the run is over.
-            const finishedRun = workflowRunOf(event.toolName, event.result);
-            const finishedPanel = finishedRun ? workflowPanelFromRun(finishedRun) : undefined;
-            if (finishedRun && workflowDismissed !== finishedRun.name)
-                pinWorkflow(finishedRun);
-            // The result belongs to the call it came from, in the same feed item.
-            // It used to be pushed as its own row, so a run of parallel reads drew
-            // every head first and every summary under them, and a bare `232 lines`
-            // sat below an unrelated `Read`: the reader could not tell which call a
-            // count belonged to. One item per call, head then summary, fixes the
-            // attribution — and the call keeps its place in the transcript instead of
-            // being reordered by when it finished.
-            const settled = feed.items.find((entry) => entry.id === `tool-${event.toolCallId}`);
-            const body = formatToolResult(event.toolName, event.result, event.isError);
-            if (settled) {
-                // The item becomes a result in place: `Block` draws the call head from
-                // `call` and the `└` summary plus detail from the body, so one item
-                // carries both lines and the summary cannot drift under another call.
-                settled.kind = "result";
-                settled.call = settled.body;
-                settled.body = body;
-                settled.live = false;
-                if (detail.length > 0)
-                    settled.detail = detail;
-                if (full.length > 0)
-                    settled.full = full;
-                if (finishedPanel)
-                    settled.panel = finishedPanel;
-            }
-            else {
-                feed.items.push({
-                    id: `tool-${event.toolCallId}`,
-                    kind: "result",
-                    title: event.toolName,
-                    body,
-                    ...(detail.length > 0 ? { detail } : {}),
-                    ...(full.length > 0 ? { full } : {}),
-                    ...(finishedPanel ? { panel: finishedPanel } : {}),
-                });
-            }
-            // Shell and file tools change the working tree; keep the HUD honest.
-            // Only these four can, so the other tools do not pay for a git spawn.
-            if (event.toolName === "bash" || event.toolName === "powershell" || event.toolName === "edit" || event.toolName === "write") {
-                refreshGitMarker();
-            }
-        }
-        else if (event.type === "compaction_start") {
-            // The SDK squeezes the context here, and the screen used to say nothing
-            // at all: the context meter dropped from 62% to 26% with no explanation,
-            // which reads as the assistant losing its memory. Say it is happening,
-            // and say why — a threshold squeeze and a manual `/compact` are the same
-            // event with different reasons.
-            liveSawAnything = true;
-            const why = event.reason === "manual" ? "on request" : "context is nearly full";
-            const item = feed.items.find((entry) => entry.id === `compact-${liveId}`);
-            const title = "compacting context";
-            const body = `${why} · summarizing the older turns`;
-            if (item) {
-                item.title = title;
-                item.body = body;
-            }
-            else {
-                feed.items.push({ id: `compact-${liveId}`, kind: "note", title, body, live: true });
-            }
-            activity("note", "compacting context");
-        }
-        else if (event.type === "compaction_end") {
-            // Settle the note with the real numbers: how much was in the window
-            // before, and how much the summary squeezed it to. This is the receipt
-            // the user never got, and it is the difference between "it forgot" and
-            // "it compressed".
-            const item = feed.items.find((entry) => entry.id === `compact-${liveId}`);
-            const result = event.result;
-            const settledTitle = "compacted";
-            let settledBody;
-            if (event.aborted) {
-                settledBody = "cancelled";
-            }
-            else if (event.errorMessage) {
-                settledBody = `failed: ${event.errorMessage}`;
-            }
-            else if (result) {
-                const before = Math.round(result.tokensBefore / 1000);
-                const after = result.estimatedTokensAfter !== undefined ? Math.round(result.estimatedTokensAfter / 1000) : undefined;
-                // A squeeze that frees almost nothing is worse than no squeeze: the
-                // window is still full, so the very next turn crosses the threshold and
-                // compacts again — the loop a sibling harness reported as "compaction
-                // freed too little context to make progress". Say when the receipt is
-                // barely a receipt, so a session that keeps compacting reads as the
-                // window being too small for the work instead of as a stuck agent.
-                const freed = result.estimatedTokensAfter !== undefined ? result.tokensBefore - result.estimatedTokensAfter : undefined;
-                const barely = freed !== undefined && freed < 2000;
-                settledBody = after !== undefined
-                    ? `${before}k → ${after}k tokens · older turns summarized${barely ? "\nthis freed almost nothing; the window may be too small for this work" : ""}`
-                    : `${before}k tokens · older turns summarized`;
-            }
-            else {
-                settledBody = "nothing to compact";
-            }
-            if (item) {
-                item.title = settledTitle;
-                item.body = settledBody;
-                item.live = false;
-            }
-            else {
-                feed.items.push({ id: `compact-${liveId}`, kind: "note", title: settledTitle, body: settledBody });
-            }
-            hud.percent = contextPercent(session);
-            activity("note", undefined);
-        }
-        else if (event.type === "message_start" && event.message.role === "user") {
-            // The session is the authority on what the model has actually been given,
-            // and this event is the moment the turn reaches it. Rebuild the feed's view
-            // of that message from it: the feed drew its own copy at submit time with
-            // its own id, so without this the message is drawn twice — once as the
-            // optimistic row and once as the replayed turn — and the row that stays
-            // carries no queue state at all.
-            //
-            // The copy is identified by content and only ever retired once, which is
-            // why the id is not matched: the two ids are generated by different code.
-            const text = userTextOf(event.message);
-            if (text)
-                feed.items = upsertUserTurn(feed.items, text, `u-${event.message.timestamp}`);
-            // Whatever is still in the steering queue has not been read; everything
-            // else has. This is the same moment `agent_start` fires, so it runs here
-            // rather than there — a first prompt has no queue and nothing to clear.
-            markUserMessagesRead();
-        }
-        else if (event.type === "message_end" && event.message.role === "assistant") {
-            const live = feed.items.find((item) => item.id === `live-${liveId}`);
-            if (live)
-                live.id = `done-${liveId}`;
-            // A turn that failed before it produced a word leaves an empty row, and an
-            // empty row reads as a run that is still thinking. The provider said why —
-            // a 401, a missing key, a model this account cannot reach — so say it: a
-            // prompt that answers nothing and explains nothing is the worst version of
-            // this bug.
-            const failure = event.message.errorMessage;
-            if (failure && live) {
-                live.title = "failed";
-                live.kind = "error";
-                live.body = liveBody.trim() ? `${failure}\n\n${liveBody.trim()}` : failure;
-            }
-            else if (failure) {
-                feed.items.push({ id: `e-${event.message.timestamp}`, kind: "error", title: "failed", body: failure });
-            }
-            liveId += 1;
-            liveBody = "";
-            hud.percent = contextPercent(session);
-        }
-        else if (event.type === "agent_settled") {
-            // The run is over: the sweep stops with it, so the row settles on its
-            // static colour instead of freezing mid-band.
-            hud.live = false;
-            // A queue that is still non-empty here was never delivered — the run ended
-            // first. Leaving the marker on would say "the agent will read this" about a
-            // run that is no longer running, so the text goes back to the editor and
-            // the marker goes with it.
-            const undelivered = [...session.getSteeringMessages()].map((message) => message.trim()).filter(Boolean);
-            if (undelivered.length > 0) {
-                const draft = editor.getText().trim();
-                editor.setText(draft ? `${undelivered.join("\n")}\n${draft}` : undelivered.join("\n"));
-                const dropped = new Set(undelivered);
-                for (const item of feed.items) {
-                    if (item.kind === "user" && item.pending && dropped.has(item.body.trim()))
-                        item.pending = undefined;
-                }
-                note("queued", `${undelivered.length} unread message${undelivered.length === 1 ? "" : "s"} were never read and are back in the editor`);
-            }
-            for (const item of feed.items) {
-                if (item.kind === "user" && item.pending)
-                    item.pending = undefined;
-            }
-            // The worktree is quiet again, so this is the state the *next* prompt
-            // starts from. Taking it here keeps the Enter path free of git.
-            takeSnapshot(lastSubmitted);
-            lastSubmitted = "";
-            activity("run", undefined);
-            if (userAborted) {
-                // Say it in the transcript, not only in the activity row that has just
-                // been cleared: the feed is the record, and "stopped" is the answer the
-                // user pressed the key for.
-                const live = feed.items.find((item) => item.id === `live-${liveId}`);
-                if (live) {
-                    live.id = `stopped-${liveId}`;
-                    live.title = "stopped";
-                    live.body = liveBody.trim() || "(no output)";
-                    live.live = false;
-                }
-                else {
-                    feed.items.push({ id: `stopped-${liveId}`, kind: "note", title: "stopped", body: "run cancelled" });
-                }
-                liveId += 1;
-                liveBody = "";
-                note("stopped", "run cancelled by Esc");
-                userAborted = false;
-            }
-            hud.percent = contextPercent(session);
-            // The run is over, so its note goes with it. `activityText` gives a note
-            // priority over the run, and the note layer was never cleared here — so the
-            // stall notice ("no answer yet after 45s — the provider may be stalled")
-            // stayed pinned under the finished answer, contradicting it, until the next
-            // prompt cleared it. Clearing the layer this event owns is the fix; a note
-            // that belongs to a *waiting user* (a prompt) lives in its own layer and
-            // still survives, which is the property `check-activity` guards.
-            activity("note", undefined);
-            // A retry the run is still waiting on must not outlive it either.
-            activityRetry(undefined);
-            // The agent may have edited files, so the branch/dirty marker is stale.
-            // `hud.live` is cleared just above, so refresh it directly rather than
-            // through the idle-guarded helper.
-            void readGit(options.cwd).then((marker) => {
-                if (marker === null)
-                    return;
-                hud.git = marker;
-                refresh();
-            });
-            editor.disableSubmit = false;
-        }
-        else if (event.type === "thinking_level_changed") {
-            hud.setThinking(event.level);
-        }
-        else if (event.type === "auto_retry_start") {
-            // The stall notice and a retry describe the same silence — a provider that
-            // has not answered — and the retry is the one that says what is being done
-            // about it, so the notice it supersedes goes instead of sitting under it.
-            activity("note", undefined);
-            activityRetry({
-                attempt: event.attempt,
-                maxAttempts: event.maxAttempts,
-                error: event.errorMessage,
-                until: Date.now() + event.delayMs,
-            });
-        }
-        else if (event.type === "auto_retry_end") {
-            // The line has to stop saying "retry" the moment that stops being true.
-            // It used to be a note, set on the start and cleared only when the whole
-            // run ended — so an answer that came back on attempt 2 sat under a
-            // `retry 1/3` that never went away, for the rest of a run that could last
-            // minutes. The attempt count moves to the transcript, which is where a
-            // record of what happened belongs; the line goes back to the run.
-            activityRetry(undefined);
-            if (event.success) {
-                note("retry", `answered on attempt ${event.attempt} after a retry`);
-            }
-            else {
-                activity("note", `retry ${event.attempt} gave up${event.finalError ? ` · ${firstLine(event.finalError)}` : ""}`);
-            }
-        }
-        // Usage events are what move the total, so this is the sample that catches
-        // the crossing mid-turn — same stream, same dollar, as `--print`.
-        enforceSpendCap();
-        refresh();
-    };
-    let unsubscribe = session.subscribe(handleEvent);
-    // A braille spinner needs the clock to advance, so keep a timer running while
-    // the agent works; `refresh()` is idempotent and cheap when idle. The meter
-    // finishes its move after the run ends, so the clock outlives the stream by
-    // the length of that move rather than cutting it off mid-slide.
-    const spinner = setInterval(() => {
-        const popping = poppingRun !== undefined && Date.now() < poppingUntil;
-        // The ceiling shimmer is the one thing still asking for frames while the
-        // user is idle at the top level: without this clause the band would freeze
-        // exactly where it is supposed to move.
-        // The retry layer is here for the same reason the ceiling is: it is the only
-        // thing still asking for frames while the model is not streaming. A retry
-        // sleeps between attempts, so nothing else would tick and the countdown
-        // would freeze at whatever second the failure happened on.
-        if (submitting || session.isStreaming || hud.settling() || feed.entering() || picker || popping || hud.atCeiling() || hud.flashing() || hud.activity.retry !== undefined)
-            refresh();
-        // A gateway that accepts the request and never answers produces no event at
-        // all, so nothing above ever fires: the spinner turns, the clock climbs and
-        // the context meter sits at 0% forever. Measured against a server that holds
-        // the connection open: 45s in, still `thinking`, no error, no answer. Say so
-        // once, so a frozen screen reads as a stalled connection instead of a bug.
-        if ((submitting || session.isStreaming) &&
-            !liveSawAnything &&
-            !liveStallWarned &&
-            Date.now() - liveRunStartedAt > STALL_NOTICE_MS) {
-            liveStallWarned = true;
-            const waiting = runningToolName;
-            const seconds = Math.round((Date.now() - liveRunStartedAt) / 1000);
-            activity("note", waiting
-                ? `${waiting} has been running for ${seconds}s — it may be blocked; esc cancels`
-                : `no answer yet after ${seconds}s — the provider may be stalled; ctrl+c cancels`);
-            refresh();
-        }
-    }, ANIMATION_TICK_MS);
-    spinner.unref?.();
-    const swap = async (next) => {
-        // A picker left open belongs to the session being replaced. Dismiss it first:
-        // its promise is held by whatever asked the question, and disposing the
-        // session under it would leave that caller waiting on a promise nobody can
-        // settle. The tool then reports a cancel, which is the truth.
-        dismissPicker?.();
-        dismissPicker = undefined;
-        unsubscribe();
-        // The checkpoints of the session being left are unreachable from here on —
-        // the menu lists the current session's turns — so their refs go with it.
-        // The objects stay until git decides otherwise; nothing is deleted eagerly.
-        if (checkpoints)
-            void dropSession(checkpoints, session.getSessionStats().sessionId);
-        latestCheckpoint = undefined;
-        latestCheckpointAt = 0;
-        // The outgoing session's DCP state and its compress snapshot are keyed by
-        // session id in process-wide maps that nothing else clears, so each `/new`
-        // and `/resume` would otherwise keep the previous session's ref maps and a
-        // copy of its transcript until the process exits.
-        const leaving = session.getSessionStats().sessionId;
-        dropDcpState(leaving);
-        dropSnapshot(leaving);
-        // Every MCP server the outgoing session held is released before it goes.
-        // Repeated `/new` and `/resume` would otherwise accumulate one set of server
-        // processes per session for the life of the CLI.
-        await mcpLifecycle.dispose();
-        // The outgoing session's final cost dies with it, so the cap has to be
-        // handed that number before disposal: `/new` must not reset a spend total
-        // that is supposed to span the whole workbench.
-        session.dispose();
-        session = next.session;
-        // The compression toggle belongs to the session, like the mcp seam below it: the
-        // outgoing session's setter would write a flag nothing reads any more.
-        setCompressToolOutput = next.setCompressToolOutput;
-        // The seam belongs to the session, so it is replaced with it rather than
-        // reused: a fresh session owns no servers until it starts them.
-        mcpLifecycle = new McpLifecycle({
-            initial: Object.keys(readConfigForMenu().mcpServers),
-            apply: async (added, removed) => {
-                await reloadPresetResources();
-                if (added.length > 0 || removed.length > 0) {
-                    const parts = [];
-                    if (added.length > 0)
-                        parts.push(`connected ${added.join(", ")}`);
-                    if (removed.length > 0)
-                        parts.push(`stopped ${removed.join(", ")}`);
-                    note(added.length > 0 ? "mcp connected" : "mcp stopped", parts.join("; "));
-                }
-            },
-            report: (message) => error(message),
-        });
-        liveId = 0;
-        liveBody = "";
-        feed.items = [];
-        // A different session is a different transcript: the reader's position in the
-        // old one means nothing here, so this is the one place the intent is reset on
-        // purpose. `render` no longer clears it (that made a single short frame —
-        // a compaction, a rebuild — destroy the position for good), and the content
-        // anchor goes with it.
