lazyclaw 6.3.1 → 6.5.0

package/tui/pickers.mjs

@@ -11,6 +11,58 @@ import {
   fetchModelsForProvider as _fetchModelsResolve,
   supportsLiveFetch as _supportsLiveFetch,
 } from '../providers/model_catalogue.mjs';
+import { paint } from './theme.mjs';
+// Banner renderers live in a leaf sibling module (tui/banner.mjs). We import
+// the ones pickers' own code still calls (_orange / _ORANGE_RGB in
+// _printChatBanner, _loadBannerAssets / _renderBanner / _orange in
+// _renderV5Banner) and re-export the public surface so existing importers
+// (cli.mjs / commands/setup.mjs / commands/chat.mjs) keep resolving them here.
+import {
+  _ORANGE_RGB,
+  _orange,
+  _renderBanner,
+  _loadBannerAssets,
+} from './banner.mjs';
+export {
+  _orange,
+  _renderMascot,
+  _renderMascotTiny,
+  _renderBanner,
+  _loadBannerAssets,
+} from './banner.mjs';
+
+// Read exactly ONE line from a non-TTY stream (piped stdin) and hand the rest
+// back so the next reader (the next picker / a credential prompt) still gets
+// its input. The old fallbacks resolved the whole buffered payload at the
+// first newline — matching no id (skip) and swallowing every later line so the
+// following prompt hung. Pause before unshift so the buffered remainder isn't
+// dropped while no 'data' listener is attached.
+export function _readOneLine(stream) {
+  return new Promise((resolve) => {
+    let buf = '';
+    const done = (line) => {
+      stream.off('data', onData);
+      stream.off('end', onEnd);
+      resolve(line.replace(/\r$/, '').trim());
+    };
+    const onData = (chunk) => {
+      buf += chunk.toString();
+      const nl = buf.indexOf('\n');
+      if (nl === -1) return;
+      stream.pause();
+      const rest = buf.slice(nl + 1);
+      if (rest) stream.unshift(Buffer.from(rest, 'utf8'));
+      done(buf.slice(0, nl));
+    };
+    const onEnd = () => done(buf);
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    // A prior _readOneLine pauses the stream after unshifting its remainder.
+    // Adding a 'data' listener does NOT auto-resume an explicitly-paused
+    // stream, so resume() here or the next read would block on buffered input.
+    stream.resume();
+  });
+}
 
 export function _attachGhostAutocomplete(rl) {
   // Returns `{ dispose, suspend, resume }`. Dispose detaches the keypress +
@@ -107,94 +159,16 @@ export function _attachGhostAutocomplete(rl) {
   };
 }
 
-// LazyClaw banner — printed once at the top of every interactive chat
-// session so users see the active provider/model before they start
-// typing. Plain ANSI; auto-skipped when stdout isn't a TTY (so piped
-// invocations stay clean for tests/scripts).
-// Single source of truth for the LazyClaw banner — used by the chat
-// REPL header, the no-arg launcher, and the first-run welcome panel.
-// Returns an array of pre-formatted lines (with ANSI colour) so the
-// caller can splice in additional rows without re-implementing the
-// alignment.
-//
-// Width-management rule: every inner line is forced through
-// `.padEnd(W)` so a stray width miscount can't punch the right
-// border off the box (which is exactly the bug v3.99.5 shipped:
-// v4.2.2 — boxed figlet "lazy" wordmark, single-colour orange. The
-// previous mixed-colour banner (helmet-red letter art + ink-beige
-// caption) read as "two banners glued together" because the colour
-// changed mid-box. We use one warm orange (#F08246) for everything —
-// border, letter art, caption — so the eye reads it as one badge.
-//
-// Letter art is figlet "standard" (6 rows) rather than the v3.99.11
-// "small" (4 rows), because small renders as a pixel mush in most
-// terminal fonts. Standard's strokes are wide enough that the
-// letters read as `l a z y` even at small terminal sizes.
-//
-// Layout invariant: every inner row is exactly INNER_W visible cells
-// (no double-width glyphs, all chars are 1 cell in any monospace
-// font), so the right edge `│` always lands in the same column.
-//
-// _renderMascot / _renderMascotTiny are kept as stubs so any leftover
-// caller doesn't crash; no state-coloured art is produced any more.
