kritya 0.8.42-beta → 0.8.44-beta

package/dist/commands/doctor.js

@@ -10,7 +10,7 @@ import { isGitRepo } from "../agent/worktree.js";
 import { loadHooks } from "../hooks/hooks.js";
 import { loadProjectMcpServers, missingVars } from "../mcp/servers.js";
 import { scanSkillsDetailed, skillsDir, userSkillsDir } from "../agent/skills.js";
-import { defaultSandboxMode, sandboxAvailable, sandboxUnavailableReason, } from "../shell/sandbox.js";
+import { defaultSandboxMode, runSandboxCanary, sandboxAvailable, sandboxUnavailableReason, } from "../shell/sandbox.js";
 import { SWITCHYARD_ROUTE_ID, resolveEffectiveModel } from "../provider/switchyardSidecar.js";
 import { gatedContentHash, isTrusted } from "../trust/trust.js";
 import { checkForUpdate, updateCheckDisabled } from "../update/check.js";
@@ -30,8 +30,10 @@ untrusted workspace).
 
 Checks: Node version against the package's engines, config file validity, the
 active provider and whether its key resolves and the endpoint answers, workspace
-trust and git state, MCP servers, sandbox availability, persistence/privacy
-settings, discovered skills and hooks, and whether a newer release exists.`;
+trust and git state, MCP servers, sandbox availability and a live containment
+canary (it tries to write outside the workspace and reports whether that was
+blocked), persistence/privacy settings, discovered skills and hooks, and whether
+a newer release exists.`;
 const MARKS = { ok: "✓", warn: "!", fail: "✗" };
 function ok(label) {
     return { level: "ok", label };
@@ -241,7 +243,7 @@ function workspaceSection(workspace, config) {
     }
     return { title: "Workspace", checks };
 }
-function safetySection(config) {
+function safetySection(config, workspace) {
     const checks = [];
     const mode = config.sandboxExec ?? defaultSandboxMode();
     const available = sandboxAvailable();
@@ -261,6 +263,27 @@ function safetySection(config) {
         checks.push(warn(`sandboxExec is "${mode}" but ${sandboxUnavailableReason()} — sandboxed commands ` +
             `fall back to unsandboxed execution with a warning`));
     }
+    // A live self-test, not a policy inspection: availability says the wrapper
+    // can be *built*, but only running a canary proves this machine actually
+    // contains it. Skipped (never failed) when there is no backend — that case
+    // is already reported by the check above.
+    if (available && mode !== "off") {
+        const canary = runSandboxCanary(workspace);
+        for (const probe of canary.probes) {
+            if (probe.informational) {
+                checks.push(ok(probe.what));
+            }
+            else {
+                checks.push(probe.held ? ok(`sandbox canary: ${probe.what}`) : fail(`sandbox canary: ${probe.what}`));
+            }
+        }
+    }
+    else if (available) {
+        checks.push(ok("sandbox canary: skipped (sandboxExec is off)"));
+    }
+    else {
+        checks.push(ok("sandbox canary: skipped (no sandbox backend available)"));
+    }
     const privacy = privacyModeFor(config);
     checks.push(privacy
         ? warn("privacy mode is ON — transcripts, audit logs and telemetry are not written")
@@ -320,7 +343,7 @@ export async function collectDiagnostics(options = {}) {
     }
     sections.push(provider);
     sections.push(workspaceSection(workspace, config));
-    sections.push(safetySection(config));
+    sections.push(safetySection(config, workspace));
     sections.push(extensionsSection(workspace, config));
     return sections;
 }

