klyro 1.0.4 → 1.0.6

package/dist/tui/app.test.js

@@ -261,8 +261,13 @@ describe('App', () => {
         stdin.write('/c');
         await new Promise((r) => setTimeout(r, 30));
         const withSuggest = lastFrame() ?? '';
-        expect(withSuggest).toMatch(/\/clear/);
         expect(withSuggest).toMatch(/tab to complete/i);
+        // Prefix dominance: every suggestion for '/c' still starts with c.
+        const sugLines = withSuggest.split('\n').filter((l) => l.includes('/') && /clear|compact|cost|config|context|commands|copy|cancel/.test(l));
+        expect(sugLines.length).toBeGreaterThan(0);
+        // Unambiguous fuzzy prefix completes deterministically.
+        stdin.write('le');
+        await new Promise((r) => setTimeout(r, 30));
         stdin.write('\t');
         await new Promise((r) => setTimeout(r, 30));
         expect(lastFrame() ?? '').toContain('/clear ');
@@ -315,9 +320,15 @@ describe('App', () => {
         const kinds = onSlash.mock.calls.map((c) => c[0].kind);
         expect(kinds).toEqual(['cancel', 'quit']);
     });
-    it('running Esc with empty queue cancels streaming (design.md §18)', async () => {
+    it('running Esc×2 with empty queue cancels streaming (double-Esc convention)', async () => {
         const onSlash = vi.fn(async () => { });
-        const { stdin } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: onSlash, initialStatus: { status: 'running' } }));
+        const { stdin, lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: onSlash, initialStatus: { status: 'running' } }));
+        // First Esc only arms (hint shows, no cancel yet).
+        stdin.write('\x1b');
+        await new Promise((r) => setTimeout(r, 50));
+        expect(onSlash).not.toHaveBeenCalled();
+        await waitForMatch(lastFrame, /press esc again to cancel/);
+        // Second Esc within the window cancels.
         stdin.write('\x1b');
         await new Promise((r) => setTimeout(r, 50));
         expect(onSlash).toHaveBeenCalled();
@@ -519,6 +530,58 @@ describe('App', () => {
         expect(frame).not.toContain('{"path"');
         expect(frame).not.toContain('queued:');
     });
+    it('scrubs secret shapes at the render boundary (never paints raw)', async () => {
+        let hooks = null;
+        const { lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: false, onMounted: (h) => {
+                hooks = { append: h.append };
+            } }));
+        await new Promise((r) => setTimeout(r, 50));
+        hooks.append({ id: 'sec-1', kind: 'text', text: 'deploy with password=hunter2-hunter2', role: 'assistant' });
+        const frame = await waitForMatch(lastFrame, /REDACTED/);
+        expect(frame).not.toMatch(/hunter2-hunter2/);
+    });
+    it('vim counts, word motions, and dd edit the buffer', async () => {
+        let hooks = null;
+        const { stdin, lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: false, onMounted: (h) => {
+                hooks = { setVimMode: h.setVimMode };
+            } }));
+        await new Promise((r) => setTimeout(r, 50));
+        stdin.write('abcdef');
+        await waitForMatch(lastFrame, /abcdef/);
+        hooks.setVimMode('normal');
+        await waitForMatch(lastFrame, /--NORMAL--/);
+        // 0 then 3x deletes three chars → 'def'
+        stdin.write('0');
+        await new Promise((r) => setTimeout(r, 30));
+        stdin.write('3');
+        await new Promise((r) => setTimeout(r, 30));
+        stdin.write('x');
+        await waitForMatch(lastFrame, /def/);
+        expect(lastFrame() ?? '').not.toMatch(/abcdef/);
+        // dd clears the single-line buffer
+        stdin.write('d');
+        await new Promise((r) => setTimeout(r, 30));
+        stdin.write('d');
+        await waitForMatch(lastFrame, /Message Klyro/);
+    });
+    it('vim normal mode swallows typing, shows mode, i returns to insert', async () => {
+        let hooks = null;
+        const { stdin, lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: false, onMounted: (h) => {
+                hooks = { setVimMode: h.setVimMode };
+            } }));
+        await new Promise((r) => setTimeout(r, 50));
+        stdin.write('ok');
+        await waitForMatch(lastFrame, /ok/);
+        hooks.setVimMode('normal');
+        await waitForMatch(lastFrame, /--NORMAL--/);
+        stdin.write('zzz');
+        await new Promise((r) => setTimeout(r, 200));
+        expect(lastFrame() ?? '').not.toMatch(/zzz/);
+        stdin.write('i');
+        await waitForAbsent(lastFrame, /--NORMAL--/);
+        stdin.write('!');
+        await waitForMatch(lastFrame, /ok!/);
+    });
     it('aborted run leaves no thinking behind (only response may remain)', async () => {
         let hooks = null;
         const { lastFrame } = render(_jsx(App, { initialModel: "m", maxSteps: 10, cwd: "/test", onPrompt: async () => { }, onSlash: async () => { }, isFullscreen: true, initialStatus: { status: 'running' }, onMounted: (h) => {

