jaitus 0.3.3 → 0.3.5

package/src/index.js

@@ -16,16 +16,19 @@ import {
   loadCredentials, clearCredentials, loadSettings, saveSettings,
   endpoints, version, HOME, HISTORY,
 } from './config.js';
-import { runAgent } from './agent/loop.js';
+import { runAgent, repairToolPairs } from './agent/loop.js';
 import { createPermissions } from './agent/permissions.js';
-import { forgetIgnoreCache, imageBlock } from './agent/tools.js';
+import { DEFAULT_DENY } from './agent/rules.js';
+import { forgetIgnoreCache, imageBlock, IMAGE_MIME } from './agent/tools.js';
+import { shrinkImageFile } from './tui/clipboard.js';
+import { THEME_NAMES } from './tui/theme.js';
 import { loadContext, CONTEXT_FILE } from './project.js';
 import { discoverSkills, skillCatalog } from './skills.js';
 import { runHook, configuredHookEvents } from './hooks.js';
-import { newSession, saveSession, loadSession, latestSession, listSessions, sessionSummary, replaySession } from './sessions.js';
+import { newSession, saveSession, loadSession, latestSession, listSessions, sessionSummary, replaySession, sameDir } from './sessions.js';
 import { createJournal, displayPath } from './rewind.js';
 import { createLedger } from './ledger.js';
-import { listMcpServers, addMcpServer, removeMcpServer } from './mcp.js';
+import { listMcpServers, addMcpServer, removeMcpServer, untrustedServers, trustServer, discoverMcpTools, mcpProblems, allServers } from './mcp.js';
 import { banner, wordmark, renderHomeLogo, startupTip } from './brand.js';
 import {
   c, out, err, ok, fail, info, warn, table, present,
@@ -78,28 +81,48 @@ const OPTIONS = [
 
 const FLAG_NAMES = ['--print', '-p', '--continue', '-c', '--resume', '-r', '--output-format', '--max-turns', '--permission-mode', '--dangerously-skip-permissions', '--system-prompt', '--append-system-prompt', '--model', '--cwd', '--yes', '-y', '--json', '--no-color', '--no-banner', '--help', '-h', '--version', '-v', '--force', '--ascii'];
 
+/** `Plan`, `acceptedits`, `bypass` → the real mode name; anything else → null. */
+function normaliseMode(value) {
+  const v = String(value || '').trim().toLowerCase().replace(/[-_\s]/g, '');
+  return { default: 'default', ask: 'default', plan: 'plan', acceptedits: 'acceptEdits', autoedit: 'acceptEdits', bypass: 'bypassPermissions', bypasspermissions: 'bypassPermissions', auto: 'bypassPermissions' }[v] || null;
+}
+
 function parseArgs(argv) {
   const flags = {
     model: null, yes: false, cwd: process.cwd(), json: false, help: false, version: false,
-    print: false, continue: false, resume: null, outputFormat: 'text', maxTurns: 40,
+    print: false, continue: false, resume: null, outputFormat: 'text', maxTurns: undefined,
     permissionMode: 'default', systemPrompt: '', appendSystemPrompt: '',
   };
   const rest = [];
   const passthrough = [];
   let literal = false;
+  // After a subcommand, its arguments are its own, in order: `jaitus mcp add fs npx -y
+  // @scope/server` used to lose the -y (read as Jaitus's --yes), and `--port 3000` was
+  // moved to the end. Only the few flags that mean the same thing everywhere are still
+  // read as Jaitus flags there.
+  let sub = false;
+  const SUB_GLOBAL = new Set(['--json', '--help', '--cwd', '--no-color', '--ascii', '--no-banner']);
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (literal) { rest.push(a); continue; }
+    if (!rest.length && !a.startsWith('-') && Object.prototype.hasOwnProperty.call(commands, a)) { sub = true; rest.push(a); continue; }
+    if (sub && !SUB_GLOBAL.has(a)) {
+      if (a === '--') { literal = true; continue; }
+      if (a === '--yes' || a === '-y') flags.yes = true;
+      rest.push(a);
+      continue;
+    }
 
     if (a === '--') { literal = true; continue; }
     else if (a === '--print' || a === '-p') flags.print = true;
     else if (a === '--continue' || a === '-c') flags.continue = true;
     else if (a === '--resume' || a === '-r') flags.resume = argv[++i];
     else if (a === '--output-format') flags.outputFormat = argv[++i] || 'text';
-    else if (a === '--max-turns') flags.maxTurns = Math.max(1, Number(argv[++i]) || 40);
-    else if (a === '--permission-mode') flags.permissionMode = argv[++i] || 'default';
-    else if (a === '--dangerously-skip-permissions') flags.permissionMode = 'bypassPermissions';
+    // Validated below: `--max-turns 0` or `abc` silently became the 1000-step maximum.
+    else if (a === '--max-turns') { flags.maxTurnsRaw = argv[++i]; flags.maxTurns = Number(flags.maxTurnsRaw); }
+    else if (a === '--permission-mode') { flags.permissionMode = normaliseMode(argv[++i]); flags.permissionModeExplicit = true; }
+    else if (a === '--dangerously-skip-permissions') { flags.permissionMode = 'bypassPermissions'; flags.permissionModeExplicit = true; }
     else if (a === '--system-prompt') flags.systemPrompt = argv[++i] || '';
     else if (a === '--append-system-prompt') flags.appendSystemPrompt = argv[++i] || '';
     else if (a === '--model') flags.model = argv[++i];
@@ -174,11 +197,27 @@ function commandHelp(name) {
 // ─── Shared plumbing ────────────────────────────────────────────────────────────
 
 /** Anything piped in becomes context for the task. */
-async function readStdin() {
+async function readStdin({ patient = false } = {}) {
   if (process.stdin.isTTY) return '';
-  const chunks = [];
-  for await (const chunk of process.stdin) chunks.push(chunk);
-  return Buffer.concat(chunks).toString('utf8').trim();
+  if (patient) {
+    // A task was given: wait for the whole pipe (`npm test 2>&1 | jaitus -p "why"` can
+    // take seconds before its first byte).
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8').trim();
+  }
+  // Git Bash (mintty) and some IDE terminals give a pipe that never closes: waiting for
+  // its end hung `jaitus` forever. Piped input starts at once; with nothing in the first
+  // moment there is nothing piped.
+  return new Promise((resolve) => {
+    const chunks = [];
+    let got = false;
+    const done = () => { process.stdin.removeAllListeners('data'); process.stdin.pause(); resolve(Buffer.concat(chunks).toString('utf8').trim()); };
+    const idle = setTimeout(() => { if (!got) done(); }, 400);
+    process.stdin.on('data', (c) => { got = true; chunks.push(c); });
+    process.stdin.on('end', () => { clearTimeout(idle); done(); });
+    process.stdin.on('error', () => { clearTimeout(idle); done(); });
+  });
 }
 
 class NoModel extends Error {}
@@ -219,6 +258,10 @@ function estimateTokens(messages) {
 
 /** Clipboard write that degrades honestly: returns false when no path exists. */
 async function copyToClipboard(text) {
+  // The terminal tests' stand-in clipboard (see tui/clipboard.js): never the real one.
+  if (process.env.JAITUS_CLIPBOARD_DIR) {
+    try { fs.writeFileSync(path.join(process.env.JAITUS_CLIPBOARD_DIR, 'copied.txt'), text); return true; } catch { return false; }
+  }
   const { spawn } = await import('node:child_process');
   const { promisify } = await import('node:util');
   const platforms = process.platform === 'win32' ? [['clip']]
@@ -239,11 +282,13 @@ async function copyToClipboard(text) {
   return false;
 }
 