-        feed.scrollOffset = 0;
-        if (next.note)
-            feed.items.push({ id: "note", kind: "note", title: "note", body: next.note });
-        feed.items.push(...itemsFromMessages(session.state.messages));
-        hud.model = next.modelLabel.split("/").at(-1) || "no-model";
-        hud.setThinking(session.thinkingLevel);
-        syncCeiling();
-        hud.percent = contextPercent(session);
-        syncCost();
-        hud.abandonAnimations();
-        activity("tally", undefined);
-        activity("run", undefined);
-        editor.setAutocompleteProvider(new CombinedAutocompleteProvider(slashCommands(session), options.cwd));
-        editor.disableSubmit = false;
-        bindUI(session);
-        unsubscribe = session.subscribe(handleEvent);
-        refresh();
-    };
-    const shutdown = async () => {
-        if (closed)
-            return;
-        closed = true;
-        clearInterval(spinner);
-        unsubscribe();
-        // `SessionEnd` has to be run here, on the way out, and awaited.
-        //
-        // Measured: the SDK's `session_shutdown` does not fire when the process
-        // exits — `/quit` and double Ctrl+C both produced zero events, even for a
-        // TypeScript extension writing synchronously. It fires for a session being
-        // *replaced* (`new`/`resume`/`fork`), which is a different moment. So the
-        // documented "fires when the session is quit" can only be honoured by the
-        // CLI's own exit path, and it must complete before `process.exit`.
-        try {
-            const loaded = loadHooks(HOOKS_FILE);
-            if (loaded.config.hooks.SessionEnd) {
-                const { outcome } = await runHooksFor(loaded.config, "SessionEnd", { hook_event_name: "SessionEnd", cwd: process.cwd(), reason: "quit" }, { cwd: process.cwd() });
-                if (outcome.error)
-                    note("hooks", `SessionEnd hook: ${outcome.error}`);
-            }
-        }
-        catch {
-            // A hook is a courtesy at exit: a broken one must not stop the CLI from
-            // closing, and there is no screen left to complain on anyway.
-        }
-        // Before the session goes, release every MCP server it started. A teardown
-        // failure is already reported by the seam rather than thrown, so exit is
-        // never blocked by a server that will not close.
-        await mcpLifecycle.dispose();
-        // The outgoing session's final cost dies with it, so the cap has to be
-        // handed that number before disposal: `/new` must not reset a spend total
-        // that is supposed to span the whole workbench.
-        const leaving = session.getSessionStats().sessionId;
-        spendCap.close(session.getSessionStats().cost);
-        dropDcpState(leaving);
-        dropSnapshot(leaving);
-        session.dispose();
-        tui.stop();
-        process.stdout.write("\x1b[0m");
-        process.exit(0);
-    };
-    /**
-     * Everything `submit()` does after its slash/shell checks: record the turn,
-     * reset the run state, and send the prompt. `/skill:name` arrives from
-     * `runSlash` and needs this exact path — calling `submit()` back would loop
-     * on the leading slash — so the tail lives here rather than being copied.
-     */
-    // The daily check-in, claimed on the user's behalf: once at start, and again
-    // after a turn settles, because a terminal left open across midnight would
-    // otherwise miss the new day. The server keeps the rule that matters — one
-    // claim per account per day — so repeating the call costs nothing.
-    //
-    // Silent by design: a gateway that cannot be reached must not interrupt the
-    // work. HOWTOFIX_CHECKIN_DEBUG=1 records which branch was taken, so a silent
-    // skip can be told apart from a silent failure.
-    let lastClaimCheck = 0;
-    const maybeClaimDaily = async (force = false) => {
-        const now = Date.now();
-        if (!force && now - lastClaimCheck < 10 * 60 * 1000)
-            return;
-        lastClaimCheck = now;
-        const trace = (line) => {
-            if (process.env.HOWTOFIX_CHECKIN_DEBUG !== "1")
-                return;
-            try {
-                appendFileSync(`${AGENT_DIR}/checkin-debug.log`, `${new Date().toISOString()} ${line}\n`);
-            }
-            catch {
-                // Diagnostics must never break the session.
-            }
-        };
-        // Returns true when it got far enough to know the answer (claimed, already
-        // claimed, or refused). False means the runtime was not ready yet.
-        const runOnce = async () => {
-            try {
-                const configured = new Set((await session.modelRuntime.getAvailable())
-                    .map((model) => model.provider)
-                    .filter((provider) => isHowtofixProvider(provider)));
-                const target = HOWTOFIX_PROVIDERS.find((provider) => configured.has(provider));
-                trace(`providers=${[...configured].join(",") || "(none)"} target=${target ?? "(none)"}`);
-                if (!target)
-                    return false;
-                const raw = (await session.modelRuntime.getAuth(target))?.auth?.apiKey;
-                // The provider entry can hold an environment reference (`$HOWTOFIX_VIP_API_KEY`)
-                // rather than the key itself. The SDK substitutes it for chat calls; this
-                // call is ours, so it has to resolve the reference or it sends the literal
-                // string and the gateway answers 401.
-                const reference = raw?.trim().match(/^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$|^\{env:([A-Za-z_][A-Za-z0-9_]*)\}$/);
-                const fromEnv = (name) => (name ? (process.env[name] ?? "").trim() : "");
-                let key = reference ? fromEnv(reference[1] ?? reference[2]) || undefined : raw?.trim() || undefined;
-                if (!key) {
-                    for (const name of ["HOWTOFIX_API_KEY", "HOWTOFIX_VIP_API_KEY", "HOWTOFIX_FREE_API_KEY"]) {
-                        const candidate = fromEnv(name);
-                        if (candidate) {
-                            key = candidate;
-                            trace(`key dari fallback ${name}`);
-                            break;
-                        }
-                    }
-                }
-                trace(`key=${key ? `ada(${key.length})` : "(kosong)"}${reference ? " dari env" : ""}`);
-                if (!key)
-                    return false;
-                const status = await checkCliCheckin(key);
-                trace(`status ok=${status.ok} enabled=${status.enabled} claimed=${status.checkedInToday} msg=${status.message}`);
-                if (!status.ok || !status.enabled || status.checkedInToday)
-                    return true;
-                const claim = await claimCliCheckin(key);
-                trace(`claim ok=${claim.ok} awarded=${claim.quotaAwarded} msg=${claim.message}`);
-                if (claim.ok) {
-                    note("check-in", `daily check-in claimed: +${formatQuotaUsd(claim.quotaAwarded)} credited to your howtofix.id account`);
-                    refresh();
-                }
-                return true;
-            }
-            catch (e) {
-                trace(`error ${e.message}`);
-                return false;
-            }
-        };
-        if (await runOnce())
-            return;
-        // The model runtime can still be loading when the workbench opens; one
-        // retry after it settles is what turns a silent skip into a claim.
-        await new Promise((resolve) => setTimeout(resolve, 4000));
-        await runOnce();
-    };
-    const sendTask = async (task) => {
-        // A cap that has fired is a stop, not a warning: the next turn is refused
-        // before it can spend anything. Slash commands and `!sh` do not come
-        // through here, so `/stats`, `/model` and `/quit` still answer after it —
-        // which is how a user reads what they spent and gets out.
-        const capHit = spendCap.check(session.getSessionStats().cost);
-        if (capHit !== undefined) {
-            error(`budget reached: $${capHit.spent.toFixed(4)} of $${capHit.limit.toFixed(2)} — raise it with ` +
-                `--max-budget-usd, or start without the flag`);
-            return;
-        }
-        // A message typed while the run is working does not start a turn: it is
-        // handed to the run in flight and delivered with the next tool result. So it
-        // must not reset what belongs to that turn. It used to: the tally and the run
-        // clock were cleared on every submit, so steering a long run zeroed the count
-        // of tools it had already called and restarted the timer, which is why the
-        // elapsed time jumped backwards after a mid-run message. The HUD's spinner
-        // was already immune — `beginRun` keeps its start when the label matches —
-        // which is exactly why the bug hid: only the seconds and the tally moved.
-        const steering = session.isStreaming;
-        // The item's id is captured so the turn can be recognised when the real
-        // message arrives from the session: the id below is not reused, and the two
-        // would otherwise be two rows for one message. See the `message_start` case.
-        const optimisticId = `you-${Date.now()}`;
-        feed.items.push({
-            id: optimisticId,
-            kind: "user",
-            title: "you",
-            body: task,
-            // Marked pending for a steer only. A fresh turn is read immediately, and a
-            // marker on it would be a claim that is wrong from the first frame.
-            pending: steering ? true : undefined,
-        });
-        // Snapshot the worktree *before* the agent touches anything: that is what
-        // "go back to before this prompt" has to mean. The snapshot is of the tree
-        // as it stands, so the checkpoint named for this prompt is the state it
-        // started from, and rewinding to it undoes this turn and every turn after.
-        if (!steering) {
-            // A fresh turn starts with a fresh tally: the previous turn's counts are
-            // not this turn's work. The run layer takes over the line while the agent
-            // works.
-            activity("tally", undefined);
-            toolCounts.clear();
-            failedTools.clear();
-            activity("run", "thinking");
-            // The clock starts here, at submit, not at the first event: the wait the
-            // user experiences is the wait after pressing enter, and starting it in the
-            // event handler both lagged and — because a second run resets it only when
-            // its label differs — carried the previous run's seconds into the new one.
-            hud.beginRun();
-        }
-        // Not `requestRender(true)`: forcing resets the painter's previous frame, so
-        // the screen is erased (`ESC[2J`) and fully redrawn — a visible blink on
-        // every submit. A plain request diffs against the previous frame and still
-        // lands within one frame interval (the throttle is 16 ms).
-        refresh();
-        // The editor stays open mid-run on purpose: typing while the agent works is
-        // how a steer is sent. Locking it here made the steering path unreachable.
-        editor.disableSubmit = false;
-        const expanded = expandFileReferences(task, options.cwd);
-        // No snapshot here: it was taken when the previous run settled (or at
-        // startup), which is the same worktree state and costs this keypress nothing.
-        lastSubmitted = task;
-        // A short-lived access token has to be renewed before it is used, and the
-        // prompt is the moment it is used. This is awaited: a renewal that landed
-        // after the request went out would be a failed turn, and the wait is a single
-        // HTTPS round trip every few hours.
-        await ensureFreshCredential();
-        submitting = true;
-        // A message sent mid-run steers the run instead of queueing behind it: it is
-        // delivered with the next tool result, so the agent can change course
-        // without finishing the work it was about to abandon. `followUp` would wait
-        // for the whole turn, which for a long run is the wrong answer to "wait, do
-        // this instead".
-        const run = steering ? session.prompt(expanded, { streamingBehavior: "steer" }) : session.prompt(expanded);
-        submitting = false;
-        // The claim rides along with real use: a terminal left open past midnight
-        // claims the new day on the next turn instead of waiting for a restart.
-        void run
-            .then(() => maybeClaimDaily())
-            .catch((cause) => error(cause instanceof Error ? cause.message : String(cause)));
-    };
-    const submit = (text) => {
-        const task = text.trim();
-        if (!task)
-            return;
-        if (editorSubmit) {
-            const take = editorSubmit;
-            editorSubmit = undefined;
-            editor.setText("");
-            take(task);
-            return;
-        }
-        editor.setText("");
-        editor.addToHistory(task);
-        if (task.startsWith("!")) {
-            const command = task.slice(1).trim();
-            if (!command)
-                return;
-            feed.items.push({ id: `sh-${Date.now()}`, kind: "tool", title: "$", body: command });
-            activity("run", "shell");
-            // Same reason as the prompt path: a forced render wipes the screen.
-            refresh();
-            void session
-                .executeBash(command, (chunk) => {
-                activity("run", `shell · ${chunk.length} bytes`);
-                refresh();
-            })
-                .then((result) => {
-                const output = result.output.trim();
-                feed.items.push({
-                    id: `sh-out-${Date.now()}`,
-                    kind: result.exitCode === 0 ? "result" : "error",
-                    title: `exit ${result.exitCode ?? "?"}`,
-                    body: output || "(no output)",
-                });
-                activity("tally", undefined);
-                refresh();
-            })
-                .catch((cause) => error(cause instanceof Error ? cause.message : String(cause)));
-            return;
-        }
-        if (task.startsWith("/")) {
-            void runSlash(task);
-            return;
-        }
-        void sendTask(task);
-    };
-    editor.onSubmit = submit;
-    /**
-     * Esc Esc with an empty editor opens the rewind menu, the way `omp` and
-     * Claude Code do it. The window is short (600 ms) because a second Esc is
-     * otherwise a normal thing to press; Esc with text in the editor clears the
-     * draft, as it always did, and is not a rewind gesture.
-     */
-    let lastEscapeAt = 0;
-    // Idle Ctrl+C quits on the second press, not the first: one keystroke is too
-    // easy to send by accident in a terminal where the same key is the copy
-    // shortcut, and quitting takes the transcript with it.
-    let lastCtrlCAt = 0;
-    /**
-     * Insert the clipboard at the cursor, saying why when it cannot be read.
-     *
-     * Shared by `ctrl+v` and a right click, because they are the same intent and
-     * a user who reaches for one should not get a different answer than the other.
-     */
-    const pasteFromClipboard = () => {
-        void readClipboardText()
-            .then((result) => {
-            if (!result.ok) {
-                note("paste", result.reason);
-            }
-            else {
-                editor.insertTextAtCursor(result.text);
-            }
-            refresh();
-        })
-            .catch((cause) => {
-            note("paste", `could not read the clipboard: ${cause instanceof Error ? cause.message : String(cause)}`);
-            refresh();
-        });
-    };
-    // The SDK's right-click hook resolves to this. On Windows the terminal has
-    // already decided the click means paste, so this is the whole of the handling
-    // there — the pane's own predicate deliberately declines on that platform.
-    pasteFromRightClick = pasteFromClipboard;
-    /**
-     * A right click pastes.
-     *
-     * This cannot live in the input listener: `TuiAltScreen` registers its own
-     * listener in its constructor, `Set` iterates in insertion order, and that
-     * listener consumes every SGR mouse sequence before ours is reached — an
-     * instrumented run showed the bytes never arriving. The mouse event that the
-     * alt-screen synthesises from those bytes is the hook that is actually
-     * reachable, and the pane's `handleMouse` is proof it arrives: the wheel
-     * already scrolls the transcript through it.
-     *
-     * On every platform but Windows the alt-screen routes the click into the
-     * layout, where nothing claimed it, so mouse tracking had already stopped the
-     * terminal from pasting and the click did nothing at all. On Windows the
-     * terminal pastes on its own and the SDK hands the click to it, so handling it
-     * here as well pasted the clipboard twice — `rightClickPastesHere` owns that
-     * decision, and the user can overrule it from `/settings`.
-     */
-    const rightClickPastesHere = (event) => rightClickPasteEnabled(readWorkbenchSettings(AGENT_DIR).rightClickPaste) &&
-        event.type === "press" &&
-        event.button === "right";
-    tui.addInputListener((data) => {
-        // The selector is open: it owns every key, and this listener sees them before
-        // the viewport does — `TuiAltScreen` binds arrow keys to scrolling in a
-        // listener it registers in its own constructor, so without this the tree
-        // selector never receives `up`/`down` and the selection cannot move.
-        if (treeSelector) {
-            if (matchesKey(data, "escape")) {
-                closeRewind();
-                return { consume: true };
-            }
-            // No wrap-around. `TreeList` turns a vertical move at either end into a
-            // jump to the opposite end, so one `↑` past the top seized the newest
-            // entry and one `↓` past the bottom seized `[system]`.
-            //
-            // The move is refused *before* it is delivered. An earlier version let the
-            // key through and then replayed the opposite key to undo the wrap, which
-            // does not return to where you were: from the wrapped position the opposite
-            // key steps to the next entry, so after a wrap the selection was stranded
-            // and onward presses looked stuck. It also measured adjacency against
-            // `getTree()`, which still contains the rows the selector hides
-            // (`session_info`, usage), so the index was offset and an ordinary one-step
-            // `↑` was misread as a wrap.
-            const kb = getKeybindings();
-            const isUp = kb.matches(data, "tui.select.up");
-            const isDown = kb.matches(data, "tui.select.down");
-            if (isUp || isDown) {
-                const list = treeSelector.getTreeList();
-                const before = list.getSelectedNode()?.entry.id;
-                const shown = shownIds();
-                const at = before === undefined ? -1 : shown.indexOf(before);
-                const blocked = isUp ? at === 0 : at === shown.length - 1;
-                if (blocked) {
-                    refresh();
-                    return { consume: true };
-                }
-            }
-            treeSelector.handleInput(data);
-            refresh();
-            return { consume: true };
-        }
-        // A pinned workflow panel gets Esc before the rewind gesture below, which
-        // would otherwise swallow it (`return undefined` without consuming) so the
-        // panel's own Esc — release the keys, collapse the drill-in, unpin — never
-        // ran. The selector above still takes precedence, because when it is open it
-        // owns every key.