-
-const _ORANGE_RGB = '241;130;70';  // #F18246
-export function _orange(s) { return `\x1b[38;2;${_ORANGE_RGB}m${s}\x1b[0m`; }
-
-export function _renderMascot() {
-  return ['lazyclaw'];
-}
-
-export function _renderMascotTiny() {
-  return 'lazyclaw';
-}
-
-// figlet "standard" "lazy", trimmed of leading blank line. Each row
-// is left-padded by two spaces inside the box, and every row is then
-// padded to INNER_W cells.
-const _LAZY_STANDARD = [
-  ' _                  ',
-  '| | __ _ _____   _  ',
-  '| |/ _` |_  / | | | ',
-  '| | (_| |/ /| |_| | ',
-  '|_|\\__,_/___|\\__, | ',
-  '             |___/  ',
-];
-
-const _INNER_W = 32;  // 2 left pad + 20 letter art + caption headroom
-
-export function _renderBanner(version) {
-  const v = String(version || '?.?.?');
-  const cap = `  LazyClaw  v${v}`;
-  const padInner = (s) => '  ' + s.padEnd(_INNER_W - 2, ' ');
-  const wrap = (inner) => _orange('│') + _orange(inner) + _orange('│');
-  const top = _orange('╭' + '─'.repeat(_INNER_W) + '╮');
-  const bot = _orange('╰' + '─'.repeat(_INNER_W) + '╯');
-  return [
-    top,
-    ..._LAZY_STANDARD.map((row) => wrap(padInner(row))),
-    wrap(padInner(cap)),
-    bot,
-  ];
-}
+// Banner renderers (_ORANGE_RGB / _orange / _renderMascot / _renderMascotTiny
+// / _renderBanner / _loadBannerAssets) moved to tui/banner.mjs — imported at
+// the top of this file and re-exported there for existing callers. The v5
+// splash composer and chat header below still live here because they read
+// pickers-local state and stay close to the wizard that prints them.
 
 // v5 hero banner — ANSI Shadow LAZYCLAW wordmark stacked on top of the
 // braille sloth (tui/banner.generated.mjs + tui/wordmark.mjs). Left-aligned
 // with a 2-cell margin so wide terminals don't push the art to the right.
 // Opt out with LAZYCLAW_LEGACY_MENU=1 to fall back to the v4 figlet box.
-let _bannerAssetsCache = null;
-export async function _loadBannerAssets() {
-  if (_bannerAssetsCache !== null) return _bannerAssetsCache;
-  try {
-    const { banner } = await import('./banner.generated.mjs');
-    const { wordmark } = await import('./wordmark.mjs');
-    _bannerAssetsCache = { banner, wordmark };
-  } catch {
-    _bannerAssetsCache = null;
-  }
-  return _bannerAssetsCache;
-}
-
 export async function _renderV5Banner(version) {
   const a = await _loadBannerAssets();
   if (!a) return _renderBanner(version); // missing tarball asset → v4 figlet
@@ -261,14 +235,7 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
     process.stderr.write(`${title}\n`);
     items.forEach((it, i) => process.stderr.write(`  ${i + 1}. ${it.label}${it.desc ? ' — ' + it.desc : ''}\n`));
     process.stderr.write('pick (number / id, blank for first): ');
-    const ans = await new Promise((resolve) => {
-      let buf = '';
-      const onData = (chunk) => {
-        buf += chunk.toString();
-        if (buf.includes('\n')) { process.stdin.off('data', onData); resolve(buf.trim()); }
-      };
-      process.stdin.on('data', onData);
-    });
+    const ans = await _readOneLine(process.stdin);
     if (!ans) return items[0];
     const byNum = parseInt(ans, 10);
     if (Number.isFinite(byNum) && byNum >= 1 && byNum <= items.length) return items[byNum - 1];
@@ -286,9 +253,18 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
   // before drawing so the picker always receives the first keypress.
   process.stdin.resume();
   if (process.stdin.ref) process.stdin.ref();
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
+  // Render on the ALTERNATE screen buffer (the same trick vim / less / fzf
+  // use). Without it, the menu's full-screen \x1b[2J clears land on the main
+  // buffer, interleave with the readline output from prior wizard steps, and
+  // every step pushes a screenful into scrollback — the "화면이 밀린다" bug.
