lazyclaw 6.3.0 → 6.4.0

package/tui/pickers.mjs

@@ -1,8 +1,8 @@
-// Interactive TUI helpers — readline pickers, banner/mascot renderers,
-// arrow-key menu, provider/model selection, and the _quickPrompt line reader.
-// Extracted from cli.mjs in Phase D4. Lives in tui/ so banner asset imports
-// are siblings (./banner.generated.mjs, ./wordmark.mjs).
+// Interactive TUI helpers — readline pickers, banner renderers, arrow-key
+// menu, provider/model selection, _quickPrompt. Extracted from cli.mjs (D4);
+// lives in tui/ so banner asset imports are siblings.
 import { readConfig, writeConfig, _resolveAuthKey } from '../lib/config.mjs';
+import { SLASH_COMMANDS } from './slash_commands.mjs';
 import { ensureRegistry, getRegistry } from '../lib/registry_boot.mjs';
 import { bucketProviders as _bucketProviders } from './provider_families.mjs';
 import { addCustomProvider } from '../providers/custom_provider.mjs';
@@ -11,15 +11,47 @@ import {
   fetchModelsForProvider as _fetchModelsResolve,
   supportsLiveFetch as _supportsLiveFetch,
 } from '../providers/model_catalogue.mjs';
+import { paint } from './theme.mjs';
+
+// Read exactly ONE line from a non-TTY stream (piped stdin) and hand the rest
+// back so the next reader (the next picker / a credential prompt) still gets
+// its input. The old fallbacks resolved the whole buffered payload at the
+// first newline — matching no id (skip) and swallowing every later line so the
+// following prompt hung. Pause before unshift so the buffered remainder isn't
+// dropped while no 'data' listener is attached.
+export function _readOneLine(stream) {
+  return new Promise((resolve) => {
+    let buf = '';
+    const done = (line) => {
+      stream.off('data', onData);
+      stream.off('end', onEnd);
+      resolve(line.replace(/\r$/, '').trim());
+    };
+    const onData = (chunk) => {
+      buf += chunk.toString();
+      const nl = buf.indexOf('\n');
+      if (nl === -1) return;
+      stream.pause();
+      const rest = buf.slice(nl + 1);
+      if (rest) stream.unshift(Buffer.from(rest, 'utf8'));
+      done(buf.slice(0, nl));
+    };
+    const onEnd = () => done(buf);
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    // A prior _readOneLine pauses the stream after unshifting its remainder.
+    // Adding a 'data' listener does NOT auto-resume an explicitly-paused
+    // stream, so resume() here or the next read would block on buffered input.
+    stream.resume();
+  });
+}
 
 export function _attachGhostAutocomplete(rl) {
-  // Returns `{ dispose, suspend, resume }`. Dispose detaches the
-  // keypress + rl 'line' listeners (failure to do so leaks the
-  // event-loop ref, which is exactly the slow-exit bug v3.92
-  // fixed). Suspend / resume gate the keypress handler so the
-  // streaming chat output isn't interleaved with `\x1b[s\x1b[K\x1b[u`
-  // ghost-render escapes — that interleaving is what surfaces as
-  // visible gaps between Korean characters in long replies.
+  // Returns `{ dispose, suspend, resume }`. Dispose detaches the keypress +
+  // rl 'line' listeners (leaking them is the v3.92 slow-exit bug). Suspend /
+  // resume gate the keypress handler so streaming chat output isn't
+  // interleaved with `\x1b[s\x1b[K\x1b[u` ghost-render escapes — that
+  // interleaving surfaced as visible gaps between Korean characters.
   const noop = () => {};
   if (!process.stdout.isTTY) return { dispose: noop, suspend: noop, resume: noop };
   const cmds = SLASH_COMMANDS.map((c) => c.cmd);
@@ -109,36 +141,15 @@ export function _attachGhostAutocomplete(rl) {
   };
 }
 
-// LazyClaw banner — printed once at the top of every interactive chat
-// session so users see the active provider/model before they start
-// typing. Plain ANSI; auto-skipped when stdout isn't a TTY (so piped
-// invocations stay clean for tests/scripts).
