securevibe 0.1.8 → 0.1.12

package/dist/index.js

@@ -22,16 +22,18 @@ function addCommon(cmd) {
         .option("--sarif", "output SARIF 2.1.0 (for CI / GitHub code scanning)")
         .option("--no-color", "disable coloured output")
         .option("--staged", "scan only git-staged files (for pre-commit guards)")
+        .option("--diff <base>", "scan only files changed since <base> (for PR checks)")
         .option("--ci", "CI mode: exit non-zero based on deployment readiness");
 }
 /**
  * Free beta metering: one use per analysis command against the daily quota.
- * The --staged commit guard is exempt — a quota must never block a commit.
- * Returns the usage state so callers can show it, or undefined when this run
- * wasn't metered (--staged).
+ * The --staged commit guard and --diff (PR-scoped CI scans) are both exempt —
+ * an always-on automated guard must never be the thing that breaks. Returns
+ * the usage state so callers can show it, or undefined when this run wasn't
+ * metered.
  */
 async function meter(opts = {}) {
-    if (opts.staged)
+    if (opts.staged || opts.diff)
         return undefined;
     const { recordUse, limitMessage } = await import("./usage.js");
     const r = await recordUse();
@@ -62,6 +64,20 @@ async function runScan(pathArg, opts, scanOpts = {}) {
             scanOpts = { ...scanOpts, files: staged };
         }
     }
+    // --diff <base>: analyze only files changed since <base> (PR-scoped CI checks).
+    if (opts.diff) {
+        const path = await import("node:path");
+        const { listChangedFiles } = await import("./engine/git.js");
+        const absRoot = path.resolve(target);
+        const changed = await listChangedFiles(absRoot, opts.diff);
+        if (changed === null) {
+            if (!quiet)
+                process.stderr.write(`  · could not diff against ${opts.diff} — scanning the whole tree\n`);
+        }
+        else {
+            scanOpts = { ...scanOpts, files: changed };
+        }
+    }
     const result = await scan(target, {
         ...scanOpts,
         onProgress: quiet ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
@@ -128,6 +144,8 @@ program
     const { renderInit } = await import("./ui/init.js");
     const result = await runInit(pathArg ?? ".", { force: opts.force });
     process.stdout.write(renderInit(result) + "\n");
+    const { maybeOfferAiFixerSetupDuringInit } = await import("./index-support.js");
+    await maybeOfferAiFixerSetupDuringInit(pathArg ?? ".");
 });
 program
     .command("fix")
@@ -169,6 +187,66 @@ program
     }
     await maybeNotifyUpdate({ json: opts.json });
 });
+program
+    .command("explain")
+    .description("AI-powered plain-language explanations for critical/high findings")
+    .argument("[path]", "path to the repository", ".")
+    .option("--json", "output machine-readable JSON")
+    .option("--no-color", "disable coloured output")
+    .action(async (pathArg, opts) => {
+    if (opts.color === false)
+        process.env.NO_COLOR = "1";