package/dist/commands/registry.js

@@ -9,6 +9,7 @@ import { pluginsDir, pluginSkillsRoots, scanPlugins, scanPluginsDetailed, userPl
 import { scanPluginMcpServers } from "../plugins/mcp.js";
 import { listProviders } from "../config/config.js";
 import { expandCommand } from "./custom.js";
+import { recordCommandUse } from "../ui/recentCommands.js";
 import { artifactPath, clearProjectState, loadProjectState, parseIdea, parsePhase, phaseBlocker, phasePrompt, renameProject, staleArtifacts, PHASE_COMMAND, PHASE_ORDER, PHASE_SUMMARY, saveProjectState, slugify, } from "../agent/workflow.js";
 const WORKFLOW = "Workflow";
 const SESSION = "Session";
@@ -162,8 +163,9 @@ Also: @path/to/file attaches a file to your message (with autocomplete).
 MCP servers can also contribute their own /server-prompt commands.
 Project memory: put standing instructions in KRITYA.md at your workspace root.
 Keys: Esc cancels · Tab completes · Shift+Tab cycles normal/accept-edits/dry-run
-mode · ↑/↓ recalls history · Ctrl+O toggles full tool output · Ctrl+K is the
-kill switch (stops everything until /kill off) · Ctrl+C exits`;
+mode · ↑/↓ recalls history · Ctrl+R searches history · Ctrl+P opens the command
+palette · Ctrl+B copies the last code block · Ctrl+O toggles full tool output ·
+Ctrl+K is the kill switch (stops everything until /kill off) · Ctrl+C exits`;
 /**
  * A phase boundary is the one place compaction is unambiguously safe: the
  * phase that just ended wrote its conclusions to a durable artifact on disk,
@@ -833,6 +835,16 @@ export async function runCommand(cmd, ctx) {
         });
         return;
     }
+    // Rank the palette by what a user actually runs. Recorded here rather than
+    // when the palette inserts the command: insertion only fills the input line
+    // (the user may edit or abandon it), so that signal would rank
+    // typed-and-abandoned commands above the ones really used. An unknown command
+    // is not recorded — it never ran. See ui/recentCommands.ts.
+    const known = handlers[cmd] !== undefined ||
+        ctx.customCommands.some((c) => c.name === cmd) ||
+        mcpPrompts().some((p) => p.command === cmd);
+    if (known)
+        recordCommandUse(cmd);
     const handler = handlers[cmd];
     if (handler)
         return handler(ctx);