package/dist/tui/approval.js

@@ -74,13 +74,65 @@ export function ApprovalModal({ bridge }) {
     }, [bridge]);
     const [explain, setExplain] = useState(false);
     const [full, setFull] = useState(false);
+    // Inline edit mode (`e`): buffer holds the JSON input being edited.
+    // Enter submits (re-validated + re-prompted by the runtime), Esc cancels
+    // back to the choice keys. Reset whenever a new prompt arrives.
+    const [editing, setEditing] = useState(null);
+    const [editError, setEditError] = useState(null);
+    useEffect(() => {
+        setEditing(null);
+        setEditError(null);
+    }, [pending]);
     useInput((inputStr, key) => {
         if (!pending)
             return;
+        if (editing !== null) {
+            if (key.return) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(editing);
+                }
+                catch (err) {
+                    setEditError(`invalid JSON: ${err instanceof Error ? err.message : String(err)}`);
+                    return;
+                }
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                    setEditError('edited input must be a JSON object');
+                    return;
+                }
+                bridge.resolve({ kind: 'edit', editedInput: parsed });
+                return;
+            }
+            if (key.escape) {
+                setEditing(null);
+                setEditError(null);
+                return;
+            }
+            if (key.backspace || key.delete) {
+                setEditing((v) => (v ?? '').slice(0, -1));
+                return;
+            }
+            if (!key.ctrl && !key.meta)
+                setEditing((v) => (v ?? '') + inputStr.replace(/\r/g, '\n'));
+            return;
+        }
         if (key.return) {
             bridge.resolve('deny');
             return;
         }
+        // `e` enters inline edit mode (real edit-and-retry); the stdin prompt
+        // keeps `e` as deny since it has no editor. Case-sensitive mapping for
+        // the rest lives in approvalChoiceForKey.
+        if (inputStr === 'e') {
+            try {
+                setEditing(JSON.stringify(pending.input ?? {}, null, 2));
+            }
+            catch {
+                setEditing('{}');
+            }
+            setEditError(null);
+            return;
+        }
         // Case-sensitive mapping lives in approvalChoiceForKey: 'A' persists,
         // 'a' is session-only (the old inline toLowerCase-first code collapsed
         // them, silently downgrading persistence).
@@ -107,5 +159,5 @@ export function ApprovalModal({ bridge }) {
         const clean = sanitizeForPrompt(s);
         return !full && clean.length > n ? clean.slice(0, n) + '…' : clean;
     };
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[f] full" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "double", borderColor: "yellow", paddingX: 1, marginY: 1, children: [_jsxs(Text, { color: "yellow", bold: true, children: ["\u26A0 approval needed \u2014 ", pending.toolName] }), _jsxs(Text, { color: "gray", children: ["  reason: \"", trunc(pending.reason), "\""] }), pending.summary ? _jsxs(Text, { children: ["  \"", trunc(pending.summary), "\""] }) : null, editing !== null ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { color: "yellow", bold: true, children: "  editing input JSON (Enter = submit, Esc = back):" }), _jsxs(Text, { wrap: "wrap", children: ["  ", (editing.length > 1500 ? editing.slice(0, 1500) + '…' : editing) + '▌'] }), editError ? _jsxs(Text, { color: "red", children: ["  ", editError] }) : null] })) : null, explain ? _jsxs(Text, { color: "cyan", children: ["  Explain: This tool will ", pending.toolName, " with the shown args. [y] once, [a] session, [A] always\u2192settings, [n] deny, [e] edit, [f] full text, [?] toggle help."] }) : null, _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: "green", children: "[y] once" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[a] session" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "green", children: "[A] always" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "red", children: "[n] deny" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "yellow", children: "[e] edit" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[f] full" }), _jsx(Text, { color: "gray", children: "  " }), _jsx(Text, { color: "cyan", children: "[?] explain" }), _jsx(Text, { color: "gray", children: "  (Enter = deny)" })] })] }));
 }

