vibehacker 4.1.0 → 4.2.0

package/src/src/app.js

@@ -0,0 +1,2151 @@
+'use strict';
+
+// WSL / terminal compatibility — must be set before blessed loads
+if (!process.env.TERM || process.env.TERM === 'dumb') {
+  process.env.TERM = 'xterm-256color';
+}
+
+const blessed = require('blessed');
+const path = require('path');
+const { Agent, MODES } = require('./agent');
+const { ModelManager } = require('./models');
+const { ProviderManager, PROVIDERS } = require('./providers');
+const { ERR, isCircuitOpen, getHealth } = require('./api');
+const { showWelcome } = require('./welcome');
+const { showApproval, NEEDS_APPROVAL, getAllowKey } = require('./approve');
+const { showSetup } = require('./setup');
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function esc(str) {
+  return String(str).replace(/\{/g, '\\{').replace(/\}/g, '\\}');
+}
+
+// XmlStreamFilter — strips tool XML blocks (raw or ```xml fenced) from
+// streamed AI output so nothing leaks on screen.
+// .feed(token) → visible text to display (may be empty string)
+// .reset()     → call between tool iterations
+// Sync tool names from tools.js + add thinking block support
+const { TOOL_TAG_NAMES } = require('./tools');
+const TOOL_NAMES = [...TOOL_TAG_NAMES];
+// Suppressed block tags: tool calls AND thinking blocks
+const SUPPRESSED_NAMES = [...TOOL_NAMES, 'think', 'thinking'];
+const TOOL_OPEN_TAGS  = SUPPRESSED_NAMES.map(n => `<${n}>`);
+const TOOL_CLOSE_TAGS = SUPPRESSED_NAMES.map(n => `</${n}>`);
+// Also catch ``` ```xml fenced variants
+const FENCE_OPENERS = ['```xml\n', '```xml\r\n', '```\n<', '```\r\n<'];
+
+// Pre-compute max tag length for safe buffer holdback
+const _maxTagLen = Math.max(...TOOL_OPEN_TAGS.map(t => t.length), ...FENCE_OPENERS.map(t => t.length), 1);
+
+class XmlStreamFilter {
+  constructor() { this.reset(); }
+
+  reset() {
+    this._chunks  = [];    // array-based accumulation (O(1) append vs O(n) string concat)
+    this._buf     = '';    // materialized only when scanning
+    this._emitted = 0;
+    this._inBlock = false;
+    this._fence   = false;
+    this._dirty   = false; // tracks if _chunks has new data since last _materialize
+  }
+
+  feed(token) {
+    this._chunks.push(token);
+    this._dirty = true;
+    return this._drain();
+  }
+
+  _materialize() {
+    if (this._dirty) {
+      this._buf += this._chunks.join('');
+      this._chunks.length = 0;
+      this._dirty = false;
+    }
+  }
+
+  _drain() {
+    this._materialize();
+    let out = '';
+
+    while (true) {
+      if (!this._inBlock) {
+        const slice = this._buf.substring(this._emitted);
+        if (!slice) break;
+
+        // Find earliest suppressed block opener
+        let earliest = -1;
+        let isFence  = false;
+
+        for (const tag of TOOL_OPEN_TAGS) {
+          const pos = slice.indexOf(tag);
+          if (pos !== -1 && (earliest === -1 || pos < earliest)) { earliest = pos; isFence = false; }
+        }
+        for (const fence of FENCE_OPENERS) {
+          const pos = slice.indexOf(fence);
+          if (pos !== -1 && (earliest === -1 || pos < earliest)) { earliest = pos; isFence = true; }
+        }
+
+        if (earliest === -1) {
+          // Emit everything except holdback zone (partial tag guard)
+          const safe = Math.max(0, slice.length - _maxTagLen);
+          if (safe > 0) { out += slice.substring(0, safe); this._emitted += safe; }
+          break;
+        }
+
+        // Emit clean text before block
+        const before = slice.substring(0, earliest).replace(/\s+$/, '');