package/dist/shell/sandbox.js

@@ -3,9 +3,29 @@ import fs from "node:fs";
 import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
+import { CONFIG_DIR, loadDotEnv } from "../config/config.js";
 import { classifyDanger } from "../permissions/danger.js";
 let cachedTool;
 let cachedMxcExec;
+let dotEnvLoaded = false;
+/**
+ * Load `~/.kritya/.env` before the backend is resolved, once per process.
+ *
+ * `locateMxcExecutable` reads `KRITYA_MXC_EXEC` and `MXC_BIN_DIR` from the
+ * environment, but the sandbox module is callable from frontends that never
+ * load the global `.env` themselves (the tool executor reaches
+ * `sandboxAvailable()` directly). Without this, a user who configured the MXC
+ * path in `.env` would have it honoured only when some *other* entry point
+ * happened to load the file first — and because `sandboxTool()` memoizes its
+ * answer, a miss could not self-correct later in the session. Loading here
+ * makes discovery independent of who calls it first.
+ */
+function loadSandboxEnv() {
+    if (dotEnvLoaded)
+        return;
+    dotEnvLoaded = true;
+    loadDotEnv([path.join(CONFIG_DIR, ".env")]);
+}
 function commandExists(bin) {
     const finder = os.platform() === "win32" ? "where" : "which";
     try {
@@ -73,11 +93,13 @@ function mxcExecutable() {
 export function resetSandboxToolCache() {
     cachedTool = undefined;
     cachedMxcExec = undefined;
+    dotEnvLoaded = false;
 }
 /** Which sandbox backend (if any) is usable on this platform, cached after the first check. */
 function sandboxTool() {
     if (cachedTool !== undefined)
         return cachedTool;
+    loadSandboxEnv();
     const platform = os.platform();
     if (platform === "linux") {
         cachedTool = commandExists("bwrap") ? "bwrap" : null;
@@ -111,6 +133,117 @@ export function sandboxAvailable() {
 export function defaultSandboxMode() {
     return os.platform() === "win32" ? "strict" : "auto";
 }
+/** Quoted for `cmd.exe` (Windows), where the canary command runs. */
+function windowsQuote(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+/**
+ * Turns the observed state of the canary's two marker files into probes.
+ *
+ * Split out from `runSandboxCanary` so the decision — the part that can be
+ * wrong — is testable without a backend to spawn. `escaped` is "the file
+ * outside the workspace exists", `wroteInside` is "the file inside does".
+ *
+ * The three-way logic matters: `escaped && wroteInside` is a breached sandbox;
+ * `!escaped && wroteInside` is a healthy one; and `!escaped && !wroteInside`
+ * means the command never reached the shell at all, which must NOT be read as
+ * containment — that is why the inside write is a probe rather than a
+ * throwaway control.
+ */
+export function canaryProbes(escaped, wroteInside) {
+    return [
+        {
+            what: "a write outside the workspace (system temp dir) was blocked",
+            held: !escaped,
+        },
+        {
+            what: "a write inside the workspace succeeded (the sandbox is not simply refusing everything)",
+            held: wroteInside,
+        },
+        {
+            what: "reads outside the workspace (incl. ~/.kritya/.env) are open by design",
+            held: false,
+            informational: true,
+        },
+    ];
+}
+/**
+ * A live containment check: run a canary *inside* the sandbox that tries to
+ * write outside the workspace, then report whether the write was actually
+ * blocked.
+ *
+ * CI can only test the policy this module *builds*; it cannot prove the
+ * backend on the user's machine enforces it (an MXC too old for
+ * `processcontainer`, a stale `wxc-exec.exe`, or a host missing the one-time
+ * privilege prep all change the answer without changing a line of code here).
+ * This closes that gap the only honest way — by trying to escape and looking
+ * at the result. It writes at most one marker file, in the system temp dir,
+ * and removes it either way.
+ *
+ * Only the *write* probe is a containment claim: reads outside the workspace
+ * are open by design (see `buildSandboxedCommand`), so the read probe is
+ * reported but never counted as a failure.
+ */
+export function runSandboxCanary(workspace) {
+    const reason = sandboxUnavailableReason();
+    if (!sandboxAvailable()) {
+        return { ran: false, reason, probes: [] };
+    }
+    // The escape target: outside the workspace, guaranteed writable by the real
+    // user, so "the file is not there afterwards" can only mean the sandbox
+    // blocked it. A path *inside* the workspace would prove nothing.
+    const escapeTarget = path.join(os.tmpdir(), `kritya-canary-escape-${process.pid}.txt`);
+    const insideTarget = path.join(workspace, `.kritya-canary-inside-${process.pid}.txt`);
+    const cleanup = () => {
+        for (const f of [escapeTarget, insideTarget]) {
+            try {
+                fs.rmSync(f, { force: true });
+            }
+            catch {
+                /* best effort — a file that is not there is the expected case */
+            }
+        }
+    };
+    cleanup(); // in case a previous run left a marker behind
+    const isWindows = os.platform() === "win32";
+    const writeOutside = isWindows
+        ? `echo canary> ${windowsQuote(escapeTarget)}`
+        : `printf canary > ${JSON.stringify(escapeTarget)}`;
+    const writeInside = isWindows
+        ? `echo canary> ${windowsQuote(insideTarget)}`
+        : `printf canary > ${JSON.stringify(insideTarget)}`;
+    // The canary exits 0 regardless: reaching the shell at all is the point, and
+    // a nonzero exit from a *blocked* write is not something the caller needs.
+    const script = isWindows
+        ? `${writeOutside} & ${writeInside} & exit /b 0`
+        : `${writeOutside}; ${writeInside}; true`;
+    const wrapped = buildSandboxedCommand(script, workspace);
+    if (!wrapped) {
+        return { ran: false, reason, probes: [] };
+    }
+    const opts = wrapped.env && process.env ? { ...process.env, ...wrapped.env } : process.env;
+    try {
+        spawnSync(wrapped.cmd, wrapped.args, {
+            cwd: workspace,
+            env: opts,
+            timeout: 30_000,
+            windowsHide: true,
+            stdio: "ignore",
+        });
+    }
+    catch {
+        // A backend that cannot even start the container means containment is not
+        // in force — report the escape as *not* held rather than crashing doctor.
+        cleanup();
+        wrapped.cleanup?.();
+        return { ran: true, probes: canaryProbes(true, false) };
+    }
+    wrapped.cleanup?.();
+    const escaped = fs.existsSync(escapeTarget);
+    const wroteInside = fs.existsSync(insideTarget);
+    cleanup();
+    return { ran: true, probes: canaryProbes(escaped, wroteInside) };
+}
 /** One-line reason sandboxing can't run here, for a fallback warning. */
 export function sandboxUnavailableReason() {
     const platform = os.platform();

