securevibe 0.1.10 → 0.1.13

package/dist/repl.js

@@ -40,28 +40,64 @@ async function meterOrPrint(io) {
     }
     return r;
 }
-const HELP = [
-    "  Commands:",
-    "    scan [--json]                 full scan",
-    "    fix [--apply] [--yes] [--no-llm] [--json]   fix findings",
-    "    explain [--json]               AI explanations for critical/high findings",
-    "    ai-audit | protect | attack-map | score | deps | ready   [--json]",
-    "    init [--force]                 wire up the pre-commit guard + CI",
-    "    config show | set-key <groq|anthropic> | unset-key <groq|anthropic>",
-    "    db update | status             manage the local OSV database",
-    "    cd <path>                      change the scan target",
-    "    pwd                            show the current scan target",
-    "    help                           this message",
-    "    exit | quit                    leave the session",
-].join("\n");
-/** Public entry point: real stdio, refuses to start without a TTY. */
+/** Public entry point: real stdio, refuses to start without a TTY. Mounts
+ * the Ink interactive app (ui/repl-tui/App.ts) -- runReplSession above stays
+ * the tested, TTY-free core; this is the real-terminal presentation layer. */
 export async function runRepl(initialPath) {
     if (!isInteractive()) {
         process.stderr.write("  repl needs an interactive terminal.\n");
         process.exitCode = 64;
         return;
     }
-    await runReplSession(initialPath, { input: process.stdin, output: process.stdout });
+    const { render } = await import("ink");
+    const React = (await import("react")).default;
+    const { App } = await import("./ui/repl-tui/App.js");
+    const { waitUntilExit } = render(React.createElement(App, { initialPath }));
+    await waitUntilExit();
+}
+/**
+ * Handle one line of input against the given state: built-in commands
+ * (exit/quit/q, help, pwd, cd) plus everything dispatch() handles. Returns
+ * true if the session should end after this line. Shared by the legacy
+ * readline loop (runReplSession, below) and the Ink app (ui/repl-tui/App.ts)
+ * — extracted so both drive the exact same behavior from one place.
+ */
+export async function processLine(line, state, io) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return false;
+    const tokens = tokenize(trimmed);
+    const cmd = tokens[0];
+    const rest = tokens.slice(1);
+    try {
+        if ((cmd === "exit" || cmd === "quit" || cmd === "q") && rest.length === 0)
+            return true;
+        if ((cmd === "help" || cmd === "?") && rest.length === 0) {
+            const { renderHelp } = await import("./ui/repl-tui/commandRegistry.js");
+            write(io, renderHelp() + "\n\n");
+            return false;
+        }
+        if (cmd === "pwd" && rest.length === 0) {
+            write(io, `  ${state.root}\n\n`);
+            return false;
+        }
+        if (cmd === "cd" && rest.length <= 1) {
+            if (!rest[0]) {
+                write(io, "  usage: cd <path>\n\n");
+                return false;
+            }
+            state.root = path.resolve(state.root, rest[0]);
+            state.lastResult = undefined; // stale results would ground chat in the wrong repo
+            state.chat?.reset();
+            write(io, `  target: ${state.root}\n\n`);
+            return false;
+        }
+        await dispatch(cmd, rest, state, io, trimmed);
+    }
+    catch (err) {
+        write(io, `  error: ${err?.message ?? err}\n\n`);
+    }
+    return false;
 }
 /** The actual session loop, over injectable streams — testable without a TTY. */
 export async function runReplSession(initialPath, io) {
@@ -73,49 +109,61 @@ export async function runReplSession(initialPath, io) {
     write(io, `  target: ${state.root}\n\n`);
     while (true) {