+  // On the alt buffer the menu draws in isolation; leaving it (cleanup) restores
+  // the main buffer (and the wizard text on it) verbatim, with nothing pushed.
+  const altScreen = !!(process.stdout.isTTY);
+  if (altScreen) process.stdout.write('\x1b[?1049h');
+  // Menu chrome via the theme gate: plain text under NO_COLOR / dumb / non-TTY.
+  const accent = (s) => paint('38;5;208', s);
+  const dim    = (s) => paint('2', s);
+  const bold   = (s) => paint('1', s);
 
   // Typeahead state. `query` accumulates printable chars when searchable
   // is on; the visible item slice is recomputed on every keystroke. We
@@ -381,7 +357,10 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
         cleanup();
         resolve(view[idx]);
       }
-      else if (key.ctrl && key.name === 'c') { cleanup(); process.exit(130); }
+      // Ctrl+C mid-wizard cancels this step (resolve the CANCEL sentinel the
+      // callers already handle) instead of hard-killing the whole process —
+      // a wizard step must be abortable without taking the app down.
+      else if (key.ctrl && key.name === 'c') { cleanup(); resolve('CANCEL'); }
       else if (key.ctrl && key.name === 'u') { if (searchable) { query = ''; recompute(); } }
       else if (key.name === 'escape') {
         if (searchable && query) { query = ''; recompute(); return; }
@@ -403,12 +382,50 @@ export async function _arrowMenu({ title, subtitle, footer, items, defaultIdx =
     const cleanup = () => {
       process.stdin.off('keypress', onKey);
       if (process.stdin.setRawMode) process.stdin.setRawMode(false);
-      process.stdout.write('\x1b[?25h\x1b[2J\x1b[H');
+      // Show the cursor, then leave the alt screen → the main buffer (with the
+      // wizard's prior output) reappears exactly as it was, nothing pushed into
+      // scrollback. Fall back to a clear+home when the alt buffer wasn't used.
+      if (altScreen) process.stdout.write('\x1b[?25h\x1b[?1049l');
+      else process.stdout.write('\x1b[?25h\x1b[2J\x1b[H');
+      // Release stdin so a one-shot CLI caller (the setup / onboard wizard) can
+      // exit. We resume()+ref() stdin on entry to receive keypresses; if it's
+      // never unref'd, the event loop stays alive after the LAST picker and the
+      // process hangs at "Setup complete" instead of returning to the shell.
+      // The chat REPL re-refs stdin (via _pauseChatForSubMenu's finally) and
+      // its own readline keeps the loop alive, so this is safe there.
+      if (process.stdin.unref) process.stdin.unref();
     };
     process.stdin.on('keypress', onKey);
   });
 }
 
+// Arrow-key yes/no — replaces the typed `[Y/n]` prompts in the wizard so the
+// user never types a letter. Returns a boolean. Esc / q resolve to the default.
+// Inherits _arrowMenu's non-TTY fallback (reads a line). `pick` is injectable
+// for tests.
+export async function _pickYesNo(title, { subtitle, yesLabel = 'Yes', noLabel = 'No', defaultYes = true, pick = _arrowMenu } = {}) {
+  const picked = await pick({
+    title,
+    subtitle,
+    items: [
+      { id: 'yes', label: yesLabel },
+      { id: 'no', label: noLabel },
+    ],
+    defaultIdx: defaultYes ? 0 : 1,
+  });
+  if (picked === 'BACK' || picked === 'CANCEL' || picked == null) return defaultYes;
+  const id = typeof picked === 'object' ? picked.id : picked;
+  return id === 'yes';
+}
+
+// Arrow-key single choice — `options` is [{ id, label, desc }]. Returns the
+// chosen id, or `fallback` on Esc/cancel. `pick` injectable for tests.