+        if (before) out += before + '\n';
+        this._emitted += earliest;
+        this._inBlock = true;
+        this._fence   = isFence;
+
+      } else {
+        const slice = this._buf.substring(this._emitted);
+        let found = -1, foundLen = 0;
+
+        if (this._fence) {
+          const fc = slice.indexOf('\n```');
+          if (fc !== -1) { found = fc + 4; if (this._buf[this._emitted + found] === '\n') found++; }
+        } else {
+          for (const tag of TOOL_CLOSE_TAGS) {
+            const pos = slice.indexOf(tag);
+            if (pos !== -1 && (found === -1 || pos < found)) { found = pos; foundLen = tag.length; }
+          }
+          if (found !== -1) { found += foundLen; if (this._buf[this._emitted + found] === '\n') found++; }
+        }
+
+        if (found === -1) break;
+        this._emitted += found;
+        this._inBlock = false;
+        this._fence   = false;
+      }
+    }
+
+    // Compact buffer periodically to prevent memory growth
+    if (this._emitted > 8192) {
+      this._buf = this._buf.substring(this._emitted);
+      this._emitted = 0;
+    }
+
+    return out;
+  }
+}
+
+// Icon per tool name
+function _toolIcon(name) {
+  const icons = {
+    read_file:        '📄',
+    edit_file:        '✏️ ',
+    write_file:       '📝',
+    execute_command:  '⚡',
+    list_files:       '📂',
+    search_files:     '🔍',
+    grep:             '🔎',
+    glob:             '📂',
+    create_directory: '📁',
+    delete_file:      '🗑 ',
+  };
+  return icons[name] || '🔧';
+}
+
+// Format tool args into a short human-readable summary
+function _fmtToolArgs(name, args) {
+  if (!args) return '';
+  if (name === 'read_file') {
+    let s = args.path || '';
+    if (args.offset || args.limit) s += `  (lines ${args.offset || 1}-${(args.offset || 1) + (args.limit || 0)})`;
+    return s;
+  }
+  if (name === 'edit_file') return `${args.path}  (${args.replace_all ? 'replace all' : 'edit'})`;
+  if (name === 'delete_file' || name === 'create_directory') return args.path || '';
+  if (name === 'write_file') return `${args.path}  (${args.content ? args.content.split('\n').length + ' lines' : ''})`;
+  if (name === 'execute_command') return args.command || '';
+  if (name === 'list_files')  return `${args.path || '.'}${args.recursive ? '  (recursive)' : ''}`;
+  if (name === 'search_files' || name === 'grep') return `"${args.pattern}"  in  ${args.path || '.'}`;
+  if (name === 'glob') return args.pattern || '';
+  return JSON.stringify(args).substring(0, 60);
+}
+
+function fmtCtx(n) {
+  if (n >= 1000000) return `${(n / 1000000).toFixed(1)}M`;
+  if (n >= 1000)    return `${Math.floor(n / 1000)}k`;
+  return String(n);
+}
+
+// ── App ──────────────────────────────────────────────────────────────────────
+
+class HackerCLIApp {
+  constructor() {
+    this.agent     = new Agent();
+    this.models    = new ModelManager();
+    this.providers = new ProviderManager(this.models); // Multi-provider rotation
+    this.modeIndex = 0;
+    this.inputHistory  = [];
+    this.historyIndex  = -1;
+    this.isProcessing  = false;
+    this._spinnerTimer = null;
+    this._menuOpen     = false;
+    this._abortCtrl    = null;
+    this._inputBuf     = '';
+    this._lastMessage  = '';     // for Ctrl+R retry
+    this._dailyLimitHit  = false; // all providers exhausted
+    this._alwaysAllowed  = new Set(); // keys of always-approved tool patterns
+    this._lastToolContext = '';  // last AI prose before a tool call (for dialog context)
+    // Animation state