-        if (workflowPinned && currentRun && matchesKey(data, "escape")) {
-            if (workflowKeysActive) {
-                workflowKeysActive = false;
-                note("workflow", "panel keys off; the editor has the keyboard");
-            }
-            else if (workflowView.expanded) {
-                workflowView.expanded = false;
-                note("workflow", "collapsed the drill-in");
-            }
-            else {
-                unpinWorkflow();
-                note("workflow", "panel unpinned; the run is still in the transcript");
-            }
-            drawWorkflow();
-            refresh();
-            return { consume: true };
-        }
-        // A picker takes the keyboard before the escape gestures below: inside a
-        // dialog `Escape` means "dismiss this question", never "abort the run", and
-        // the SDK's own interrupt handling is superseded while one is open.
-        if (picker) {
-            picker.handleInput(data);
-            refresh();
-            return { consume: true };
-        }
-        if (matchesKey(data, "escape")) {
-            // Streaming: `Escape` cancels the run. This is `app.interrupt` in the SDK's
-            // own keybindings ("Cancel or abort"), and it is what a user reaches for
-            // when a turn runs long — `Ctrl+C` did the same job, but nobody looks for
-            // it when the screen is busy.
-            if (session.isStreaming) {
-                userAborted = true;
-                // A message that was queued but never read is the user's work, and
-                // cancelling must not swallow it: it goes back into the editor, the same
-                // place Claude Code puts it, so the next prompt is not a retyping.
-                const unread = [...session.getSteeringMessages()].map((message) => message.trim()).filter(Boolean);
-                if (unread.length > 0) {
-                    const draft = editor.getText().trim();
-                    editor.setText(draft ? `${unread.join("\n")}\n${draft}` : unread.join("\n"));
-                    const dropped = new Set(unread);
-                    for (const item of feed.items) {
-                        if (item.kind === "user" && item.pending && dropped.has(item.body.trim()))
-                            item.pending = undefined;
-                    }
-                    note("queued", `${unread.length} unread message${unread.length === 1 ? "" : "s"} returned to the editor`);
-                }
-                void session.abort();
-                activity("note", "stopping");
-                refresh();
-                return { consume: true };
-            }
-            const at = Date.now();
-            if (editor.getText().length === 0 && at - lastEscapeAt < 600) {
-                lastEscapeAt = 0;
-                openRewind();
-                return { consume: true };
-            }
-            lastEscapeAt = at;
-            return undefined;
-        }
-        if (matchesKey(data, "ctrl+c") || isInterrupt(data)) {
-            if (session.isStreaming) {
-                void session.abort();
-                activity("note", "stopping");
-                refresh();
-            }
-            else if (editor.getText().length > 0) {
-                // A draft in the box is work the user can lose by accident: Ctrl+C used
-                // to quit outright and take it with it. First press clears the draft and
-                // says so, the second quits — the same shape Claude Code uses, and the
-                // same one the Esc-Esc rewind already relies on.
-                editor.setText("");
-                activity("note", "draft cleared; ctrl+c again quits");
-                refresh();
-            }
-            else {
-                // Idle with an empty box: the first press only warns, so a stray
-                // Ctrl+C (or a terminal where Ctrl+C is "copy") cannot end the session.
-                const now = Date.now();
-                if (now - lastCtrlCAt < 2000) {
-                    void shutdown();
-                }
-                else {
-                    lastCtrlCAt = now;
-                    activity("note", "press ctrl+c again to quit");
-                    refresh();
-                }
-            }
-            return { consume: true };
-        }
-        if (matchesKey(data, "ctrl+d") && editor.getText().length === 0) {
-            void shutdown();
-            return { consume: true };
-        }
-        // Keyboard scrolling for the transcript.
-        //
-        // The wheel is the pane's (`handleMouse`), because the viewport consumes
-        // wheel events before the app sees them. The page keys are not consumed
-        // anywhere: the viewport's own handler scrolls the *frame*, and the frame is
-        // exactly one viewport tall here, so it has nothing to scroll and the keys
-        // did nothing at all. The transcript's own offset is the thing to move.
-        const page = Math.max(1, feed.viewportHeight - 1);
-        if (matchesKey(data, "pageUp")) {
-            feed.scrollOffset += page;
-            refresh();
-            return { consume: true };
-        }
-        if (matchesKey(data, "pageDown")) {
-            feed.scrollOffset = Math.max(0, feed.scrollOffset - page);
-            refresh();
-            return { consume: true };
-        }
-        // Home/End are rebound from the viewport too (`claimTranscriptScrollKeys`), so
-        // they reach here. The offset is clamped inside `render`, so asking for the
-        // whole transcript is safe.
-        if (matchesKey(data, "home")) {
-            feed.scrollOffset = Number.MAX_SAFE_INTEGER;
-            refresh();
-            return { consume: true };
-        }
-        if (matchesKey(data, "end")) {
-            feed.scrollOffset = 0;
-            refresh();
-            return { consume: true };
-        }
-        // Paste. The SDK's mouse paste is Windows-only, and with mouse tracking on
-        // the terminal no longer handles a right click itself, so on Linux there was
-        // no way to paste at all. `getNativeClipboard` shells out to the platform's
-        // clipboard tool, so this works wherever one is installed.
-        if (matchesKey(data, "ctrl+v")) {
-            pasteFromClipboard();
-            return { consume: true };
-        }
-        if (matchesKey(data, "ctrl+l")) {
-            // Jump to the latest line: the transcript's own offset, not the viewport's.
-            feed.scrollOffset = 0;
-            tui.scrollToBottom();
-            refresh();
-            return { consume: true };
-        }
-        if (matchesKey(data, "ctrl+e")) {
-            // Expand the most recent result; if that one is already open, collapse it.
-            // A single key that toggles the thing you are looking at is the whole
-            // interaction — no picker, no mode.
-            const target = [...feed.items].reverse().find((item) => (item.full?.length ?? 0) > 0);
-            if (!target) {
-                note("expand", "nothing to expand in this transcript yet");
-                return { consume: true };
-            }
-            target.expanded = target.expanded !== true;
-            refresh();
-            return { consume: true };
-        }
-        if (matchesKey(data, "ctrl+o") && !session.isStreaming) {
-            feed.items = [{ id: "cleared", kind: "note", title: "bench", body: "screen cleared. session history is still stored." }];
-            refresh();
-            return { consume: true };
-        }
-        // Thinking level, raise and lower, each wrapping so neither end of the
-        // range leaves a dead key. `ctrl+shift+t` IS distinguishable from `ctrl+t`
-        // in this key table: hxf-tui parses the kitty CSI-u and modifyOtherKeys
-        // forms (`\x1b[116;6u` vs the legacy `\x14`) into different key ids, so
-        // both halves survive on a terminal that reports modifiers. On a terminal
-        // that sends only the legacy byte the shift variant collapses into
-        // `ctrl+t` (raise), and `/thinking` remains the path that always works.
-        if (matchesKey(data, "ctrl+t")) {
-            setThinking(nextLevel(hud.thinking));
-            return { consume: true };
-        }
-        if (matchesKey(data, "ctrl+shift+t")) {
-            setThinking(prevLevel(hud.thinking));
-            return { consume: true };
-        }
-        // Hand the panel the keyboard, and take it back. Nothing else gives the
-        // panel input: while it is pinned but passive, every letter and Enter reach
-        // the editor, which is the only way the user can type or send a message
-        // while a panel is on screen.
-        if (matchesKey(data, WORKFLOW_KEY_TOGGLE) && workflowPinned && currentRun) {
-            workflowKeysActive = !workflowKeysActive;
-            note("workflow", workflowKeysActive ? "panel keys active; Esc gives the keyboard back" : "panel keys off; the editor has the keyboard");
-            drawWorkflow();
-            refresh();
-            return { consume: true };
-        }
-        if (workflowKeysActive && workflowPinned && currentRun) {
-            const action = workflowAction(data);
-            if (action) {
-                const groups = groupPhases(currentRun, Date.now());
-                if (action === "stop") {
-                    if (stopWorkflow) {
-                        stopWorkflow();
-                        stopWorkflow = null;
-                        note("workflow", "stopping the run; in-flight agents resolve as null");
-                    }
-                    else {
-                        note("workflow", "the run has already finished");
-                    }
-                    return { consume: true };
-                }
-                if (action === "save") {
-                    // The footer advertises this key, so it has to do the thing it says.
-                    // What is saved is the script the model wrote, named exactly as its
-                    // own `meta.name`, because the tool refuses to run a script whose
-                    // `meta.name` does not match its filename.
-                    const saved = saveScript(savedScript, WORKFLOWS_DIR);
-                    note("workflow", saved.ok ? `saved ${saved.path}` : saved.reason);
-                    refresh();
-                    return { consume: true };
-                }
-                Object.assign(workflowView, applyView(workflowView, action, groups));
-                drawWorkflow();
-                refresh();
-                return { consume: true };
-            }
-        }
-        return undefined;
-    });
-    const loginHere = (requested) => {
-        const askKey = (provider) => {
-            activity("prompt", `API key for ${provider}. Paste it, then press enter.`);
-            refresh();
-            const previous = editorSubmit;
-            editorSubmit = (value) => {
-                editorSubmit = previous;
-                const key = value.trim();
-                if (!key) {
-                    activity("prompt", undefined);
-                    refresh();
-                    return;
-                }
-                // `setRuntimeApiKey` is an in-memory override: the SDK calls it
-                // "non-persistent" — nothing writes auth.json, and the next start sees
-                // no key at all (the same silent loss `/connect` documents below). So
-                // the override first, to keep the key usable for the rest of *this*
-                // session, then `login(provider, "api_key", ...)` — the SDK's supported
-                // persist path. If persistence fails, the note says so instead of
-                // claiming a save that did not happen.
-                void session.modelRuntime.setRuntimeApiKey(provider, key).then(() => session.modelRuntime.login(provider, "api_key", { prompt: async () => key, notify: () => undefined }).then(() => note("login", `saved API key for ${provider}`), (cause) => note("login", `key set for this session, but it could not be saved (${cause instanceof Error ? cause.message : String(cause)}); run /login again after restarting`)), (cause) => note("login", cause instanceof Error ? cause.message : String(cause)));
-            };
-        };
-        if (requested) {
-            askKey(requested);
-            return;
-        }
-        // Same source as `/providers`: an empty picker here told the user there was
-        // nothing to log into, which was wrong.
-        void session.modelRuntime.getAvailable().then((available) => {
-            const providers = [...new Set(available.map((model) => model.provider))].sort();
-            if (providers.length === 0) {
-                note("login", "no providers are configured; pass one explicitly, e.g. /login nrimo");
-                return;
-            }
-            choose("Login", providers.map((provider) => ({ value: provider, label: provider })), askKey);
-        }, (cause) => note("login", cause instanceof Error ? cause.message : String(cause)));
-    };
-    const syncModelsFor = async (provider, ids) => {
-        const path = join(AGENT_DIR, "models.json");
-        let parsed;
-        let createdFile = false;
-        try {
-            parsed = JSON.parse(readFileSync(path, "utf8"));
-        }
-        catch (cause) {
-            // A missing file is the normal first-run state, not a failure. Without this
-            // branch `/connect` on a fresh install verified the token, said "connected",
-            // and stored nothing — the first thing a new user does left them with no
-            // models at all. Any other read error is still reported, because overwriting
-            // a file we cannot parse would throw the user's own config away.
-            const missing = cause instanceof Error && "code" in cause && cause.code === "ENOENT";
-            if (!missing)
-                return `could not read ${path}; the models were not added`;
-            parsed = { providers: {} };
-            createdFile = true;
-        }
-        if (!parsed.providers || typeof parsed.providers !== "object")
-            parsed.providers = {};
-        let entry = parsed.providers[provider];
-        if (!entry) {
-            // Same story for the entry: a file that exists but has no howtofix provider
-            // is a state a new user can be in, and refusing to write there leaves them
-            // stuck with no way forward from the CLI.
-            entry = newProviderEntry();
-            parsed.providers[provider] = entry;
-            createdFile = true;
-        }
-        const existing = Array.isArray(entry.models) ? entry.models : [];
-        const added = countNewModels(existing, ids);
-        // Read the catalogue before merging so a model added here is written with its
-        // real window and reasoning flag in the same pass — otherwise `/connect`
-        // would store the 128k guess and only the next start would correct it, which
-        // is a wrong number the user sees first.
-        const catalog = await loadCatalog(AGENT_DIR).catch(() => ({ index: new Map() }));
-        const repaired = applyCompat(mergeModels(existing, ids, catalog.index));
-        entry.models = repaired.models;
-        try {
-            mkdirSync(AGENT_DIR, { recursive: true });
-            writeFileAtomicSync(path, `${JSON.stringify(parsed, null, 2)}\n`);
-        }
-        catch {
-            return `could not write ${path}; the models were not added`;
-        }
-        let reloaded = false;
-        try {
-            await session.modelRuntime.refresh();
-            reloaded = true;
-        }
-        catch {
-            reloaded = false;
-        }
-        // Saying only "added N" would hide the repair: a user whose existing models
-        // were all broken by the developer-role bug needs to know they work now.
-        const fixed = repaired.changed > 0 ? `, repaired ${repaired.changed}` : "";
-        const restart = reloaded ? "" : "; restart the CLI to see them all";
-        const where = createdFile ? ` (created ${path})` : "";
-        return added === 0
-            ? `all ${ids.length} models were already configured${fixed}${where}${restart}`
-            : `added ${added} model(s) to "${provider}"${fixed}${where}${restart}`;
-    };
-    /**
-     * Connect a howtofix.id account: verify the token, store it, pull the model
-     * list, and pick a model — in that order, because storing an unverified token
-     * is how a user ends up with a session that fails on the first prompt.
-     *
-     * The order also matters for the paid providers: `howtofix` is the paid
-     * account and `howtofix-free` is the free tier. A token is verified against
-     * both, and the first one that accepts it is where the models land.
-     */
-    const connectHere = (token, credential) => {
-        void (async () => {
-            if (!token) {
-                // A browser login first: it is one click, and it is what people expect
-                // from a coding CLI. The token path stays behind it for a panel that
-                // cannot complete a login (see `oauth-login.ts`), and for a user who
-                // already has a key.
-                const result = await loginWithBrowser({
-                    onProgress: (progress) => {
-                        // The URL and the one-time code are the only things the user has to
-                        // move out of this screen, and a terminal that does not copy on
-                        // selection makes that impossible. Write them somewhere a shell can
-                        // read instead: `cat ~/.howtofix/connect-url.txt`.
-                        let savedPath = "";
-                        try {
-                            const dir = join(AGENT_DIR, ".howtofix");
-                            mkdirSync(dir, { recursive: true, mode: 0o700 });
-                            const target = join(dir, "connect-url.txt");
-                            const lines = progress.kind === "browser"
-                                ? [progress.url]
-                                : [progress.url, `code: ${progress.code}`];
-                            writeFileSync(target, lines.join("\n") + "\n", { mode: 0o600 });
-                            savedPath = target;
-                        }
-                        catch {
-                            savedPath = "";
-                        }
-                        const saved = savedPath ? [`  saved to ${savedPath}`] : [];
-                        if (progress.kind === "browser") {
-                            void openInBrowser(progress.url);
-                            note("connect", [
-                                "finish signing in to howtofix.id:",
-                                "  a browser window is opening — approve the sign-in there",
-                                `  if it did not open, visit ${progress.url}`,
-                                ...saved,
-                            ].join("\n"));
-                        }
-                        else {
-                            void openInBrowser(progress.url);
-                            note("connect", [
-                                "finish signing in to howtofix.id:",
-                                `  1. go to ${progress.url}`,
-                                `  2. enter the code: ${progress.code}`,
-                                "  waiting…",
-                                ...saved,
-                            ].join("\n"));
-                        }
-                        refresh();
-                    },
-                });
-                if (result.ok) {
-                    // Everything after this point is the token path's job, so the browser
-                    // flow ends by handing it the key rather than duplicating the work.