+    const { applyStoredKeysToEnv } = await import("./config.js");
+    await applyStoredKeysToEnv();
+    if (!opts.json) {
+        const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+        await maybeOfferAiFixerSetup();
+    }
+    const { result, usage } = await runScan(pathArg, { json: opts.json, color: opts.color });
+    const { explainFindings } = await import("./engine/explain.js");
+    const report = await explainFindings(result, {
+        onProgress: opts.json ? undefined : (m) => process.stderr.write(`  · ${m}\n`),
+    });
+    if (opts.json) {
+        const { explainToJson } = await import("./ui/explain.js");
+        process.stdout.write(explainToJson(report) + "\n");
+    }
+    else {
+        const { renderExplain } = await import("./ui/explain.js");
+        process.stdout.write(renderExplain(report, usage) + "\n");
+    }
+    await maybeNotifyUpdate({ json: opts.json });
+});
+program
+    .command("pr-comment")
+    .description("Post/update a PR summary of changed-file findings (used by the GitHub Actions workflow)")
+    .argument("[path]", "path to the repository", ".")
+    .option("--diff <base>", "base ref to diff against (the workflow passes the PR's base SHA)")
+    .action(async (pathArg, opts) => {
+    if (!opts.diff) {
+        process.stderr.write("  pr-comment: --diff <base> is required (the workflow passes the PR's base SHA).\n");
+        process.exit(64);
+    }
+    const { result } = await runScan(pathArg, { diff: opts.diff });
+    const { renderPrComment } = await import("./ui/prComment.js");
+    const body = renderPrComment(result);
+    const token = process.env.GITHUB_TOKEN;
+    const repoSlug = process.env.GITHUB_REPOSITORY;
+    const prNumber = process.env.PR_NUMBER ? Number(process.env.PR_NUMBER) : undefined;
+    if (!token || !repoSlug || !prNumber) {
+        process.stdout.write(body + "\n");
+        return;
+    }
+    const [owner, repo] = repoSlug.split("/");
+    const { postOrUpdateComment } = await import("./engine/github.js");
+    const posted = await postOrUpdateComment({ owner, repo, prNumber, token }, body);
+    if (!posted.posted) {
+        process.stderr.write(`  pr-comment: could not post to GitHub (${posted.error ?? "unknown error"}) — printing instead.\n`);
+        process.stdout.write(body + "\n");
+        return;
+    }
+    process.stderr.write(`  pr-comment: ${posted.updated ? "updated" : "posted"} the summary on PR #${prNumber}.\n`);
+});
 addCommon(program
     .command("ai-audit")
     .description("Focus on the AI-application / agent attack surface (doc 04)")
@@ -243,7 +321,7 @@ addCommon(program
 });
 program
     .command("db")
-    .description("Manage the local OSV vulnerability database (the only networked command)")
+    .description("Manage the local OSV vulnerability database (update is networked)")
     .argument("<action>", "update | status")
     .option("--no-color", "disable coloured output")
     .action(async (action, opts) => {