-function requireAuth() {
+function requireAuth({ quiet = false } = {}) {
   try {
     return createClient();
   } catch (e) {
     if (e instanceof NotSignedIn) {
+      // quiet: the caller reports it in its own format (--output-format json).
+      if (quiet) return null;
       fail(e.message);
       info(`Run ${c.bold('jaitus login')} — it opens your browser, no key to copy.`);
       process.exit(1);
@@ -325,17 +370,50 @@ const MENTION_MAX_BYTES = 48_000;
  * One summarisation call. Shared by /compact and auto-compaction so the two cannot
  * drift into producing different kinds of summary from the same conversation.
  */
+/**
+ * The conversation as plain text, for summarising. Sending the raw history broke in
+ * three ways: every image was sent again (past the gateway's size limit once there were
+ * a few), tool calls went without a tools list (which some providers reject), and a long
+ * session was larger than the window being compacted. Tool calls and results become
+ * short lines, images a note, and the middle of a very long session is trimmed.
+ */
+function transcriptForSummary(messages, maxChars = 360_000) {
+  const clip = (s, n) => (s.length > n ? `${s.slice(0, n)}…` : s);
+  const lines = [];
+  for (const m of messages) {
+    const who = m.role === 'assistant' ? 'ASSISTANT' : 'USER';
+    if (typeof m.content === 'string') { lines.push(`${who}: ${m.content}`); continue; }
+    for (const b of Array.isArray(m.content) ? m.content : []) {
+      if (b?.type === 'text' && b.text) lines.push(`${who}: ${b.text}`);
+      else if (b?.type === 'tool_use') lines.push(`${who} ran ${b.name}: ${clip(JSON.stringify(b.input ?? {}), 400)}`);
+      else if (b?.type === 'tool_result') {
+        const t = typeof b.content === 'string' ? b.content : Array.isArray(b.content) ? b.content.map((c) => c?.text || '').join('\n') : '';
+        lines.push(`RESULT${b.is_error ? ' (error)' : ''}: ${clip(t, 1500)}`);
+      } else if (b?.type === 'image') lines.push(`${who}: [an image]`);
+    }
+  }
+  let text = lines.join('\n');
+  if (text.length > maxChars) {
+    const head = text.slice(0, Math.floor(maxChars * 0.25));
+    const tail = text.slice(-Math.floor(maxChars * 0.7));
+    text = `${head}\n\n[… the middle of the session is left out …]\n\n${tail}`;
+  }
+  return text;
+}
+
 async function summarise(client, model, messages, focus) {
   const res = await client.messages({
     model,
-    max_tokens: 2048,
+    // Room for the model to reason before it writes; at 2048 the reasoning could use
+    // it all and the summary came back empty.
+    max_tokens: 6000,
     messages: [
-      ...messages,
       {
         role: 'user',
         content: 'Summarize this conversation compactly for a successor agent: what was asked, '
           + 'what was done (files changed, commands run, outcomes), what remains. Be specific and terse.'
-          + (focus ? ` Focus on: ${focus}.` : ''),
+          + (focus ? ` Focus on: ${focus}.` : '')
+          + `\n\n<conversation>\n${transcriptForSummary(messages)}\n</conversation>`,
       },
     ],
     stream: false,
@@ -357,6 +435,9 @@ async function summarise(client, model, messages, focus) {
 function expandMentions(input, cwd) {
   const blocks = [];
   const notes = [];
+  // Image files are attached as images by the caller (async: they may need shrinking).
+  // Read as text, a PNG used to go into the prompt as a page of binary garbage.
+  const images = [];
   const seen = new Set();
   for (const match of String(input).matchAll(/(?:^|\s)@([^\s@]+)/g)) {
     const ref = match[1].replace(/[.,;:)]+$/, '');
@@ -375,41 +456,95 @@ function expandMentions(input, cwd) {
         notes.push(`@${ref} — ${entries.length} entries attached`);
         continue;
       }
+      if (IMAGE_MIME[path.extname(full).toLowerCase()]) {
+        images.push(full);
+        notes.push(`@${ref} — image attached`);
+        continue;
+      }
       if (stat.size > MENTION_MAX_BYTES) {
         notes.push(`@${ref} is ${Math.round(stat.size / 1024)} kB — too large to attach; the agent can read it if it needs to.`);
         continue;
       }
-      const text = fs.readFileSync(full, 'utf8');
+      const buf = fs.readFileSync(full);
+      // Any other binary (a zip, a PDF, an .exe) is not text either: say so, send nothing.
+      if (buf.subarray(0, 8000).includes(0)) {
+        notes.push(`@${ref} is a binary file — not attached. The agent can inspect it with a command if it needs to.`);
+        continue;
+      }
+      const text = buf.toString('utf8');
       blocks.push({ type: 'text', text: `<mentioned path="${ref}">\n${text}\n</mentioned>` });
       notes.push(`@${ref} — ${text.split('\n').length} lines attached`);
     } catch {
       notes.push(`@${ref} could not be read — not attached.`);
     }
   }
-  return { blocks, notes };
+  return { blocks, notes, images };
 }
 
 /** Saved allow/deny rules for one project directory. */
 function projectRules(cwd) {
-  const saved = loadSettings().permissionRules?.[cwd] || {};
+  const all = loadSettings().permissionRules || {};
+  // Keyed by folder, and on Windows a folder has many spellings (`c:\app`, `C:\App`):
+  // typed differently, the saved "always allow" rules were simply not found.
+  const key = Object.keys(all).find((k) => sameDir(k, cwd));
+  const saved = (key && all[key]) || {};
   return { allow: Array.isArray(saved.allow) ? saved.allow : [], deny: Array.isArray(saved.deny) ? saved.deny : [] };
 }
 
+/** The key rules are saved under: the existing spelling when there is one. */
+function rulesKey(cwd) {
+  return Object.keys(loadSettings().permissionRules || {}).find((k) => sameDir(k, cwd)) || path.resolve(cwd);
+}
+
 /** 18400 → "18.4k". Header space is scarce and the exact digit never mattered. */
 const format = (n) => (n >= 1000 ? `${(n / 1000).toFixed(n >= 10000 ? 0 : 1)}k` : String(n));
 
+/**
+ * A task from the command line: run it, print the answer, exit.
+ *
+ * Nobody is there to answer a prompt, so nothing prompts: a write or command that needs
+ * permission is refused with the flag that would allow it (it used to wait in raw mode
+ * for a key nobody saw, and write the question into --output-format json). A run that
+ * did not finish exits 1 and says why on stderr — it used to exit 0 whatever happened.
+ * --continue / --resume pick up a saved session and the result is saved back.
+ */
 async function oneShot(task, { flags }) {
-  const client = requireAuth();
-  const model = await resolveModel(client, flags.model);
-  const messages = [{ role: 'user', content: task }];
-  const permissions = createPermissions({ autoApprove: flags.yes, mode: flags.permissionMode });
-  const format = ['text', 'json', 'stream-json'].includes(flags.outputFormat) ? flags.outputFormat : 'text';
+  const format = flags.outputFormat;
   let answer = '';
+  const failJson = (message, status = 500, code = 'internal') => {
+    if (format !== 'text') out(JSON.stringify({ type: 'error', error: message, code, status }));
+    else fail(message);
+    return 1;
+  };
+  let client;
+  let model;
+  try {
+    client = requireAuth({ quiet: format !== 'text' });
+    model = await resolveModel(client, flags.model);
+  } catch (e) {
+    // Sign-in and model-list failures used to escape before the try below, as plain
+    // text, whatever --output-format said.
+    if (format !== 'text') return failJson(e.message || String(e), e.status || 401, e.code || 'auth_required');
+    return reportAgentError(e);
+  }
+  if (!client) return failJson('Not signed in. Run `jaitus login`.', 401, 'auth_required');
+
+  const loaded = flags.resume ? loadSession(flags.resume) : flags.continue ? latestSession({ cwd: flags.cwd }) : null;
+  if ((flags.resume || flags.continue) && !loaded) return failJson(flags.resume ? `No saved session ${flags.resume}. \`jaitus sessions\` lists them.` : 'No saved session in this folder to continue.', 404, 'not_found');
+  const session = loaded || newSession({ cwd: flags.cwd, model });
+  const messages = Array.isArray(session.messages) ? session.messages : [];
+  messages.push({ role: 'user', content: task });
+
+  const explicitPlan = flags.permissionModeExplicit && flags.permissionMode === 'plan';
+  const permissions = createPermissions({
+    autoApprove: flags.yes && !explicitPlan, mode: flags.permissionMode,
+    interactive: false, ...projectRules(flags.cwd),
+  });
 