package/dist/ui/App.js

@@ -18,6 +18,10 @@ import { ElicitationPrompt } from "./ElicitationPrompt.js";
 import { PermissionPrompt } from "./PermissionPrompt.js";
 import { SelectList } from "./SelectList.js";
 import { buildPaletteItems } from "./palette.js";
+import { searchHistory } from "./historySearch.js";
+import { extractLastCodeBlock } from "./codeBlock.js";
+import { copyToClipboard } from "./clipboard.js";
+import { loadCommandRecency } from "./recentCommands.js";
 import { Spinner } from "./Spinner.js";
 import { StatusLine } from "./StatusLine.js";
 import { StreamViewport } from "./StreamViewport.js";
@@ -31,6 +35,26 @@ const MENTION_RE = /(^|\s)@([^\s@]*)$/;
 const MENTION_ALL_RE = /(?:^|\s)@([^\s@]+)/g;
 const MAX_MENTION_CHARS = 8000;
 const IMAGE_RE = /\.(png|jpe?g|gif|webp|bmp)$/i;
+/**
+ * The most recent complete code block the *agent* wrote, newest first.
+ *
+ * Walks the transcript backwards so the newest block wins — the user asking
+ * "copy that" almost always means the one just shown — and reads only
+ * `assistant` items, because a block the user pasted is not the agent's.
+ * `extractLastCodeBlock` returns null for a still-open fence, so a block that
+ * is mid-stream is skipped rather than copied half-written.
+ */
+function findLastAssistantCodeBlock(items) {
+    for (let i = items.length - 1; i >= 0; i--) {
+        const item = items[i];
+        if (item.kind !== "assistant")
+            continue;
+        const block = extractLastCodeBlock(item.text);
+        if (block)
+            return block;
+    }
+    return null;
+}
 export function App({ agent, workspace, modelRef, providerRef, config, resumedCount, resumedName, initialTasks, undoStack, uiBridge, resumeSessions, customCommands = [], mcpToolCount = 0, onSwitchClient, onRequestPermissionReady, onRequestElicitationReady, privacyMode, firstLaunch, }) {
     const { exit, suspendTerminal, waitUntilRenderFlush } = useApp();
     /**
@@ -88,6 +112,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
     const [steerInput, setSteerInput] = useState("");
     const [resumeFilter, setResumeFilter] = useState("");
     const [paletteFilter, setPaletteFilter] = useState("");
+    const [historyFilter, setHistoryFilter] = useState("");
     const [cmdIndex, setCmdIndex] = useState(0);
     const [fileIndex, setFileIndex] = useState(0);
     const [fileList, setFileList] = useState([]);
@@ -95,6 +120,15 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
     const [elapsed, setElapsed] = useState(0);
     const inputHistory = useRef([]);
     const histIndex = useRef(-1); // -1 means "current, not browsing history"
+    // The Ctrl+R cursor: an index into the *filtered* history list (0 = newest
+    // match). A ref, not `cmdIndex`, so the palette's suggestion cursor and the
+    // history cursor can never clobber each other.
+    const historyCursor = useRef(0);
+    // Command recency for the palette's ordering. Read lazily when the palette
+    // opens rather than at mount: /doctor and a long session both run commands,
+    // and the file on disk is the source of truth. A ref (not state) because it
+    // only feeds the palette's sort — nothing else re-renders on it.
+    const commandRecency = useRef({});
     // Ctrl-chord bookkeeping used to live here: Ink delivers a keypress to every
     // `useInput` hook, and ink-text-input swallowed only Ctrl+C, so Ctrl+K and
     // Ctrl+O ran their shortcut *and* typed a bare "k"/"o" into the prompt — which
@@ -234,6 +268,33 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             editorBusy.current = false;
         }
     }, [suspendTerminal, undoStack, addItem]);
+    // Ctrl+B: copy the agent's most recent complete code block. Scans the
+    // transcript backwards so the newest block wins, and only assistant text is
+    // considered — a user's own pasted block is not "the agent's most recent".
+    const copyLastCodeBlock = useCallback(async () => {
+        const block = findLastAssistantCodeBlock(items);
+        if (!block) {
+            addItem({
+                kind: "info",
+                text: "Ctrl+B: no code block in this transcript yet.",
+            });
+            return;
+        }
+        const ok = await copyToClipboard(block.code);
+        const lines = block.code.split("\n").length;
+        if (ok) {
+            addItem({
+                kind: "info",
+                text: `Copied the last code block (${lines} line${lines === 1 ? "" : "s"}${block.lang ? `, ${block.lang}` : ""}) to the clipboard.`,
+            });
+        }
+        else {
+            addItem({
+                kind: "info",
+                text: "Ctrl+B: no clipboard tool found (Linux needs wl-copy, xclip or xsel).",
+            });
+        }
+    }, [items, addItem]);
     useInput((_input, key) => {
         // Ctrl+K is the kill switch, and it comes before every other binding and
         // phase check on purpose: a panic button that only works from the idle
@@ -251,6 +312,9 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
         if (key.ctrl && _input === "p") {
             if (phase === "input") {
                 setPaletteFilter("");
+                // Re-read on each open so a command run earlier in this session is
+                // reflected; a failed read degrades to the previous map, never throws.
+                commandRecency.current = loadCommandRecency();
                 setPhase("palette");
             }
             else if (phase === "palette") {
@@ -258,6 +322,22 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             }
             return;
         }
+        // Ctrl+R opens reverse history search — the whole in-memory history,
+        // filtered by fragment. ↑/↓ already walks history one entry at a time,
+        // which is no help for an entry forty back. Toggles closed like Ctrl+P.
+        // Idle prompt only, so it can't race a running turn.
+        if (key.ctrl && _input === "r") {
+            if (phase === "input") {
+                setHistoryFilter("");
+                histIndex.current = -1;
+                historyCursor.current = 0;
+                setPhase("history");
+            }
+            else if (phase === "history") {
+                setPhase("input");
+            }
+            return;
+        }
         if (key.escape && phase === "working") {