+export async function _pickChoice(title, options, { subtitle, defaultIdx = 0, fallback = null, pick = _arrowMenu } = {}) {
+  const picked = await pick({ title, subtitle, items: options, defaultIdx, searchable: false });
+  if (picked === 'BACK' || picked === 'CANCEL' || picked == null) return fallback;
+  return typeof picked === 'object' ? picked.id : picked;
+}
+
 // Bucket every registered provider into one of three auth-method
 // families. The picker's first step asks the user which family
 // they want before drilling into specific providers — much less
@@ -420,10 +437,10 @@ export function _providerFamilies() {
   // tui/provider_families.mjs; the ANSI tags below are readline-specific.
   const b = _bucketProviders(getRegistry());
   return {
-    api: { label: 'API key', desc: 'paste an sk-... key during setup',  tag: '\x1b[38;5;245m[needs key]\x1b[0m', members: b.api },
-    cli: { label: 'CLI / Local', desc: 'keyless — uses an existing CLI login or a local daemon', tag: '\x1b[38;5;208m[no key]\x1b[0m', members: b.cli },
-    meta: { label: 'Multi-agent', desc: 'orchestrator — fan a task out to a planner + workers (advanced)', tag: '\x1b[38;5;245m[meta]\x1b[0m', members: b.meta },
-    mock: { label: 'Mock', desc: 'offline echo, only useful for testing', tag: '\x1b[38;5;245m[test]\x1b[0m', members: b.mock },
+    api: { label: 'API key', desc: 'paste an sk-... key during setup',  tag: paint('38;5;245', '[needs key]'), members: b.api },
+    cli: { label: 'CLI / Local', desc: 'keyless — uses an existing CLI login or a local daemon', tag: paint('38;5;208', '[no key]'), members: b.cli },
+    meta: { label: 'Multi-agent', desc: 'orchestrator — fan a task out to a planner + workers (advanced)', tag: paint('38;5;245', '[meta]'), members: b.meta },
+    mock: { label: 'Mock', desc: 'offline echo, only useful for testing', tag: paint('38;5;245', '[test]'), members: b.mock },
   };
 }
 
@@ -446,14 +463,7 @@ export async function _pickProviderInteractive() {
   // Non-TTY fallback — single-prompt picker, identical to before.
   if (!process.stdout.isTTY || !process.stdin.isTTY) {
     process.stdout.write(`provider [${providers.join('|')}]: `);
-    const ans = await new Promise((resolve) => {
-      let buf = '';
-      const onData = (chunk) => {
-        buf += chunk.toString();
-        if (buf.includes('\n')) { process.stdin.off('data', onData); resolve(buf.trim()); }
-      };
-      process.stdin.on('data', onData);
-    });
+    const ans = await _readOneLine(process.stdin);
     // v5.3.2 — non-TTY fallback used to be `providers[0]`, which was
     // whatever happened to be first in the registry (currently
     // anthropic). Pin to claude-cli to match the interactive onboard
@@ -510,8 +520,8 @@ export async function _pickProviderInteractive() {
         label: name,
         desc,
         tag: isCustom
-          ? '\x1b[38;5;213m[custom]\x1b[0m'
-          : (meta.requiresApiKey ? '\x1b[38;5;245m[api key]\x1b[0m' : '\x1b[38;5;208m[no key]\x1b[0m'),
+          ? paint('38;5;213', '[custom]')
+          : (meta.requiresApiKey ? paint('38;5;245', '[api key]') : paint('38;5;208', '[no key]')),
       };
     });
     // Surface a "+ Add a new custom endpoint…" entry inside the API-key
@@ -523,7 +533,7 @@ export async function _pickProviderInteractive() {
         id: '__add_custom__',
         label: '+ Add a custom OpenAI-compatible endpoint…',
         desc: 'NVIDIA NIM · OpenRouter · Together · Groq · vLLM · LM Studio · …',
-        tag: '\x1b[38;5;213m[new]\x1b[0m',
+        tag: paint('38;5;213', '[new]'),
       });
     }
     if (memberNames.length === 1 && family.id !== 'api') {
@@ -569,124 +579,10 @@ export async function _pickProviderInteractive() {
   return { provider: provider.id, model: picked };
 }
 
-// Step-3 alternative for composite providers (currently only the
-// orchestrator). Builds `cfg.orchestrator = { planner, workers,
-// maxSubtasks }` interactively and persists it before returning.
-//
-// planner: single picker over registered non-composite providers.
-// workers: multi-select with a running list + add/remove/done loop.
-// maxSubtasks: typed integer, default 5.