         const raw = await askLine(`securevibe (${path.basename(state.root)})> `, io.input, io.output);
-        const line = raw.trim();
-        if (!line)
-            continue;
-        const tokens = tokenize(line);
-        const cmd = tokens[0];
-        const rest = tokens.slice(1);
-        try {
-            if (cmd === "exit" || cmd === "quit" || cmd === "q")
-                break;
-            if (cmd === "help" || cmd === "?") {
-                write(io, HELP + "\n\n");
-                continue;
-            }
-            if (cmd === "pwd") {
-                write(io, `  ${state.root}\n\n`);
-                continue;
-            }
-            if (cmd === "cd") {
-                if (!rest[0]) {
-                    write(io, "  usage: cd <path>\n\n");
-                    continue;
-                }
-                state.root = path.resolve(state.root, rest[0]);
-                write(io, `  target: ${state.root}\n\n`);
-                continue;
-            }
-            await dispatch(cmd, rest, state, io);
-        }
-        catch (err) {
-            write(io, `  error: ${err?.message ?? err}\n\n`);
-        }
+        if (await processLine(raw, state, io))
+            break;
+    }
+}
+/** Progress callback for scan()/runFix()/explainFindings(): prefers io.onProgress
+ * (Ink path) over the default scrolling-line behavior (legacy readline path). */
+function progressCallback(io, asJson) {
+    if (asJson)
+        return undefined;
+    return io.onProgress ?? ((m) => write(io, `  · ${m}\n`));
+}
+/**
+ * True when `rest` (the tokens after the command word) is a plausible
+ * argument list for `cmd`'s actual grammar -- known flags/subcommands only.
+ * A command WORD matching a real command but followed by tokens outside its
+ * grammar is natural language that happens to start with that word (e.g.
+ * "score seems too low, why?"), not an invocation -- dispatch() falls
+ * through to chat instead of running the command. Every dispatch-level name
+ * here must also appear in ui/repl-tui/commandRegistry.ts's COMMANDS list;
+ * repl-command-collision.test.ts cross-checks the two so they can't drift.
+ */
+export function matchesCommandGrammar(cmd, rest) {
+    const jsonOnly = new Set(["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready", "explain"]);
+    if (jsonOnly.has(cmd))
+        return rest.every((t) => t === "--json");
+    if (cmd === "fix") {
+        const known = new Set(["--apply", "--yes", "--no-llm", "--json"]);
+        return rest.every((t) => known.has(t));
+    }
+    if (cmd === "init")
+        return rest.every((t) => t === "--force");
+    if (cmd === "config") {
+        if (rest.length === 0)
+            return true;
+        if (rest[0] === "show")
+            return rest.length === 1;
+        if (rest[0] === "set-key" || rest[0] === "unset-key")
+            return rest.length <= 2;
+        return false;
     }
+    if (cmd === "db")
+        return rest.length === 0 || (rest.length === 1 && (rest[0] === "update" || rest[0] === "status"));
+    return false;
 }
-async function dispatch(cmd, tokens, state, io) {
+async function dispatch(cmd, tokens, state, io, rawLine) {
     const asJson = hasFlag(tokens, "--json");
-    if (["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready"].includes(cmd)) {
+    if (["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready"].includes(cmd) && matchesCommandGrammar(cmd, tokens)) {
         const { scan } = await import("./engine/scan.js");
         const usage = await meterOrPrint(io);
         const result = await scan(state.root, {
             aiOnly: cmd === "ai-audit",
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            onProgress: progressCallback(io, asJson),
         });
         state.lastResult = result;
+        state.chat?.setScanResult(result);
         if (asJson) {