-// Single source of truth for the LazyClaw banner — used by the chat
-// REPL header, the no-arg launcher, and the first-run welcome panel.
-// Returns an array of pre-formatted lines (with ANSI colour) so the
-// caller can splice in additional rows without re-implementing the
-// alignment.
-//
-// Width-management rule: every inner line is forced through
-// `.padEnd(W)` so a stray width miscount can't punch the right
-// border off the box (which is exactly the bug v3.99.5 shipped:
-// v4.2.2 — boxed figlet "lazy" wordmark, single-colour orange. The
-// previous mixed-colour banner (helmet-red letter art + ink-beige
-// caption) read as "two banners glued together" because the colour
-// changed mid-box. We use one warm orange (#F08246) for everything —
-// border, letter art, caption — so the eye reads it as one badge.
-//
-// Letter art is figlet "standard" (6 rows) rather than the v3.99.11
-// "small" (4 rows), because small renders as a pixel mush in most
-// terminal fonts. Standard's strokes are wide enough that the
-// letters read as `l a z y` even at small terminal sizes.
-//
-// Layout invariant: every inner row is exactly INNER_W visible cells
-// (no double-width glyphs, all chars are 1 cell in any monospace
-// font), so the right edge `│` always lands in the same column.
+// LazyClaw banner — single source of truth (chat REPL header, no-arg
+// launcher, first-run welcome). Printed once so users see the active
+// provider/model; plain ANSI, auto-skipped when stdout isn't a TTY.
+// Returns an array of pre-formatted lines the caller can splice rows into.
 //
-// _renderMascot / _renderMascotTiny are kept as stubs so any leftover
-// caller doesn't crash; no state-coloured art is produced any more.
+// Layout invariants: every inner row is forced through `.padEnd(INNER_W)`
+// and is exactly INNER_W single-cell glyphs, so the right border `│` always
+// lands in the same column. _renderMascot / _renderMascotTiny are stubs kept
+// so any leftover caller doesn't crash.
 
 const _ORANGE_RGB = '241;130;70';  // #F18246
 export function _orange(s) { return `\x1b[38;2;${_ORANGE_RGB}m${s}\x1b[0m`; }
@@ -219,15 +230,16 @@ export async function _renderV5Banner(version) {
   return rows;
 }
 
-export function _printChatBanner(activeProvName, activeModel, version) {
+export async function _printChatBanner(activeProvName, activeModel, version) {
   if (!process.stdout.isTTY) return;
-  // Single-hue header: labels dim-orange, values/emphasis full-orange, so the
-  // four caption rows below the box read as part of the same warm badge.
+  // Single-hue header: labels dim-orange, values/emphasis full-orange. Uses
+  // the v5 sloth splash (NOT the retired v4 figlet box — see _renderV5Banner;
+  // figlet remains only as the missing-asset last resort).
   const dimOrange = (s) => `\x1b[2m\x1b[38;2;${_ORANGE_RGB}m${s}\x1b[0m`;
   const orange = _orange;
   const lines = [
     '',
-    ..._renderBanner(version),
+    ...(await _renderV5Banner(version)),
     '',
     `  ${dimOrange('provider ·')} ${orange(activeProvName)}`,
     `  ${dimOrange('model    ·')} ${orange(activeModel || '(default)')}`,
@@ -262,14 +274,7 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
     process.stderr.write(`${title}\n`);
     items.forEach((it, i) => process.stderr.write(`  ${i + 1}. ${it.label}${it.desc ? ' — ' + it.desc : ''}\n`));
     process.stderr.write('pick (number / id, blank for first): ');
-    const ans = await new Promise((resolve) => {
-      let buf = '';
-      const onData = (chunk) => {
-        buf += chunk.toString();
-        if (buf.includes('\n')) { process.stdin.off('data', onData); resolve(buf.trim()); }
-      };
-      process.stdin.on('data', onData);
-    });
+    const ans = await _readOneLine(process.stdin);
     if (!ans) return items[0];
     const byNum = parseInt(ans, 10);
     if (Number.isFinite(byNum) && byNum >= 1 && byNum <= items.length) return items[byNum - 1];
@@ -287,9 +292,18 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
   // before drawing so the picker always receives the first keypress.