             setActivity("cancelling…");
             abortRef.current?.abort();
@@ -278,6 +358,14 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             void openInEditorFlow();
             return;
         }
+        // Ctrl+B copies the agent's most recent code block to the clipboard. Works
+        // from any phase: it reads the transcript, not the input line, so it is
+        // safe mid-turn (and useful exactly then — the block just appeared) and
+        // unlike Ctrl+E it cannot race the agent over a shared resource.
+        if (key.ctrl && _input === "b") {
+            void copyLastCodeBlock();
+            return;
+        }
         // Shift+Tab cycles normal → accept-edits → plan → normal. Only from the
         // plain input state — not mid-permission-prompt, mid-resume-picker, etc.
         if (key.tab && key.shift && phase === "input") {
@@ -337,6 +425,37 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                 setPaletteFilter((f) => f + _input);
             }
         }
+        if (phase === "history") {
+            // Newest-first, so index 0 is the most recent match.
+            const matches = searchHistory([...inputHistory.current].reverse(), historyFilter);
+            if (key.backspace || key.delete) {
+                setHistoryFilter((f) => f.slice(0, -1));
+                historyCursor.current = 0; // a changed query invalidates the old selection
+            }
+            else if (key.upArrow) {
+                historyCursor.current = Math.max(historyCursor.current - 1, 0);
+            }
+            else if (key.downArrow) {
+                historyCursor.current = Math.min(historyCursor.current + 1, Math.max(matches.length - 1, 0));
+            }
+            else if (key.return) {
+                const picked = matches[Math.min(historyCursor.current, matches.length - 1)];
+                if (picked) {
+                    setInput(picked.text);
+                    setInputKey((k) => k + 1);
+                }
+                histIndex.current = -1; // the ↑/↓ browser starts fresh from the input
+                setPhase("input");
+            }
+            else if (key.escape) {
+                setPhase("input");
+            }
+            else if (_input && !key.tab) {
+                setHistoryFilter((f) => f + _input);
+                historyCursor.current = 0;
+            }
+            return;
+        }
         if (suggestions.length) {
             if (key.upArrow)
                 setCmdIndex((i) => (i - 1 + suggestions.length) % suggestions.length);
@@ -424,7 +543,12 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
             setPhase("input");
         }
     };
-    const paletteItems = buildPaletteItems(allCommands, agent.listCheckpoints(), paletteFilter);
+    const paletteItems = buildPaletteItems(allCommands, agent.listCheckpoints(), paletteFilter, commandRecency.current);
+    // Reverse history search rows. Built from the in-memory history (there is no
+    // disk history), newest first, which is why the list is reversed: the entry
+    // just typed is the one Ctrl+R should offer first.
+    const historyMatches = searchHistory([...inputHistory.current].reverse(), historyFilter);
+    const historySelected = Math.min(historyCursor.current, Math.max(historyMatches.length - 1, 0));
     const expandMentions = async (text) => {
         const mentions = [...new Set([...text.matchAll(MENTION_ALL_RE)].map((m) => m[1]))];
         let extra = "";
@@ -557,7 +681,7 @@ export function App({ agent, workspace, modelRef, providerRef, config, resumedCo
                             label: s.name || s.title,
                             value: s.file,
                             hint: `${s.shortId} · ${s.date} · ${s.count} msgs`,
-                        })), onSelect: onResumeSelect, onCancel: () => onResumeSelect("") })] })), phase === "palette" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "cyan", children: ["Command palette", " ", _jsx(Text, { dimColor: true, children: "(type to filter \u00B7 \u2191\u2193 navigate \u00B7 Enter selects \u00B7 Esc closes \u00B7 Ctrl+P toggles)" })] }), paletteFilter ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "filter: " }), paletteFilter] })) : null, _jsx(SelectList, { items: paletteItems, onSelect: onPaletteSelect, onCancel: () => setPhase("input") })] })), phase === "input" && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "round", borderColor: "gray", paddingX: 1, children: [_jsx(Text, { color: "green", children: "\u276F " }), _jsx(TextInput, { value: input, onChange: (v) => {
+                        })), onSelect: onResumeSelect, onCancel: () => onResumeSelect("") })] })), phase === "palette" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "cyan", children: ["Command palette", " ", _jsx(Text, { dimColor: true, children: "(type to filter \u00B7 \u2191\u2193 navigate \u00B7 Enter selects \u00B7 Esc closes \u00B7 Ctrl+P toggles)" })] }), paletteFilter ? (_jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "filter: " }), paletteFilter] })) : null, _jsx(SelectList, { items: paletteItems, onSelect: onPaletteSelect, onCancel: () => setPhase("input") })] })), phase === "history" && (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "yellow", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "yellow", children: ["History", " ", _jsx(Text, { dimColor: true, children: "(type to search \u00B7 \u2191\u2193 navigate \u00B7 Enter selects \u00B7 Esc closes \u00B7 Ctrl+R toggles)" })] }), _jsxs(Text, { children: [_jsx(Text, { dimColor: true, children: "query: " }), historyFilter || _jsx(Text, { dimColor: true, children: "(all recent prompts)" })] }), historyMatches.length === 0 ? (_jsx(Text, { dimColor: true, children: " no matches" })) : (historyMatches.slice(0, 10).map((m, i) => (_jsxs(Text, { color: i === historySelected ? "green" : undefined, children: [i === historySelected ? "❯ " : "  ", m.text] }, `${m.index}:${m.text}`))))] })), phase === "input" && (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "round", borderColor: "gray", paddingX: 1, children: [_jsx(Text, { color: "green", children: "\u276F " }), _jsx(TextInput, { value: input, onChange: (v) => {
                                     setInput(v.replace(/\t/g, ""));
                                     setCmdIndex(0);
                                     setFileIndex(0);