-export async function _setupOrchestratorInteractive() {
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
-  const ok     = (s) => `\x1b[32m${s}\x1b[0m`;
-  const info = getRegistry().PROVIDER_INFO || {};
-  const eligibleNames = Object.keys(getRegistry().PROVIDERS).filter((n) => n !== 'orchestrator' && n !== 'mock');
-  if (eligibleNames.length === 0) {
-    process.stdout.write('\n' + accent('orchestrator setup') + ': no eligible workers — register a real provider first.\n');
-    await _quickPrompt('  press Enter to continue ');
-    return 'CANCEL';
-  }
-  const cfg = readConfig();
-  const existing = cfg.orchestrator && typeof cfg.orchestrator === 'object' ? cfg.orchestrator : {};
-
-  // ── Pick planner ─────────────────────────────────────────────────
-  const plannerItems = eligibleNames.map((name) => {
-    const m = info[name] || {};
-    const defaultModel = m.defaultModel || '';
-    return {
-      id: `${name}${defaultModel ? ':' + defaultModel : ''}`,
-      label: m.label && m.label !== name ? `${name} — ${m.label}` : name,
-      desc: defaultModel ? `default model: ${defaultModel}` : '',
-    };
-  });
-  const plannerPick = await _arrowMenu({
-    title: 'LazyClaw setup — Step 3 of 3:  orchestrator — pick the planner',
-    subtitle: 'The planner decomposes the user request into subtasks and writes the final synthesis. Strong reasoning models work best here.',
-    items: plannerItems,
-    searchable: true,
-    defaultIdx: Math.max(0, plannerItems.findIndex((p) => p.id === existing.planner)),
-  });
-  if (plannerPick === 'CANCEL') return 'CANCEL';
-  if (plannerPick === 'BACK')   return 'BACK';
-  const planner = plannerPick.id;
-
-  // ── Pick workers (iterative add/remove) ──────────────────────────
-  const workers = Array.isArray(existing.workers) ? existing.workers.slice() : [];
-  while (true) {
-    process.stdout.write('\x1b[2J\x1b[H');
-    process.stdout.write(accent('Orchestrator workers') + '\n');
-    process.stdout.write(dim('Subtasks are dispatched round-robin across this list.') + '\n\n');
-    if (workers.length === 0) {
-      process.stdout.write('  ' + dim('(none yet — add at least one)') + '\n\n');
-    } else {
-      workers.forEach((w, i) => {
-        process.stdout.write(`  ${i + 1}. ${ok(w)}\n`);
-      });
-      process.stdout.write('\n');
-    }
-    const items = [
-      { id: '__add__',    label: '+ Add a worker',     desc: 'pick from registered providers' },
-      { id: '__remove__', label: '- Remove a worker',  desc: workers.length ? 'pick which entry to drop' : '(nothing to remove)' },
-      { id: '__done__',   label: `Done${workers.length ? ` (${workers.length} worker${workers.length === 1 ? '' : 's'})` : ' — at least one worker required'}`, desc: workers.length ? 'save cfg.orchestrator and finish' : 'add one worker first' },
-    ];
-    const action = await _arrowMenu({
-      title: 'LazyClaw setup — orchestrator workers',
-      subtitle: `Planner: ${planner}`,
-      items,
-    });
-    if (action === 'CANCEL') return 'CANCEL';
-    if (action === 'BACK')   return 'BACK';
-    if (action.id === '__add__') {
-      const wPick = await _arrowMenu({
-        title: 'Add worker',
-        subtitle: 'Picked entries are appended to the workers list.',
-        items: plannerItems.filter((p) => !workers.includes(p.id)),
-        searchable: true,
-      });
-      if (wPick === 'CANCEL' || wPick === 'BACK') continue;
-      workers.push(wPick.id);
-      continue;
-    }
-    if (action.id === '__remove__') {
-      if (!workers.length) continue;
-      const rPick = await _arrowMenu({
-        title: 'Remove worker',
-        subtitle: 'Highlighted entry is removed from the list.',
-        items: workers.map((w) => ({ id: w, label: w })),