   process.stdin.resume();
   if (process.stdin.ref) process.stdin.ref();
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
+  // Render on the ALTERNATE screen buffer (the same trick vim / less / fzf
+  // use). Without it, the menu's full-screen \x1b[2J clears land on the main
+  // buffer, interleave with the readline output from prior wizard steps, and
+  // every step pushes a screenful into scrollback — the "화면이 밀린다" bug.
+  // On the alt buffer the menu draws in isolation; leaving it (cleanup) restores
+  // the main buffer (and the wizard text on it) verbatim, with nothing pushed.
+  const altScreen = !!(process.stdout.isTTY);
+  if (altScreen) process.stdout.write('\x1b[?1049h');
+  // Menu chrome via the theme gate: plain text under NO_COLOR / dumb / non-TTY.
+  const accent = (s) => paint('38;5;208', s);
+  const dim    = (s) => paint('2', s);
+  const bold   = (s) => paint('1', s);
 
   // Typeahead state. `query` accumulates printable chars when searchable
   // is on; the visible item slice is recomputed on every keystroke. We
@@ -382,7 +396,10 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
         cleanup();
         resolve(view[idx]);
       }
-      else if (key.ctrl && key.name === 'c') { cleanup(); process.exit(130); }
+      // Ctrl+C mid-wizard cancels this step (resolve the CANCEL sentinel the
+      // callers already handle) instead of hard-killing the whole process —
+      // a wizard step must be abortable without taking the app down.
+      else if (key.ctrl && key.name === 'c') { cleanup(); resolve('CANCEL'); }
       else if (key.ctrl && key.name === 'u') { if (searchable) { query = ''; recompute(); } }
       else if (key.name === 'escape') {
         if (searchable && query) { query = ''; recompute(); return; }
@@ -404,12 +421,50 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
     const cleanup = () => {
       process.stdin.off('keypress', onKey);
       if (process.stdin.setRawMode) process.stdin.setRawMode(false);
-      process.stdout.write('\x1b[?25h\x1b[2J\x1b[H');
+      // Show the cursor, then leave the alt screen → the main buffer (with the
+      // wizard's prior output) reappears exactly as it was, nothing pushed into
+      // scrollback. Fall back to a clear+home when the alt buffer wasn't used.
+      if (altScreen) process.stdout.write('\x1b[?25h\x1b[?1049l');
+      else process.stdout.write('\x1b[?25h\x1b[2J\x1b[H');
+      // Release stdin so a one-shot CLI caller (the setup / onboard wizard) can
+      // exit. We resume()+ref() stdin on entry to receive keypresses; if it's
+      // never unref'd, the event loop stays alive after the LAST picker and the
+      // process hangs at "Setup complete" instead of returning to the shell.
+      // The chat REPL re-refs stdin (via _pauseChatForSubMenu's finally) and
+      // its own readline keeps the loop alive, so this is safe there.
+      if (process.stdin.unref) process.stdin.unref();
     };
     process.stdin.on('keypress', onKey);
   });
 }
 
+// Arrow-key yes/no — replaces the typed `[Y/n]` prompts in the wizard so the
+// user never types a letter. Returns a boolean. Esc / q resolve to the default.
+// Inherits _arrowMenu's non-TTY fallback (reads a line). `pick` is injectable
+// for tests.