+    this._tokenCount    = 0;
+    this._reqStartTime  = null;
+    this._toolStepCount = 0;
+    // no header animation
+    // Retry tracking — prevents infinite loops
+    this._triedModels   = new Set();   // model IDs tried this request
+    this._pinnedModel   = false;       // true once user manually picks a model — disables silent auto-switching
+    this._inCodeBlock   = false;       // tracks ``` state during streaming for clean code rendering
+    this._codeLang      = '';          // language tag of active code fence
+    this._renderPending = false;       // coalesces screen.render() calls into ~60fps
+    this._retryCount    = 0;           // total retries this request
+    this._maxRetries    = 6;           // hard cap on auto-retries
+    // Tier info (from Supabase)
+    this._tier          = null;        // 'free' | 'pro' | null (unknown)
+    this._remaining     = null;        // requests remaining today (-1 = unlimited)
+    this._dailyLimit    = null;        // daily limit
+  }
+
+  // ── Init ─────────────────────────────────────────────────────────────────
+
+  async start() {
+    const headerH = 3; // single line + border
+
+    this.screen = blessed.screen({
+      smartCSR:    true,
+      title:       'Vibe Hacker — Cybersecurity Assistant',
+      fullUnicode: true,
+      forceUnicode: true,
+      dockBorders: true,
+    });
+
+    // ── Header — single compact bar ──
+    this.header = blessed.box({
+      top: 0, left: 0, width: '100%', height: headerH,
+      tags:  true,
+      content: this._buildHeaderContent(),
+      border: { type: 'line' },
+      style: { fg: '#00ff88', bg: 'black', border: { fg: '#005500' } },
+      padding: { left: 1 },
+    });
+
+    // ── Chat log ──
+    this.chat = blessed.log({
+      top: headerH, left: 0, width: '100%',
+      height: `100%-${headerH + 5}`,
+      tags: true, scrollable: true, alwaysScroll: true,
+      mouse: true,
+      scrollbar: { ch: '▐', style: { fg: '#003300', bg: 'black' } },
+      border: { type: 'line' },
+      style: { fg: '#00ff00', bg: 'black', border: { fg: '#003300' } },
+      padding: { left: 1, right: 1 },
+    });
+
+    // ── Input wrap ──
+    this.inputWrap = blessed.box({
+      bottom: 1, left: 0, width: '100%', height: 4,
+      tags: true,
+      border: { type: 'line' },
+      label: ' {#00ff88-fg}{bold} ❯ {/bold}{/#00ff88-fg} ',
+      style: { fg: '#00ff00', bg: 'black', border: { fg: '#00aa44' } },
+    });
+
+    // CRITICAL: inputOnFocus MUST be false — it steals raw keypresses from
+    // overlay lists. We manage keyboard input manually via screen.on('keypress').
+    this.inputBox = blessed.textarea({
+      parent: this.inputWrap,
+      top: 0, left: 0, width: '100%-2', height: 2,
+      inputOnFocus: false,
+      mouse: true,
+      style: { fg: '#00ff88', bg: 'black' },
+    });
+
+    this.modeBar = blessed.text({
+      parent: this.inputWrap,
+      bottom: 0, left: 1, width: '100%-3', height: 1,
+      tags: true,
+      content: this._modeBarContent(),
+      style: { fg: '#00aa00', bg: 'black' },
+    });
+
+    // ── Pet bar (bottom — animated mascot) ──
+    this.petBar = blessed.box({
+      bottom: 0, left: 0, width: '100%', height: 1,
+      tags: true,
+      content: '',
+      style: { fg: '#003300', bg: 'black' },
+      padding: { left: 1 },
+    });
+    this._startPet();
+
+    this.screen.append(this.header);
+    this.screen.append(this.chat);
+    this.screen.append(this.inputWrap);
+    this.screen.append(this.petBar);
+
+    this._bindKeys();