-      });
-      if (rPick === 'CANCEL' || rPick === 'BACK') continue;
-      const idx = workers.indexOf(rPick.id);
-      if (idx >= 0) workers.splice(idx, 1);
-      continue;
-    }
-    if (action.id === '__done__') {
-      if (workers.length === 0) continue;
-      break;
-    }
-  }
-
-  // ── maxSubtasks ──────────────────────────────────────────────────
-  const defaultMax = Number.isFinite(existing.maxSubtasks) && existing.maxSubtasks > 0
-    ? Math.min(10, existing.maxSubtasks)
-    : 5;
-  const rawMax = (await _quickPrompt(`  ${bold('maxSubtasks')} ${dim(`(2..10, blank → ${defaultMax}):`)} `)).trim();
-  let maxSubtasks = defaultMax;
-  if (rawMax) {
-    const n = parseInt(rawMax, 10);
-    if (Number.isFinite(n) && n >= 1) maxSubtasks = Math.min(10, Math.max(1, n));
-  }
-
-  // ── Persist ──────────────────────────────────────────────────────
-  cfg.orchestrator = { planner, workers, maxSubtasks };
-  writeConfig(cfg);
-  process.stdout.write('\n');
-  process.stdout.write(`  ${ok('✓ orchestrator saved')}  ${dim('→')} ` +
-    `planner ${ok(planner)}  ·  ${workers.length} worker${workers.length === 1 ? '' : 's'}  ·  maxSubtasks ${maxSubtasks}\n`);
-  await _quickPrompt('  press Enter to continue ');
-  return { ok: true };
-}
+// _setupOrchestratorInteractive moved to tui/orchestrator_setup.mjs (it imports
+// _arrowMenu / _quickPrompt back from here at call time → a safe cycle). The
+// re-export line sits at the BOTTOM of this file, after those helpers are
+// declared, so the live bindings resolve.
 
 // Pause the chat REPL's readline + ghost-autocomplete while a sub-picker
 // (provider / model arrow menu) takes over the terminal. The sub-picker
@@ -735,25 +631,40 @@ export async function _pickModelInteractive(providerId, opts = {}) {
   let dynamicModels = [];
   while (true) {
     const allModels = Array.from(new Set([...baseModels, ...dynamicModels]));
-    const modelItems = allModels.map((m) => ({ id: m, label: m, desc: '' }));
+    // "Use the provider's own default" — send no `-m`, the reliable path for
+    // keyless CLI providers (codex-cli / gemini-cli) whose allowed model set
+    // is fixed by the logged-in account: forcing a model the plan isn't
+    // entitled to makes the CLI reject the turn. Pre-selected when the
+    // provider declares no defaultModel.
+    const modelItems = [{
+      id: '__provider_default__',
+      label: "▷ Use the provider's own default model",
+      desc: 'no model override — the CLI/login picks (recommended for codex-cli / gemini-cli)',
+      tag: paint('38;5;208', '[default]'),
+    }];
     if (supportsLiveFetch) {
-      modelItems.unshift({
+      modelItems.push({
         id: '__fetch_models__',
         label: '↻ Fetch live model list from /v1/models',
         desc: isCustom || isBuiltinCompat ? `GET ${meta.baseUrl}/models` : 'pulls the up-to-date catalogue from the provider',
-        tag: '\x1b[38;5;245m[live]\x1b[0m',
+        tag: paint('38;5;245', '[live]'),
       });
     }
+    for (const m of allModels) modelItems.push({ id: m, label: m, desc: '' });
     modelItems.push({
       id: '__custom_model__',
       label: '… type a custom model id',
       desc: 'use any model id supported by this provider, even if not listed above',
-      tag: '\x1b[38;5;245m[free]\x1b[0m',
+      tag: paint('38;5;245', '[free]'),
     });
 
-    const defaultIdx = supportsLiveFetch
-      ? Math.max(0, 1 + allModels.indexOf(meta.defaultModel || allModels[0]))
-      : Math.max(0, allModels.indexOf(meta.defaultModel || allModels[0]));
+    // Land the cursor on the configured default model when there is one;
+    // otherwise pre-select "use the provider's own default" (index 0).