             const { toJson } = await import("./ui/emit.js");
             write(io, toJson(result) + "\n\n");
@@ -124,21 +172,34 @@ async function dispatch(cmd, tokens, state, io) {
         write(io, (await renderFor(cmd, result, usage)) + "\n");
         return;
     }
-    if (cmd === "fix") {
+    if (cmd === "fix" && matchesCommandGrammar(cmd, tokens)) {
         const { runFix } = await import("./engine/fix/session.js");
         const { renderFixSession, fixToJson, renderApprovalRequest } = await import("./ui/fix.js");
         const opts = { apply: hasFlag(tokens, "--apply"), yes: hasFlag(tokens, "--yes"), json: asJson };
         const decision = decideApply(opts, true);
         if (decision.apply && !hasFlag(tokens, "--no-llm")) {
-            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
-            await maybeOfferAiFixerSetup();
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
         }
         const usage = await meterOrPrint(io);
+        const confirmFn = decision.prompt
+            ? io.makeConfirm
+                ? io.makeConfirm(renderApprovalRequest)
+                : makeFixConfirm(renderApprovalRequest, io.input, io.output)
+            : undefined;
         const result = await runFix(state.root, {
             apply: decision.apply,
             noLlm: hasFlag(tokens, "--no-llm"),
-            confirm: decision.prompt ? makeFixConfirm(renderApprovalRequest, io.input, io.output) : undefined,
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            confirm: confirmFn,
+            onProgress: progressCallback(io, asJson),
         });
         if (asJson) {
             write(io, fixToJson(result) + "\n\n");
@@ -150,18 +211,26 @@ async function dispatch(cmd, tokens, state, io) {
         }
         return;
     }
-    if (cmd === "explain") {
+    if (cmd === "explain" && matchesCommandGrammar(cmd, tokens)) {
         if (!asJson) {
-            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
-            await maybeOfferAiFixerSetup();
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
         }
         const { explainFindings } = await import("./engine/explain.js");
         const usage = await meterOrPrint(io);
         const { scan } = await import("./engine/scan.js");
-        const scanResult = await scan(state.root, { onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`) });
+        const scanResult = await scan(state.root, { onProgress: progressCallback(io, asJson) });
         state.lastResult = scanResult;
         const report = await explainFindings(scanResult, {
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            onProgress: progressCallback(io, asJson),
         });
         if (asJson) {
             const { explainToJson } = await import("./ui/explain.js");
@@ -172,24 +241,88 @@ async function dispatch(cmd, tokens, state, io) {
         write(io, renderExplain(report, usage) + "\n");
         return;
     }
-    if (cmd === "init") {
+    if (cmd === "init" && matchesCommandGrammar(cmd, tokens)) {
         const { runInit } = await import("./engine/init.js");
         const { renderInit } = await import("./ui/init.js");
         const result = await runInit(state.root, { force: hasFlag(tokens, "--force") });
         write(io, renderInit(result) + "\n");
-        const { maybeOfferAiFixerSetupDuringInit } = await import("./index-support.js");
-        await maybeOfferAiFixerSetupDuringInit(state.root);
+        const { maybeOfferAiFixerSetupDuringInit, noKeyNudgeMessage } = await import("./index-support.js");
+        await maybeOfferAiFixerSetupDuringInit(state.root, io.inkMode
+            ? {
+                writePreamble: (text) => write(io, text),
+                offer: async () => {
+                    const msg = noKeyNudgeMessage();
+                    if (msg)