+export async function _pickYesNo(title, { subtitle, yesLabel = 'Yes', noLabel = 'No', defaultYes = true, pick = _arrowMenu } = {}) {
+  const picked = await pick({
+    title,
+    subtitle,
+    items: [
+      { id: 'yes', label: yesLabel },
+      { id: 'no', label: noLabel },
+    ],
+    defaultIdx: defaultYes ? 0 : 1,
+  });
+  if (picked === 'BACK' || picked === 'CANCEL' || picked == null) return defaultYes;
+  const id = typeof picked === 'object' ? picked.id : picked;
+  return id === 'yes';
+}
+
+// Arrow-key single choice — `options` is [{ id, label, desc }]. Returns the
+// chosen id, or `fallback` on Esc/cancel. `pick` injectable for tests.
+export async function _pickChoice(title, options, { subtitle, defaultIdx = 0, fallback = null, pick = _arrowMenu } = {}) {
+  const picked = await pick({ title, subtitle, items: options, defaultIdx, searchable: false });
+  if (picked === 'BACK' || picked === 'CANCEL' || picked == null) return fallback;
+  return typeof picked === 'object' ? picked.id : picked;
+}
+
 // Bucket every registered provider into one of three auth-method
 // families. The picker's first step asks the user which family
 // they want before drilling into specific providers — much less
@@ -421,10 +476,10 @@ export function _providerFamilies() {
   // tui/provider_families.mjs; the ANSI tags below are readline-specific.
   const b = _bucketProviders(getRegistry());
   return {
-    api: { label: 'API key', desc: 'paste an sk-... key during setup',  tag: '\x1b[38;5;245m[needs key]\x1b[0m', members: b.api },
-    cli: { label: 'CLI / Local', desc: 'keyless — uses an existing CLI login or a local daemon', tag: '\x1b[38;5;208m[no key]\x1b[0m', members: b.cli },
-    meta: { label: 'Multi-agent', desc: 'orchestrator — fan a task out to a planner + workers (advanced)', tag: '\x1b[38;5;245m[meta]\x1b[0m', members: b.meta },
-    mock: { label: 'Mock', desc: 'offline echo, only useful for testing', tag: '\x1b[38;5;245m[test]\x1b[0m', members: b.mock },
+    api: { label: 'API key', desc: 'paste an sk-... key during setup',  tag: paint('38;5;245', '[needs key]'), members: b.api },
+    cli: { label: 'CLI / Local', desc: 'keyless — uses an existing CLI login or a local daemon', tag: paint('38;5;208', '[no key]'), members: b.cli },
+    meta: { label: 'Multi-agent', desc: 'orchestrator — fan a task out to a planner + workers (advanced)', tag: paint('38;5;245', '[meta]'), members: b.meta },
+    mock: { label: 'Mock', desc: 'offline echo, only useful for testing', tag: paint('38;5;245', '[test]'), members: b.mock },
   };
 }
 
@@ -447,14 +502,7 @@ export async function _pickProviderInteractive() {
   // Non-TTY fallback — single-prompt picker, identical to before.
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stdout.write(`provider [${providers.join('|')}]: `);
-    const ans = await new Promise((resolve) => {
-      let buf = '';
-      const onData = (chunk) => {
-        buf += chunk.toString();
-        if (buf.includes('\n')) { process.stdin.off('data', onData); resolve(buf.trim()); }
-      };
-      process.stdin.on('data', onData);
-    });
+    const ans = await _readOneLine(process.stdin);
     // v5.3.2 — non-TTY fallback used to be `providers[0]`, which was
     // whatever happened to be first in the registry (currently
     // anthropic). Pin to claude-cli to match the interactive onboard
@@ -511,8 +559,8 @@ export async function _pickProviderInteractive() {
         label: name,
         desc,
         tag: isCustom
-          ? '\x1b[38;5;213m[custom]\x1b[0m'
-          : (meta.requiresApiKey ? '\x1b[38;5;245m[api key]\x1b[0m' : '\x1b[38;5;208m[no key]\x1b[0m'),
+          ? paint('38;5;213', '[custom]')
+          : (meta.requiresApiKey ? paint('38;5;245', '[api key]') : paint('38;5;208', '[no key]')),
       };
     });
     // Surface a "+ Add a new custom endpoint…" entry inside the API-key
@@ -524,7 +572,7 @@ export async function _pickProviderInteractive() {
         id: '__add_custom__',
         label: '+ Add a custom OpenAI-compatible endpoint…',
         desc: 'NVIDIA NIM · OpenRouter · Together · Groq · vLLM · LM Studio · …',
-        tag: '\x1b[38;5;213m[new]\x1b[0m',
+        tag: paint('38;5;213', '[new]'),
       });
     }
     if (memberNames.length === 1 && family.id !== 'api') {
@@ -578,10 +626,10 @@ export async function _pickProviderInteractive() {
 // workers: multi-select with a running list + add/remove/done loop.