+    this.screen.render();
+    this.inputBox.focus();
+    this._syncInputDisplay();
+    this._refreshHeader();
+
+    // ── First-run setup — each user provides their own API key ──
+    // This is critical for production: no shared keys, each user = own limits
+    const cfg = require('./config');
+    if (!cfg.hasKey()) {
+      const key = await showSetup(this.screen);
+      if (key) {
+        this.providers.add(key);
+        this.providers.clearLimits();
+        this._updateModeBar();
+        this._freshSetup = true; // skip silent key check — model fetch validates key
+      }
+    }
+
+    // ── Welcome screen — fast fade-in logo ──
+    await showWelcome(this.screen);
+
+    // ── Post-welcome ──
+    this.inputBox.focus();
+    this._syncInputDisplay();
+
+    const _cwd = (() => { try { const c = process.cwd(); return c || ''; } catch (_) { return ''; } })() || require('os').homedir() || '/';
+    this.agent.setCwd(_cwd);
+
+    // ── Professional disclaimer + greeting ──
+    this._log('');
+    this._log('  {green-fg}{bold}◈ Vibe Hacker{/bold}{/green-fg}  {#00aa66-fg}Cybersecurity Assistant{/#00aa66-fg}');
+    this._log('  {#333333-fg}────────────────────────────────────────────────{/#333333-fg}');
+    this._log('  {#888888-fg}Vibe Hacker is a professional-grade assistant for{/#888888-fg}');
+    this._log('  {#888888-fg}authorized security testing and research only.{/#888888-fg}');
+    this._log('');
+    this._log('  {#666666-fg}By using this tool you acknowledge that you{/#666666-fg}');
+    this._log('  {#666666-fg}are solely responsible for your actions. The{/#666666-fg}');
+    this._log('  {#666666-fg}authors assume no liability for misuse, damage,{/#666666-fg}');
+    this._log('  {#666666-fg}or unlawful activity of any kind.{/#666666-fg}');
+    this._log('  {#333333-fg}────────────────────────────────────────────────{/#333333-fg}');
+    this._log('');
+    this._log('  {#00ff88-fg}{bold}Hello hacker — what are we vibing today?{/bold}{/#00ff88-fg}');
+    this._log('  {#444444-fg}Type your task, or press / for commands.{/#444444-fg}');
+    this._log('');
+    this.screen.render();
+
+    // Always silently refresh models on startup — no picker, no prompts
+    const cfg2 = require('./config');
+    if (cfg2.hasKey()) {
+      this._silentModelRefresh();
+      this._checkTier();
+    }
+
+    // Background update check — delayed 3s so it doesn't slow the first render
+    setTimeout(() => this._checkForUpdate(), 3000);
+  }
+
+  // ── Key binding ───────────────────────────────────────────────────────────
+
+  _bindKeys() {
+    const sc = this.screen;
+
+    // Global keys (always active)
+    // Ctrl+C — exit immediately (blessed may intercept SIGINT before process handler)
+    sc.key(['C-c'], () => this._exit());
+    sc.key(['C-l'], () => {
+      this.chat.setContent('');
+      this._log('{#444444-fg}[cleared]{/#444444-fg}');
+      sc.render();
+    });
+    sc.key(['C-p'], () => { if (!this._menuOpen) this._showPalette(); });
+    // Model picker
+    sc.key(['C-n'], () => { if (!this._menuOpen && !this.isProcessing) this._showModelPicker(); });
+    // Retry last message
+    sc.key(['C-r'], () => {
+      if (this.isProcessing || !this._lastMessage) return;
+      this._log('{#444444-fg}[retrying last message…]{/#444444-fg}');
+      this.screen.render();
+      this._submit(this._lastMessage);
+    });
+    // Cancel in-progress request
+    sc.key(['C-x'], () => {
+      if (this.isProcessing) {
+        if (this._abortCtrl) this._abortCtrl.abort();