+    let defaultIdx = 0;
+    if (meta.defaultModel) {
+      const i = modelItems.findIndex((it) => it.id === meta.defaultModel);
+      if (i >= 0) defaultIdx = i;
+    }
     const titlePrefix = opts.titlePrefix ? `${opts.titlePrefix}  ` : '';
     const picked = await _arrowMenu({
       title: `${titlePrefix}pick a model for ${providerId}`,
@@ -764,6 +675,8 @@ export async function _pickModelInteractive(providerId, opts = {}) {
     });
     if (picked === 'CANCEL') return 'CANCEL';
     if (picked === 'BACK')   return 'BACK';
+    // Empty string = "no explicit model" (use the provider/CLI default).
+    if (picked.id === '__provider_default__') return '';
     if (picked.id === '__custom_model__') {
       const typed = (await _quickPrompt(`  model id for ${providerId}: `)).trim();
       if (!typed) continue;
@@ -774,7 +687,7 @@ export async function _pickModelInteractive(providerId, opts = {}) {
         process.stdout.write(`\n  fetching ${providerId} model list…\n`);
         const fetched = await _fetchModelsForProvider(providerId);
         if (!fetched.length) {
-          process.stdout.write(`  ${'\x1b[33m'}no models returned${'\x1b[0m'} — falling back to the suggested list.\n`);
+          process.stdout.write(`  ${paint(33, 'no models returned')} — falling back to the suggested list.\n`);
           await _quickPrompt('  press Enter to continue ');
         } else {
           dynamicModels = fetched;
@@ -782,7 +695,7 @@ export async function _pickModelInteractive(providerId, opts = {}) {
           await _quickPrompt('  press Enter to pick one ');
         }
       } catch (e) {
-        process.stdout.write(`\n  ${'\x1b[33m'}fetch failed:${'\x1b[0m'} ${e?.message || e}\n`);
+        process.stdout.write(`\n  ${paint(33, 'fetch failed:')} ${e?.message || e}\n`);
         await _quickPrompt('  press Enter to continue ');
       }
       continue;
@@ -819,10 +732,10 @@ export async function _fetchModelsForProvider(providerId) {
 // Persists into cfg.customProviders[] and returns { name } on success,
 // or null when the user backs out.
 export async function _addCustomProviderInteractive() {
-  const accent = (s) => `\x1b[38;5;208m${s}\x1b[0m`;
-  const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
-  const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
-  const ok     = (s) => `\x1b[32m${s}\x1b[0m`;
+  const accent = (s) => paint('38;5;208', s);
+  const dim    = (s) => paint('2', s);
+  const bold   = (s) => paint('1', s);
+  const ok     = (s) => paint('32', s);
 
   process.stdout.write('\x1b[2J\x1b[H');
   process.stdout.write(accent('Add a custom OpenAI-compatible endpoint') + '\n');
@@ -844,7 +757,7 @@ export async function _addCustomProviderInteractive() {
     }
     try { name = validateCustomProviderName(raw); }
     catch (e) {
-      process.stdout.write(`  \x1b[33m${e.message}\x1b[0m — try again.\n`);
+      process.stdout.write(`  ${paint(33, e.message)} — try again.\n`);
       continue;
     }
     // OpenAI-compat builtins (nim / openrouter / groq / …) can be overridden
@@ -854,9 +767,9 @@ export async function _addCustomProviderInteractive() {
     // the override so it isn't a silent surprise.