-                    // The paste prompt armed by `/connect` with no argument is disarmed
-                    // first: the user has already signed in, and leaving "paste your token"
-                    // on screen would ask them for something they no longer need.
-                    activity("prompt", undefined);
-                    editorSubmit = undefined;
-                    connectHere(result.token, result.credential);
-                    return;
-                }
-                // Say why, then fall back to the token: a failed login must leave the
-                // user with a way in, not just an error.
-                const opened = await openInBrowser(HOWTOFIX_CONSOLE_URL);
-                note("connect", [
-                    `browser sign-in: ${result.message}`,
-                    "",
-                    "connect with a token instead:",
-                    `  1. ${opened ? "the keys page is opening in your browser" : `open ${HOWTOFIX_CONSOLE_URL}`}`,
-                    "  2. sign in if asked, then create a key (starts with sk-)",
-                    "  3. run /connect <token>",
-                    "  or /connect again, and paste the key when asked",
-                ].join("\n"));
-                refresh();
-                return;
-            }
-            if (!looksLikeToken(token)) {
-                note("connect", "that does not look like a howtofix token; the Console issues tokens that start with sk-");
-                return;
-            }
-            activity("note", `connecting to howtofix.id (${maskToken(token)})`);
-            refresh();
-            const check = await checkAccount(token);
-            if (!check.ok) {
-                activity("note", undefined);
-                note("connect", check.message);
-                refresh();
-                return;
-            }
-            // Order matters here, and getting it wrong is silent.
-            //
-            // The provider is not registered with the runtime until `models.json` names
-            // it and the runtime reloads, and `login()` refuses an unregistered
-            // provider with "Unknown provider: howtofix". So the model list is written
-            // *first* (syncModelsFor refreshes the runtime as part of its job), and the
-            // credential is persisted after — otherwise the sign-in is lost and the
-            // only clue is a note saying it could not be saved.
-            const stored = await syncModelsFor("howtofix", check.models);
-            await session.modelRuntime.setRuntimeApiKey("howtofix", token);
-            // `setRuntimeApiKey` is an in-memory override: the SDK calls it
-            // "non-persistent", nothing writes auth.json, and the next start reports
-            // the provider unconfigured — the first prompt then dies with "Failed to
-            // resolve API key for provider \"howtofix\" from environment variable:
-            // HOWTOFIX_VIP_API_KEY", advice for a variable a signed-in user never had.
-            // Measured: the key was set, listCredentials showed it, and a fresh runtime
-            // saw nothing.
-            //
-            // `login(provider, "api_key", ...)` is the SDK's supported persist path — it
-            // runs the provider's own key login and stores the credential. The prompt is
-            // answered with the key we already verified, so the user sees nothing. The
-            // override above still matters: it makes the key usable for the rest of
-            // *this* session, while login() is what keeps it across sessions.
-            let persistenceNote;
-            try {
-                await session.modelRuntime.login("howtofix", "api_key", {
-                    prompt: async () => token,
-                    notify: () => undefined,
-                });
-            }
-            catch (cause) {
-                // Falling back is honest, not silent: the session works either way, and
-                // the note tells the user the sign-in will not survive a restart so they
-                // can act on it.
-                persistenceNote = `this sign-in could not be saved (${cause instanceof Error ? cause.message : String(cause)}); run /connect again after restarting`;
-            }
-            // A sign-in that came with a refresh token is a device session: the access
-            // token above expires in hours, and this pair is what renews it without
-            // sending the user back to the browser. It is written after the key is
-            // persisted, so a failure to store the credential pair cannot leave a
-            // session that works now but has nothing to renew with.
-            if (credential) {
-                if (writeCliCredential(AGENT_DIR, credential)) {
-                    cliCredential = credential;
-                }
-                else {
-                    persistenceNote = `this sign-in renews itself, but the pair could not be saved to ${cliCredentialsPath(AGENT_DIR)}; it will expire in hours and need /connect again`;
-                }
-            }
-            // Finish the job: a verified token with no model selected leaves the
-            // workbench on `[unknown]`, so the first prompt the user sends goes nowhere.
-            // Pick the best model the account can reach and say which one, unless the
-            // user already has a working model — replacing a chosen model would be rude.
-            const alreadyUsable = Boolean(session.model) && session.model?.provider !== undefined && hud.model !== "unknown";
-            let picked;
-            let pickFailure;
-            if (!alreadyUsable) {
-                try {
-                    const available = (await session.modelRuntime.getAvailable()).filter((model) => isHowtofixProvider(model.provider));
-                    // "Listed" is not "working": try the preferred families in order and
-                    // take the first that actually answers. Without this the first prompt a
-                    // new user sends hits a dead channel and the install looks broken.
-                    const ordered = orderModelsForDefault(available.map((model) => model.id));
-                    const attempts = ordered.slice(0, 4);
-                    for (const id of attempts) {
-                        const probe = await probeModel(id, token);
-                        if (!probe.ok)
-                            continue;
-                        const chosen = available.find((model) => model.id === id);
-                        if (!chosen)
-                            continue;
-                        await session.setModel(chosen);
-                        hud.model = chosen.id;
-                        syncCeiling();
-                        picked = `${chosen.provider}/${chosen.id}`;
-                        break;
-                    }
-                    if (!picked) {
-                        pickFailure =
-                            attempts.length > 0
-                                ? `none of the first ${attempts.length} models answered (${attempts[0]} did not)`
-                                : "the account lists no chat model";
-                    }
-                }
-                catch (cause) {
-                    // A model that will not load is not a reason to fail the connection —
-                    // the key and the catalog are stored — but the reason is reported
-                    // rather than swallowed, because a silent failure here is what left the
-                    // workbench on `[unknown]` with no explanation.
-                    pickFailure = cause instanceof Error ? cause.message : String(cause);
-                }
-            }
-            activity("note", undefined);
-            // Say what the account has left while we are here: it is one more request
-            // against a key we just verified, and "connected" without a balance leaves
-            // the user to discover an empty quota from a failed prompt.
-            const usage = await checkUsage(token);
-            note("connect", [
-                `connected ${maskToken(token)} — ${check.message}`,
-                stored,
-                formatUsage("howtofix", usage),
-                picked
-                    ? `using ${picked} (change it with /model)`
-                    : `pick a model with /model, then send a prompt${pickFailure ? ` (auto-select failed: ${pickFailure})` : ""}`,
-                persistenceNote,
-            ]
-                .filter((line) => Boolean(line))
-                .join("\n"));
-            refresh();
-        })().catch((cause) => {
-            activity("note", undefined);
-            note("connect", cause instanceof Error ? cause.message : String(cause));
-            refresh();
-        });
-    };
-    /**
-     * Connect with the account itself instead of a key made for the occasion.
-     *
-     * The credential is `email:password`, base64-encoded, and it is stored so a
-     * later `/connect` needs nothing typed. The key the relay uses is the one the
-     * account already has: a reconnect reuses it rather than adding another row to
-     * the panel. Everything after the key is obtained is the ordinary connect path,
-     * so verification, model sync and model choice do not fork here.
-     */
-    const connectWithCredential = (raw) => {
-        void (async () => {
-            const parsed = parseCredentialInput(raw);
-            if (!parsed) {
-                note("connect", [
-                    "that is not an account credential.",
-                    "  /connect <email>:<password>",
-                    "  /connect <base64 of email:password>",
-                ].join("\n"));
-                refresh();
-                return;
-            }
-            activity("note", `signing in as ${parsed.username}`);
-            refresh();
-            const { token } = await loginWithCredential(PANEL_URL, parsed.username, parsed.password, APP_VERSION);
-            const saved = saveAccountCredential(AGENT_DIR, parsed.username, parsed.password);
-            activity("note", undefined);
-            note("connect", [
-                `signed in as ${parsed.username}`,
-                "using the CLI key this account owns — no new key was made",
-                saved
-                    ? "credential stored — /connect will not ask again"
-                    : "could not store the credential, so the next connect will ask again",
-            ].join("\n"));
-            refresh();
-            connectHere(token);
-        })().catch((cause) => {
-            activity("note", undefined);
-            note("connect", cause instanceof Error ? cause.message : String(cause));
-            refresh();
-        });
-    };
-    /**
-     * Render a usage check the way a reader scans it: a label column, then the
-     * figures. Prose ("15.00 USD left of 20.00") buries the number that matters.
-     */
-    const formatUsage = (provider, usage) => {
-        if (!usage.ok)
-            return [`${provider} account`, `  ${usage.message}`].join("\n");
-        if (usage.unlimited)
-            return [`${provider} account`, "  quota      no limit on this token"].join("\n");
-        // The bar needs all three figures; a gateway that answers with a subset
-        // still gets a readable panel rather than a row of blanks.
-        if (usage.limit === undefined || usage.used === undefined) {
-            const rows = [`${provider} account`];
-            const money = (value) => `${value.toFixed(2)} ${usage.unit}`;
-            if (usage.limit !== undefined)
-                rows.push(`  granted    ${money(usage.limit)}`);
-            if (usage.used !== undefined)
-                rows.push(`  spent      ${money(usage.used)}`);
-            if (usage.remaining !== undefined)
-                rows.push(`  remaining  ${money(usage.remaining)}`);
-            return rows.join("\n");
-        }
-        return quotaLines(provider, usage.limit, usage.used, usage.unit).join("\n");
-    };
-    /**
-     * `/preset` — the developer-provided preset catalogue.
-     *
-     * The menu is deliberately two levels deep and nothing installs by itself. A
-     * preset puts skill descriptions into every request, so the user is shown what a
-     * preset contains, and what it costs, before anything is copied — and the
-     * "view" action exists because reading what will enter your prompt is the only
-     * real defence against a preset that asks the agent to do something harmful.
-     *
-     * Argument forms are kept as well as the menu, because a menu is the wrong tool
-     * for a scripted install and the wrong tool for a user who already knows the
-     * name:
-     *
-     *   /preset                menu (installed, then categories, then everything)
-     *   /preset list           what is installed
-     *   /preset show <name>    full contents, installs nothing
-     *   /preset add <src>      install from a git URL or a local directory
-     *   /preset remove <name>  uninstall
-     */
-    /**
-     * The servers already in `mcp.json`, for the menu to mark them and to offer
-     * remove instead of install.
-     *
-     * Read through a tolerant path: a config that cannot be parsed is an empty
-     * list here, not a crash in a picker. The install path is the one that refuses
-     * to write over such a file, and it says so there.
-     */
-    const readConfigForMenu = () => ({
-        mcpServers: readGlobalMcpServers(),
-    });
-    /** The MCP servers a preset contributes, as lines for `show` and the summary. */
-    const mcpLines = (mcp) => {
-        const names = Object.keys(mcp ?? {});
-        if (names.length === 0)
-            return [];
-        return names.map((name) => `  mcp       ${name}  ${describeMcpServer(mcp[name])}`);
-    };
-    const presetSummary = (entry) => {
-        const size = presetSize(entry.dir, entry.manifest);
-        const skills = entry.manifest.skills.join(", ");
-        return [
-            entry.manifest.description,
-            `  category  ${entry.manifest.category}`,
-            `  version   ${entry.manifest.version}`,
-            `  skills    ${skills}`,
-            entry.manifest.prompt ? `  prompt    ${entry.manifest.prompt}` : "  prompt    (none)",
-            `  size      ${size} bytes of skill text`,
-            `  source    ${entry.source}`,
-            ...mcpLines(entry.manifest.mcp),
-        ].join("\n");
-    };
-    const presetContents = (entry) => {
-        const parts = [presetSummary(entry), ""];
-        if (entry.manifest.prompt) {
-            const file = join(entry.dir, entry.manifest.prompt);
-            if (existsSync(file))
-                parts.push(`--- ${entry.manifest.prompt} ---`, readFileSync(file, "utf8").trim(), "");
-        }
-        for (const skill of entry.manifest.skills) {
-            const file = join(entry.dir, "skills", skill, "SKILL.md");
-            if (existsSync(file))
-                parts.push(`--- skills/${skill}/SKILL.md ---`, readFileSync(file, "utf8").trim(), "");
-        }
-        return parts.join("\n");
-    };
-    const reloadPresetResources = async () => {
-        // `session.reload()` re-emits `resources_discover` and `session_start`, which is
-        // what makes the MCP extension rebuild its server set from the file just written.
-        // A removal only takes effect through that rebuild.
-        //
-        // The failure is propagated, not swallowed. An earlier version caught it and
-        // returned, so a reload that never ran still reported the server as stopped:
-        // the message and the session disagreed and the process kept running. A caller
-        // that cannot apply a change must be able to say so.
-        await session.reload();
-    };
-    /**
-     * Serialises installs. A picker row can be entered twice before the first
-     * install finishes — a fast double Enter, or an impatient second press — and two
-     * copies racing over one directory is what produced `ENOENT: lstat` and killed
-     * the session before this existed. The second press is told what is happening
-     * rather than silently ignored.
-     */
-    let presetBusy = false;
-    /** One install path for both a local directory and a registry entry. */
-    const runInstall = async (run) => {
-        if (presetBusy) {
-            note("preset", "an install is already running; wait for it to finish");
-            return;
-        }
-        presetBusy = true;
-        try {
-            // Installing touches the filesystem — a download, a copy, a replace — and
-            // this runs from a `void` call inside a picker handler. A throw here would
-            // be an unhandled rejection that takes the whole session down, so every
-            // failure is reported instead.
-            let result;
-            try {
-                result = await run();
-            }
-            catch (err) {
-                error(`preset not installed: ${err instanceof Error ? err.message : String(err)}`);
-                return;
-            }
-            if (!result.ok || !result.name) {
-                error(`preset not installed:\n  ${result.problems.join("\n  ")}`);
-                return;
-            }
-            await reloadPresetResources();
-            // A preset can bring servers as well as skills. Say which, because a
-            // server that starts on the next session is a visible change to the
-            // machine and the user should hear it from the install, not from /mcp.
-            const installedEntry = listCatalog(options.cwd).entries.find((entry) => entry.manifest.name === result.name);
-            const integration = installedEntry?.manifest.integrates || installedEntry?.manifest.mcp;
-            const mcpLine = integration
-                ? `\n  integration disabled by default; run /preset enable ${result.name} when you want to use it`
-                : await registerPresetMcpServers(result.name);
-            if (integration && installedEntry)
-                writeFileSync(join(installedEntry.dir, ".disabled"), "installed\n");
-            // Two different outcomes wear the same "installed" otherwise. A skill the
-            // model cannot see still installs correctly, and the user would reasonably
-            // expect the model to reach for it afterwards.
-            const how = result.modelInvocable === false
-                ? `its skill ${result.skill} is invoke-only (disable-model-invocation): the model cannot choose it, run /skill:${result.skill} yourself`
-                : "its skill is in the model's catalogue from the next message";
-            note("preset", `installed ${result.name} into ${result.target}\n${how}${mcpLine}`);
-        }
-        finally {
-            presetBusy = false;
-        }
-    };
-    /**
-     * The MCP lifecycle for the current session.
-     *
-     * Editing `mcp.json` and making the running session match it are different
-     * things, and only the first used to happen: removing a server left its
-     * transport, its process, and its tools live until the CLI exited. This is the
-     * one seam every MCP change goes through, so no path can bypass the teardown.
-     * Rebuilt on `swap` alongside the session it belongs to.
-     */
-    // Seeded from the file the session actually started with. An empty initial
-    // set made the first reconcile a no-op — `desired` and `active` were both
-    // empty, so `apply` never ran and a removal was never applied — which is the
-    // whole failure this seam exists to prevent.
-    let mcpLifecycle = new McpLifecycle({
-        initial: Object.keys(readConfigForMenu().mcpServers),
-        apply: async (added, removed) => {
-            // A reload re-emits `resources_discover`, which is what rebuilds the MCP
-            // extension's server set from the file just written. Removal only takes
-            // effect through that rebuild, so it runs for both directions.
-            await reloadPresetResources();
-            if (added.length > 0 || removed.length > 0) {
-                const parts = [];
-                if (added.length > 0)
-                    parts.push(`connected ${added.join(", ")}`);
-                if (removed.length > 0)
-                    parts.push(`stopped ${removed.join(", ")}`);
-                note(added.length > 0 ? "mcp connected" : "mcp stopped", parts.join("; "));
-            }
-        },
-        report: (message) => error(message),
-    });
-    /**
-     * Bring the live session in line with `mcp.json`.