package/dist/repl.js

@@ -40,27 +40,62 @@ async function meterOrPrint(io) {
     }
     return r;
 }
-const HELP = [
-    "  Commands:",
-    "    scan [--json]                 full scan",
-    "    fix [--apply] [--yes] [--no-llm] [--json]   fix findings",
-    "    ai-audit | protect | attack-map | score | deps | ready   [--json]",
-    "    init [--force]                 wire up the pre-commit guard + CI",
-    "    config show | set-key <groq|anthropic> | unset-key <groq|anthropic>",
-    "    db update | status             manage the local OSV database",
-    "    cd <path>                      change the scan target",
-    "    pwd                            show the current scan target",
-    "    help                           this message",
-    "    exit | quit                    leave the session",
-].join("\n");
-/** Public entry point: real stdio, refuses to start without a TTY. */
+/** Public entry point: real stdio, refuses to start without a TTY. Mounts
+ * the Ink interactive app (ui/repl-tui/App.ts) -- runReplSession above stays
+ * the tested, TTY-free core; this is the real-terminal presentation layer. */
 export async function runRepl(initialPath) {
     if (!isInteractive()) {
         process.stderr.write("  repl needs an interactive terminal.\n");
         process.exitCode = 64;
         return;
     }
-    await runReplSession(initialPath, { input: process.stdin, output: process.stdout });
+    const { render } = await import("ink");
+    const React = (await import("react")).default;
+    const { App } = await import("./ui/repl-tui/App.js");
+    const { waitUntilExit } = render(React.createElement(App, { initialPath }));
+    await waitUntilExit();
+}
+/**
+ * Handle one line of input against the given state: built-in commands
+ * (exit/quit/q, help, pwd, cd) plus everything dispatch() handles. Returns
+ * true if the session should end after this line. Shared by the legacy
+ * readline loop (runReplSession, below) and the Ink app (ui/repl-tui/App.ts)
+ * — extracted so both drive the exact same behavior from one place.
+ */
+export async function processLine(line, state, io) {
+    const trimmed = line.trim();
+    if (!trimmed)
+        return false;
+    const tokens = tokenize(trimmed);
+    const cmd = tokens[0];
+    const rest = tokens.slice(1);
+    try {
+        if (cmd === "exit" || cmd === "quit" || cmd === "q")
+            return true;
+        if (cmd === "help" || cmd === "?") {
+            const { renderHelp } = await import("./ui/repl-tui/commandRegistry.js");
+            write(io, renderHelp() + "\n\n");
+            return false;
+        }
+        if (cmd === "pwd") {
+            write(io, `  ${state.root}\n\n`);
+            return false;
+        }
+        if (cmd === "cd") {
+            if (!rest[0]) {
+                write(io, "  usage: cd <path>\n\n");
+                return false;
+            }
+            state.root = path.resolve(state.root, rest[0]);
+            write(io, `  target: ${state.root}\n\n`);
+            return false;
+        }
+        await dispatch(cmd, rest, state, io);
+    }
+    catch (err) {
+        write(io, `  error: ${err?.message ?? err}\n\n`);
+    }
+    return false;
 }
 /** The actual session loop, over injectable streams — testable without a TTY. */
 export async function runReplSession(initialPath, io) {
@@ -72,39 +107,17 @@ export async function runReplSession(initialPath, io) {
     write(io, `  target: ${state.root}\n\n`);
     while (true) {
         const raw = await askLine(`securevibe (${path.basename(state.root)})> `, io.input, io.output);
-        const line = raw.trim();
-        if (!line)
-            continue;
-        const tokens = tokenize(line);
-        const cmd = tokens[0];
-        const rest = tokens.slice(1);
-        try {
-            if (cmd === "exit" || cmd === "quit" || cmd === "q")
-                break;
-            if (cmd === "help" || cmd === "?") {
-                write(io, HELP + "\n\n");
-                continue;
-            }
-            if (cmd === "pwd") {
-                write(io, `  ${state.root}\n\n`);
-                continue;
-            }
-            if (cmd === "cd") {
-                if (!rest[0]) {
-                    write(io, "  usage: cd <path>\n\n");
-                    continue;
-                }
-                state.root = path.resolve(state.root, rest[0]);
-                write(io, `  target: ${state.root}\n\n`);
-                continue;
-            }
-            await dispatch(cmd, rest, state, io);
-        }
-        catch (err) {
-            write(io, `  error: ${err?.message ?? err}\n\n`);
-        }
+        if (await processLine(raw, state, io))
+            break;
     }
 }
+/** Progress callback for scan()/runFix()/explainFindings(): prefers io.onProgress
+ * (Ink path) over the default scrolling-line behavior (legacy readline path). */