package/dist/ui/clipboard.js

@@ -0,0 +1,83 @@
+import { spawn } from "node:child_process";
+import os from "node:os";
+/**
+ * Copies text to the system clipboard.
+ *
+ * Deliberately shelling out rather than taking a dependency: every OS already
+ * ships a clipboard command, and the alternatives (a native module, an OSC 52
+ * escape) either add a build step or only work in terminals that opt in. OSC 52
+ * was tempting — it needs no subprocess and works over SSH — but it silently
+ * does nothing in terminals that refuse it, and this feature is only useful if
+ * the paste actually lands.
+ *
+ * Returns true only when the write completed cleanly, so the caller can say
+ * "copied" or "couldn't copy" honestly rather than claiming success blindly.
+ */
+/** The clipboard command for this platform, or null where there is none. */
+function clipboardCommand() {
+    switch (os.platform()) {
+        case "darwin":
+            return { cmd: "pbcopy", args: [] };
+        case "win32":
+            // `clip` is present on every Windows install; `clip.exe` is what
+            // Git Bash and WSL resolve it to, and CreateProcess finds either.
+            return { cmd: "clip", args: [] };
+        default:
+            // Linux/BSD: Wayland first (wl-copy), then X11 (xclip, then xsel).
+            // There is no "just use the right one" — which is available depends on
+            // the session — so the caller gets null and reports it as unavailable
+            // rather than picking a tool that will exit with ENOENT.
+            return null;
+    }
+}
+/**
+ * Linux has no single guaranteed clipboard tool, so probe the two common ones.
+ * Kept separate from the platform switch so the probe is a plain lookup the
+ * tests can reason about.
+ */
+export function linuxClipboardCandidates() {
+    return [
+        { cmd: "wl-copy", args: [] },
+        { cmd: "xclip", args: ["-selection", "clipboard"] },
+        { cmd: "xsel", args: ["--clipboard", "--input"] },
+    ];
+}
+function writeTo(cmd, args, text) {
+    return new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
+        }
+        catch {
+            resolve(false);
+            return;
+        }
+        // A tool that is not installed fails here; a missing binary is not an
+        // error worth surfacing, just "this method didn't work".
+        child.on("error", () => resolve(false));
+        child.on("close", (code) => resolve(code === 0));
+        try {
+            child.stdin.end(text);
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+/**
+ * Copy `text` to the clipboard. Resolves false (never rejects) when no
+ * clipboard method is available, so a keybinding can report the failure in the
+ * transcript instead of crashing the session.
+ */
+export async function copyToClipboard(text) {
+    const direct = clipboardCommand();
+    if (direct)
+        return writeTo(direct.cmd, direct.args, text);
+    if (os.platform() === "linux") {
+        for (const candidate of linuxClipboardCandidates()) {
+            if (await writeTo(candidate.cmd, candidate.args, text))
+                return true;
+        }
+    }
+    return false;
+}