-     *
-     * Single-flight and coalescing live in the seam; this only reads the file and
-     * hands over the desired set, so two quick presses cannot interleave a write
-     * with a reload.
-     */
-    const reconcileMcp = async () => {
-        const desired = Object.keys(readConfigForMenu().mcpServers);
-        return await mcpLifecycle.reconcile(desired);
-    };
-    /**
-     * Merge a freshly installed preset's MCP servers into `mcp.json`.
-     *
-     * Returns the line to append to the install message. An existing server of the
-     * same name is never replaced — it may be one the user configured by hand, and
-     * silently repointing it is the kind of change nobody notices until it breaks.
-     */
-    const registerPresetMcpServers = async (name) => {
-        const { entries } = listCatalog(options.cwd);
-        const entry = entries.find((candidate) => candidate.manifest.name === name);
-        const servers = entry?.manifest.mcp;
-        if (!servers || Object.keys(servers).length === 0)
-            return "";
-        const result = addMcpServers(servers);
-        if (result.problems.length > 0)
-            return `\n  MCP: ${result.problems.join("; ")}`;
-        const lines = [];
-        if (result.added.length > 0) {
-            // The server is registered before the session is told about it, so the
-            // wording matches the order the work happens in: the config is written,
-            // then reconciliation connects it. Saying "next session" was wrong — the
-            // reload that follows brings it up in this one.
-            const outcome = await reconcileMcp();
-            const connected = result.added.filter((server) => outcome.added.includes(server));
-            lines.push(connected.length > 0
-                ? `MCP servers connected: ${connected.join(", ")}`
-                : `MCP servers added to mcp.json: ${result.added.join(", ")}`);
-        }
-        if (result.skipped.length > 0) {
-            lines.push(`MCP servers kept as they were (already configured): ${result.skipped.join(", ")}`);
-        }
-        return lines.length > 0 ? `\n  ${lines.join("\n  ")}` : "";
-    };
-    const installPreset = (source) => runInstall(async () => installFrom(source, defaultInstallRoot(options.cwd)));
-    /**
-     * Install a registry entry.
-     *
-     * The download is announced before it starts: the archive can be tens of
-     * megabytes, and a picker that appears to hang is worse than one that says what
-     * it is doing.
-     */
-    const installHubPreset = (entry) => {
-        const mb = entry.sizeKb >= 1024 ? `${(entry.sizeKb / 1024).toFixed(1)} MB` : `${entry.sizeKb} KB`;
-        // Say what is about to happen and what will arrive. A download that can take
-        // seconds to minutes and shows one line reads as a hang; naming the source,
-        // the pinned commit and the size is what makes the wait legible.
-        note("preset", [
-            `downloading ${entry.title}`,
-            `  from    ${entry.repo} @ ${entry.sha.slice(0, 7)}`,
-            `  skill   ${entry.skill}${entry.modelInvocable === false ? "  (invoke-only: the model cannot choose it)" : ""}`,
-            `  size    ~${mb}  ·  ${entry.license}`,
-            `  checking the pinned commit and the contents the registry recorded…`,
-        ].join("\n"));
-        return runInstall(() => installFromHub(entry, defaultInstallRoot(options.cwd)));
-    };
-    /** Rows for one preset: what it does, where it came from, what it costs. */
-    const hubPick = (entries, title) => {
-        choose(title, entries.map((entry) => ({
-            value: entry.name,
-            label: entry.title,
-            description: entry.description,
-        })), (value) => {
-            const entry = entries.find((candidate) => candidate.name === value);
-            if (!entry)
-                return;
-            const size = entry.sizeKb >= 1024 ? `${(entry.sizeKb / 1024).toFixed(1)} MB` : `${entry.sizeKb} KB`;
-            choose(entry.title, [
-                { value: "install", label: "Install", description: `download ~${size} and add its skill to this project` },
-                { value: "view", label: "View contents", description: "read what it contains before downloading" },
-                { value: "back", label: "Back", description: "return to the menu" },
-            ], (action) => {
-                if (action === "install") {
-                    void installHubPreset(entry);
-                    return;
-                }
-                if (action === "view") {
-                    // Local files only: viewing must not fetch tens of megabytes.
-                    note(`preset ${entry.name}`, [
-                        `${entry.description}`,
-                        "",
-                        `skill     ${entry.skill}`,
-                        `source    ${entry.repo} @ ${entry.sha.slice(0, 7)}`,
-                        `licence   ${entry.license}`,
-                        `size      ~${size}`,
-                        `category  ${entry.category}`,
-                        `model     ${entry.modelInvocable === false ? "invoke-only — the model cannot choose it, only /skill:" + entry.skill : "the model can choose it from its catalogue"}`,
-                        "",
-                        "Install downloads the skill and adds it to this project.",
-                    ].join("\n"));
-                    return;
-                }
-                presetMenu();
-            });
-        }, () => refresh());
-    };
-    const presetPick = (entries, title) => {
-        choose(title, entries.map((entry) => ({
-            value: entry.manifest.name,
-            label: entry.manifest.title,
-            // Name the skills the preset provides. The menu is where a user finds out
-            // what this build ships, and a title alone ("Web UI") does not say what
-            // arrives; the skill name is what gets loaded and what `/skills` will list.
-            description: entry.manifest.skills.length > 0
-                ? `${entry.manifest.skills.join(", ")} — ${entry.manifest.description}`
-                : entry.manifest.description,
-        })), (value) => {
-            const entry = entries.find((candidate) => candidate.manifest.name === value);
-            if (!entry)
-                return;
-            choose(entry.manifest.title, [
-                { value: "install", label: "Install", description: "add its skills and rules to this project" },
-                { value: "view", label: "View contents", description: "read the skills and prompt first" },
-                { value: "back", label: "Back", description: "return to the menu" },
-            ], (action) => {
-                if (action === "install") {
-                    void installPreset(entry.dir);
-                    return;
-                }
-                if (action === "view") {
-                    note(`preset ${entry.manifest.name}`, presetContents(entry));
-                    return;
-                }
-                presetCommand("");
-            });
-        }, () => refresh());
-    };
-    /**
-     * Presets that install a tool rather than text.
-     *
-     * A preset can be a bundle of prompt text, or it can be a program: RoToolbox
-     * writes an MCP server into `mcp.json`, and the server is useless until its
-     * other half has been set up somewhere this CLI cannot reach (a Studio plugin,
-     * an editor extension). Filed under Skills — where it used to be, because a
-     * preset carries a skill either way — it looked like text, and the setup it
-     * needs never came up until the tools silently did nothing.
-     *
-     * `integrates` is how a preset declares that: the fact is in the manifest, so
-     * the menu is derived from it rather than from a list of names kept here.
-     * Removing the flag removes the category, and no second copy of the truth
-     * exists to drift.
-     */
-    const integrating = (entries) => entries.filter((entry) => entry.manifest.integrates !== undefined);
-    const integrationsMenu = () => {
-        const { entries } = listCatalog(options.cwd);
-        const hits = integrating(entries);
-        if (hits.length === 0) {
-            note("integrations", "nothing installed that drives another application. /preset lists the rest.");
-            return;
-        }
-        presetPick(hits, "Integrations");
-    };
-    const presetMenu = () => {
-        // Three kinds of thing are on offer and they behave differently. A skill is
-        // text that reaches the prompt; an MCP entry is a server the session
-        // connects to; an integration is a tool that only works once something
-        // outside this CLI has been set up. A single flat list hid the last two
-        // behind a category name, so the menu opens by asking which one — and filing
-        // an integration under Skills is what made installing one look like pasting
-        // text, when it starts a program that will not work until the other half is
-        // configured.
-        const { entries } = listCatalog(options.cwd);
-        const items = [
-            { value: "skills", label: "Skills", description: "bundles of skills and prompt text, installed into the project" },
-            { value: "mcp", label: "MCP", description: "Model Context Protocol servers, added to mcp.json" },
-        ];
-        const count = integrating(entries).length;
-        if (count > 0) {
-            items.push({
-                value: "integrations",
-                label: "Integrations",
-                description: `${count} that drive another application, and need setup there first`,
-            });
-        }
-        choose("Presets", items, (value) => value === "mcp" ? mcpMenu() : value === "integrations" ? integrationsMenu() : skillsMenu());
-    };
-    /** The MCP side: servers, by category, installed into `mcp.json`. */
-    const mcpMenu = () => {
-        const { entries, problems } = readMcpHub();
-        if (problems.length > 0)
-            note("mcp problems", problems.join("\n"));
-        if (entries.length === 0) {
-            note("mcp catalogue", "no servers in the catalogue. run /mcp to inspect the ones already configured.");
-            return;
-        }
-        const installed = new Set(Object.keys(readConfigForMenu().mcpServers));
-        const actions = new Map();
-        const items = [];
-        for (const category of mcpHubCategories(entries)) {
-            const inCategory = mcpHubIn(entries, category);
-            actions.set(category, () => mcpPick(inCategory, category));
-            const ready = inCategory.filter((entry) => installed.has(entry.name)).length;
-            items.push({
-                value: category,
-                label: category,
-                description: `${inCategory.map((entry) => entry.title).join(", ")}${ready > 0 ? ` · ${ready} configured` : ""}`,
-            });
-        }
-        actions.set("all-mcp", () => mcpPick(entries, "All MCP servers"));
-        items.push({
-            value: "all-mcp",
-            label: "All servers",
-            description: `${entries.length} available${installed.size > 0 ? `, ${installed.size} already configured` : ""}`,
-        });
-        choose("MCP servers", items, (value) => actions.get(value)?.());
-    };
-    /** One MCP entry: what it is, what it needs, install or remove. */
-    const mcpPick = (entries, title) => {
-        const configured = readConfigForMenu().mcpServers;
-        choose(title, entries.map((entry) => {
-            const state = configured[entry.name] !== undefined ? "configured · " : "";
-            return { value: entry.name, label: entry.title, description: `${state}${entry.description}` };
-        }), (value) => {
-            const entry = mcpHubFind(entries, value);
-            if (!entry)
-                return;
-            const isConfigured = configured[entry.name] !== undefined;
-            const missing = missingEnvFor(entry);
-            const detail = [
-                entry.description,
-                "",
-                `server    ${entry.name}`,
-                `runs      ${describeMcpServer(serverSpecFromEntry(entry))}`,
-                ...(entry.needs && entry.needs.length > 0
-                    ? [
-                        `needs     ${entry.needs.join(", ")}`,
-                        missing.length > 0
-                            ? `          ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not set in this shell — the value is read at connect time, so export it before the next session`
-                            : "          all set in this shell",
-                    ]
-                    : []),
-                ...(entry.docs ? [`docs      ${entry.docs}`] : []),
-                "",
-                isConfigured
-                    ? "already in mcp.json — removing it takes the entry out; nothing else changes"
-                    : "install writes this server into mcp.json. nothing is downloaded, and it connects on the next session",
-            ].join("\n");
-            const choices = isConfigured
-                ? [
-                    { value: "remove", label: "Remove", description: "take the server out of mcp.json" },
-                    { value: "view", label: "Details", description: "what it runs and what it needs" },
-                    { value: "back", label: "Back", description: "return to the list" },
-                ]
-                : [
-                    { value: "install", label: "Install", description: "add the server to mcp.json" },
-                    { value: "view", label: "Details", description: "what it runs and what it needs" },
-                    { value: "back", label: "Back", description: "return to the list" },
-                ];
-            choose(entry.title, choices, (action) => {
-                if (action === "view") {
-                    note(`mcp ${entry.name}`, detail);
-                    return;
-                }
-                if (action === "install") {
-                    // A bundled entry ships a preset too — its skill and its prompt.
-                    // Install that first, so one action gives both the server and the
-                    // guidance for using it, and so the two cannot drift apart.
-                    const problems = [];
-                    if (entry.preset) {
-                        const bundled = join(bundledPresetsDir(), "mcp", entry.preset.replace(/^mcp-/, ""));
-                        if (existsSync(join(bundled, "preset.json"))) {
-                            const installed = installFromDirectory(bundled, defaultInstallRoot(options.cwd));
-                            if (!installed.ok)
-                                problems.push(...installed.problems);
-                        }
-                    }
-                    const result = addMcpServers({ [entry.name]: serverSpecFromEntry(entry) });
-                    problems.push(...result.problems);
-                    if (problems.length > 0) {
-                        error(`mcp not installed:\n  ${problems.join("\n  ")}`);
-                        return;
-                    }
-                    if (result.skipped.length > 0) {
-                        note("mcp install", `${entry.name} is already in mcp.json; it was left as it is.`);
-                        return;
-                    }
-                    const warn = missing.length > 0
-                        ? `\n  ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not set in this shell — the value is read when the server connects, so export ${missing.length === 1 ? "it" : "them"} and reload, or it will fail every call`
-                        : "";
-                    // A title of its own. The session's own MCP notice is titled `mcp`,
-                    // and `upsertNote` replaces the last note that shares a title — so
-                    // writing under `mcp` meant one of the two messages silently ate
-                    // the other, whichever landed second.
-                    note("mcp installed", [
-                        `added ${entry.name} to mcp.json${entry.preset ? ` and installed its skill preset` : ""}`,
-                        `  runs  ${describeMcpServer(serverSpecFromEntry(entry))}`,
-                        `  connecting now; /mcp shows its state and its tools${warn}`,
-                    ].join("\n"));
-                    // Through the seam, not a bare reload: a `void` reload racing a
-                    // second install is what let two config writes and two session
-                    // reloads interleave. The seam serialises them and connects the
-                    // server once.
-                    void reconcileMcp().catch((cause) => {
-                        error(`mcp installed but the session was not updated: ${cause instanceof Error ? cause.message : String(cause)}`);
-                    });
-                    return;
-                }
-                if (action === "remove") {
-                    const result = removeMcpServers([entry.name]);
-                    if (result.problems.length > 0) {
-                        error(`mcp not removed:\n  ${result.problems.join("\n  ")}`);
-                        return;
-                    }
-                    // Editing the file is only half of a removal. Without the
-                    // reconcile the server's process, transport, and tools stay live
-                    // in the session, so the agent can still call a server the user
-                    // just removed. `choose` takes a synchronous handler, so this is
-                    // launched and every failure reported inside, never left to
-                    // surface as an unhandled rejection.
-                    void reconcileMcp()
-                        .then((outcome) => {
-                        note("mcp remove", outcome.removed.length > 0
-                            ? `removed ${outcome.removed.join(", ")} from mcp.json and stopped ${outcome.removed.length === 1 ? "it" : "them"}`
-                            : result.removed.length > 0
-                                ? `removed ${entry.name} from mcp.json`
-                                : `${entry.name} was not in mcp.json`);
-                    })
-                        .catch((cause) => {
-                        error(`mcp removed from config but the session was not updated: ${cause instanceof Error ? cause.message : String(cause)}`);
-                    });
-                    return;
-                }
-                mcpMenu();
-            });
-        }, () => mcpMenu());
-    };
-    /** The skills side: the preset catalogue as it was, minus the server entries. */
-    const skillsMenu = () => {
-        const { entries, problems } = listCatalog(options.cwd);
-        const { entries: hub, problems: hubProblems } = readHub();
-        if (problems.length > 0)
-            note("preset problems", problems.join("\n"));
-        if (hubProblems.length > 0)
-            note("preset problems", hubProblems.join("\n"));
-        const installed = entries.filter((entry) => entry.source === "installed");
-        // Each row's value is what the picker filters on (`SelectList.setFilter`
-        // matches `value.startsWith(input)`), so it has to be the word a user would
-        // type. A `cat:` prefix made the category rows unfindable by typing — the
-        // filter matched nothing and the menu looked broken. The value doubles as the
-        // dispatch key through this map instead of being parsed back out.
-        const actions = new Map();
-        const items = [];
-        if (installed.length > 0) {
-            actions.set("installed", () => presetPick(installed, "Installed presets"));
-            items.push({ value: "installed", label: "Installed", description: `${installed.length} active` });
-        }
-        // Bundled and installed presets first: they are already on disk, so they work
-        // without a download.