+function progressCallback(io, asJson) {
+    if (asJson)
+        return undefined;
+    return io.onProgress ?? ((m) => write(io, `  · ${m}\n`));
+}
 async function dispatch(cmd, tokens, state, io) {
     const asJson = hasFlag(tokens, "--json");
     if (["scan", "ai-audit", "protect", "attack-map", "score", "deps", "ready"].includes(cmd)) {
@@ -112,7 +125,7 @@ async function dispatch(cmd, tokens, state, io) {
         const usage = await meterOrPrint(io);
         const result = await scan(state.root, {
             aiOnly: cmd === "ai-audit",
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            onProgress: progressCallback(io, asJson),
         });
         state.lastResult = result;
         if (asJson) {
@@ -129,15 +142,28 @@ async function dispatch(cmd, tokens, state, io) {
         const opts = { apply: hasFlag(tokens, "--apply"), yes: hasFlag(tokens, "--yes"), json: asJson };
         const decision = decideApply(opts, true);
         if (decision.apply && !hasFlag(tokens, "--no-llm")) {
-            const { maybeOfferAiFixerSetup } = await import("./index-support.js");
-            await maybeOfferAiFixerSetup();
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
         }
         const usage = await meterOrPrint(io);
+        const confirmFn = decision.prompt
+            ? io.makeConfirm
+                ? io.makeConfirm(renderApprovalRequest)
+                : makeFixConfirm(renderApprovalRequest, io.input, io.output)
+            : undefined;
         const result = await runFix(state.root, {
             apply: decision.apply,
             noLlm: hasFlag(tokens, "--no-llm"),
-            confirm: decision.prompt ? makeFixConfirm(renderApprovalRequest, io.input, io.output) : undefined,
-            onProgress: asJson ? undefined : (m) => write(io, `  · ${m}\n`),
+            confirm: confirmFn,
+            onProgress: progressCallback(io, asJson),
         });
         if (asJson) {
             write(io, fixToJson(result) + "\n\n");
@@ -149,11 +175,52 @@ async function dispatch(cmd, tokens, state, io) {
         }
         return;
     }
+    if (cmd === "explain") {
+        if (!asJson) {
+            if (io.inkMode) {
+                const { noKeyNudgeMessage } = await import("./index-support.js");
+                const msg = noKeyNudgeMessage();
+                if (msg)
+                    write(io, msg);
+            }
+            else {
+                const { maybeOfferAiFixerSetup } = await import("./index-support.js");
+                await maybeOfferAiFixerSetup();
+            }
+        }
+        const { explainFindings } = await import("./engine/explain.js");
+        const usage = await meterOrPrint(io);
+        const { scan } = await import("./engine/scan.js");
+        const scanResult = await scan(state.root, { onProgress: progressCallback(io, asJson) });
+        state.lastResult = scanResult;
+        const report = await explainFindings(scanResult, {
+            onProgress: progressCallback(io, asJson),
+        });
+        if (asJson) {
+            const { explainToJson } = await import("./ui/explain.js");
+            write(io, explainToJson(report) + "\n\n");
+            return;
+        }
+        const { renderExplain } = await import("./ui/explain.js");
+        write(io, renderExplain(report, usage) + "\n");
+        return;
+    }
     if (cmd === "init") {
         const { runInit } = await import("./engine/init.js");
         const { renderInit } = await import("./ui/init.js");
         const result = await runInit(state.root, { force: hasFlag(tokens, "--force") });
         write(io, renderInit(result) + "\n");
+        const { maybeOfferAiFixerSetupDuringInit, noKeyNudgeMessage } = await import("./index-support.js");
+        await maybeOfferAiFixerSetupDuringInit(state.root, io.inkMode
+            ? {
+                writePreamble: (text) => write(io, text),
+                offer: async () => {
+                    const msg = noKeyNudgeMessage();
+                    if (msg)
+                        write(io, msg);
+                },
+            }
+            : undefined);
         return;
     }
     if (cmd === "config") {
@@ -207,6 +274,10 @@ async function handleConfig(tokens, io) {
         return;
     }
     if (action === "set-key") {
+        if (io.inkMode) {
+            write(io, `  config set-key needs a real terminal prompt — run \`securevibe config set-key ${provider}\` as a one-shot command outside the REPL (or set the ${provider === "groq" ? "GROQ_API_KEY" : "ANTHROPIC_API_KEY"} env var directly).\n\n`);
+            return;
+        }
         const hint = provider === "groq" ? " (free — console.groq.com/keys)" : " (console.anthropic.com)";
         const key = (await askLine(`  Paste your ${provider} API key${hint}: `, io.input, io.output)).trim();
         if (!key) {