package/dist/ui/codeBlock.js

@@ -0,0 +1,49 @@
+/**
+ * Pulls the last fenced code block out of agent output, so one keystroke can
+ * copy it to the clipboard.
+ *
+ * The agent writes fenced blocks (` ```ts … ``` `) constantly and copying one
+ * by hand means selecting across a wrapped, scrollable transcript — fiddly at
+ * best and wrong at worst. This finds the last complete block and returns just
+ * its body, with the language tag kept separately for the caller's message.
+ *
+ * Only *complete* blocks count: an unterminated fence (output still streaming)
+ * would otherwise hand back a half-written snippet. The fence parsing mirrors
+ * Markdown.tsx (`line.trimStart().startsWith("```")`), including the rule that
+ * the info string is whatever follows the three backticks.
+ */
+/**
+ * The last complete fenced block in `text`, or null when there is none.
+ *
+ * A block with no closing fence is ignored, not returned partially — that is
+ * what makes this safe to call while output is still arriving.
+ */
+export function extractLastCodeBlock(text) {
+    const lines = text.split("\n");
+    let inCode = false;
+    let lang = "";
+    let current = [];
+    let last = null;
+    for (const line of lines) {
+        if (line.trimStart().startsWith("```")) {
+            if (inCode) {
+                // Closing fence: the block is complete, so it becomes the latest
+                // candidate. A later block simply overwrites it.
+                last = { code: current.join("\n"), lang };
+                current = [];
+                lang = "";
+                inCode = false;
+            }
+            else {
+                lang = line.trim().slice(3).trim().toLowerCase();
+                inCode = true;
+            }
+            continue;
+        }
+        if (inCode)
+            current.push(line);
+    }
+    // A trailing opener that never closed leaves `inCode` true with `last` still
+    // holding the previous complete block — which is the one to return.
+    return last;
+}

package/dist/ui/historySearch.js

@@ -0,0 +1,24 @@
+import { fuzzyMatch } from "./palette.js";
+/**
+ * Match `query` against `history` (newest-first is the expected order) and
+ * return the entries that match, preserving that order. An empty query matches
+ * everything, which is what makes Ctrl+R useful before a fragment is typed:
+ * it shows the recent prompts immediately.
+ *
+ * Duplicates are collapsed by text, keeping the newest occurrence — pressing
+ * Ctrl+R after typing a prompt three times should not offer it three times.
+ */
+export function searchHistory(history, query) {
+    const seen = new Set();
+    const out = [];
+    for (let index = 0; index < history.length; index++) {
+        const text = history[index];
+        if (!fuzzyMatch(text, query))
+            continue;
+        if (seen.has(text))
+            continue;
+        seen.add(text);
+        out.push({ text, index });
+    }
+    return out;
+}