   try {
     const result = await runAgent({
       client, messages, model, cwd: flags.cwd, permissions,
-      maxIterations: flags.maxTurns,
+      ...(flags.maxTurns ? { maxIterations: flags.maxTurns } : {}),
       silent: true,
       systemOverride: flags.systemPrompt || null,
       extraSystem: flags.appendSystemPrompt ? `\n\nAdditional instructions:\n${flags.appendSystemPrompt}` : '',
@@ -418,17 +553,32 @@ async function oneShot(task, { flags }) {
         if (format === 'stream-json') out(JSON.stringify({ type: 'content_block_delta', delta: { text } }));
       },
     });
+    repairToolPairs(messages);
+    session.messages = messages;
+    session.model = model;
+    try { saveSession(session); } catch { /* the answer still stands */ }
+
+    const unfinished = {
+      max_iterations: `Stopped at the step limit (${flags.maxTurns || 'the safety limit'}) before finishing.`,
+      stuck: 'Stopped: it repeated the same action without making progress.',
+      plan_blocked: 'Plan mode is read-only; nothing was written or run.',
+      cut: 'The answer was cut off before it finished.',
+      interrupted: 'Interrupted.',
+    }[result.stopReason];
+    const deniedNote = result.denied ? `${result.denied} action${result.denied === 1 ? '' : 's'} needed permission and did not run — re-run with --yes, or --permission-mode acceptEdits for file edits only.` : '';
     if (format === 'json') {
-      out(JSON.stringify({ type: 'result', result: answer, model, stop_reason: result.stopReason, usage: result }));
+      out(JSON.stringify({ type: 'result', result: answer, model, stop_reason: result.stopReason, finished: !unfinished, session_id: session.id, denied: result.denied || 0, usage: result }));
     } else if (format === 'stream-json') {
-      out(JSON.stringify({ type: 'message_stop', stop_reason: result.stopReason, usage: result }));
+      out(JSON.stringify({ type: 'message_stop', stop_reason: result.stopReason, finished: !unfinished, session_id: session.id, denied: result.denied || 0, usage: result }));
     } else {
       out(answer);
     }
-    return 0;
+    if (unfinished) process.stderr.write(`${unfinished}\n`);
+    if (deniedNote) process.stderr.write(`${deniedNote}\n`);
+    return unfinished || result.denied ? 1 : 0;
   } catch (e) {
-    if (format !== 'text') out(JSON.stringify({ type: 'error', error: e.message, status: e.status || 500 }));
-    if (format !== 'text') return 1;
+    try { repairToolPairs(messages); session.messages = messages; saveSession(session); } catch { /* best effort */ }
+    if (format !== 'text') return failJson(e.message, e.status || 500, e.code || 'internal');
     return reportAgentError(e);
   }
 }
@@ -448,7 +598,7 @@ const SLASH = {
   '/compact [focus]': { summary: 'summarize the conversation to free context' },
   '/export [file]': { summary: 'write the conversation to a file (txt/md/json)' },
   '/copy': { summary: 'copy the last response to the clipboard' },
-  '/diff': { summary: 'what changed on disk since the session started' },
+  '/diff': { summary: 'uncommitted changes, staged or not, and new files' },
   '/tasks': { summary: 'review tool activity from this session' },
   '/image <path>': { summary: 'attach an image (png/jpg/gif/webp) the model will see with your next message' },
   '/memory [text]': { summary: 'show or append to JAITUS.md (# does this inline)' },
@@ -592,8 +742,11 @@ async function session({ flags }) {
   sessionState.model = model;
   const creds = loadCredentials();
   let tui = null;
+  // An explicit plan mode beats -y: `-y --permission-mode plan` asked for read-only and
+  // used to run every write and command.
+  const explicitPlan = flags.permissionModeExplicit && flags.permissionMode === 'plan';
   const permissions = createPermissions({
-    autoApprove: flags.yes,
+    autoApprove: flags.yes && !explicitPlan,
     mode: flags.permissionMode,
     // Saved rules are per project, keyed by directory, because "always allow npm test"
     // in one repo says nothing about what is safe in another.
@@ -602,7 +755,7 @@ async function session({ flags }) {
       const settings = loadSettings();
       saveSettings({
         ...settings,
-        permissionRules: { ...(settings.permissionRules || {}), [flags.cwd]: { allow, deny } },
+        permissionRules: { ...(settings.permissionRules || {}), [rulesKey(flags.cwd)]: { allow, deny } },
       });
     },
     onModeChange: (m) => {
@@ -610,7 +763,12 @@ async function session({ flags }) {
       tui?.setMeta({ mode: m });
     },
   });
-  if (loadSettings().lastMode && !flags.yes) permissions.setMode(loadSettings().lastMode);
+  // The last mode comes back only when nothing was asked for on the command line — the
+  // flag used to be overridden by it, so after one Shift+Tab `--permission-mode plan`
+  // started a session that edited files without asking. Plan (often set by /ask or
+  // /plan, not chosen) and bypass never carry into a new session on their own.
+  const lastMode = loadSettings().lastMode;
+  if (lastMode && !flags.yes && !flags.permissionModeExplicit && ['default', 'acceptEdits'].includes(lastMode)) permissions.setMode(lastMode);
   // Starting straight into bypass gets one explicit confirmation (§11) when a
   // human is present; headless runs just get the warning on stderr.
   if (permissions.mode === 'bypassPermissions' && !flags.yes) {
@@ -681,7 +839,7 @@ async function session({ flags }) {
   // ── The fullscreen interface ──
   // The alternate-screen app owns a fixed composer and a scrolling transcript. out()
   // routes transcript events through it so command output cannot disturb the composer.
-  tui = await createTui({
+  const tuiOptions = {
     // Names AND summaries: the composer menu and the palette both show what a command
     // does beside its name, which is the difference between a list you scan and a list
     // you have to already know.
@@ -689,7 +847,7 @@ async function session({ flags }) {
       ...Object.entries(SLASH)
         .filter(([, value]) => !value.hidden)
         .map(([key, value]) => ({ name: key.split(' ')[0], summary: value.summary })),
-      ...Object.entries(skills).map(([name, skill]) => ({ name: `/${name}`, summary: skill.summary || 'project workflow' })),
+      ...Object.entries(skills).map(([name, skill]) => ({ name: `/${name}`, summary: skill.description || skill.summary || 'project workflow' })),
     ],
     fileProvider: (frag) => completeFiles(frag),
     settings: loadSettings(),
@@ -717,7 +875,8 @@ async function session({ flags }) {
       refreshStatusLine('mode');
       return m;
     },
-  });
+  };
+  tui = await createTui(tuiOptions);
   setTuiSink(tui);
   activeTui = tui;
 
@@ -771,16 +930,65 @@ async function session({ flags }) {
   // Esc/Ctrl+C while busy aborts the current run; the loop below notices via the
   // rejected signal and reports the interruption.
   let activeAbort = null;
+  let lastRunInterrupted = false;
   tui.onEscape(() => { if (activeAbort) activeAbort.abort(); });
 