+                        write(io, msg);
+                },
+            }
+            : undefined);
         return;
     }
-    if (cmd === "config") {
+    if (cmd === "config" && matchesCommandGrammar(cmd, tokens)) {
         await handleConfig(tokens, io);
         return;
     }
-    if (cmd === "db") {
+    if (cmd === "db" && matchesCommandGrammar(cmd, tokens)) {
         await handleDb(tokens, io);
         return;
     }
-    write(io, `  unknown command: ${cmd} (type \`help\`)\n\n`);
+    await handleChat(rawLine, state, io);
+}
+/** Two-space indent so answers sit inside the REPL's output gutter. */
+function indentAnswer(text) {
+    return text
+        .split("\n")
+        .map((l) => "  " + l)
+        .join("\n");
+}
+/**
+ * Free text = a question about the last scan (spec 2026-07-12). Order of
+ * gates: scan first (nothing to talk about), then key (consent would be
+ * pointless without one), then once-per-session consent, then the ask.
+ * NOT metered: no scan runs here and the call spends the user's own key,
+ * the same reasoning that exempts --staged/--diff.
+ */
+async function handleChat(question, state, io) {
+    if (!state.lastResult) {
+        write(io, "  Run `scan` first so I have findings to talk about. (Free text asks the AI about your last scan; type `help` for commands.)\n\n");
+        return;
+    }
+    const { llmAvailability } = await import("./engine/fix/llm.js");
+    const avail = llmAvailability(false);
+    if (!avail.available) {
+        write(io, "  Chat needs an AI key. Run `securevibe config set-key groq` (outside the REPL) to enable it; `explain` and `fix` use the same key.\n\n");
+        return;
+    }
+    if (state.chatConsent === false) {
+        write(io, "  Chat is off for this session (you declined earlier). Commands still work; type `help`.\n\n");
+        return;
+    }
+    if (state.chatConsent === undefined) {
+        const render = (req) => req.kind === "chat-consent"
+            ? `  First question this session: send your questions and the scan findings to ${req.provider}?`
+            : "";
+        const confirm = io.makeConfirm ? io.makeConfirm(render) : makeFixConfirm(render, io.input, io.output);
+        const answer = await confirm({ kind: "chat-consent", provider: avail.provider });
+        state.chatConsent = answer === "yes";
+        if (!state.chatConsent) {
+            write(io, "  Understood, chat stays off for this session. Commands still work; type `help`.\n\n");
+            return;
+        }
+    }
+    if (!state.chat) {
+        const { ChatSession } = await import("./engine/chat.js");
+        state.chat = new ChatSession();
+        state.chat.setScanResult(state.lastResult);
+    }
+    const progress = progressCallback(io, false);
+    progress?.(`asking ${avail.provider}…`);
+    const answer = await state.chat.ask(question);
+    if (answer == null) {
+        write(io, "  The AI call failed; nothing was answered. Try again, or use `explain` for per finding context.\n\n");
+        return;
+    }
+    write(io, indentAnswer(answer) + "\n\n");
 }
 async function renderFor(cmd, result, usage) {
     if (cmd === "scan" || cmd === "ai-audit") {
@@ -232,6 +365,10 @@ async function handleConfig(tokens, io) {
         return;
     }
     if (action === "set-key") {
+        if (io.inkMode) {
+            write(io, `  config set-key needs a real terminal prompt — run \`securevibe config set-key ${provider}\` as a one-shot command outside the REPL (or set the ${provider === "groq" ? "GROQ_API_KEY" : "ANTHROPIC_API_KEY"} env var directly).\n\n`);
+            return;
+        }
         const hint = provider === "groq" ? " (free — console.groq.com/keys)" : " (console.anthropic.com)";
         const key = (await askLine(`  Paste your ${provider} API key${hint}: `, io.input, io.output)).trim();
         if (!key) {