 // maxSubtasks: typed integer, default 5.
 export async function _setupOrchestratorInteractive() {
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
-  const ok     = (s) => `\x1b[32m${s}\x1b[0m`;
+  const accent = (s) => paint('38;5;208', s);
+  const dim    = (s) => paint('2', s);
+  const bold   = (s) => paint('1', s);
+  const ok     = (s) => paint('32', s);
   const info = getRegistry().PROVIDER_INFO || {};
   const eligibleNames = Object.keys(getRegistry().PROVIDERS).filter((n) => n !== 'orchestrator' && n !== 'mock');
   if (eligibleNames.length === 0) {
@@ -736,25 +784,40 @@ export async function _pickModelInteractive(providerId, opts = {}) {
   let dynamicModels = [];
   while (true) {
     const allModels = Array.from(new Set([...baseModels, ...dynamicModels]));
-    const modelItems = allModels.map((m) => ({ id: m, label: m, desc: '' }));
+    // "Use the provider's own default" — send no `-m`, the reliable path for
+    // keyless CLI providers (codex-cli / gemini-cli) whose allowed model set
+    // is fixed by the logged-in account: forcing a model the plan isn't
+    // entitled to makes the CLI reject the turn. Pre-selected when the
+    // provider declares no defaultModel.
+    const modelItems = [{
+      id: '__provider_default__',
+      label: "▷ Use the provider's own default model",
+      desc: 'no model override — the CLI/login picks (recommended for codex-cli / gemini-cli)',
+      tag: paint('38;5;208', '[default]'),
+    }];
     if (supportsLiveFetch) {
-      modelItems.unshift({
+      modelItems.push({
         id: '__fetch_models__',
         label: '↻ Fetch live model list from /v1/models',
         desc: isCustom || isBuiltinCompat ? `GET ${meta.baseUrl}/models` : 'pulls the up-to-date catalogue from the provider',
-        tag: '\x1b[38;5;245m[live]\x1b[0m',
+        tag: paint('38;5;245', '[live]'),
       });
     }
+    for (const m of allModels) modelItems.push({ id: m, label: m, desc: '' });
     modelItems.push({
       id: '__custom_model__',
       label: '… type a custom model id',
       desc: 'use any model id supported by this provider, even if not listed above',
-      tag: '\x1b[38;5;245m[free]\x1b[0m',
+      tag: paint('38;5;245', '[free]'),
     });
 
-    const defaultIdx = supportsLiveFetch
-      ? Math.max(0, 1 + allModels.indexOf(meta.defaultModel || allModels[0]))
-      : Math.max(0, allModels.indexOf(meta.defaultModel || allModels[0]));
+    // Land the cursor on the configured default model when there is one;
+    // otherwise pre-select "use the provider's own default" (index 0).