+  /**
+   * A side run — /review, /research, /explain, /btw, /agent, /test --fix, /commit — in
+   * the app. They used to call the agent with no screen and no stop signal: the answer
+   * was written straight to the terminal over the app and wiped by the next frame (never
+   * in the transcript, never copyable), and Esc could not stop them. They also got fresh
+   * permissions without the user's deny rules. Now: the app's transcript, Esc stops it,
+   * and the session's rules in the mode asked for.
+   */
+  /** Run fn(signal) so that Esc stops it — for commands that run something long (/test). */
+  const abortable = async (fn) => {
+    const ctrl = new AbortController();
+    const outer = activeAbort;
+    activeAbort = ctrl;
+    try { return await fn(ctrl.signal); } finally { activeAbort = outer; }
+  };
+
+  const runSide = async ({ messages: sideMessages, mode = 'plan', extraSystem = '', onText = null, maxIterations, allow = [] } = {}) => {
+    const ctrl = new AbortController();
+    const outer = activeAbort;
+    activeAbort = ctrl;
+    try {
+      const result = await runAgent({
+        client, messages: sideMessages, model, cwd: flags.cwd,
+        permissions: permissions.fork({ mode, allow }), signal: ctrl.signal, tui, journal,
+        extraSystem, onText, ...(maxIterations ? { maxIterations } : {}),
+      });
+      if (result?.stopReason === 'interrupted') lastRunInterrupted = true;
+      if (result && !result.__error) {
+        spent.input += result.input || 0;
+        spent.cached += result.cached || 0;
+        spent.output += result.output || 0;
+        spent.tools += result.tools || 0;
+        try { tui?.setSpent?.(spent); } catch { /* header keeps last value */ }
+      }
+      return { ...result, messages: sideMessages };
+    } finally {
+      activeAbort = outer;
+    }
+  };
+
   /** One agent run with abort wiring, error accounting, and queue draining after. */
   const runManaged = async (messages) => {
     const ctrl = new AbortController();
     activeAbort = ctrl;
     const turnStarted = Date.now();
+    // Where this run started: on a failure, only a prompt that got NO answer at all is
+    // removed. Popping "the last user message" after a few tool steps removed the tool
+    // RESULTS instead, leaving a tool call with no result — which the provider rejects,
+    // so every later message in the session failed too.
+    const startLength = messages.length;
+    // The new message counts toward the context from the moment it is sent.
+    try { showContext(); } catch { /* header keeps last value */ }
     try {
       const result = await runAgent({
         client, messages, model, cwd: flags.cwd, permissions, signal: ctrl.signal, tui, journal,
+        onContext: (n) => { lastContext = n; sessionState.lastContext = n; showContext(); },
         extraSystem: `${skillCatalog(skills)}\n\nCurrent intent: ${intentMode}. ${intentGuidance[intentMode]}${flags.appendSystemPrompt ? `\n\nAdditional instructions:\n${flags.appendSystemPrompt}` : ''}`,
         systemOverride: flags.systemPrompt || null,
       });
@@ -793,6 +1001,7 @@ async function session({ flags }) {
         if (result.context) { lastContext = result.context; sessionState.lastContext = lastContext; }
       }
       if (result?.stopReason === 'interrupted') {
+        lastRunInterrupted = true;
         ledger.note('interrupted', 'The user interrupted the previous turn with Esc before it finished. Whatever it was doing did not complete.');
         // Keep the partial assistant turn out of history if it never completed.
         const last = messages[messages.length - 1];
@@ -816,9 +1025,17 @@ async function session({ flags }) {
       // conversation the API will reject — but the model is told it happened. Without
       // that, its next turn begins as though nothing went wrong and it re-attempts the
       // thing that just failed.
-      ledger.note('turn-failed', `A request to the gateway failed${e.status ? ` with HTTP ${e.status}` : ''}: ${e.message}. That turn was discarded and the user's message was not answered.`);
-      if (messages[messages.length - 1]?.role === 'user') messages.pop();
+      if (ctrl.signal.aborted) lastRunInterrupted = true;
+      if (messages.length === startLength && messages[messages.length - 1]?.role === 'user') {
+        messages.pop();
+        ledger.note('turn-failed', `A request to the gateway failed${e.status ? ` with HTTP ${e.status}` : ''}: ${e.message}. That turn was discarded and the user's message was not answered.`);
+      } else {
+        ledger.note('turn-failed', `A request to the gateway failed${e.status ? ` with HTTP ${e.status}` : ''} partway through the task: ${e.message}. The steps before it are kept; it did not finish.`);
+      }
     } finally {
+      // Whatever ended the run, the history leaves here well-formed: every tool call
+      // has a result.
+      repairToolPairs(messages);
       activeAbort = null;
       sessionState.messages = messages;
       sessionState.model = model;
@@ -885,12 +1102,16 @@ async function session({ flags }) {
   const handleLineInner = async (rawLine) => {
     const input = rawLine.trim();
     if (!input) return;
+    appendHistoryLine(tui.lastTyped?.() ?? input);
     // First submit leaves home: the composer goes full session width.
     tui.setHome?.(false);
 
     // Echo the submission as a first-class entry rather than two pre-formatted lines,
     // so it wraps, re-wraps on resize, and carries its attachments.
-    if (tui.user) tui.user(input, pendingImages.map((i) => i.name).filter(Boolean));
+    if (tui.user) {
+      const chips = [...input.matchAll(/\[Image #(\d+)\]/g)].map((m) => `image #${m[1]}`);
+      tui.user(input, [...pendingImages.map((i) => i.name).filter(Boolean), ...chips]);
+    }
     else {
       const bar = c.brand(glyph('│', '|'));
       tui.print(`\n  ${bar}  ${c.bold(input.replace(/\n/g, ' '))}`, 'user');
@@ -905,6 +1126,10 @@ async function session({ flags }) {
     if (input.startsWith('/')) {
       const [verb, ...args] = input.split(/\s+/);
       let result;
+      // Busy while it runs, like any turn: /ask, /review, /research and the skills run
+      // the agent, and without this Esc could not interrupt them and a message typed
+      // meanwhile started a SECOND turn on the same conversation at the same time.
+      tui.setBusy(true);
       try {
         result = await slashCommand(verb, args, {
           client, messages, permissions, flags, spent, resetContext,
@@ -913,15 +1138,27 @@ async function session({ flags }) {
             sessionState.model = m;
             tui?.setMeta?.({ model: m });
           },
-          skills, sessionState, runManaged, tui, pendingImages, journal, setIntent,
+          skills, sessionState, runManaged, runSide, abortable, tui, pendingImages, journal, setIntent,
         });
       } catch (error) {
         // Slash commands run inside the fullscreen app. Letting this escape to the
         // process-level handler prints to stderr outside the alternate screen and
         // makes a real failure look like nothing happened.
         reportAgentError(error);
+      } finally {
+        tui.setBusy(false);
+      }
+      if (result === 'exit' || result === 'logout') {
+        // Saved first: /clear, /undo, /compact, /model then /exit used to lose the change.
+        try { sessionState.messages = messages; sessionState.model = model; saveSession(sessionState); } catch { /* best effort */ }
+        setTuiSink(null); tui.stop();
+        if (result === 'logout') {
+          const { default: logout } = await import('./commands/logout.js');
+          await logout().catch((e) => fail(e.message));
+        }
+        process.exit(0);
       }
-      if (result === 'exit') { setTuiSink(null); tui.stop(); process.exit(0); }
+      await drainQueued();
       return;
     }
 
@@ -988,9 +1225,17 @@ async function session({ flags }) {
         for (const note of mentioned.notes) tui.notice?.(note, 'dim');
       }
 
-      // Image chips pasted with Ctrl+V ride first, then the text.
+      // Images ride first, then the text: those whose [Image #N] chip is in the message,
+      // plus any @image.png mentioned in it.
       const pasted = tui.drainAttachments ? tui.drainAttachments(input) : [];
-      const queuedImages = [...pendingImages.splice(0), ...pasted];
+      const mentionedImages = [];
+      for (const file of mentioned.images) {
+        const ready = await shrinkImageFile(file).catch(() => null);
+        const block = ready ? await imageBlock(ready).catch(() => null) : null;
+        if (block) mentionedImages.push(block);
+        else tui.notice?.(`@${path.basename(file)} could not be attached as an image (png, jpg, gif or webp, under 3.5 MB)`, 'warn');
+      }
+      const queuedImages = [...pendingImages.splice(0), ...pasted, ...mentionedImages];
       if (queuedImages.length || mentioned.blocks.length) {
         messages.push({ role: 'user', content: [...queuedImages, ...mentioned.blocks, { type: 'text', text: input }] });
       } else {
@@ -1006,26 +1251,34 @@ async function session({ flags }) {
       reportAgentError(error, { title: 'That turn did not run' });
     } finally {
       tui.setBusy(false);
-      // While the agent was running, Enter queued whatever was typed — send those
-      // now, one at a time, each itself interruptible.
-      for (;;) {
-        const queued = tui.takeQueued()[0];
-        if (queued === undefined) break;
-        messages.push({ role: 'user', content: queued });
-        // Through the same entry type as a typed message. This was two pre-formatted
-        // lines each carrying a `│`, pushed in as raw text — which is where the doubled
-        // bar people saw after interrupting came from: the queue drains in the `finally`
-        // of an interrupted turn, so that is exactly when it showed up.
-        if (tui.user) tui.user(queued);
-        else tui.print(`\n  ${c.brand(glyph('│', '|'))}  ${c.bold(queued.replace(/\n/g, ' '))}`, 'user');
-        tui.setBusy(true);
-        await runManaged(messages);
-        tui.setBusy(false);
-      }
       await runHook(flags.cwd, 'afterTurn', { prompt: input, sessionId: sessionState.id });
+      await drainQueued();
     }
   };
 