-        for (const category of categoriesOf(entries)) {
-            const inCategory = presetsIn(entries, category);
-            const fromHub = hubIn(hub, category);
-            actions.set(category, () => fromHub.length > 0 ? presetCategoryPick(inCategory, category, fromHub) : presetPick(inCategory, category));
-            // Name the local presets and their skills on the row itself. This is the
-            // list of what development provides; a bare category name and a count make
-            // the user open every one to find out, which is the complaint this fixes.
-            const local = inCategory
-                .map((entry) => `${entry.manifest.title} (${entry.manifest.skills.join(", ")})`)
-                .join(", ");
-            items.push({
-                value: category,
-                label: category,
-                description: `${local}${fromHub.length > 0 ? ` · ${fromHub.length} more to download` : ""}`,
-            });
-        }
-        // Categories that exist only in the registry.
-        for (const category of hubCategories(hub)) {
-            if (entries.some((entry) => entry.manifest.category === category))
-                continue;
-            const inCategory = hubIn(hub, category);
-            actions.set(category, () => hubPick(inCategory, category));
-            items.push({ value: category, label: category, description: `${inCategory.length} to download` });
-        }
-        actions.set("all", () => presetPick(entries, "All presets"));
-        items.push({ value: "all", label: "All presets", description: `${entries.length} ready to install` });
-        if (hub.length > 0) {
-            // Passed the whole registry: the caller supplies the rows, this helper
-            // never re-filters by a category name.
-            actions.set("hub", () => presetCategoryPick([], "Community presets", hub));
-            const projects = new Set(hub.map((entry) => entry.repo)).size;
-            items.push({
-                value: "hub",
-                label: "Community",
-                description: `${hub.length} to download, from ${projects} projects`,
-            });
-        }
-        choose("Skill presets", items, (value) => actions.get(value)?.());
-    };
-    /**
-     * One category, with what is local and what has to be downloaded.
-     *
-     * `local` is the bundled/installed entries of that category and `inHub` the
-     * registry's — already filtered by the caller, never re-filtered here by
-     * category name: a "Community" list passed with a title instead of a category
-     * matched nothing and rendered an empty picker.
-     */
-    const presetCategoryPick = (local, category, inHub) => {
-        if (inHub.length === 0) {
-            presetPick(local, category);
-            return;
-        }
-        if (local.length === 0) {
-            hubPick(inHub, `${category} (download)`);
-            return;
-        }
-        choose(category, [
-            { value: "local", label: `Included (${local.length})`, description: "already on disk, no download" },
-            { value: "hub", label: `Downloadable (${inHub.length})`, description: "fetched when installed" },
-        ], (value) => (value === "local" ? presetPick(local, category) : hubPick(inHub, category)));
-    };
-    const presetCommand = (arg) => {
-        const [sub, ...rest] = arg.trim().split(/\s+/);
-        const value = rest.join(" ").trim();
-        if (!sub) {
-            presetMenu();
-            return;
-        }
-        if (sub === "list") {
-            const { entries } = listCatalog(options.cwd);
-            const installed = entries.filter((entry) => entry.source === "installed");
-            if (installed.length === 0) {
-                note("preset list", "nothing installed. run /preset to browse the catalogue.");
-                return;
-            }
-            note("preset list", installed
-                .map((entry) => `${entry.manifest.name}  ${entry.manifest.version}  [${isPresetDisabled(entry.dir) ? "disabled" : "active"}]\n  ${entry.manifest.description}\n  ${entry.dir}`)
-                .join("\n"));
-            return;
-        }
-        if (sub === "show") {
-            if (!value) {
-                note("preset show", "usage: /preset show <name>");
-                return;
-            }
-            const { entries } = listCatalog(options.cwd);
-            const entry = entries.find((candidate) => candidate.manifest.name === value);
-            if (entry) {
-                note(`preset ${value}`, presetContents(entry));
-                return;
-            }
-            // Not on disk: the registry can still describe it, which is what makes
-            // `/preset show impeccable` useful before committing to a download.
-            const { entries: hub } = readHub();
-            const hubEntry = hubFind(hub, value);
-            if (!hubEntry) {
-                note("preset show", `no preset named "${value}". run /preset to list them.`);
-                return;
-            }
-            const size = hubEntry.sizeKb >= 1024 ? `${(hubEntry.sizeKb / 1024).toFixed(1)} MB` : `${hubEntry.sizeKb} KB`;
-            note(`preset ${value}`, [
-                hubEntry.description,
-                "",
-                `skill     ${hubEntry.skill}`,
-                `source    ${hubEntry.repo} @ ${hubEntry.sha.slice(0, 7)}`,
-                `licence   ${hubEntry.license}`,
-                `size      ~${size}`,
-                `category  ${hubEntry.category}`,
-                "",
-                "not installed. install it from /preset, or: /preset add-hub " + hubEntry.name,
-            ].join("\n"));
-            return;
-        }
-        if (sub === "add") {
-            if (!value) {
-                note("preset add", "usage: /preset add <git-url | directory>");
-                return;
-            }
-            void installPreset(value);
-            return;
-        }
-        if (sub === "add-hub") {
-            if (!value) {
-                note("preset add-hub", "usage: /preset add-hub <name>  (see /preset for names)");
-                return;
-            }
-            const { entries: hub } = readHub();
-            const hubEntry = hubFind(hub, value);
-            if (!hubEntry) {
-                note("preset add-hub", `"${value}" is not in the community registry. run /preset to browse it.`);
-                return;
-            }
-            void installHubPreset(hubEntry);
-            return;
-        }
-        if (sub === "enable" || sub === "disable") {
-            if (!value) {
-                note(`preset ${sub}`, `usage: /preset ${sub} <name>`);
-                return;
-            }
-            const entry = listCatalog(options.cwd).entries.find((candidate) => candidate.manifest.name === value && candidate.source === "installed");
-            if (!entry) {
-                note(`preset ${sub}`, `no installed preset named "${value}"`);
-                return;
-            }
-            const marker = join(entry.dir, ".disabled");
-            if (sub === "disable") {
-                writeFileSync(marker, "disabled\n");
-                const mcp = entry.manifest.mcp ? removeMcpServers(Object.keys(entry.manifest.mcp)) : { removed: [], kept: [], problems: [] };
-                void reconcileMcp()
-                    .then(() => reloadPresetResources())
-                    .then(() => note("preset", `disabled ${value}${mcp.removed.length ? `; stopped ${mcp.removed.join(", ")}` : ""}`))
-                    .catch((cause) => error(`preset disable failed: ${cause instanceof Error ? cause.message : String(cause)}`));
-                return;
-            }
-            rmSync(marker, { force: true });
-            void registerPresetMcpServers(value)
-                .then((mcpLine) => reloadPresetResources().then(() => note("preset", `enabled ${value}${mcpLine}`)))
-                .catch((cause) => error(`preset enable failed: ${cause instanceof Error ? cause.message : String(cause)}`));
-            return;
-        }
-        if (sub === "remove") {
-            if (!value) {
-                note("preset remove", "usage: /preset remove <name>");
-                return;
-            }
-            const result = removeInstalled(value, options.cwd);
-            if (result.problems.length > 0) {
-                note("preset remove", result.problems.join("\n"));
-                return;
-            }
-            // Take back the servers this preset added, but only the ones no other
-            // installed preset still declares. Removing one another preset needs would
-            // break that preset silently, the next time somebody uses it.
-            const before = listCatalog(options.cwd).entries;
-            const wasInstalled = before.find((entry) => entry.manifest.name === value);
-            const claimed = new Set();
-            for (const entry of listCatalog(options.cwd).entries) {
-                if (entry.manifest.name === value)
-                    continue;
-                for (const name of Object.keys(entry.manifest.mcp ?? {}))
-                    claimed.add(name);
-            }
-            const mcp = wasInstalled?.manifest.mcp ? removeMcpServers(Object.keys(wasInstalled.manifest.mcp), claimed) : { removed: [], kept: [], problems: [] };
-            const mcpLine = mcp.removed.length > 0
-                ? `\n  MCP servers removed from mcp.json: ${mcp.removed.join(", ")}`
-                : mcp.kept.length > 0
-                    ? `\n  MCP servers kept (still used by another preset): ${mcp.kept.join(", ")}`
-                    : "";
-            const mcpProblem = mcp.problems.length > 0 ? `\n  MCP: ${mcp.problems.join("; ")}` : "";
-            void reloadPresetResources().then(() => {
-                note("preset", `removed ${value}\n  ${result.removed.join("\n  ")}${mcpLine}${mcpProblem}`);
-            });
-            return;
-        }
-        note("preset", `unknown subcommand "${sub}". try: list, show, add, add-hub, remove.`);
-    };
-    const runSlash = async (text) => {
-        const [name, ...rest] = text.slice(1).split(/\s+/);
-        const arg = rest.join(" ");
-        if (name === "quit" || name === "exit") {
-            void shutdown();
-            return;
-        }
-        if (name === "help") {
-            note("help", slashCommands(session).map((command) => `/${command.name}  ${command.description ?? ""}`).join("\n"));
-            return;
-        }
-        if (name === "init") {
-            const target = join(options.cwd, "AGENTS.md");
-            if (existsSync(target) && arg !== "force") {
-                note("init", `AGENTS.md already exists at ${target}. run /init force to overwrite.`);
-                return;
-            }
-            writeFileAtomicSync(target, INIT_TEMPLATE);
-            // Without this the command looked like it did nothing: the file was
-            // written and a model turn started, but the screen showed no trace.
-            note("init", `wrote ${target}; asking the agent to fill it in`);
-            await session.prompt("Read AGENTS.md, then fill it in with the real build, test, and layout facts of this repo. Keep it short.");
-            return;
-        }
-        if (name === "login") {
-            loginHere(arg);
-            return;
-        }
-        if (name === "connect") {
-            // With an argument the token is used directly. Without one, show how to get
-            // a token and where to make one, then take the next line typed into the
-            // editor as the token. The guide runs first because "paste your token" on
-            // its own leaves the user with no idea where a token comes from.
-            //
-            // A relay key always starts with `sk-`. Anything else that reads as a
-            // credential — `email:password`, or the base64 of it — is the account
-            // itself, and takes the path that reuses the key the account already owns
-            // instead of minting another one.
-            const raw = arg.trim();
-            if (raw && !raw.startsWith("sk-") && parseCredentialInput(raw)) {
-                connectWithCredential(raw);
-                return;
-            }
-            if (raw) {
-                connectHere(raw);
-                return;
-            }
-            // No argument and a credential on disk: sign in with it rather than
-            // sending the user through a browser they have already been through.
-            const stored = loadAccountCredential(AGENT_DIR);
-            if (stored) {
-                connectWithCredential(stored.credential);
-                return;
-            }
-            void connectHere("");
-            activity("prompt", "paste your howtofix.id token, then press enter");
-            refresh();
-            const previous = editorSubmit;
-            editorSubmit = (value) => {
-                editorSubmit = previous;
-                activity("prompt", undefined);
-                connectHere(value.trim());
-            };
-            return;
-        }
-        if (name === "sync") {
-            // Re-pull the gateway's catalogue without asking for the token again.
-            //
-            // The gateway adds and retires models, and `models.json` is a snapshot: a
-            // user who connected last month still sees last month's list, and the only
-            // way to refresh it was `/connect <token>` — re-pasting a credential to do
-            // something that needs no new credential at all.
-            //
-            // The key is already configured (as a literal or a `$ENV` reference), so
-            // the runtime can resolve it for us; nothing is printed and nothing is
-            // written back to the file.
-            const configured = new Set((await session.modelRuntime.getAvailable())
-                .map((model) => model.provider)
-                .filter((provider) => isHowtofixProvider(provider)));
-            const target = HOWTOFIX_PROVIDERS.find((provider) => configured.has(provider));
-            if (!target) {
-                note("sync", "no howtofix.id account is connected; run /connect first");
-                return;
-            }
-            activity("note", `re-syncing ${target} from howtofix.id`);
-            refresh();
-            const auth = await session.modelRuntime.getAuth(target);
-            const key = auth?.auth?.apiKey;
-            if (!key) {
-                activity("note", undefined);
-                note("sync", `${target} has no usable key; run /connect to sign in again`);
-                refresh();
-                return;
-            }
-            const check = await checkAccount(key);
-            if (!check.ok) {
-                activity("note", undefined);
-                note("sync", check.message);
-                refresh();
-                return;
-            }
-            const outcome = await syncModelsFor(target, check.models);
-            const usage = await checkUsage(key);
-            activity("note", undefined);
-            note("sync", `${outcome}\n${formatUsage(target, usage)}`);
-            // A newly synced model is not in the runtime's catalogue until it reloads.
-            await session.modelRuntime.refresh();
-            refresh();
-            return;
-        }
-        if (name === "usage") {
-            // What the account has left. The gateway answers this to the API key alone
-            // (`/v1/dashboard/billing/…`), so there is no session and no OAuth here.
-            const configured = new Set((await session.modelRuntime.getAvailable())
-                .map((model) => model.provider)
-                .filter((provider) => isHowtofixProvider(provider)));
-            const target = HOWTOFIX_PROVIDERS.find((provider) => configured.has(provider));
-            if (!target) {
-                note("usage", "no howtofix.id account is connected; run /connect first");
-                return;
-            }
-            activity("note", `asking howtofix.id for the account usage`);
-            refresh();
-            const auth = await session.modelRuntime.getAuth(target);
-            const key = auth?.auth?.apiKey;
-            if (!key) {
-                activity("note", undefined);
-                note("usage", `${target} has no usable key; run /connect to sign in again`);
-                refresh();
-                return;
-            }
-            const usage = await checkUsage(key);
-            // The daily check-in rides along: it is money on the same account, and
-            // asking for it here is one request the user would otherwise make in a
-            // browser. A status that cannot be read simply leaves the line off.
-            const checkin = await checkCliCheckin(key);
-            activity("note", undefined);
-            const checkinLine = checkin.ok && checkin.enabled
-                ? checkin.checkedInToday
-                    ? `check-in: claimed today (+${formatQuotaUsd(checkin.quotaToday)})`
-                    : "check-in: not claimed yet today (it claims itself on the next start)"
-                : "";
-            note("usage", checkinLine ? `${formatUsage(target, usage)}\n${checkinLine}` : formatUsage(target, usage));
-            refresh();
-            return;
-        }
-        if (name === "logout") {
-            // Same empty-list bug as `/providers`: the registered-ids set does not
-            // contain the configured providers, so the picker had nothing to pick.
-            const available = await session.modelRuntime.getAvailable();
-            const providers = [...new Set(available.map((model) => model.provider))].sort();
-            if (providers.length === 0) {
-                note("logout", "no providers are configured");
-                return;
-            }
-            choose("Logout", providers.map((provider) => ({ value: provider, label: provider })), (provider) => {
-                void session.modelRuntime.logout(provider).then(() => note("logout", `logged out ${provider}`), (cause) => note("logout", cause instanceof Error ? cause.message : String(cause)));
-            });
-            return;
-        }
-        if (name === "providers") {
-            // Providers that actually have models. `getRegisteredProviderIds()` is
-            // empty unless a provider was registered at runtime by a login, so the
-            // picker used to open with no rows even though `/model` listed four
-            // providers. Ask the same source `/model` asks.
-            const available = await session.modelRuntime.getAvailable();
-            const providers = [...new Set(available.map((model) => model.provider))].sort();
-            // The product's own gateway first: this CLI is meant to be usable through
-            // howtofix.id alone, so its providers must not be buried under others.
-            providers.sort((a, b) => Number(isHowtofixProvider(b)) - Number(isHowtofixProvider(a)));
-            choose("Providers", providers.map((provider) => ({ value: provider, label: provider })), (provider) => {
-                const models = session.modelRuntime.getModels(provider);
-                if (models.length === 0) {
-                    loginHere(provider);
-                    return;
-                }
-                choose(provider, models.map((model) => ({ value: model.id, label: model.id })), (id) => {
-                    const picked = models.find((model) => model.id === id);
-                    if (!picked)
-                        return;
-                    void session.setModel(picked, { persist: true }).then(() => {
-                        hud.model = picked.id;
-                        syncCeiling();
-                        note("providers", `${provider}/${picked.id}`);
-                    }, () => loginHere(provider));
-                });
-            });
-            return;
-        }
-        if (name === "name") {
-            if (!arg) {
-                note("name", `usage: /name <session name>`);
-                return;
-            }
-            session.setSessionName(arg);
-            note("name", `session name: ${arg}`);
-            return;
-        }
-        if (name === "update") {
-            // Same path the startup check takes, but asked for: so it always answers.