package/dist/tui/markdown.js

@@ -103,6 +103,14 @@ export function highlightCodeLine(line, lang) {
             }
         }
         if (STRING_DELIMS.includes(ch)) {
+            // Contraction guard: a single-quote mid-word (it's, don't, users')
+            // is prose punctuation, not a string delimiter — only open on `'`
+            // after start-of-line or a non-word char. Other delims open anywhere.
+            if (ch === "'" && i > 0 && /[A-Za-z0-9_)}\]]/.test(line[i - 1])) {
+                buf += ch;
+                i++;
+                continue;
+            }
             flush();
             inString = true;
             strDelim = ch;
@@ -115,6 +123,7 @@ export function highlightCodeLine(line, lang) {
             while (j < line.length && /[A-Za-z0-9_$]/.test(line[j]))
                 j++;
             const tok = line.slice(i, j);
+            flush(); // pending separators (spaces, punctuation) precede the token
             flushKw(tok);
             i = j;
             continue;

package/dist/tui/mouse.d.ts

@@ -34,6 +34,28 @@ export declare class MouseFilter {
 }
 export declare const MOUSE_ENABLE = "\u001B[?1000h\u001B[?1006h";
 export declare const MOUSE_DISABLE = "\u001B[?1000l\u001B[?1006l";
+export declare const PASTE_START = "\u001B[200~";
+export declare const PASTE_END = "\u001B[201~";
+export declare const PASTE_ENABLE = "\u001B[?2004h";
+export declare const PASTE_DISABLE = "\u001B[?2004l";
+/**
+ * Bracketed-paste splitter. Strips the `ESC[200~` / `ESC[201~` markers and
+ * delivers pasted content as one atomic string so the TUI can bulk-insert
+ * it (no per-char autocomplete/history side effects). Content split across
+ * stdin chunks is reassembled; an unterminated paste is held (up to 1 MiB,
+ * then force-flushed) so a partial escape never leaks into the input.
+ */
+export declare class PasteFilter {
+    private pending;
+    private inPaste;
+    private chunks;
+    private size;
+    push(chunk: Buffer): {
+        kept: Buffer;
+        pastes: string[];
+    };
+    reset(): void;
+}
 /**
  * stdin.read() wrapper implementing the tap (see repl.ts installMouseTap).
  * Ink 7 consumes stdin via paused-mode read() calls, so filtering happens
@@ -43,4 +65,7 @@ export declare const MOUSE_DISABLE = "\u001B[?1000l\u001B[?1006l";
  * mouse sequences are swallowed (wheels dispatched); everything else is
  * returned byte-identical in its original string/Buffer shape.
  */
-export declare function createReadWrapper(origRead: (size?: number) => unknown, filter: MouseFilter, onWheel: (delta: number) => void): (size?: number) => unknown;
+export declare function createReadWrapper(origRead: (size?: number) => unknown, filter: MouseFilter, onWheel: (delta: number) => void, opts?: {
+    onPaste?: (text: string) => void;
+    pasteFilter?: PasteFilter;
+}): (size?: number) => unknown;