+  /**
+   * Whatever was typed while the agent worked. Each line goes through handleLineInner —
+   * the same path as typing it now — so `/model`, `!ls`, `@file` and image chips in a
+   * queued line work. They used to be pushed into the conversation as raw text: a queued
+   * `/clear` became a message to the model.
+   *
+   * After Esc, the queue is handed back to the composer instead of sent: stopping a turn
+   * and having the next queued message start immediately was not stopping.
+   */
+  async function drainQueued() {
+    const queued = tui.takeQueued?.() || [];
+    if (!queued.length) return;
+    if (lastRunInterrupted) {
+      lastRunInterrupted = false;
+      tui.restoreInput?.(queued.join('\n'));
+      tui.flash?.('Interrupted — your queued messages are back in the box', 'info', 2200);
+      return;
+    }
+    const [next, ...rest] = queued;
+    for (const line of rest) tui.queue?.(line);
+    await handleLineInner(next);
+  }
+
   useHistoryFile(HISTORY);
   // ── Which renderer ──
   //
@@ -1054,11 +1307,58 @@ async function session({ flags }) {
     // is incapable.
     : !device.vt && !knownGoodTerminal && process.stdout.isTTY ? false
     : true;
+  // Not going full-screen: the classic renderer, which prints straight to the terminal
+  // while it is not running. The app view was used regardless — never started, so every
+  // answer, /help and /status went into a transcript nobody could see, and pickers
+  // (/model, /resume, /theme) waited forever on a dialog that was never drawn.
+  if (!(process.stdout.isTTY && wantFullscreen) && createTui !== createClassicTui) {
+    tui = await createClassicTui(tuiOptions);
+    setTuiSink(tui);
+    activeTui = tui;
+    tui.onEscape?.(() => { if (activeAbort) activeAbort.abort(); });
+    // Its dialog and panel draw only while it runs full-screen. Inline, a question is a
+    // numbered list answered with one key, and a panel is printed.
+    tui.askDialog = async (question, options = [], preview = []) => {
+      out(`  ${c.bold(String(question).replace(/\x1b\[[0-9;]*m/g, ''))}`);
+      for (const line of preview.slice(0, 20)) out(`    ${c.dim(String(line))}`);
+      const list = options.slice(0, 9);
+      list.forEach((o, i) => out(`    ${c.brand(String(i + 1))}. ${String(o?.label ?? o?.value ?? o).replace(/\x1b\[[0-9;]*m/g, '')}`));
+      if (!process.stdin.isTTY) return null;
+      const keys = list.map((_, i) => String(i + 1));
+      const key = await askKey(`  ${c.dim(`1-${list.length}, or n to cancel ›`)} `, [...keys, 'n', '\x1b']);
+      const picked = list[Number(key) - 1];
+      return picked === undefined ? null : (picked && typeof picked === 'object' ? picked : { value: picked });
+    };
+    tui.showPanel = async (title, lines) => {
+      out(`  ${c.bold(String(title))}`);
+      for (const line of (Array.isArray(lines) ? lines : String(lines).split('\n'))) out(`  ${line}`);
+      return null;
+    };
+  }
   if (process.stdout.isTTY && wantFullscreen) {
     tui.start({ onLine: handleLine, history: sessionHistory() });
     // A global install never updates itself; say so when there is something newer.
     // Background and cached for a day — the app never waits on the network for this.
     void updateNotice().then((line) => { if (line) tui.notice(line, 'info'); }).catch(() => {});
+    // A project's .mcp.json runs programs on this machine. Nothing in it starts until the
+    // exact command is approved here — asked once, remembered per project and command.
+    void (async () => {
+      for (const server of untrustedServers(flags.cwd)) {
+        const line = [server.config.command, ...(server.config.args || [])].join(' ');
+        const answer = dialogValue(await tui.askDialog(
+          `This project's .mcp.json wants to start an MCP server "${server.name}". It runs on your computer, with your files.`,
+          [{ label: 'Allow and remember for this project', value: 'trust' }, { label: 'Not now', value: 'no' }],
+          [`command: ${line.slice(0, 300)}`, ...(server.config.env ? [`env: ${Object.keys(server.config.env).join(', ')}`] : [])],
+          { title: 'MCP SERVER', hideComment: true },
+        ));
+        if (answer === 'trust') { trustServer(flags.cwd, server); tui.notice(`MCP server ${server.name} approved for this project.`, 'info'); }
+        else tui.notice(`MCP server ${server.name} not started. \`jaitus mcp trust ${server.name}\` approves it later.`, 'dim');
+      }
+      // Problems starting an approved server are said once, not swallowed.
+      const tools = await discoverMcpTools(flags.cwd).catch(() => []);
+      for (const [name, why] of mcpProblems) tui.notice(`MCP server ${name} could not start: ${String(why).slice(0, 160)}`, 'warn');
+      void tools;
+    })().catch(() => {});
     // Fresh sessions open on the home moment, opencode-style: the centered
     // two-tone mark, then a tip — the composer below is the whole welcome.
     // The mark is vertically centered in the free space above the pinned
@@ -1246,17 +1546,42 @@ function completeFiles(frag) {
 let currentCwd = process.cwd();
 
 /** Prior prompts for Up-arrow recall: this session first, then earlier ones. */
+/**
+ * Prompt history across sessions, oldest first (what the app's Up/Down walks).
+ *
+ * The file is one entry per line, oldest first — the format the classic prompt writes.
+ * This used to JSON.parse it, which always failed, so history never carried over; and
+ * the app never wrote to it at all. A newline inside an entry is stored as U+2028 so
+ * each entry stays one line.
+ */
+// U+2028: a newline inside a history entry, so each entry stays one line of the file.
+const LINE_SEP = String.fromCharCode(0x2028);
+const NL = String.fromCharCode(10);
+const NEWLINE_RE = new RegExp('\\r?\\n');
+
 function sessionHistory() {
   try {
     const file = path.join(HOME, 'history');
     if (!fs.existsSync(file)) return [];
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
-    return Array.isArray(parsed) ? parsed.slice(-50).reverse() : [];
+    return fs.readFileSync(file, 'utf8').split(NEWLINE_RE).filter(Boolean).slice(-200).map((l) => l.split(LINE_SEP).join(NL));
   } catch {
     return [];
   }
 }
 
+function appendHistoryLine(line) {
+  const entry = String(line || '').trim().split(NEWLINE_RE).join(LINE_SEP);
+  if (!entry) return;
+  try {
+    const file = path.join(HOME, 'history');
+    const lines = fs.existsSync(file) ? fs.readFileSync(file, 'utf8').split(NEWLINE_RE).filter(Boolean) : [];
+    if (lines.at(-1) === entry) return;
+    lines.push(entry);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, lines.slice(-500).join(NL) + NL, { mode: 0o600 });
+  } catch { /* history is a convenience, never a reason to fail */ }
+}
+
 /** Append one line to the project memory file, creating it with a header if needed. */
 function appendMemory(cwd, note) {
   const file = path.join(cwd, CONTEXT_FILE);
@@ -1312,11 +1637,14 @@ async function relaunchRenderer(ctx, want) {
   setTuiSink(null);
   ctx.tui.stop();
   const bin = fileURLToPath(new URL('../bin/jaitus.js', import.meta.url));
-  const argv = process.argv.slice(2).filter((a) => a !== '--resume' && a !== '-r' && a !== '--continue' && a !== '-c');
-  // Drop the value that followed --resume/-r, if any.
+  // Drop --resume/-r WITH its value, and --continue/-c. The flags used to be filtered
+  // out first, so the loop below never saw them and the old id stayed behind — the new
+  // process read it as a task prompt and exited.
+  const argv = process.argv.slice(2);
   const cleaned = [];
   for (let i = 0; i < argv.length; i++) {
-    if ((argv[i] === '--resume' || argv[i] === '-r')) { i++; continue; }
+    if (argv[i] === '--resume' || argv[i] === '-r') { i++; continue; }
+    if (argv[i] === '--continue' || argv[i] === '-c') continue;
     cleaned.push(argv[i]);
   }
   out(c.dim(`  Relaunching in ${want} mode — conversation continues where it left off…`));
@@ -1328,9 +1656,18 @@ async function relaunchRenderer(ctx, want) {
  * Single-select picker for anything listable (sessions, models, modes, jobs):
  * arrows + Enter, 1-9 jump, Esc cancels. Returns the value or undefined.
  */
+/** Put the (changed) conversation back on screen: after /undo and /rewind the dropped turns stayed visible. */
+function redrawConversation(ctx) {
+  try {
+    if (!ctx.tui?.clearTranscript) return;
+    ctx.tui.clearTranscript();
+    if (ctx.messages.length) replaySession(ctx.tui, ctx.messages);
+  } catch { /* the conversation itself is already right; only the view is stale */ }
+}
+
 async function pickOption(tui, title, question, options, preview = []) {
   if (!options.length) return undefined;
-  const r = await tui.askDialog(question, options.slice(0, 9), preview, { title, hideComment: true });
+  const r = await tui.askDialog(question, options.slice(0, 20), preview, { title, hideComment: true });
   const value = r && typeof r === 'object' ? r.value : r;
   return value == null ? undefined : value;
 }
@@ -1403,20 +1740,39 @@ async function slashCommand(verb, args, ctx) {
     }
 