-            //
-            // The check is a network call, and this one had no busy signal at all —
-            // `/sync` and `/usage` both say what they are doing, so `/update` read as
-            // a dead key on a slow link until the answer finally landed.
-            activity("note", "checking for a newer release");
-            try {
-                await checkAndMaybeInstallUpdate({ current: APP_VERSION, install: true });
-            }
-            finally {
-                activity("note", undefined);
-            }
-            return;
-        }
-        if (name === "stats") {
-            const stats = session.getSessionStats();
-            const usage = session.getContextUsage();
-            // Same absent-usage class as the context meter: a message whose usage never
-            // arrived makes the SDK's aggregate `NaN`, and `$${NaN.toFixed(4)}` prints
-            // "$NaN". Print a dash for a reading that does not exist.
-            const n = (value) => (Number.isFinite(value) ? String(value) : ";");
-            // A high `cacheRead` alone does not say whether we are paying twice for the same
-            // context; the rate across cached AND billed prompt tokens does, and a miss is
-            // worth naming because it is almost always attributable to a cause.
-            const cache = summarizeCacheUsage(session.sessionManager.getEntries());
-            const cacheLine = cache.hitRate === null
-                ? "cache hit rate unknown (no prompt billed yet)"
-                : `cache hit ${cache.hitRate.toFixed(1)}% of ${cache.cachedTokens + cache.billedTokens} prompt tokens`;
-            note("stats", [
-                `session ${stats.sessionId}`,
-                stats.sessionFile ? `file ${stats.sessionFile}` : "not persisted",
-                `messages ${n(stats.totalMessages)} (user ${n(stats.userMessages)}, assistant ${n(stats.assistantMessages)}, tools ${n(stats.toolCalls)})`,
-                `tokens in ${n(stats.tokens.input)} out ${n(stats.tokens.output)} cache ${n(stats.tokens.cacheRead)}/${n(stats.tokens.cacheWrite)}`,
-                cacheLine,
-                cache.misses.length > 0
-                    ? `cache misses ${cache.misses.length} (${n(cache.missedTokens)} tokens re-billed) — last: ${explainMiss(cache.misses[cache.misses.length - 1])}`
-                    : "cache misses none counted",
-                `cost $${Number.isFinite(stats.cost) ? stats.cost.toFixed(4) : ";"}`,
-                usage ? `context ${usage.percent === null || !Number.isFinite(usage.percent) ? "?" : `${Math.round(usage.percent)}%`} of ${usage.contextWindow}` : "context unknown",
-            ].join("\n"));
-            return;
-        }
-        if (name === "diff") {
-            // Async: `git diff` on a large change set is slow enough to be felt, and a
-            // synchronous spawn blocks the whole event loop — the same reason every
-            // other git call on an interactive path was moved off `execFileSync`.
-            const run = async (args) => {
-                try {
-                    const { stdout } = await execFileAsync("git", args, { cwd: options.cwd, encoding: "utf8" });
-                    return stdout.trim();
-                }
-                catch {
-                    return "";
-                }
-            };
-            const body = (await run(["diff", "--stat"])) + "\n\n" + (await run(["diff", "--", "."]));
-            // The summary stays whole; the patch body is capped so one large change
-            // cannot push the rest of the transcript off the screen.
-            const [summary = "", patch = ""] = body.split("\n\n", 2);
-            const clipped = clipDiff(patch);
-            note("diff", [summary.trim(), clipped].filter(Boolean).join("\n\n") || "working tree clean");
-            return;
-        }
-        if (name === "copy") {
-            const last = [...session.state.messages].reverse().find((message) => message.role === "assistant");
-            const parts = Array.isArray(last?.content) ? last.content : [];
-            const textOut = parts
-                .filter((part) => part.type === "text")
-                .map((part) => part.text)
-                .join("");
-            if (!textOut) {
-                note("copy", "nothing to copy");
-                return;
-            }
-            try {
-                await copyToClipboard(textOut);
-                note("copy", `copied ${textOut.length} characters`);
-            }
-            catch (cause) {
-                note("copy", cause instanceof Error ? cause.message : String(cause));
-            }
-            return;
-        }
-        if (name === "export") {
-            // An empty transcript exported to a file and reported "wrote ..." — the
-            // user gets a file with a header and nothing in it, and no hint that the
-            // session was empty. Say so instead of writing a misleading artifact.
-            const body = feed.items.filter((item) => item.body.trim().length > 0);
-            if (body.length === 0) {
-                note("export", "nothing to export yet; the transcript is empty");
-                return;
-            }
-            const target = resolve(options.cwd, arg || `howtofix-session-${Date.now()}.md`);
-            const lines = [`# ${APP_TITLE} session`, "", `model ${hud.model}`, ""];
-            for (const item of body) {
-                lines.push(`## ${item.title || item.kind}`, "", item.body, "");
-            }
-            try {
-                writeFileAtomicSync(target, lines.join("\n"));
-            }
-            catch (cause) {
-                // A bad path or a read-only target used to throw out of the input
-                // handler; the workbench stayed up but the command died silently.
-                note("export", `could not write ${target}: ${cause instanceof Error ? cause.message : String(cause)}`);
-                return;
-            }
-            note("export", `wrote ${target}`);
-            return;
-        }
-        if (name === "agents") {
-            // `/agents <id> <message>` talks to a parked agent. The capability existed
-            // (sendMail) but nothing called it, so a parked agent could only be listed,
-            // never resumed with new instructions — the point of parking it.
-            const [id = "", ...rest] = arg.split(/\s+/).filter(Boolean);
-            const message = rest.join(" ").trim();
-            if (id && message) {
-                note("agents", await sendMail(id, message));
-                return;
-            }
-            note("agents", id ? showRun(id) : listRuns());
-            return;
-        }
-        if (name === "new") {
-            const next = await options.reopen({ noSession: false });
-            await swap(next);
-            note("new", "started a new session");
-            return;
-        }
-        if (name === "resume") {
-            const sessions = await SessionManager.list(options.cwd);
-            if (sessions.length === 0) {
-                note("resume", "no saved sessions for this folder");
-                return;
-            }
-            choose("Resume session", sessions.slice(0, 30).map((info) => ({
-                value: info.path,
-                label: info.name || `${info.id.slice(0, 8)} ${info.firstMessage.slice(0, 40)}`,
-                description: `${info.modified.toISOString().slice(0, 16)} ${info.messageCount} messages`,
-            })), (path) => {
-                void options.reopen({ sessionPath: path }).then(swap, (cause) => error(cause instanceof Error ? cause.message : String(cause)));
-            });
-            return;
-        }
-        if (name === "model") {
-            const models = await session.modelRuntime.getAvailable();
-            const match = arg ? models.find((model) => `${model.provider}/${model.id}` === arg || model.id === arg) : undefined;
-            if (!arg) {
-                choose("Select model", models.map((model) => ({ value: `${model.provider}/${model.id}`, label: model.id, description: model.provider })), (value) => {
-                    const picked = models.find((model) => `${model.provider}/${model.id}` === value);
-                    if (!picked)
-                        return;
-                    void session.setModel(picked, { persist: true }).then(() => {
-                        hud.model = picked.id;
-                        syncCeiling();
-                        note("model", `model ${value}`);
-                    });
-                });
-                return;
-            }
-            if (!match) {
-                note("model", `unknown model ${arg}`);
-                return;
-            }
-            await session.setModel(match, { persist: true });
-            hud.model = match.id;
-            syncCeiling();
-            note("model", `model ${match.provider}/${match.id}`);
-            return;
-        }
-        if (name === "thinking") {
-            if (!arg) {
-                choose("Thinking level", THINKING_LEVELS.map((level) => ({ value: level, label: level })), (value) => setThinking(value));
-                return;
-            }
-            if (!THINKING_LEVELS.includes(arg)) {
-                note("thinking", `thinking: ${THINKING_LEVELS.join(", ")}`);
-                return;
-            }
-            setThinking(arg);
-            return;
-        }
-        if (name === "rtk") {
-            // Reads the setting each time so `/rtk` reflects what is actually on disk — the
-            // user may have flipped it from another terminal, and reporting a cached value
-            // would make the command a liar.
-            const current = readWorkbenchSettings(AGENT_DIR).compressToolOutput;
-            if (!arg) {
-                note("rtk", `compress tool output: ${current ? "on" : "off"}\n/rtk on | /rtk off`);
-                return;
-            }
-            const wanted = arg.toLowerCase();
-            if (wanted !== "on" && wanted !== "off") {
-                note("rtk", "rtk: on | off");
-                return;
-            }
-            const next = wanted === "on";
-            if (next === current) {
-                note("rtk", `already ${wanted}`);
-                return;
-            }
-            if (!writeWorkbenchSetting(AGENT_DIR, "compressToolOutput", next)) {
-                note("rtk", "could not write the setting");
-                return;
-            }
-            // The extension reads the flag per tool result, so this takes effect on the next
-            // tool call rather than on the next process — which is what a toggle should do.
-            setCompressToolOutput(next);
-            note("rtk", `compress tool output ${wanted}\nlong results are ${next ? "summarised before the model reads them" : "sent in full"}`);
-            return;
-        }
-        if (name === "compact") {
-            // The SDK throws when there is nothing to compact, and an uncaught
-            // rejection here killed the whole workbench (Node exits on it). A failed
-            // compaction is a normal outcome, not a reason to lose the session.
-            try {
-                await session.compact(arg || undefined);
-                note("compact", "session compacted");
-            }
-            catch (cause) {
-                note("compact", cause instanceof Error ? cause.message : String(cause));
-            }
-            return;
-        }
-        if (name === "approval") {
-            const apply = (mode) => {
-                setApprovalMode(mode);
-                note("approval", APPROVAL_LABELS[mode]);
-            };
-            if (!arg) {
-                choose("Approval mode", APPROVAL_MODES.map((mode) => ({ value: mode, label: mode, description: APPROVAL_LABELS[mode] })), (value) => apply(value));
-                return;
-            }
-            if (!APPROVAL_MODES.includes(arg)) {
-                note("approval", `modes: ${APPROVAL_MODES.join(", ")}`);
-                return;
-            }
-            apply(arg);
-            return;
-        }
-        if (name === "settings") {
-            /**
-             * A settings hub, not one toggle.
-             *
-             * Each entry opens the same picker its own slash command opens, so there is
-             * one implementation per setting and the hub is only a way in. The current
-             * value is in the picker's detail line, which is the part a user actually
-             * needs before choosing.
-             */
-            const permissionLabel = () => (isDangerousBypass() ? "off — everything runs" : "on — critical commands are refused");
-            const openPermission = () => {
-                choose("Permission checks", [
-                    { value: "on", label: "on", description: "refuse critical commands and repeated calls (the default)" },
-                    { value: "off", label: "off", description: "run everything without asking — for unattended runs" },
-                ], (value) => {
-                    // The row says "off" about the *checks*, and the stored flag says
-                    // whether to skip them — the two are opposites, so this is the one
-                    // place the polarity is flipped, and it is flipped exactly once.
-                    const bypassOn = value === "off";
-                    const stored = writeWorkbenchSetting(AGENT_DIR, "skipPermissions", bypassOn);
-                    // Applied now, not only on the next start: a setting the user changed
-                    // and cannot feel is a setting they will change twice.
-                    setDangerousBypass(bypassOn);
-                    hud.skipPermissions = bypassOn;
-                    refresh();
-                    if (!stored) {
-                        note("settings", "changed for this session, but settings.json could not be written (is it valid JSON?)");
-                        return;
-                    }
-                    note("settings", bypassOn
-                        ? "permission checks are OFF — critical commands and the repeat guard will not stop anything. Stored for future sessions."
-                        : "permission checks are ON — critical commands and repeated calls are refused again.");
-                }, undefined, false, [`Currently ${permissionLabel()}.`]);
-            };
-            const openThinking = () => {
-                choose("Thinking level", THINKING_LEVELS.map((level) => ({
-                    value: level,
-                    label: level,
-                    description: level === hud.thinking ? "current" : undefined,
-                })), (value) => setThinking(value), undefined, false, [`Currently ${hud.thinking}.`]);
-            };
-            const openAutoUpdate = () => {
-                choose("Auto-update", [
-                    { value: "on", label: "on", description: "install a newer release on start (the default)" },
-                    { value: "off", label: "off", description: "stay on this version until you update by hand" },
-                ], (value) => {
-                    const on = value !== "off";
-                    const stored = writeWorkbenchSetting(AGENT_DIR, "autoUpdate", on);
-                    note("settings", stored
-                        ? `auto-update ${on ? "on" : "off"} — takes effect on the next start.`
-                        : "auto-update changed for this session, but settings.json could not be written (is it valid JSON?)");
-                }, undefined, false, [`Currently ${autoUpdateEnabled(`${AGENT_DIR}/settings.json`) ? "on" : "off"}.`]);
-            };
-            const openDcp = () => {
-                const status = runDcpCommand("status", options.cwd, session.getSessionStats().sessionId);
-                choose("Dynamic context pruning", [
-                    { value: "on", label: "on", description: "fold stale ranges so long sessions stay affordable" },
-                    { value: "off", label: "off", description: "send the full transcript, unpruned" },
-                    { value: "status", label: "status", description: "what it has pruned so far" },
-                ], (value) => note("dcp", runDcpCommand(value, options.cwd, session.getSessionStats().sessionId)), undefined, false, status.split("\n").slice(0, 2));
-            };
-            const openModel = () => {
-                // `/model` owns its own picker; this only routes to it so the hub has the
-                // entry without a second copy of the catalogue logic.
-                void runSlash("/model");
-            };
-            const openProxy = () => {
-                // `/proxy` owns the whole interaction — there is a URL to type, which a
-                // picker cannot take — so this only routes to it and says what is set.
-                void runSlash("/proxy");
-            };
-            const openRightClickPaste = () => {
-                const current = readWorkbenchSettings(AGENT_DIR).rightClickPaste;
-                const platformDefault = process.platform === "win32" ? "off" : "on";
-                choose("Right click", [
-                    { value: "auto", label: "auto", description: `follow the terminal (${platformDefault} on ${process.platform})` },
-                    { value: "on", label: "on", description: "the CLI pastes the clipboard itself" },
-                    { value: "off", label: "off", description: "the terminal handles it, or the click does nothing" },
-                ], (value) => {
-                    const stored = writeRightClickPasteSetting(AGENT_DIR, value);
-                    note("settings", stored
-                        ? value === "auto"
-                            ? `right click follows the terminal — ${rightClickPasteEnabled("auto") ? "the CLI pastes" : "the terminal pastes"} here.`
-                            : `right click ${value === "on" ? "pastes from the CLI" : "is left to the terminal"}.`
-                        : "right click changed for this session, but settings.json could not be written (is it valid JSON?)");
-                }, undefined, false, [`Currently ${current}.`]);
-            };
-            /**
-             * How many agents may run at once, across `task` and `workflow`.
-             *
-             * One budget rather than two is the point: both paths open sessions, and
-             * before this each had its own width, so the two together could put more
-             * streams in flight than the machine is sized for.