+        this.isProcessing = false;
+        this._stopSpinner();
+        this._log('{yellow-fg}[cancelled]{/yellow-fg}');
+        this.screen.render();
+      }
+    });
+
+    sc.key(['tab'], () => {
+      if (this.isProcessing || this._menuOpen) return;
+      this.modeIndex = (this.modeIndex + 1) % MODES.length;
+      this.agent.setMode(MODES[this.modeIndex].id);
+      this._updateModeBar();
+    });
+
+    // Smooth scrolling — scroll by a few lines, not half-page jumps
+    const SCROLL_LINES = 3;
+    const PAGE_LINES   = () => Math.max(3, Math.floor(this.chat.height / 2));
+    sc.key(['pageup'],   () => { this.chat.scroll(-PAGE_LINES()); sc.render(); });
+    sc.key(['pagedown'], () => { this.chat.scroll( PAGE_LINES()); sc.render(); });
+
+    // Mouse wheel scrolling — smooth 3-line increments
+    this.chat.on('wheelup',   () => { this.chat.scroll(-SCROLL_LINES); this.screen.render(); });
+    this.chat.on('wheeldown', () => { this.chat.scroll( SCROLL_LINES); this.screen.render(); });
+
+    // ── Manual keyboard input (bypasses inputOnFocus raw capture) ──
+    sc.on('keypress', (ch, key) => {
+      // Route to menu handler when overlay is open
+      if (this._menuOpen) {
+        if (this._menuKeyHandler) this._menuKeyHandler(ch, key);
+        return;
+      }
+      if (!key || key.ctrl || key.meta) return;
+
+      const name = key.name;
+
+      if (name === 'enter' || name === 'return') {
+        if (this.isProcessing) return;
+        const val = this._inputBuf.trim();
+        if (val) this._submit(val);
+        return;
+      }
+
+      if (name === 'escape') {
+        this._inputBuf = '';
+        this.historyIndex = -1;
+        this._syncInputDisplay();
+        return;
+      }
+
+      if (name === 'backspace') {
+        this._inputBuf = this._inputBuf.slice(0, -1);
+        this._syncInputDisplay();
+        return;
+      }
+
+      if (name === 'up') {
+        if (!this.inputHistory.length) return;
+        if (this.historyIndex < this.inputHistory.length - 1) {
+          this.historyIndex++;
+          this._inputBuf = this.inputHistory[this.inputHistory.length - 1 - this.historyIndex];
+          this._syncInputDisplay();
+        }
+        return;
+      }
+
+      if (name === 'down') {
+        if (this.historyIndex > 0) {
+          this.historyIndex--;
+          this._inputBuf = this.inputHistory[this.inputHistory.length - 1 - this.historyIndex];
+        } else {
+          this.historyIndex = -1;
+          this._inputBuf = '';
+        }
+        this._syncInputDisplay();
+        return;
+      }
+
+      // Slash menu trigger — clear input immediately, open menu
+      if (ch === '/' && this._inputBuf === '') {
+        if (!this._menuOpen) {
+          this._inputBuf = '';
+          this._syncInputDisplay();
+          this._showSlashMenu();
+        }
+        return;
+      }
+
+      // Regular char
+      if (ch && ch.length === 1) {
+        this._inputBuf += ch;
+        this._syncInputDisplay();
+      }
+    });
+  }
+
+  // Sync the visible textarea content with our manual buffer
+  _syncInputDisplay() {
+    this.inputBox.setValue(this._inputBuf);
+    // Update input label to show prompt indicator
+    const label = this.isProcessing
+      ? ' {#444444-fg}processing…{/#444444-fg} '
+      : ' {#00ff88-fg}{bold} ❯ {/bold}{/#00ff88-fg} ';
+    this.inputWrap.setLabel(label);
+
+    // Dynamic height — expand input box for long / multi-line text
+    const cols = (this.screen.width || 80) - 4; // account for border + padding