     case '/export': {
-      const target = args[0] || `jaitus-session-${new Date().toISOString().slice(0, 16).replace(/[:T]/g, '-')}.md`;
+      const target = args.join(' ').replace(/^["']|["']$/g, '') || `jaitus-session-${new Date().toISOString().slice(0, 16).replace(/[:T]/g, '-')}.md`;
       try {
-        const lines = [`# Jaitus session — ${new Date().toISOString()}`, ''];
-        for (const m of ctx.messages) {
-          if (m.role === 'user' && typeof m.content === 'string') lines.push(`## You\n\n${m.content}\n`);
-          else if (m.role === 'assistant') {
-            const text = (Array.isArray(m.content) ? m.content : [])
-              .filter((b) => b.type === 'text').map((b) => b.text).join('\n');
-            const tools = (Array.isArray(m.content) ? m.content : []).filter((b) => b.type === 'tool_use');
-            if (text) lines.push(`## Jaitus\n\n${text}\n`);
-            for (const t of tools) lines.push(`> ${c.grey('')}\`${t.name} ${JSON.stringify(t.input).slice(1, 120)}\``);
+        const ext = path.extname(target).toLowerCase();
+        const blocks = (m) => (Array.isArray(m.content) ? m.content : [{ type: 'text', text: String(m.content ?? '') }]);
+        let body;
+        if (ext === '.json') {
+          // The conversation as the model saw it, images included.
+          body = JSON.stringify({ session: ctx.sessionState.id, model: ctx.model, exportedAt: new Date().toISOString(), messages: ctx.messages }, null, 2);
+        } else {
+          // Markdown or plain text. User turns with an image or an @mention are content
+          // arrays and used to be left out; ANSI colour codes used to land in the file.
+          const md = ext !== '.txt';
+          const lines = [md ? `# Jaitus session — ${new Date().toISOString()}` : `Jaitus session — ${new Date().toISOString()}`, ''];
+          for (const m of ctx.messages) {
+            const parts = blocks(m);
+            const text = parts.filter((b) => b.type === 'text' && !/^<mentioned /.test(b.text || '')).map((b) => b.text).join('\n').trim();
+            const extras = [
+              ...parts.filter((b) => b.type === 'image').map(() => '[image]'),
+              ...parts.filter((b) => b.type === 'text' && /^<mentioned path="([^"]+)"/.test(b.text || '')).map((b) => `[@${/path="([^"]+)"/.exec(b.text)[1]}]`),
+            ];
+            if (m.role === 'user' && (text || extras.length) && !parts.every((b) => b.type === 'tool_result')) {
+              lines.push(md ? `## You\n\n${[text, extras.join(' ')].filter(Boolean).join('\n\n')}\n` : `YOU: ${[text, extras.join(' ')].filter(Boolean).join(' ')}\n`);
+            } else if (m.role === 'assistant') {
+              if (text) lines.push(md ? `## Jaitus\n\n${text}\n` : `JAITUS: ${text}\n`);
+              for (const t of parts.filter((b) => b.type === 'tool_use')) {
+                const call = `${t.name} ${JSON.stringify(t.input).slice(0, 160)}`;
+                lines.push(md ? `> \`${call}\`` : `  (ran ${call})`);
+              }
+            }
           }
+          body = lines.join('\n');
         }
-        fs.writeFileSync(path.resolve(ctx.flags.cwd, target), lines.join('\n'), 'utf8');
+        fs.writeFileSync(path.resolve(ctx.flags.cwd, target), body, 'utf8');
         ok(`Exported to ${c.bold(target)}`);
       } catch (e) {
         fail(`Export failed: ${e.message}`);
@@ -1438,22 +1794,32 @@ async function slashCommand(verb, args, ctx) {
     case '/image': {
       const [p] = args;
       if (!p) { warn('Give an image path: /image screenshot.png (png, jpg, gif, webp — max ~3 MB).'); return null; }
-      const abs = path.isAbsolute(p) ? p : path.join(ctx.flags.cwd, p);
-      const block = await imageBlock(abs);
-      if (!block) { warn(`Cannot attach ${p} — not a supported image (png/jpg/jpeg/gif/webp), too big, or unreadable.`); return null; }
+      // A path with spaces arrives split into args; quotes around it are the user's.
+      const joined = args.join(' ').replace(/^["']|["']$/g, '');
+      const abs = path.isAbsolute(joined) ? joined : path.join(ctx.flags.cwd, joined);
+      // The app view: a chip in the composer, removable with Backspace, shrunk if large.
+      if (ctx.tui?.addImageFiles) { await ctx.tui.addImageFiles([abs]); return null; }
+      const ready = await shrinkImageFile(abs).catch(() => null);
+      const block = ready ? await imageBlock(ready) : null;
+      if (!block) { warn(`Cannot attach ${joined} — not a supported image (png/jpg/jpeg/gif/webp), unreadable, or could not be made smaller than 3.5 MB.`); return null; }
       ctx.pendingImages.push(block);
       ok(`Image attached (${Math.round((block.source.data.length * 3) / 4 / 1024)} KB). It is sent with your next message.`);
       return null;
     }
 
     case '/diff': {
-      const [stat, diff] = await Promise.all([
-        captureProcess('git', ['diff', '--stat'], ctx.flags.cwd),
-        captureProcess('git', ['diff', '--no-ext-diff', '--unified=3'], ctx.flags.cwd),
+      // Everything not yet committed: staged and unstaged (git diff HEAD), plus new files
+      // git does not track yet. Plain `git diff` showed only unstaged edits and missed
+      // every file the agent had created.
+      const [stat, diff, untracked] = await Promise.all([
+        captureProcess('git', ['diff', 'HEAD', '--stat'], ctx.flags.cwd),
+        captureProcess('git', ['diff', 'HEAD', '--no-ext-diff', '--unified=3'], ctx.flags.cwd),
+        captureProcess('git', ['ls-files', '--others', '--exclude-standard'], ctx.flags.cwd),
       ]);
       if (stat.error || diff.error) { warn('Not a git repository, or git is not installed.'); return null; }
-      const body = `${stat.stdout}${stat.stdout && diff.stdout ? '\n\n' : ''}${diff.stdout}`.trim()
-        || 'No uncommitted changes.';
+      const fresh = String(untracked.stdout || '').trim();
+      const body = [stat.stdout.trim(), fresh ? `New files, not yet tracked:\n${fresh.split('\n').map((f) => `  + ${f}`).join('\n')}` : '', diff.stdout.trim()]
+        .filter(Boolean).join('\n\n') || 'No uncommitted changes.';
       if (ctx.tui) await ctx.tui.showPanel('Changes', body.split('\n'));
       else out(body);
       return null;
@@ -1533,7 +1899,12 @@ async function slashCommand(verb, args, ctx) {
         }
         const rule = args.slice(1).join(' ').trim();
         if (!rule) { warn(`Give a rule: /permissions ${next} run_command(npm test:*)`); return null; }
-        if (next === 'forget') { ctx.permissions.removeRule(rule); ok(`Forgot ${c.bold(rule)}.`); return null; }
+        if (next === 'forget') {
+          const { allow, deny, session } = ctx.permissions.rules;
+          if (![...allow, ...deny, ...session].includes(rule)) { warn(`No rule ${c.bold(rule)} — /permissions rules lists them.`); return null; }
+          if (DEFAULT_DENY.includes(rule)) { warn(`${c.bold(rule)} is a built-in safety rule; it can only be lifted for this session.`); }
+          ctx.permissions.removeRule(rule); ok(`Forgot ${c.bold(rule)}.`); return null;
+        }
         if (!parseRule(rule)) { warn(`That is not a rule. Try ${c.bold('run_command(npm test:*)')} or ${c.bold('edit_file(src/**)')}.`); return null; }
         ctx.permissions.addRule(rule, { persist: true, kind: next });
         ok(`${next === 'deny' ? 'Denied' : 'Allowed'}: ${c.bold(rule)} — saved for this project.`);
@@ -1630,7 +2001,7 @@ async function slashCommand(verb, args, ctx) {
         info(`Pick one: ${c.bold('/resume <id>')} — ${all.slice(0, 9).map((s) => s.id.slice(0, 8)).join('  ')}`);
         return null;
       }
-      const all = listSessions({ cwd: ctx.flags.cwd }).slice(0, 9);
+      const all = listSessions({ cwd: ctx.flags.cwd }).slice(0, 20);
       if (!all.length) { info('No saved sessions in this directory yet.'); return null; }
       const chosen = await pickOption(ctx.tui, 'Resume session',
         'Load a saved session from this directory?',
@@ -1707,6 +2078,12 @@ async function slashCommand(verb, args, ctx) {
     }
 