package/dist/ui/fix.js

@@ -131,7 +131,7 @@ export function renderApprovalRequest(req) {
         L.push(renderDiff(p.relPath, p.before, p.after));
         L.push("  " + pc.dim("verified: finding clears · no new issue · file still parses"));
     }
-    else {
+    else if (req.kind === "side-effects") {
         L.push("");
         L.push("  " + pc.bold("Supporting changes") + pc.dim(" (additive, no break risk)"));
         for (const fx of req.effects) {

package/dist/ui/prComment.js

@@ -0,0 +1,55 @@
+import { SEVERITY_ORDER } from "../engine/types.js";
+import { PR_COMMENT_MARKER } from "../engine/github.js";
+const MAX_FINDINGS = 15;
+const SEV_LABEL = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+const READINESS_LABEL = {
+    ship: "✓ Ship",
+    warn: "⚠ Ship with warnings",
+    block: "✗ Block deploy",
+};
+function severityCounts(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return ["critical", "high", "medium", "low"]
+        .filter((s) => counts[s] > 0)
+        .map((s) => `**${counts[s]}** ${SEV_LABEL[s]}`)
+        .join(" · ");
+}
+export function renderPrComment(result) {
+    const L = [];
+    L.push(PR_COMMENT_MARKER);
+    L.push("## SecureVibe — changed-files scan");
+    L.push("");
+    L.push(`**Grade ${result.score.grade}** (${result.score.composite}/100) — ${READINESS_LABEL[result.score.readiness]}`);
+    L.push("");
+    if (result.findings.length === 0) {
+        L.push("No findings in the files changed by this PR. ✓");
+        return L.join("\n");
+    }
+    L.push(severityCounts(result.findings));
+    L.push("");
+    const sorted = [...result.findings].sort((a, b) => SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity] || b.confidence - a.confidence);
+    const shown = sorted.slice(0, MAX_FINDINGS);
+    const remaining = sorted.length - shown.length;
+    for (const f of shown) {
+        L.push(`### ${SEV_LABEL[f.severity]} — ${f.title}`);
+        L.push(`\`${f.file}:${f.line}\``);
+        L.push("");
+        L.push(`**why:** ${f.why}`);
+        L.push("");
+        L.push(`**fix:** ${f.fix}`);
+        L.push("");
+    }
+    if (remaining > 0) {
+        L.push(`_+${remaining} more finding${remaining === 1 ? "" : "s"} — run \`securevibe scan\` locally to see all._`);
+        L.push("");
+    }
+    return L.join("\n");
+}

package/dist/ui/prompt.js

@@ -26,10 +26,11 @@ export function decideApply(opts, interactive) {
         return { apply: false, prompt: false, notice: true };
     return { apply: true, prompt: true, notice: false };
 }
-/** Map a raw keypress/line to an answer. Empty / unknown → the safe default "no". */
+/** Map a raw keypress/line to an answer. Empty / unknown → the safe default "no".
+ * Only "patch" offers all/quit; side-effects and chat-consent are yes/no. */
 export function mapAnswer(raw, kind) {
     const c = raw.trim().toLowerCase().charAt(0);
-    if (kind === "side-effects")
+    if (kind !== "patch")
         return c === "y" ? "yes" : "no";
     if (c === "y")
         return "yes";
@@ -55,7 +56,9 @@ export function makeFixConfirm(render, input = process.stdin, output = process.s
         output.write(render(req) + "\n");
         const prompt = req.kind === "patch"
             ? "  Apply this change? [y]es / [n]o / [a]ll / [q]uit: "
-            : "  Apply these supporting changes? [y]es / [n]o: ";
+            : req.kind === "side-effects"
+                ? "  Apply these supporting changes? [y]es / [n]o: "
+                : "  Send to your AI provider? [y]es / [n]o: ";
         const raw = await askLine(prompt, input, output);
         return mapAnswer(raw, req.kind);
     };