package/dist/tui/mouse.js

@@ -92,6 +92,92 @@ export class MouseFilter {
 }
 export const MOUSE_ENABLE = '\x1b[?1000h\x1b[?1006h'; // button events + SGR coords
 export const MOUSE_DISABLE = '\x1b[?1000l\x1b[?1006l';
+export const PASTE_START = '\x1b[200~';
+export const PASTE_END = '\x1b[201~';
+export const PASTE_ENABLE = '\x1b[?2004h'; // bracketed paste: terminal wraps pastes
+export const PASTE_DISABLE = '\x1b[?2004l';
+const PASTE_START_BUF = Buffer.from(PASTE_START, 'latin1');
+const PASTE_END_BUF = Buffer.from(PASTE_END, 'latin1');
+const MAX_PASTE_BYTES = 1024 * 1024;
+/**
+ * Bracketed-paste splitter. Strips the `ESC[200~` / `ESC[201~` markers and
+ * delivers pasted content as one atomic string so the TUI can bulk-insert
+ * it (no per-char autocomplete/history side effects). Content split across
+ * stdin chunks is reassembled; an unterminated paste is held (up to 1 MiB,
+ * then force-flushed) so a partial escape never leaks into the input.
+ */
+export class PasteFilter {
+    pending = Buffer.alloc(0);
+    inPaste = false;
+    chunks = [];
+    size = 0;
+    push(chunk) {
+        const data = Buffer.concat([this.pending, chunk]);
+        this.pending = Buffer.alloc(0);
+        const kept = [];
+        const pastes = [];
+        let pos = 0;
+        const tailPartial = (from) => {
+            // Length of the trailing run that could be a split marker prefix.
+            const tail = data.subarray(from);
+            for (let len = Math.min(tail.length, 5); len >= 1; len--) {
+                const piece = tail.subarray(tail.length - len);
+                if (PASTE_START_BUF.subarray(0, len).equals(piece) || PASTE_END_BUF.subarray(0, len).equals(piece))
+                    return len;
+            }
+            return 0;
+        };
+        while (pos < data.length) {
+            if (!this.inPaste) {
+                const idx = data.indexOf(PASTE_START_BUF, pos);
+                if (idx === -1) {
+                    const hold = tailPartial(pos);
+                    kept.push(data.subarray(pos, hold > 0 ? data.length - hold : data.length));
+                    if (hold > 0)
+                        this.pending = data.subarray(data.length - hold);
+                    break;
+                }
+                kept.push(data.subarray(pos, idx));
+                pos = idx + PASTE_START_BUF.length;
+                this.inPaste = true;
+                this.chunks = [];
+                this.size = 0;
+                continue;
+            }
+            const idx = data.indexOf(PASTE_END_BUF, pos);
+            if (idx === -1) {
+                const hold = tailPartial(pos);
+                const end = hold > 0 ? data.length - hold : data.length;
+                if (end > pos) {
+                    this.chunks.push(data.subarray(pos, end));
+                    this.size += end - pos;
+                }
+                if (hold > 0)
+                    this.pending = data.subarray(data.length - hold);
+                if (this.size >= MAX_PASTE_BYTES) {
+                    pastes.push(Buffer.concat(this.chunks).toString('utf8'));
+                    this.chunks = [];
+                    this.size = 0;
+                    this.inPaste = false; // force-flush: don't hold unbounded input
+                }
+                break;
+            }
+            this.chunks.push(data.subarray(pos, idx));
+            pastes.push(Buffer.concat(this.chunks).toString('utf8'));
+            this.chunks = [];
+            this.size = 0;
+            this.inPaste = false;
+            pos = idx + PASTE_END_BUF.length;
+        }
+        return { kept: Buffer.concat(kept), pastes };
+    }
+    reset() {
+        this.pending = Buffer.alloc(0);
+        this.inPaste = false;
+        this.chunks = [];
+        this.size = 0;
+    }
+}
 /**
  * stdin.read() wrapper implementing the tap (see repl.ts installMouseTap).
  * Ink 7 consumes stdin via paused-mode read() calls, so filtering happens
@@ -101,23 +187,35 @@ export const MOUSE_DISABLE = '\x1b[?1000l\x1b[?1006l';
  * mouse sequences are swallowed (wheels dispatched); everything else is
  * returned byte-identical in its original string/Buffer shape.
  */
-export function createReadWrapper(origRead, filter, onWheel) {
+export function createReadWrapper(origRead, filter, onWheel, opts) {
     return (size) => {
         if (size !== undefined)
             return origRead(size);
         const chunk = origRead();
         if (chunk == null)
             return chunk;
-        const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        const split = filter.push(buf);
-        for (const w of split.wheels) {
+        let buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        if (opts?.pasteFilter) {
+            const split = opts.pasteFilter.push(buf);
+            for (const p of split.pastes) {
+                try {
+                    opts.onPaste?.(p);
+                }
+                catch { /* ignore */ }
+            }
+            buf = split.kept;
+            if (buf.length === 0 && split.pastes.length > 0)
+                return null;
+        }
+        const msplit = filter.push(buf);
+        for (const w of msplit.wheels) {
             try {
                 onWheel(w);
             }
             catch { /* ignore */ }
         }
-        if (split.kept.length === 0)
+        if (msplit.kept.length === 0)
             return null;
-        return typeof chunk === 'string' ? split.kept.toString('utf8') : split.kept;
+        return typeof chunk === 'string' ? msplit.kept.toString('utf8') : msplit.kept;
     };
 }