     case '/vim': {
+      // The full-screen view has no vim mode. It used to report "Vim editing on — Esc for
+      // normal mode", and Esc then started the rewind countdown.
+      if (ctx.tui?.askDialog) {
+        warn('Vim editing is only in the classic prompt (/tui default). The full-screen view uses standard keys: arrows, Home/End, Ctrl+A/E, Ctrl+W, Ctrl+U/K.');
+        return null;
+      }
       const { loadSettings: loadSv, saveSettings: saveSv } = await import('./config.js');
       const on = loadSv().editorMode !== 'vim';
       saveSv({ ...loadSv(), editorMode: on ? 'vim' : 'emacs' });
@@ -1816,10 +2193,9 @@ async function slashCommand(verb, args, ctx) {
       const prompt = args.join(' ').trim();
       if (!prompt) { info('Usage: /agent inspect the authentication flow'); return null; }
       const sideMessages = [{ role: 'user', content: prompt }];
-      const sidePermissions = createPermissions({ mode: 'plan' });
-      const side = await runAgent({
-        client: ctx.client, messages: sideMessages, model: ctx.model, cwd: ctx.flags.cwd,
-        permissions: sidePermissions, extraSystem: `${skillCatalog(ctx.skills)}\n\nYou are a focused Jaitus side-agent. Return a concise finding; never edit files or run commands.`,
+      const side = await ctx.runSide({
+        messages: sideMessages, mode: 'plan',
+        extraSystem: `${skillCatalog(ctx.skills)}\n\nYou are a focused Jaitus side-agent. Return a concise finding; never edit files or run commands.`,
       });
       info(`Side-agent finished (${side.tools || 0} read/tool calls).`);
       return null;
@@ -1851,7 +2227,14 @@ async function slashCommand(verb, args, ctx) {
 
     case '/code':
       ctx.setIntent('build');
-      ok('Implementation intent — approval policy remains unchanged.');
+      // /ask, /plan and /architect switch to plan mode; /code has to switch back, or the
+      // agent still cannot write anything after being told to build.
+      if (ctx.permissions.mode === 'plan') {
+        ctx.permissions.setMode('default');
+        ok('Building — plan mode is off; it asks before each change (Shift+Tab to change that).');
+      } else {
+        ok('Building — the approval mode is unchanged.');
+      }
       return null;
 
     case '/explain':
@@ -1892,9 +2275,8 @@ async function slashCommand(verb, args, ctx) {
       const question = args.join(' ').trim();
       if (!question) { info('Usage: /btw <quick question> — answered off the record.'); return null; }
       const sideMessages = [{ role: 'user', content: question }];
-      await runAgent({
-        client: ctx.client, messages: sideMessages, model: ctx.model, cwd: ctx.flags.cwd,
-        permissions: createPermissions({ mode: ctx.permissions?.mode || 'default' }),
+      await ctx.runSide({
+        messages: sideMessages, mode: ctx.permissions?.mode || 'default',
         extraSystem: `${skillCatalog(ctx.skills)}\n\nYou are answering a quick side question. Be brief; this answer is shown once and never stored.`,
       });
       info(c.dim('Off the record — the conversation above is untouched.'));
@@ -1943,6 +2325,10 @@ async function slashCommand(verb, args, ctx) {
         if (!outcome.ok) { fail(`Rewind failed: ${outcome.error}`); return null; }
         ctx.sessionState.messages = ctx.messages;
         saveSession(ctx.sessionState);
+        // The context meter and the screen follow the rewound conversation (both stayed
+        // on the old one: the undone turns were still visible).
+        ctx.resetContext?.();
+        redrawConversation(ctx);
         ok(`Rewound to turn ${index + 1} — ${outcome.messageCount} message${outcome.messageCount === 1 ? '' : 's'} restored`
           + (outcome.restored.length || outcome.deleted.length
             ? c.dim(`  · ${outcome.restored.length} file${outcome.restored.length === 1 ? '' : 's'} reverted${outcome.deleted.length ? `, ${outcome.deleted.length} removed` : ''}`)
@@ -1991,7 +2377,8 @@ async function slashCommand(verb, args, ctx) {
       try {
         const line = `[${new Date().toISOString()}] session=${ctx.sessionState.id} model=${ctx.model} cwd=${ctx.flags.cwd} turns=${spent.turns}\n  ${text.replace(/\n/g, '\n  ')}\n`;
         fs.appendFileSync(path.join(HOME, 'feedback.log'), line, 'utf8');
-        ok(`Noted in ${c.bold('~/.jaitus/feedback.log')} — thank you. ${c.dim('/export sends the full conversation with it.')}`);
+        // Saved here only — it is not sent anywhere, and saying otherwise was untrue.
+        ok(`Saved to ${c.bold('~/.jaitus/feedback.log')} on this computer (it is not sent anywhere). ${c.dim('/export writes the conversation to a file if you want to share it.')}`);
       } catch (e) {
         fail(`Could not save feedback: ${e.message}`);
       }
@@ -2031,11 +2418,11 @@ async function slashCommand(verb, args, ctx) {
       return null;
     }
 
-    case '/logout': {
-      const { default: logout } = await import('./commands/logout.js');
-      await logout();
-      return 'exit';
-    }
+    case '/logout':
+      // Run after the app closes (see 'logout' in handleLineInner): its result — and a
+      // warning if the server could not be told — went into a transcript that closed at
+      // once, so nobody saw it.
+      return 'logout';
 
     case '/doctor': {
       const { default: doctor } = await import('./commands/doctor.js');
@@ -2091,10 +2478,18 @@ async function slashCommand(verb, args, ctx) {
 
     case '/undo': {
       // A turn is the user message plus everything the assistant added after it.
+      // A prompt is a user message that is not just tool results — one with an image or
+      // an @mention is an array, and was skipped, so /undo dropped TWO exchanges.
+      const isPrompt = (m) => m.role === 'user' && (typeof m.content === 'string'
+        || (Array.isArray(m.content) && m.content.some((b) => b.type !== 'tool_result')));
       let i = messages.length - 1;
-      while (i >= 0 && !(messages[i].role === 'user' && typeof messages[i].content === 'string')) i--;
-      if (i >= 0) { messages.length = i; ctx.resetContext?.(); ok('Dropped the last exchange.'); }
-      else warn('Nothing to undo.');
+      while (i >= 0 && !isPrompt(messages[i])) i--;
+      if (i >= 0) {
+        messages.length = i;
+        ctx.resetContext?.();
+        redrawConversation(ctx);
+        ok('Dropped the last exchange.');
+      } else warn('Nothing to undo.');
       return null;
     }
 