-             */
-            const openAgents = () => {
-                const current = readWorkbenchSettings(AGENT_DIR).agents;
-                const choices = [1, 2, 3, 4].map((value) => ({
-                    value: String(value),
-                    label: String(value),
-                    description: value === 1
-                        ? "one child at a time"
-                        : value === agentConcurrency()
-                            ? `current — sized to this machine`
-                            : `${value} children at once`,
-                }));
-                choose("Agent concurrency", [
-                    { value: "auto", label: "auto", description: `size it to the machine (now ${agentConcurrency()}, max ${MAX_AGENT_CONCURRENCY})` },
-                    ...choices,
-                ], (value) => {
-                    const wanted = value === "auto" ? undefined : Number(value);
-                    const stored = writeAgentsSetting(AGENT_DIR, wanted);
-                    note("settings", stored
-                        ? wanted === undefined
-                            ? `agent concurrency follows the machine — ${agentConcurrency()} at a time.`
-                            : `agent concurrency set to ${wanted} — shared by task and workflow.`
-                        : "agent concurrency changed for this session, but settings.json could not be written (is it valid JSON?)");
-                    refresh();
-                }, undefined, false);
-            };
-            const entries = [
-                { value: "permissions", label: "permissions", description: permissionLabel() },
-                { value: "thinking", label: "thinking", description: `${hud.thinking} — how hard the model reasons` },
-                { value: "model", label: "model", description: hud.model },
-                { value: "dcp", label: "context pruning", description: "fold stale ranges to save tokens" },
-                { value: "proxy", label: "proxy", description: configuredProxy(AGENT_DIR) ?? environmentProxy() ?? "none — direct to the API" },
-                { value: "rightclick", label: "right click", description: `paste: ${readWorkbenchSettings(AGENT_DIR).rightClickPaste}` },
-                { value: "agents", label: "agents", description: `${readWorkbenchSettings(AGENT_DIR).agents ?? `auto (${agentConcurrency()})`} at once, shared by task and workflow` },
-                { value: "autoupdate", label: "auto-update", description: "install a newer release on start" },
-            ];
-            if (!arg) {
-                choose("Settings", entries, (value) => {
-                    if (value === "permissions")
-                        openPermission();
-                    else if (value === "thinking")
-                        openThinking();
-                    else if (value === "dcp")
-                        openDcp();
-                    else if (value === "autoupdate")
-                        openAutoUpdate();
-                    else if (value === "model")
-                        openModel();
-                    else if (value === "proxy")
-                        openProxy();
-                    else if (value === "rightclick")
-                        openRightClickPaste();
-                    else if (value === "agents")
-                        openAgents();
-                });
-                return;
-            }
-            // Direct access, so a script or a user who knows the name skips the menu.
-            const direct = entries.find((entry) => entry.value === arg || entry.label === arg);
-            if (direct) {
-                if (direct.value === "permissions")
-                    openPermission();
-                else if (direct.value === "thinking")
-                    openThinking();
-                else if (direct.value === "dcp")
-                    openDcp();
-                else if (direct.value === "autoupdate")
-                    openAutoUpdate();
-                else if (direct.value === "model")
-                    openModel();
-                else if (direct.value === "proxy")
-                    openProxy();
-                else if (direct.value === "rightclick")
-                    openRightClickPaste();
-                else if (direct.value === "agents")
-                    openAgents();
-                return;
-            }
-            if (arg === "on" || arg === "off") {
-                // Kept from the first version: the most-wanted setting, without the menu.
-                const bypassOn = arg === "off";
-                const stored = writeWorkbenchSetting(AGENT_DIR, "skipPermissions", bypassOn);
-                setDangerousBypass(bypassOn);
-                hud.skipPermissions = bypassOn;
-                refresh();
-                note("settings", stored
-                    ? bypassOn
-                        ? "permission checks are OFF — critical commands and the repeat guard will not stop anything."
-                        : "permission checks are ON."
-                    : "changed for this session, but settings.json could not be written (is it valid JSON?)");
-                return;
-            }
-            note("settings", `settings: ${entries.map((entry) => entry.value).join(", ")} | on, off (permission checks)\n` +
-                `usage: /settings <name>, or /settings to choose`);
-            return;
-        }
-        if (name === "proxy") {
-            /**
-             * The proxy this CLI dials through.
-             *
-             * Three outcomes, because a user needs to tell them apart: what is set now,
-             * what is set now but came from the environment (so editing it here will
-             * not change it), and nothing at all. The value is shown in full — a proxy
-             * URL is not a secret, and a masked host is one nobody can check.
-             */
-            const current = configuredProxy(AGENT_DIR);
-            const fromEnv = environmentProxy();
-            const describe = () => {
-                if (current)
-                    return `proxy: ${current}  (set here, in settings.json)`;
-                if (fromEnv)
-                    return `proxy: ${fromEnv}  (from the environment, not this file)`;
-                return "proxy: none — requests go straight to the API";
-            };
-            if (!arg) {
-                note("proxy", `${describe()}\n` +
-                    "usage: /proxy <url>   route requests through a proxy\n" +
-                    "       /proxy off     stop using one\n" +
-                    "       /proxy env     use HTTPS_PROXY / HTTP_PROXY / ALL_PROXY\n" +
-                    "Only traffic to the HowToFix API goes through it; a change applies on the next start.");
-                return;
-            }
-            const value = arg.trim();
-            if (value === "off" || value === "none") {
-                const stored = writeStringSetting(AGENT_DIR, PROXY_SETTING_KEY, "");
-                // Applied now, and this is the half that matters: clearing the setting
-                // alone left the session dialling the proxy it had just removed.
-                const applied = installProxy(AGENT_DIR);
-                const now = applied.source === "env" ? `the environment still sets one (${applied.url})` : "requests go straight to the API";
-                note("proxy", stored
-                    ? `proxy off — ${now} from the next message.`
-                    : "proxy changed for this session, but settings.json could not be written (is it valid JSON?)");
-                return;
-            }
-            if (value === "env") {
-                // Clearing the setting hands control back to the environment, and the
-                // install applies it now so the change is felt without a restart.
-                const stored = writeStringSetting(AGENT_DIR, PROXY_SETTING_KEY, "");
-                const applied = installProxy(AGENT_DIR);
-                const found = applied.source === "env" ? applied.url : undefined;
-                note("proxy", stored
-                    ? found
-                        ? `using the environment from the next message: ${found}`
-                        : "settings cleared, but no HTTPS_PROXY / HTTP_PROXY / ALL_PROXY is set — requests go straight to the API."
-                    : "settings.json could not be written (is it valid JSON?)");
-                return;
-            }
-            const valid = validateProxyUrl(value);
-            if (!valid.ok) {
-                note("proxy", `not set: ${valid.problem}`);
-                return;
-            }
-            const stored = writeStringSetting(AGENT_DIR, PROXY_SETTING_KEY, valid.url);
-            if (!stored) {
-                note("proxy", "settings.json could not be written (is it valid JSON?)");
-                return;
-            }
-            // Applied to this session too, so a user who sets it can see it take effect
-            // without restarting — the same reason the permission toggle applies now.
-            const applied = installProxy(AGENT_DIR);
-            note("proxy", applied.url
-                ? `proxy set to ${valid.url} — requests go through it from the next message.`
-                : `proxy saved as ${valid.url}, but it could not be applied this session; it will be tried on the next start.`);
-            return;
-        }
-        if (name === "tools") {
-            const active = session.getActiveToolNames().sort();
-            note("tools", active.length ? active.join("\n") : "no tools enabled");
-            return;
-        }
-        if (name === "dcp") {
-            // The state file is keyed by session id, and the project config lives in
-            // the session's cwd, so both come from the live session rather than being
-            // read from a context the workbench does not have.
-            note("dcp", runDcpCommand(arg, options.cwd, session.getSessionStats().sessionId));
-            return;
-        }
-        // `/context`, `/decompress` and `/sweep` are the spec's own command names
-        // for what `/dcp` reaches as subcommands. Both spellings dispatch through
-        // one function so there is one implementation, and the subcommand form
-        // stays the discoverable one.
-        if (name === "context" || name === "decompress" || name === "sweep") {
-            note(name, runDcpCommand(`${name} ${arg}`.trim(), options.cwd, session.getSessionStats().sessionId));
-            return;
-        }
-        // `/rewind` is the session-tree picker; `/undo` is the git commit undo below.
-        // They used to share this branch, so `/undo` returned here and the git
-        // implementation below was unreachable dead code — `/undo` opened the rewind
-        // picker and answered "nothing to rewind to yet" instead of undoing the
-        // commit the README and `--help` promise.
-        if (name === "rewind") {
-            openRewind();
-            return;
-        }
-        if (name === "undo") {
-            // `/undo` is the git inverse of `/commit`. It used to share a branch with
-            // `/rewind`, so it opened the session-tree picker and answered "nothing to
-            // rewind to yet" instead of dropping the commit the README promises.
-            if (!(await isGitRepo(options.cwd))) {
-                note("undo", "not a git repository");
-                return;
-            }
-            const result = await undoLastCommit(options.cwd);
-            note("undo", result.ok ? `undone: ${result.output}` : `undo failed: ${result.output}`);
-            refreshGitMarker(true);
-            return;
-        }
-        if (name === "commit") {
-            if (!isGitRepo(options.cwd)) {
-                note("commit", "not a git repository");
-                return;
-            }
-            if (!(await hasChanges(options.cwd))) {
-                note("commit", "nothing to commit");
-                return;
-            }
-            const message = arg || `howtofix: session update ${new Date().toISOString().slice(0, 16)}`;
-            const result = await commitAll(options.cwd, message);
-            note("commit", result.ok ? result.output : `commit failed: ${result.output}`);
-            refreshGitMarker(true);
-            return;
-        }
-        if (name === "review") {
-            const diff = await fullDiff(options.cwd);
-            if (!diff.trim()) {
-                note("review", "no changes to review");
-                return;
-            }
-            submit("Review the uncommitted changes. Report concrete issues with file evidence. Do not edit files.");
-            return;
-        }
-        if (name === "workflow") {
-            // The panel is pinned above the editor and also left in the scrollback, so
-            // there is nothing to "open". The useful actions are: show it again here,
-            // or clear the pinned copy so it stops taking rows.
-            if (arg.trim() === "clear") {
-                unpinWorkflow();
-                note("workflow", "cleared the pinned workflow panel");
-                return;
-            }
-            if (!currentRun) {
-                note("workflow", "no workflow run in this session yet");
-                return;
-            }
-            const groups = groupPhases(currentRun, Date.now());
-            const selected = groups[workflowView.selectedPhase];
-            note("workflow", [
-                `panel ${workflowPinned ? "pinned above the editor" : "unpinned"}`,
-                `phase ${workflowView.selectedPhase + 1}/${groups.length}: ${selected?.title ?? "(none)"}`,
-                `filter: ${workflowView.filter}${workflowView.paused ? " · paused" : ""}`,
-                "keys: ↑/↓ phase · Enter drill in · Esc unpin · f filter · p pause · x stop · s save",
-                "clear it with /workflow clear",
-            ].join("\n"));
-            return;
-        }
-        if (name === "plan") {
-            // Toggling is the user's half of plan mode; the agent's half is the
-            // `enter_plan_mode` tool, which asks before it switches anything on.
-            if (planActive() || currentPlanSnapshot().state === "pending") {
-                transition(userExit(currentPlanSnapshot()));
-                note("plan", "plan mode off; edits are allowed again");
-                return;
-            }
-            transition(enterPending(currentPlanSnapshot()));
-            note("plan", `plan mode armed — send your next prompt to start planning\nplan file: ${currentPlanFile() ?? "(unknown)"}`);
-            return;
-        }
-        if (name === "goal") {
-            // Setting a goal is the one thing the user does here; the agent drives
-            // everything else through the tool. With no argument, show the goal.
-            const text = arg.trim();
-            if (!text) {
-                note("goal", formatGoal(currentGoal()));
-                return;
-            }
-            const { goal, error: goalError } = applyGoalOp(currentGoal(), "set", text, undefined, undefined);
-            if (goalError) {
-                error(goalError);
-                return;
-            }
-            setMirror(goal);
-            // Persist it: the HUD mirror is memory only, so a resume would otherwise
-            // lose a goal the user set from the command line.
-            await session.sendCustomMessage({ customType: GOAL_ENTRY, content: text, display: false, details: goal });
-            note("goal", `goal set\n${formatGoal(goal)}`);
-            return;
-        }
-        if (name === "session") {
-            const model = session.model;
-            note("session", model ? `${model.provider}/${model.id}` : "no model");
-            return;
-        }
-        if (name === "skills") {
-            note("skills", formatSkillList(session.resourceLoader.getSkills().skills));
-            return;
-        }
-        if (name === "preset") {
-            presetCommand(arg);
-            return;
-        }
-        if (name === "roblox") {
-            const entry = listCatalog(options.cwd).entries.find((candidate) => candidate.manifest.name === "rotoolbox");
-            if (!entry || entry.source !== "installed") {
-                note("roblox", "RoToolbox is not installed. Run /preset and install RoToolbox first.");
-                return;
-            }
-            const disabled = isPresetDisabled(entry.dir);
-            // Count every tool that names this server, not just the ones shaped
-            // `mcp__<server>__<tool>`. A server that runs in code mode is reached
-            // through a single surface rather than one tool per capability, so a
-            // prefix match reported "not loaded yet" while the server was connected
-            // and answering — the status line was wrong, not the connection.
-            const tools = session
-                .getActiveToolNames()
-                .filter((tool) => /roblox[-_]studio/i.test(tool));
-            const connected = tools.length > 0;
-            note("roblox", disabled
-                ? "RoToolbox: disabled\nEnable with /preset enable rotoolbox\nThe MCP server and manager stay stopped while disabled."
-                : [
-                    "RoToolbox: active",
-                    `MCP server: ${connected ? `connected — ${tools.length} tool${tools.length === 1 ? "" : "s"} registered` : "not connected yet"}`,
-                    "Open Roblox Studio with a place, then use a prompt to inspect it.",
-                    "Disable with /preset disable rotoolbox",
-                ].join("\n"));
-            return;
-        }
-        const invocation = skillInvocation(text, session.resourceLoader.getSkills().skills.map((skill) => skill.name));
-        if (invocation) {
-            // Reach the SDK expander: submit() would bounce back into runSlash on the
-            // leading slash, so this goes straight through the same post-slash path a
-            // normal prompt takes.
-            void sendTask(invocation);
-            return;
-        }
-        const extensionCommand = session.extensionRunner.getCommand(name ?? "");
-        if (extensionCommand) {
-            try {
-                await extensionCommand.handler(arg, session.extensionRunner.createCommandContext());
-            }
-            catch (cause) {
-                error(cause instanceof Error ? cause.message : String(cause));
-            }
-            return;
-        }
-        note("command", `/${name ?? ""} is not available in this screen yet`);
-    };
-    setAsker((question, choices) => {
-        const { promise, resolve: settle } = Promise.withResolvers();
-        // Escape on a question must answer it, not leave it hanging. Without
-        // `onDismiss` the picker closed and the promise was never settled, so the
-        // `ask` tool waited forever and the run never resumed — the model had asked
-        // a question and the user had dismissed it, and neither side could move.
-        // "cancelled" is the same answer the tool gives when no screen can ask.
-        choose(question, choices.map((choice) => ({ value: choice, label: choice })), settle, () => settle("cancelled"));
-        return promise;
-    });
-    process.on("SIGTERM", shutdown);
-    // A SIGINT that still arrives — a Windows console, or a terminal that reset
-    // its mode — must take the same path as the key, not Node's default exit.
-    catchInterrupt(() => void shutdown());
-    terminal.setTitle(`${APP_TITLE} ${APP_VERSION}`);
-    claimTranscriptScrollKeys();
-    tui.start();
-    tui.requestRender(true);
-    /**
-     * The first-run greeting, shown before the daily check-in below so its "you
-     * earned X" note lands underneath the welcome rather than being buried by it.
-     * Awaited so the picker is on screen before anything else claims the rows.
-     */
-    // The daily check-in: claimed when the workbench opens, and again after any
-    // turn, so a session left running past midnight still claims the new day.
-    void maybeClaimDaily(true);
-    {
-        const { maybeShowWelcome } = await import("./welcome.js");
-        await maybeShowWelcome({
-            cwd: options.cwd,
-            note: options.note,
-            signedIn: cliCredential !== undefined,
-            runSlash: (command) => void runSlash(command),
-            openExternal: (url) => void openInBrowser(url),
-        }, choose, note);
-    }
-    if (options.initialPrompt)
-        submit(options.initialPrompt);
-    await new Promise(() => { });
-}
-let editorSubmit;
-/**
- * How often the animated parts are asked to repaint, in milliseconds.
- *
- * 30 fps (`1000 / 30`). The spinner, the seconds clock and the context meter
- * spring all advance on this tick, and at the previous 90 ms — 11 fps — the
- * motion read as stepping rather than turning. The SDK coalesces requests and
- * drops anything inside its own 16 ms window, so this is the ceiling, not a
- * guaranteed rate, and it is only requested while something is actually
- * animating.
- */
-const ANIMATION_TICK_MS = 1000 / 30;
-/**
- * How long a run may go without a single byte of response before the UI says so.
- * Long enough not to fire on a slow first token (reasoning models can take tens
- * of seconds), short enough that a stalled connection does not look like a hang.
- */
-const STALL_NOTICE_MS = 45_000;