+    let defaultIdx = 0;
+    if (meta.defaultModel) {
+      const i = modelItems.findIndex((it) => it.id === meta.defaultModel);
+      if (i >= 0) defaultIdx = i;
+    }
     const titlePrefix = opts.titlePrefix ? `${opts.titlePrefix}  ` : '';
     const picked = await _arrowMenu({
       title: `${titlePrefix}pick a model for ${providerId}`,
@@ -765,6 +828,8 @@ export async function _pickModelInteractive(providerId, opts = {}) {
     });
     if (picked === 'CANCEL') return 'CANCEL';
     if (picked === 'BACK')   return 'BACK';
+    // Empty string = "no explicit model" (use the provider/CLI default).
+    if (picked.id === '__provider_default__') return '';
     if (picked.id === '__custom_model__') {
       const typed = (await _quickPrompt(`  model id for ${providerId}: `)).trim();
       if (!typed) continue;
@@ -775,7 +840,7 @@ export async function _pickModelInteractive(providerId, opts = {}) {
         process.stdout.write(`\n  fetching ${providerId} model list…\n`);
         const fetched = await _fetchModelsForProvider(providerId);
         if (!fetched.length) {
-          process.stdout.write(`  ${'\x1b[33m'}no models returned${'\x1b[0m'} — falling back to the suggested list.\n`);
+          process.stdout.write(`  ${paint(33, 'no models returned')} — falling back to the suggested list.\n`);
           await _quickPrompt('  press Enter to continue ');
         } else {
           dynamicModels = fetched;
@@ -783,7 +848,7 @@ export async function _pickModelInteractive(providerId, opts = {}) {
           await _quickPrompt('  press Enter to pick one ');
         }
       } catch (e) {
-        process.stdout.write(`\n  ${'\x1b[33m'}fetch failed:${'\x1b[0m'} ${e?.message || e}\n`);
+        process.stdout.write(`\n  ${paint(33, 'fetch failed:')} ${e?.message || e}\n`);
         await _quickPrompt('  press Enter to continue ');
       }
       continue;
@@ -820,10 +885,10 @@ export async function _fetchModelsForProvider(providerId) {
 // Persists into cfg.customProviders[] and returns { name } on success,
 // or null when the user backs out.
 export async function _addCustomProviderInteractive() {
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
-  const ok     = (s) => `\x1b[32m${s}\x1b[0m`;
+  const accent = (s) => paint('38;5;208', s);
+  const dim    = (s) => paint('2', s);
+  const bold   = (s) => paint('1', s);
+  const ok     = (s) => paint('32', s);
 
   process.stdout.write('\x1b[2J\x1b[H');
   process.stdout.write(accent('Add a custom OpenAI-compatible endpoint') + '\n');
@@ -845,7 +910,7 @@ export async function _addCustomProviderInteractive() {
     }
     try { name = validateCustomProviderName(raw); }
     catch (e) {
-      process.stdout.write(`  \x1b[33m${e.message}\x1b[0m — try again.\n`);
+      process.stdout.write(`  ${paint(33, e.message)} — try again.\n`);
       continue;
     }
     // OpenAI-compat builtins (nim / openrouter / groq / …) can be overridden
@@ -855,9 +920,9 @@ export async function _addCustomProviderInteractive() {
     // the override so it isn't a silent surprise.