package/dist/ui/palette.js

@@ -24,10 +24,22 @@ export function fuzzyMatch(haystack, needle) {
  * lookup — `cmd:/rename` inserts the command into the input line (never runs
  * it blind: a fuzzy finder that executes on Enter is how conversations get
  * cleared by accident), `checkpoint:<name>` rewinds to that checkpoint.
+ *
+ * `recency` (command name → last-run epoch ms) floats recently *used*
+ * commands above the rest. Only the unfiltered ordering is affected: once a
+ * user is typing a fragment they are looking for that fragment, and reordering
+ * under the cursor as matches arrive would be the opposite of helpful. Within
+ * each group the sort is stable, so the declaration order stays the tiebreak
+ * and the list is still predictable on a fresh install (`recency` omitted).
  */
-export function buildPaletteItems(commands, checkpoints, filter) {
+export function buildPaletteItems(commands, checkpoints, filter, recency) {
     const items = [];
-    for (const c of commands) {
+    // Sort first, filter second: filtering cannot change the relative order, and
+    // doing it once here avoids re-sorting an already-sorted list per item.
+    const ordered = !recency || filter.trim()
+        ? commands
+        : [...commands].sort((a, b) => (recency[b.name] ?? 0) - (recency[a.name] ?? 0));
+    for (const c of ordered) {
         if (!fuzzyMatch(`${c.name} ${c.description}`, filter))
             continue;
         items.push({ label: c.name, value: `cmd:${c.name}`, hint: c.description });

package/dist/ui/recentCommands.js

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+import { hardenWindowsDir } from "../config/winAcl.js";
+import { debugLog } from "../config/debug.js";
+/**
+ * When each slash command was last run, so the palette can float the ones a
+ * user actually reaches for to the top (the way VS Code's recent list does).
+ *
+ * Deliberately keyed on *execution*, not on insertion: the palette inserts a
+ * command into the input line rather than running it (a fuzzy finder that runs
+ * on Enter is how conversations get cleared by accident), so a recency signal
+ * recorded at insert time would rank the commands someone typed-and-abandoned
+ * above the ones they ran. The write happens in `runCommand` for exactly that
+ * reason.
+ *
+ * Only commands are tracked. Checkpoints are ephemeral (they live for one
+ * session) and have no stable identity to rank across launches.
+ *
+ * Same persistence shape as bannerSeen.ts / aiDisclosure.ts: a JSON map under
+ * ~/.kritya, 0o700 dir, 0o600 file, ACL-hardened on Windows, and a `storeFile`
+ * parameter as the test seam.
+ */
+const RECENT_FILE = path.join(CONFIG_DIR, "recent-commands.json");
+/** How many commands the file remembers. Small: this only breaks ties. */
+const MAX_TRACKED = 40;
+function loadStore(storeFile) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(storeFile, "utf8"));
+        if (!parsed || typeof parsed !== "object")
+            return {};
+        const out = {};
+        for (const [name, at] of Object.entries(parsed)) {
+            if (typeof at === "number" && Number.isFinite(at))
+                out[name] = at;
+        }
+        return out;
+    }
+    catch (err) {
+        // Missing is normal (nothing used yet); malformed just means the ordering
+        // starts fresh, which is worth being able to see but never fatal.
+        debugLog(`loadStore(${storeFile})`, err);
+        return {};
+    }
+}
+/** The recorded recency map, for passing into `buildPaletteItems`. */
+export function loadCommandRecency(storeFile = RECENT_FILE) {
+    return loadStore(storeFile);
+}
+/**
+ * Record that `name` was just run. Never throws: a palette ordering hint is
+ * not worth failing a command over, so a read-only home directory degrades to
+ * "the order just doesn't change".
+ */
+export function recordCommandUse(name, storeFile = RECENT_FILE, at = Date.now()) {
+    try {
+        const store = loadStore(storeFile);
+        store[name] = at;
+        // Bound the file: keep the most recent MAX_TRACKED, drop the rest. Without
+        // this it grows by one key per distinct command forever, and the names of
+        // commands a user tried once a year ago are not worth a line each.
+        const entries = Object.entries(store).sort((a, b) => b[1] - a[1]);
+        const trimmed = {};
+        for (const [key, value] of entries.slice(0, MAX_TRACKED))
+            trimmed[key] = value;
+        fs.mkdirSync(path.dirname(storeFile), { recursive: true, mode: 0o700 });
+        hardenWindowsDir(path.dirname(storeFile));
+        fs.writeFileSync(storeFile, JSON.stringify(trimmed, null, 2) + "\n", { mode: 0o600 });
+    }
+    catch (err) {
+        debugLog(`recordCommandUse(${name})`, err);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kritya",
-  "version": "0.8.42-beta",
+  "version": "0.8.44-beta",
   "description": "Kritya — Superintelligence at your command line",
   "type": "module",
   "publishConfig": {