@@ -2116,7 +2511,7 @@ async function slashCommand(verb, args, ctx) {
       if (!available.length) { warn('The gateway returned no models.'); return null; }
       if (!ctx.tui) { info(`Model: ${c.bold(ctx.model)}`); return null; }
       const picked = await pickOption(ctx.tui, 'Model', 'Which model serves this session?',
-        available.slice(0, 9).map((m) => ({ value: m, label: `${m === ctx.model ? '●' : '○'}  ${m}` })));
+        available.slice(0, 20).map((m) => ({ value: m, label: `${m === ctx.model ? '●' : '○'}  ${m}` })));
       if (!picked) return null;
       applyModel(picked);
       return null;
@@ -2273,23 +2668,37 @@ const commands = {
     summary: 'list or configure MCP tool servers',
     usage: [
       'jaitus mcp list',
-      'jaitus mcp add <name> <command> [args...]',
+      'jaitus mcp add [--global] <name> -- <command> [args...]',
+      'jaitus mcp trust <name>',
       'jaitus mcp remove <name>',
     ],
-    detail: ['Local stdio servers are read from .mcp.json and exposed to the agent as permission-gated tools.'],
+    detail: [
+      'Local stdio servers from your own ~/.jaitus/mcp.json (--global) and the project\'s .mcp.json, merged,',
+      'exposed to the agent as permission-gated tools. A project\'s servers start only once you approve them.',
+      'Put the command after -- so its own flags (-y, --port) are not read as Jaitus flags.',
+    ],
     run: (argv, { json, flags }) => {
-      const [action = 'list', name, command, ...args] = argv;
+      const global = argv.includes('--global');
+      const rest = argv.filter((a) => a !== '--global');
+      const [action = 'list', name, command, ...args] = rest;
       if (action === 'list') {
         const servers = listMcpServers(flags.cwd);
         present(json, { servers }, () => {
           if (!servers.length) { info('No MCP servers configured.'); return; }
-          servers.forEach((server) => out(`  ${c.brand(server.name)}  ${server.transport}  ${server.command}`));
+          servers.forEach((server) => out(`  ${c.brand(server.name)}  ${c.dim(server.scope)}  ${server.trusted ? c.accent('approved') : c.yellow('not approved')}  ${server.command}`));
         });
         return 0;
       }
       if (action === 'add' && name && command) {
-        addMcpServer(flags.cwd, name, { type: 'stdio', command, args });
-        ok(`Added MCP server ${c.bold(name)}.`);
+        addMcpServer(flags.cwd, name, { type: 'stdio', command, args }, { global });
+        ok(`Added MCP server ${c.bold(name)}${global ? ' for every project' : ''}.`);
+        return 0;
+      }
+      if (action === 'trust' && name) {
+        const server = allServers(flags.cwd).find((s) => s.name === name);
+        if (!server) { warn(`No MCP server named ${name}.`); return 1; }
+        trustServer(flags.cwd, server);
+        ok(`Approved ${c.bold(name)} for this project: ${[server.config.command, ...(server.config.args || [])].join(' ')}`);
         return 0;
       }
       if (action === 'remove' && name) {
@@ -2297,7 +2706,7 @@ const commands = {
         ok(`Removed MCP server ${c.bold(name)}.`);
         return 0;
       }
-      fail('Usage: jaitus mcp list | add <name> <command> [args...] | remove <name>');
+      fail('Usage: jaitus mcp list | add [--global] <name> -- <command> [args...] | trust <name> | remove <name>');
       return 1;
     },
   },
@@ -2308,7 +2717,8 @@ const commands = {
       'jaitus config                    show everything',
       'jaitus config model              show one value',
       'jaitus config model <id>         set it',
-      'jaitus config theme <name>       dark, light, daltonized, plain, auto',
+      'jaitus config theme <name>       dark, light, ocean, daltonized, auto',
+      'jaitus config <key> --unset      back to the default',
       'jaitus config copyOnSelect <on|off>   auto-copy mouse selection',
     ],
     detail: [
@@ -2321,7 +2731,11 @@ const commands = {
       'Stack Overflow directly, which covers most of what a coding agent asks.',
     ],
     run: (argv, { json }) => {
-      const [key, value] = argv;
+      // The value is everything after the key: `config statusLine node status.js` used to
+      // save just "node".
+      const [key, ...rest] = argv;
+      const unset = rest.length === 1 && /^(--unset|none|unset)$/i.test(rest[0]);
+      const value = unset ? '' : rest.join(' ').trim();
       const settings = loadSettings();
       const ONOFF = ['copyOnSelect', 'wheelAccel', 'autoScroll', 'animations', 'autoCompact', 'mouse', 'autoUpdate'];
       const SECRET = ['braveSearchKey', 'tavilyKey', 'serperKey'];
@@ -2349,7 +2763,7 @@ const commands = {
           ['Gateway', data.gateway],
           ['Website', data.website],
           ['Model', data.model || 'whatever the gateway lists first'],
-          ['Theme', `${data.theme} (dark, light, daltonized, plain, auto)`],
+          ['Theme', `${data.theme} (${[...THEME_NAMES, 'auto'].join(', ')})`],
           ['Copy on select', data.copyOnSelect ? 'on (drag selects, auto-copies)' : 'off (Ctrl+Shift+C copies)'],
           ['Scroll speed', String(data.scrollSpeed)],
           ['Wheel accel', data.wheelAccel ? 'on' : 'off'],
@@ -2367,6 +2781,14 @@ const commands = {
         fail(`Unknown setting: ${key}. Try model, baseUrl, siteUrl, theme, statusLine, ${ONOFF.join(', ')}, ${SECRET.join(', ')} or scrollSpeed.`);
         return 1;
       }
+      // Clearing a value (there was no way: an empty value just printed the current one).
+      if (unset) {
+        if (!['model', 'baseUrl', 'siteUrl', 'statusLine', 'theme', 'scrollSpeed', ...SECRET].includes(key)) { fail(`${key} is on/off — set it with on or off.`); return 1; }
+        delete settings[key];
+        saveSettings(settings);
+        ok(`${key} cleared — back to the default.`);
+        return 0;
+      }
       if (!value) {
         // Never print a key back. Whether it is set, and how long it is, answers every
         // question anyone actually has about it.
@@ -2378,7 +2800,9 @@ const commands = {
         out(String(settings[key] ?? '')); return 0;
       }
       if (key === 'theme') {
-        if (!['dark', 'light', 'daltonized', 'plain', 'auto'].includes(value)) { fail('Use dark, light, daltonized, plain or auto.'); return 1; }
+        // The themes that exist (ocean was refused; plain was accepted and did nothing).
+        const names = [...THEME_NAMES, 'auto'];
+        if (!names.includes(value)) { fail(`Use ${names.join(', ')}.`); return 1; }
         settings.theme = value;
         saveSettings(settings);
         ok(`theme = ${value}`);
@@ -2432,7 +2856,7 @@ const commands = {
   update: {
     summary: 'check whether a newer version is published',
     usage: ['jaitus update [--json]'],
-    detail: ['Reports; does not install. How this CLI was installed is yours to decide.'],
+    detail: ['Checks npm for a newer version and, for a global npm install, offers to install it (--yes installs without asking). Launching jaitus also updates itself; turn that off with `jaitus config autoUpdate off`.'],
     run: (argv, { json }) => update(argv, { json }),
   },
 
@@ -2490,13 +2914,41 @@ export default async function main(argv) {
   const { flags, rest, passthrough } = parseArgs(argv);
 
   if (flags.version) { out(VERSION); return 0; }
+  // A mistyped mode used to become `default` silently — the one flag whose silent
+  // fallback changes what the agent is allowed to do.
+  if (flags.permissionModeExplicit && !flags.permissionMode) {
+    fail('Unknown --permission-mode. Use one of: default, acceptEdits, plan, bypassPermissions.');
+    return 1;
+  }
+  if (flags.maxTurnsRaw !== undefined && !(Number.isInteger(flags.maxTurns) && flags.maxTurns >= 1)) {
+    fail(`--max-turns needs a whole number of steps, 1 or more (got ${flags.maxTurnsRaw === undefined ? 'nothing' : JSON.stringify(flags.maxTurnsRaw)}).`);
+    return 1;
+  }
+  if (!['text', 'json', 'stream-json'].includes(flags.outputFormat)) {
+    fail(`Unknown --output-format ${flags.outputFormat}. Use text, json or stream-json.`);
+    return 1;
+  }
+  if (flags.cwd && !fs.existsSync(flags.cwd)) {
+    fail(`--cwd ${flags.cwd} does not exist.`);
+    return 1;
+  }
 
   // Always on the newest version: install it and reopen before doing anything else.
   const relaunched = await autoUpdate({ argv, settings: loadSettings() }).catch(() => null);
   if (relaunched !== null) return relaunched;
 
   const [first, ...others] = rest;
-  const cmd = commands[first];
+  // Own properties only: `jaitus constructor` used to find Object.prototype.constructor.
+  let cmd = Object.prototype.hasOwnProperty.call(commands, first) ? commands[first] : null;
+  // A command word followed by more words than that command takes is a PROMPT that
+  // happens to start with it: `jaitus logout button is broken, fix it` signed this
+  // computer out, and `jaitus update the changelog` ran the updater.
+  const MAX_POSITIONAL = { login: 0, logout: 0, whoami: 0, usage: 0, models: 0, sessions: 0, doctor: 0, update: 0, banner: 0, version: 0, init: 0, completion: 1, help: 1 };
+  if (cmd && Object.prototype.hasOwnProperty.call(MAX_POSITIONAL, first)) {
+    const words = others.filter((a) => !a.startsWith('-'));
+    // `help <one word>` stays help (a typo gets "No such command"); `help me fix …` is a task.
+    if (words.length > MAX_POSITIONAL[first]) cmd = null;
+  }
 
   if (flags.help) {
     if (cmd) return commandHelp(first);
@@ -2520,8 +2972,8 @@ export default async function main(argv) {
     return 1;
   }
 
-  const piped = await readStdin();
   const prompt = rest.join(' ').trim();
+  const piped = await readStdin({ patient: Boolean(prompt) || flags.print });
 
   if (prompt) {
     const task = piped ? `${prompt}\n\n--- piped input ---\n${piped}` : prompt;