     if (typeof isBuiltinOpenAICompatName === 'function' && isBuiltinOpenAICompatName(name)) {
       process.stdout.write(
-        `  \x1b[2mNote: "${name}" is a built-in OpenAI-compatible provider; ` +
+        paint(2, `Note: "${name}" is a built-in OpenAI-compatible provider; ` +
         `your custom entry will override the built-in baseUrl/api-key for this install. ` +
-        `Remove with: lazyclaw providers remove ${name}\x1b[0m\n`
+        `Remove with: lazyclaw providers remove ${name}`) + '\n'
       );
     }
     break;
@@ -864,7 +777,7 @@ export async function _addCustomProviderInteractive() {
   const baseUrlRaw = (await _quickPrompt(`  ${bold('baseUrl')} ${dim('(must end in /v1, no trailing slash needed):')} `)).trim();
   if (!baseUrlRaw) { process.stdout.write(dim('  cancelled — baseUrl is required.\n')); return null; }
   if (!/^https?:\/\//i.test(baseUrlRaw)) {
-    process.stdout.write('  \x1b[33mbaseUrl must start with http:// or https://\x1b[0m — cancelled.\n');
+    process.stdout.write(`  ${paint(33, 'baseUrl must start with http:// or https://')} — cancelled.\n`);
     return null;
   }
   const apiKey = (await _quickPrompt(`  ${bold('api-key')} ${dim('(blank if the endpoint is auth-less, e.g. local vLLM):')} `)).trim();
@@ -888,7 +801,7 @@ export async function _addCustomProviderInteractive() {
   } else if (result.probe.ok) {
     probeMsg = `  ${ok('✓')} registered — /v1/models returned no entries (will rely on free-text model id).\n`;
   } else {
-    probeMsg = `  \x1b[33m!\x1b[0m registered, but /v1/models probe failed: ${result.probe.error}\n`;
+    probeMsg = `  ${paint(33, '!')} registered, but /v1/models probe failed: ${result.probe.error}\n`;
   }
   process.stdout.write('\n');
   process.stdout.write(`  ${ok(bold('✓ custom provider saved:'))} ${entry.name}  ${dim('→')} ${entry.baseUrl}\n`);
@@ -897,7 +810,15 @@ export async function _addCustomProviderInteractive() {
   await _quickPrompt('  press Enter to continue ');
   return { name };
 }
-export async function _quickPrompt(label) {
+// Single-line readline prompt. Pass { secret: true } to mask the typed value
+// (api keys, channel tokens) — the bytes are read in raw mode and echoed as
+// bullets so the secret never appears on screen / scrollback / a screen-share.
+// Non-TTY input can't be masked (no raw mode); it falls back to the plain read,
+// which is fine for piped automation where there is no screen to leak to.
+export async function _quickPrompt(label, opts = {}) {
+  if (opts.secret && process.stdin.isTTY && process.stdin.setRawMode) {
+    return _quickPromptSecret(label);
+  }
   const readline = await import('node:readline');
   process.stdout.write('\n');
   // Make sure stdin is in cooked / line-buffered mode for the
@@ -914,3 +835,52 @@ export async function _quickPrompt(label) {
   rl.close();
   return ans.trim();
 }
+
+// Masked raw-mode reader: echoes one bullet per typed character, handles
+// Backspace, Enter/Ctrl-D (submit), and Ctrl-C (abort → empty string). The real
+// characters accumulate off-screen and are returned trimmed.
+export async function _quickPromptSecret(label) {
+  const stdin = process.stdin;
+  process.stdout.write('\n' + label);
+  const wasRaw = !!stdin.isRaw;
+  try { stdin.setRawMode(true); } catch (_) {}
+  stdin.resume();
+  if (stdin.ref) stdin.ref();
+  const prevEnc = stdin.readableEncoding;
+  stdin.setEncoding('utf8');
+  let buf = '';
+  const value = await new Promise((resolve) => {
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\r' || ch === '\n' || ch === '\x04') { // Enter / Ctrl-D
+          cleanup(); resolve(buf); return;
+        }
+        if (ch === '\x03') { // Ctrl-C abort
+          cleanup(); resolve(''); return;
+        }
+        if (ch === '\x7f' || ch === '\x08') { // Backspace / Delete
+          if (buf.length) { buf = buf.slice(0, -1); process.stdout.write('\b \b'); }
+          continue;
+        }
+        if (ch < ' ') continue; // ignore other control chars (arrows, etc.)
+        buf += ch;
+        process.stdout.write('•');
+      }
+    };
+    const cleanup = () => {
+      stdin.removeListener('data', onData);
+      try { stdin.setRawMode(wasRaw); } catch (_) {}
+      if (prevEnc) { try { stdin.setEncoding(prevEnc); } catch (_) {} }
+      process.stdout.write('\n');
+    };
+    stdin.on('data', onData);
+  });
+  return value.trim();
+}
+
+// Re-export the orchestrator setup wizard (moved to tui/orchestrator_setup.mjs).
+// Kept at the BOTTOM so _arrowMenu / _quickPrompt — which that module imports
+// back from here — are already declared when the cycle resolves. The helpers
+// are hoisted top-level function declarations and used only at call time, so
+// the pickers ↔ orchestrator_setup cycle never reads an uninitialised binding.
+export { _setupOrchestratorInteractive } from './orchestrator_setup.mjs';