package/dist/ui/repl-tui/App.js

@@ -0,0 +1,132 @@
+import React, { useEffect, useRef, useState } from "react";
+import { Box, Static, Text, useApp, useInput } from "ink";
+import path from "node:path";
+import { mapAnswer } from "../prompt.js";
+import { processLine } from "../../repl.js";
+import { makeCallbackWritable } from "./outputStream.js";
+import { filterCommands } from "./commandRegistry.js";
+import { StatusLine } from "./StatusLine.js";
+import { InputBox } from "./InputBox.js";
+import { SlashMenu } from "./SlashMenu.js";
+import { Spinner } from "./Spinner.js";
+const h = React.createElement;
+// Static<T> is generic; createElement can't infer T from an untyped call the
+// way JSX's <Static<string>> would. Pin T=string via a TS instantiation
+// expression instead of casting the props object.
+const StringStatic = (Static);
+/**
+ * Top-level Ink app: <Static> scrollback (everything dispatch() writes,
+ * unchanged from the plain-text output the legacy readline loop already
+ * produces) above a live bottom region (status line, spinner, slash menu,
+ * input box). Every submitted line goes through the exact same
+ * processLine() the legacy readline loop and repl.test.ts already exercise
+ * (Task 1) -- this component only changes how a line is captured and how
+ * output is framed, never what a command does.
+ */
+export function App({ initialPath }) {
+    const { exit } = useApp();
+    const stateRef = useRef({ root: path.resolve(initialPath) });
+    const [lines, setLines] = useState([]);
+    const [value, setValue] = useState("");
+    const [history, setHistory] = useState([]);
+    const [busy, setBusy] = useState(false);
+    const [progressMessage, setProgressMessage] = useState(null);
+    const [confirmKind, setConfirmKind] = useState(null);
+    const [selectedMenuIndex, setSelectedMenuIndex] = useState(0);
+    const confirmResolverRef = useRef(null);
+    const pushLine = (text) => setLines((prev) => [...prev, text]);
+    useEffect(() => {
+        (async () => {
+            const { applyStoredKeysToEnv } = await import("../../config.js");
+            await applyStoredKeysToEnv();
+            const { renderBanner } = await import("../banner.js");
+            pushLine(renderBanner({ subtitle: "interactive session — type `help` or `/`" }) + "\n");
+            pushLine(`  target: ${stateRef.current.root}\n`);
+        })();
+    }, []);
+    const menuOpen = value.startsWith("/");
+    const filteredCommands = menuOpen ? filterCommands(value.slice(1)) : [];
+    const clampedIndex = Math.min(selectedMenuIndex, Math.max(0, filteredCommands.length - 1));
+    useInput((_input, key) => {
+        if (!menuOpen)
+            return;
+        if (key.upArrow)
+            setSelectedMenuIndex((i) => Math.max(0, i - 1));
+        if (key.downArrow)
+            setSelectedMenuIndex((i) => Math.min(filteredCommands.length - 1, i + 1));
+        if (key.escape)
+            setValue("");
+    });
+    const handleChange = (v) => {
+        setSelectedMenuIndex(0);
+        setValue(v);
+    };
+    const handleSubmit = async (line) => {
+        if (confirmResolverRef.current) {
+            const answer = mapAnswer(line, confirmKind ?? "patch");
+            confirmResolverRef.current(answer);
+            setValue("");
+            return;
+        }
+        // A command is already running (busy stays true for its whole duration,
+        // including while a confirm is pending -- but that case already returned
+        // above). Ignore a second real submission rather than racing two
+        // processLine() calls over the same mutable ReplState. The legacy
+        // readline loop can't hit this: only one askLine() is ever pending, so
+        // there's no way to submit a second line before the first resolves.
+        if (busy)
+            return;
+        if (menuOpen) {
+            const chosen = filteredCommands[clampedIndex];
+            setValue(chosen ? chosen.name + " " : "");
+            return;
+        }
+        if (!line.trim()) {
+            setValue("");
+            return;
+        }
+        setHistory((prev) => [...prev, line]);
+        setValue("");
+        setBusy(true);
+        setProgressMessage(null);
+        const io = {
+            input: process.stdin,
+            output: makeCallbackWritable(pushLine),
+            inkMode: true,
+            onProgress: (m) => setProgressMessage(m),
+            makeConfirm: (render) => {
+                return (req) => new Promise((resolve) => {
+                    pushLine(render(req) + "\n");
+                    setConfirmKind(req.kind);
+                    confirmResolverRef.current = (answer) => {
+                        setConfirmKind(null);
+                        confirmResolverRef.current = null;
+                        resolve(answer);
+                    };
+                });
+            },
+        };
+        const shouldExit = await processLine(line, stateRef.current, io);
+        setBusy(false);
+        setProgressMessage(null);
+        if (shouldExit)
+            exit();
+    };
+    return h(React.Fragment, null, h(StringStatic, {
+        items: lines,
+        children: (line, i) => h(Text, { key: i }, line),
+    }), h(Box, { flexDirection: "column" }, h(StatusLine, { targetRoot: stateRef.current.root }), busy && progressMessage ? h(Spinner, { message: progressMessage }) : null, confirmKind
+        ? h(Text, { dimColor: true }, confirmKind === "patch"
+            ? "  Apply this change? [y]es / [n]o / [a]ll / [q]uit"
+            : confirmKind === "side-effects"
+                ? "  Apply these supporting changes? [y]es / [n]o"
+                : "  Send to your AI provider? [y]es / [n]o")
+        : null, menuOpen ? h(SlashMenu, { items: filteredCommands, selectedIndex: clampedIndex }) : null, h(InputBox, {
+        value,
+        onChange: handleChange,
+        onSubmit: handleSubmit,
+        history,
+        onHistoryNavigate: setValue,
+        menuOpen,
+    })));
+}