package/dist/tui/scroll-flow.test.js

@@ -45,7 +45,9 @@ describe('scroll flow diagnostics', () => {
         const chunk = 'STREAMCHUNK lorem ipsum dolor sit amet. ';
         for (let i = 0; i < 12; i++) {
             g.__klyroAppendDelta(`${chunk}#${i} `);
-            await tick(40);
+            // Tick longer than the 64ms streaming render throttle so the flush
+            // has landed before asserting visibility (follow-tail, not latency).
+            await tick(90);
             const frame = lastFrame() ?? '';
             expect(rowsOf(frame)).toBeLessThanOrEqual(32);
             // latest streamed chunk must be visible (follow-tail)

package/dist/tui/tokens.d.ts

@@ -12,9 +12,9 @@ export declare const tokens: {
         readonly guide: "#3A3A3A";
         readonly accent: "#FF6B1A";
         readonly accentSoft: "#FFF1E6";
-        readonly ok: "#FF6B1A";
+        readonly ok: "#2FA36B";
         readonly err: "#E06C6C";
-        readonly warn: "#FF6B1A";
+        readonly warn: "#D9A021";
         readonly info: "#6FA8DC";
         readonly diffAddBg: "#12250F";
         readonly diffDelBg: "#2A1212";
@@ -26,15 +26,15 @@ export declare const tokens: {
         readonly soft: "whiteBright";
         readonly dim: "gray";
         readonly guide: "gray";
-        readonly ok: "yellowBright";
+        readonly ok: "green";
         readonly err: "red";
-        readonly warn: "yellowBright";
+        readonly warn: "yellow";
         readonly info: "blue";
         readonly border: "gray";
         readonly muted: "gray";
-        readonly success: "yellowBright";
+        readonly success: "green";
         readonly error: "red";
-        readonly warning: "yellowBright";
+        readonly warning: "yellow";
     };
 };
 export declare const glyphs: {

package/dist/tui/tokens.js

@@ -12,9 +12,12 @@ export const tokens = {
         guide: '#3A3A3A',
         accent: '#FF6B1A',
         accentSoft: '#FFF1E6',
-        ok: '#FF6B1A',
+        // Status hues are deliberately distinct from the orange brand: ok reads
+        // green, warn reads amber, err reads red. (Previously ok/warn reused the
+        // accent hex and were indistinguishable in the transcript.)
+        ok: '#2FA36B',
         err: '#E06C6C',
-        warn: '#FF6B1A',
+        warn: '#D9A021',
         info: '#6FA8DC',
         diffAddBg: '#12250F',
         diffDelBg: '#2A1212',
@@ -26,15 +29,15 @@ export const tokens = {
         soft: 'whiteBright',
         dim: 'gray',
         guide: 'gray',
-        ok: 'yellowBright',
+        ok: 'green',
         err: 'red',
-        warn: 'yellowBright',
+        warn: 'yellow',
         info: 'blue',
         border: 'gray',
         muted: 'gray',
-        success: 'yellowBright',
+        success: 'green',
         error: 'red',
-        warning: 'yellowBright',
+        warning: 'yellow',
     },
 };
 export const glyphs = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "klyro",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Klyro — autonomous coding harness CLI that streams from any OpenAI-compatible or Anthropic LLM endpoint.",
   "type": "module",
   "main": "dist/index.js",