package/dist/ui/explain.js

@@ -0,0 +1,72 @@
+/**
+ * `explain` view. Shows the AI-generated explanation per finding when
+ * available, falling back to the existing static why/fix text otherwise —
+ * an AI explanation is additional context, never a replacement, so the
+ * static text stays a guaranteed field in both the human and JSON output.
+ */
+import pc from "picocolors";
+import { renderBanner } from "./banner.js";
+import { renderUsageLine } from "./usage.js";
+const SEV_TAG = {
+    critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
+    high: (s) => pc.red(pc.bold(s)),
+    medium: (s) => pc.yellow(s),
+    low: (s) => pc.blue(s),
+    info: (s) => pc.dim(s),
+};
+export function renderExplain(report, usage) {
+    const L = [];
+    L.push(renderBanner({ subtitle: "AI-powered finding explanations" }));
+    L.push(pc.dim(`  ${report.root}`));
+    L.push("");
+    if (usage) {
+        L.push(renderUsageLine(usage));
+        L.push("");
+    }
+    if (report.results.length === 0) {
+        L.push(pc.green("  No critical/high findings to explain."));
+        L.push("");
+        return L.join("\n");
+    }
+    for (const r of report.results) {
+        const f = r.finding;
+        const sev = SEV_TAG[f.severity](` ${f.severity.toUpperCase()} `);
+        L.push(`  ${sev} ${pc.bold(f.title)} ${pc.dim(`(${f.file}:${f.line})`)}`);
+        if (r.explanation) {
+            L.push(`    ${pc.cyan("AI:")} ${r.explanation.trim()}`);
+        }
+        else {
+            L.push(`    ${pc.dim("why:")} ${f.why}`);
+            L.push(`    ${pc.dim("fix:")} ${f.fix}`);
+        }
+        L.push("");
+    }
+    if (report.truncatedCount > 0) {
+        const total = report.results.length + report.truncatedCount;
+        L.push(pc.dim(`  Showing the top ${report.results.length} of ${total} critical/high findings — re-run \`scan\` to see the rest.`));
+        L.push("");
+    }
+    if (!report.llmAvailable) {
+        L.push(pc.dim("  Set GROQ_API_KEY (free tier) or ANTHROPIC_API_KEY for AI-generated explanations — showing static guidance above. Run `securevibe config set-key groq`."));
+        L.push("");
+    }
+    return L.join("\n");
+}
+export function explainToJson(report) {
+    return JSON.stringify({
+        root: report.root,
+        llmAvailable: report.llmAvailable,
+        truncatedCount: report.truncatedCount,
+        results: report.results.map((r) => ({
+            id: r.finding.id,
+            detector: r.finding.detector,
+            severity: r.finding.severity,
+            file: r.finding.file,
+            line: r.finding.line,
+            title: r.finding.title,
+            why: r.finding.why,
+            fix: r.finding.fix,
+            explanation: r.explanation,
+        })),
+    }, null, 2);
+}

package/dist/ui/prComment.js

@@ -0,0 +1,55 @@
+import { SEVERITY_ORDER } from "../engine/types.js";
+import { PR_COMMENT_MARKER } from "../engine/github.js";
+const MAX_FINDINGS = 15;
+const SEV_LABEL = {
+    critical: "CRITICAL",
+    high: "HIGH",
+    medium: "MEDIUM",
+    low: "LOW",
+    info: "INFO",
+};
+const READINESS_LABEL = {
+    ship: "✓ Ship",
+    warn: "⚠ Ship with warnings",
+    block: "✗ Block deploy",
+};
+function severityCounts(findings) {
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    for (const f of findings)
+        counts[f.severity]++;
+    return ["critical", "high", "medium", "low"]
+        .filter((s) => counts[s] > 0)
+        .map((s) => `**${counts[s]}** ${SEV_LABEL[s]}`)
+        .join(" · ");
+}
+export function renderPrComment(result) {
+    const L = [];
+    L.push(PR_COMMENT_MARKER);
+    L.push("## SecureVibe — changed-files scan");
+    L.push("");
+    L.push(`**Grade ${result.score.grade}** (${result.score.composite}/100) — ${READINESS_LABEL[result.score.readiness]}`);
+    L.push("");
+    if (result.findings.length === 0) {
+        L.push("No findings in the files changed by this PR. ✓");
+        return L.join("\n");
+    }
+    L.push(severityCounts(result.findings));
+    L.push("");
+    const sorted = [...result.findings].sort((a, b) => SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity] || b.confidence - a.confidence);
+    const shown = sorted.slice(0, MAX_FINDINGS);
+    const remaining = sorted.length - shown.length;
+    for (const f of shown) {
+        L.push(`### ${SEV_LABEL[f.severity]} — ${f.title}`);
+        L.push(`\`${f.file}:${f.line}\``);
+        L.push("");
+        L.push(`**why:** ${f.why}`);
+        L.push("");
+        L.push(`**fix:** ${f.fix}`);
+        L.push("");
+    }
+    if (remaining > 0) {
+        L.push(`_+${remaining} more finding${remaining === 1 ? "" : "s"} — run \`securevibe scan\` locally to see all._`);
+        L.push("");
+    }
+    return L.join("\n");
+}