package/dist/ui/repl-tui/InputBox.js

@@ -0,0 +1,48 @@
+import React, { useState } from "react";
+import { Box, Text, useInput } from "ink";
+import TextInput from "ink-text-input";
+const h = React.createElement;
+/**
+ * Bordered single-line input (`>` prompt, rounded border). Up/down arrow
+ * cycles `history`, but only when the slash menu isn't open -- App.ts's own
+ * useInput takes over up/down for menu-item selection in that state.
+ * TextInput itself only handles left/right cursor movement and
+ * backspace/delete, never up/down, so there's no conflict between this
+ * hook and TextInput's own internal input handling.
+ */
+export function InputBox({ value, onChange, onSubmit, history, onHistoryNavigate, menuOpen }) {
+    const [historyIndex, setHistoryIndex] = useState(null);
+    useInput((_input, key) => {
+        if (menuOpen)
+            return;
+        if (key.upArrow) {
+            if (history.length === 0)
+                return;
+            const next = historyIndex === null ? history.length - 1 : Math.max(0, historyIndex - 1);
+            setHistoryIndex(next);
+            onHistoryNavigate(history[next]);
+            return;
+        }
+        if (key.downArrow) {
+            if (historyIndex === null)
+                return;
+            const next = historyIndex + 1;
+            if (next >= history.length) {
+                setHistoryIndex(null);
+                onHistoryNavigate("");
+            }
+            else {
+                setHistoryIndex(next);
+                onHistoryNavigate(history[next]);
+            }
+        }
+    });
+    return h(Box, { borderStyle: "round", paddingX: 1 }, h(Text, null, "> "), h(TextInput, {
+        value,
+        onChange: (v) => {
+            setHistoryIndex(null);
+            onChange(v);
+        },
+        onSubmit,
+    }));
+}

package/dist/ui/repl-tui/SlashMenu.js

@@ -0,0 +1,10 @@
+import React from "react";
+import { Box, Text } from "ink";
+const h = React.createElement;
+/** Purely presentational -- App.ts owns navigation (up/down) and selection (Enter). */
+export function SlashMenu({ items, selectedIndex }) {
+    if (items.length === 0) {
+        return h(Box, { paddingX: 1 }, h(Text, { dimColor: true }, "no matching commands"));
+    }
+    return h(Box, { flexDirection: "column", paddingX: 1 }, ...items.map((item, i) => h(Text, { key: item.name, color: i === selectedIndex ? "cyan" : undefined }, `${i === selectedIndex ? "› " : "  "}/${item.name} ${item.args} — ${item.description}`)));
+}

package/dist/ui/repl-tui/Spinner.js

@@ -0,0 +1,18 @@
+import React, { useEffect, useState } from "react";
+import { Box, Text } from "ink";
+const h = React.createElement;
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/**
+ * One live-updating line (braille spinner + current step's message),
+ * replacing the old scrolling "· message" lines during scan/fix/explain.
+ * Hand-rolled rather than a dependency -- ten frames and a setInterval is
+ * simple enough not to justify another package.
+ */
+export function Spinner({ message }) {
+    const [frame, setFrame] = useState(0);
+    useEffect(() => {
+        const id = setInterval(() => setFrame((f) => (f + 1) % FRAMES.length), 80);
+        return () => clearInterval(id);
+    }, []);
+    return h(Box, null, h(Text, { color: "cyan" }, FRAMES[frame]), h(Text, null, ` ${message}`));
+}