     if (typeof isBuiltinOpenAICompatName === 'function' && isBuiltinOpenAICompatName(name)) {
       process.stdout.write(
-        `  \x1b[2mNote: "${name}" is a built-in OpenAI-compatible provider; ` +
+        paint(2, `Note: "${name}" is a built-in OpenAI-compatible provider; ` +
         `your custom entry will override the built-in baseUrl/api-key for this install. ` +
-        `Remove with: lazyclaw providers remove ${name}\x1b[0m\n`
+        `Remove with: lazyclaw providers remove ${name}`) + '\n'
       );
     }
     break;
@@ -865,7 +930,7 @@ export async function _addCustomProviderInteractive() {
   const baseUrlRaw = (await _quickPrompt(`  ${bold('baseUrl')} ${dim('(must end in /v1, no trailing slash needed):')} `)).trim();
   if (!baseUrlRaw) { process.stdout.write(dim('  cancelled — baseUrl is required.\n')); return null; }
   if (!/^https?:\/\//i.test(baseUrlRaw)) {
-    process.stdout.write('  \x1b[33mbaseUrl must start with http:// or https://\x1b[0m — cancelled.\n');
+    process.stdout.write(`  ${paint(33, 'baseUrl must start with http:// or https://')} — cancelled.\n`);
     return null;
   }
   const apiKey = (await _quickPrompt(`  ${bold('api-key')} ${dim('(blank if the endpoint is auth-less, e.g. local vLLM):')} `)).trim();
@@ -889,7 +954,7 @@ export async function _addCustomProviderInteractive() {
   } else if (result.probe.ok) {
     probeMsg = `  ${ok('✓')} registered — /v1/models returned no entries (will rely on free-text model id).\n`;
   } else {
-    probeMsg = `  \x1b[33m!\x1b[0m registered, but /v1/models probe failed: ${result.probe.error}\n`;
+    probeMsg = `  ${paint(33, '!')} registered, but /v1/models probe failed: ${result.probe.error}\n`;
   }
   process.stdout.write('\n');
   process.stdout.write(`  ${ok(bold('✓ custom provider saved:'))} ${entry.name}  ${dim('→')} ${entry.baseUrl}\n`);
@@ -898,7 +963,15 @@ export async function _addCustomProviderInteractive() {
   await _quickPrompt('  press Enter to continue ');
   return { name };
 }
-export async function _quickPrompt(label) {
+// Single-line readline prompt. Pass { secret: true } to mask the typed value
+// (api keys, channel tokens) — the bytes are read in raw mode and echoed as
+// bullets so the secret never appears on screen / scrollback / a screen-share.
+// Non-TTY input can't be masked (no raw mode); it falls back to the plain read,
+// which is fine for piped automation where there is no screen to leak to.
+export async function _quickPrompt(label, opts = {}) {
+  if (opts.secret && process.stdin.isTTY && process.stdin.setRawMode) {
+    return _quickPromptSecret(label);
+  }
   const readline = await import('node:readline');
   process.stdout.write('\n');
   // Make sure stdin is in cooked / line-buffered mode for the
@@ -915,3 +988,45 @@ export async function _quickPrompt(label) {
   rl.close();
   return ans.trim();
 }
+
+// Masked raw-mode reader: echoes one bullet per typed character, handles
+// Backspace, Enter/Ctrl-D (submit), and Ctrl-C (abort → empty string). The real
+// characters accumulate off-screen and are returned trimmed.
+export async function _quickPromptSecret(label) {
+  const stdin = process.stdin;
+  process.stdout.write('\n' + label);
+  const wasRaw = !!stdin.isRaw;
+  try { stdin.setRawMode(true); } catch (_) {}
+  stdin.resume();
+  if (stdin.ref) stdin.ref();
+  const prevEnc = stdin.readableEncoding;
+  stdin.setEncoding('utf8');
+  let buf = '';
+  const value = await new Promise((resolve) => {
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n' || ch === '\x04') { // Enter / Ctrl-D
+          cleanup(); resolve(buf); return;
+        }
+        if (ch === '\x03') { // Ctrl-C abort
+          cleanup(); resolve(''); return;
+        }
+        if (ch === '\x7f' || ch === '\x08') { // Backspace / Delete
+          if (buf.length) { buf = buf.slice(0, -1); process.stdout.write('\b \b'); }
+          continue;
+        }
+        if (ch < ' ') continue; // ignore other control chars (arrows, etc.)
+        buf += ch;
+        process.stdout.write('•');
+      }
+    };
+    const cleanup = () => {
+      stdin.removeListener('data', onData);
+      try { stdin.setRawMode(wasRaw); } catch (_) {}
+      if (prevEnc) { try { stdin.setEncoding(prevEnc); } catch (_) {} }
+      process.stdout.write('\n');
+    };
+    stdin.on('data', onData);
+  });
+  return value.trim();
+}