package/dist/ui/repl-tui/App.js

@@ -0,0 +1,130 @@
+import React, { useEffect, useRef, useState } from "react";
+import { Box, Static, Text, useApp, useInput } from "ink";
+import path from "node:path";
+import { mapAnswer } from "../prompt.js";
+import { processLine } from "../../repl.js";
+import { makeCallbackWritable } from "./outputStream.js";
+import { filterCommands } from "./commandRegistry.js";
+import { StatusLine } from "./StatusLine.js";
+import { InputBox } from "./InputBox.js";
+import { SlashMenu } from "./SlashMenu.js";
+import { Spinner } from "./Spinner.js";
+const h = React.createElement;
+// Static<T> is generic; createElement can't infer T from an untyped call the
+// way JSX's <Static<string>> would. Pin T=string via a TS instantiation
+// expression instead of casting the props object.
+const StringStatic = (Static);
+/**
+ * Top-level Ink app: <Static> scrollback (everything dispatch() writes,
+ * unchanged from the plain-text output the legacy readline loop already
+ * produces) above a live bottom region (status line, spinner, slash menu,
+ * input box). Every submitted line goes through the exact same
+ * processLine() the legacy readline loop and repl.test.ts already exercise
+ * (Task 1) -- this component only changes how a line is captured and how
+ * output is framed, never what a command does.
+ */
+export function App({ initialPath }) {
+    const { exit } = useApp();
+    const stateRef = useRef({ root: path.resolve(initialPath) });
+    const [lines, setLines] = useState([]);
+    const [value, setValue] = useState("");
+    const [history, setHistory] = useState([]);
+    const [busy, setBusy] = useState(false);
+    const [progressMessage, setProgressMessage] = useState(null);
+    const [confirmKind, setConfirmKind] = useState(null);
+    const [selectedMenuIndex, setSelectedMenuIndex] = useState(0);
+    const confirmResolverRef = useRef(null);
+    const pushLine = (text) => setLines((prev) => [...prev, text]);
+    useEffect(() => {
+        (async () => {
+            const { applyStoredKeysToEnv } = await import("../../config.js");
+            await applyStoredKeysToEnv();
+            const { renderBanner } = await import("../banner.js");
+            pushLine(renderBanner({ subtitle: "interactive session — type `help` or `/`" }) + "\n");
+            pushLine(`  target: ${stateRef.current.root}\n`);
+        })();
+    }, []);
+    const menuOpen = value.startsWith("/");
+    const filteredCommands = menuOpen ? filterCommands(value.slice(1)) : [];
+    const clampedIndex = Math.min(selectedMenuIndex, Math.max(0, filteredCommands.length - 1));
+    useInput((_input, key) => {
+        if (!menuOpen)
+            return;
+        if (key.upArrow)
+            setSelectedMenuIndex((i) => Math.max(0, i - 1));
+        if (key.downArrow)
+            setSelectedMenuIndex((i) => Math.min(filteredCommands.length - 1, i + 1));
+        if (key.escape)
+            setValue("");
+    });
+    const handleChange = (v) => {
+        setSelectedMenuIndex(0);
+        setValue(v);
+    };
+    const handleSubmit = async (line) => {
+        if (confirmResolverRef.current) {
+            const answer = mapAnswer(line, confirmKind ?? "patch");
+            confirmResolverRef.current(answer);
+            setValue("");
+            return;
+        }
+        // A command is already running (busy stays true for its whole duration,
+        // including while a confirm is pending -- but that case already returned
+        // above). Ignore a second real submission rather than racing two
+        // processLine() calls over the same mutable ReplState. The legacy
+        // readline loop can't hit this: only one askLine() is ever pending, so
+        // there's no way to submit a second line before the first resolves.
+        if (busy)
+            return;
+        if (menuOpen) {
+            const chosen = filteredCommands[clampedIndex];
+            setValue(chosen ? chosen.name + " " : "");
+            return;
+        }
+        if (!line.trim()) {
+            setValue("");
+            return;
+        }
+        setHistory((prev) => [...prev, line]);
+        setValue("");
+        setBusy(true);
+        setProgressMessage(null);
+        const io = {
+            input: process.stdin,
+            output: makeCallbackWritable(pushLine),
+            inkMode: true,
+            onProgress: (m) => setProgressMessage(m),
+            makeConfirm: (render) => {
+                return (req) => new Promise((resolve) => {
+                    pushLine(render(req) + "\n");
+                    setConfirmKind(req.kind);
+                    confirmResolverRef.current = (answer) => {
+                        setConfirmKind(null);
+                        confirmResolverRef.current = null;
+                        resolve(answer);
+                    };
+                });
+            },
+        };
+        const shouldExit = await processLine(line, stateRef.current, io);
+        setBusy(false);
+        setProgressMessage(null);
+        if (shouldExit)
+            exit();
+    };
+    return h(React.Fragment, null, h(StringStatic, {
+        items: lines,
+        children: (line, i) => h(Text, { key: i }, line),
+    }), h(Box, { flexDirection: "column" }, h(StatusLine, { targetRoot: stateRef.current.root }), busy && progressMessage ? h(Spinner, { message: progressMessage }) : null, confirmKind
+        ? h(Text, { dimColor: true }, confirmKind === "patch"
+            ? "  Apply this change? [y]es / [n]o / [a]ll / [q]uit"
+            : "  Apply these supporting changes? [y]es / [n]o")
+        : null, menuOpen ? h(SlashMenu, { items: filteredCommands, selectedIndex: clampedIndex }) : null, h(InputBox, {
+        value,
+        onChange: handleChange,
+        onSubmit: handleSubmit,
+        history,
+        onHistoryNavigate: setValue,
+        menuOpen,
+    })));
+}

package/dist/ui/repl-tui/InputBox.js

@@ -0,0 +1,48 @@
+import React, { useState } from "react";
+import { Box, Text, useInput } from "ink";
+import TextInput from "ink-text-input";
+const h = React.createElement;
+/**
+ * Bordered single-line input (`>` prompt, rounded border). Up/down arrow
+ * cycles `history`, but only when the slash menu isn't open -- App.ts's own
+ * useInput takes over up/down for menu-item selection in that state.
+ * TextInput itself only handles left/right cursor movement and
+ * backspace/delete, never up/down, so there's no conflict between this
+ * hook and TextInput's own internal input handling.
+ */
+export function InputBox({ value, onChange, onSubmit, history, onHistoryNavigate, menuOpen }) {
+    const [historyIndex, setHistoryIndex] = useState(null);
+    useInput((_input, key) => {
+        if (menuOpen)
+            return;
+        if (key.upArrow) {
+            if (history.length === 0)
+                return;
+            const next = historyIndex === null ? history.length - 1 : Math.max(0, historyIndex - 1);
+            setHistoryIndex(next);
+            onHistoryNavigate(history[next]);
+            return;
+        }
+        if (key.downArrow) {
+            if (historyIndex === null)
+                return;
+            const next = historyIndex + 1;
+            if (next >= history.length) {
+                setHistoryIndex(null);
+                onHistoryNavigate("");
+            }
+            else {
+                setHistoryIndex(next);
+                onHistoryNavigate(history[next]);
+            }
+        }
+    });
+    return h(Box, { borderStyle: "round", paddingX: 1 }, h(Text, null, "> "), h(TextInput, {
+        value,
+        onChange: (v) => {
+            setHistoryIndex(null);
+            onChange(v);
+        },
+        onSubmit,
+    }));
+}

package/dist/ui/repl-tui/SlashMenu.js

@@ -0,0 +1,10 @@
+import React from "react";
+import { Box, Text } from "ink";
+const h = React.createElement;
+/** Purely presentational -- App.ts owns navigation (up/down) and selection (Enter). */
+export function SlashMenu({ items, selectedIndex }) {
+    if (items.length === 0) {
+        return h(Box, { paddingX: 1 }, h(Text, { dimColor: true }, "no matching commands"));
+    }
+    return h(Box, { flexDirection: "column", paddingX: 1 }, ...items.map((item, i) => h(Text, { key: item.name, color: i === selectedIndex ? "cyan" : undefined }, `${i === selectedIndex ? "› " : "  "}/${item.name} ${item.args} — ${item.description}`)));
+}