+    const lines = this._inputBuf.split('\n');
+    let visualLines = 0;
+    for (const ln of lines) {
+      visualLines += Math.max(1, Math.ceil((ln.length || 1) / Math.max(1, cols)));
+    }
+    const innerH = Math.min(10, Math.max(1, visualLines));   // 1–10 lines
+    const wrapH  = innerH + 3;                                // border(2) + modeBar(1)
+    if (this.inputBox.height !== innerH) {
+      this.inputBox.height = innerH;
+      this.inputWrap.height = wrapH;
+    }
+    this.screen.render();
+  }
+
+  // ── Display helpers ───────────────────────────────────────────────────────
+
+  _modeBarContent() {
+    const mode     = MODES[this.modeIndex];
+    const provider = this.providers.current();
+    const model    = this.providers.currentModel();
+
+    // Account tier badge
+    let acctBadge;
+    if (this._tier === 'pro') {
+      acctBadge = '{#ffaa00-fg}PRO{/#ffaa00-fg}';
+    } else if (this._tier === 'free') {
+      acctBadge = '{#00cc44-fg}FREE{/#00cc44-fg}';
+    } else {
+      acctBadge = this.providers.isCurrentFree()
+        ? '{#00cc44-fg}FREE{/#00cc44-fg}'
+        : '{yellow-fg}PAID{/yellow-fg}';
+    }
+
+    // Show "Vibe Model" — never expose which underlying model is used
+    return (
+      `{cyan-fg}{bold}${mode.name}{/bold}{/cyan-fg} ` +
+      `{#1a3a1a-fg}│{/#1a3a1a-fg} ` +
+      `{#44ff88-fg}Vibe Hacker{/#44ff88-fg} ` +
+      `{#1a3a1a-fg}›{/#1a3a1a-fg} ` +
+      `{#88ff88-fg}Vibe Model{/#88ff88-fg} ` +
+      `{#1a3a1a-fg}[{/#1a3a1a-fg}${acctBadge}{#1a3a1a-fg}]{/#1a3a1a-fg}`
+    );
+  }
+
+  // ── Animated pet mascot ────────────────────────────────────────────────────
+
+  _startPet() {
+    const petFrames = [
+      ['(⟐)', ' ⟐ ', '(⟐)', ' ⟐ '],                     // idle blink
+      ['(⟐)  ~', '(⟐) ~~', '(⟐)~~~', '(⟐) ~~', '(⟐)  ~'],   // thinking waves
+      ['{#00ff88-fg}(⟐){/#00ff88-fg}', '{#00cc66-fg}(⟐){/#00cc66-fg}', '{#009944-fg}(⟐){/#009944-fg}', '{#00cc66-fg}(⟐){/#00cc66-fg}'], // pulse
+    ];
+    this._petMode = 0; // 0=idle, 1=thinking, 2=pulse
+    this._petFrame = 0;
+    this._petPos = 0;
+    this._petDir = 1;
+
+    const w = () => (this.screen && this.screen.width) ? this.screen.width - 4 : 76;
+
+    this._petTimer = setInterval(() => {
+      // Skip pet updates while streaming — avoids render contention with tokens
+      if (this.isProcessing && this._petMode !== 1) return;
+      this._petFrame++;
+      const frames = petFrames[this._petMode] || petFrames[0];
+      const pet = frames[this._petFrame % frames.length];
+
+      // Slowly wander left/right
+      if (this._petFrame % 3 === 0) {
+        this._petPos += this._petDir;
+        const maxPos = w() - 20;
+        if (this._petPos >= maxPos) this._petDir = -1;
+        if (this._petPos <= 0) this._petDir = 1;
+      }
+
+      const pad = ' '.repeat(Math.max(0, this._petPos));
+      const msg = this._petMsg || '';
+      this.petBar.setContent(
+        `${pad}{#004400-fg}${pet}{/#004400-fg}` +
+        (msg ? `  {#333333-fg}${msg}{/#333333-fg}` : '')
+      );
+      this._scheduleRender();
+    }, 600);
+  }
+
+  _setPetMode(mode, msg) {
+    this._petMode = mode;
+    this._petMsg = msg || '';
+  }
+
+  _updateModeBar() {
+    this.modeBar.setContent(this._modeBarContent());
+    this._refreshHeader();
+    this.screen.render();
+  }
+
+  _log(text) {
+    this.chat.log(text);
+  }
+
+  _startSpinner(msg) {
+    this._setPetMode(1, msg); // thinking mode
+    const spinStart = this._reqStartTime || Date.now();
+    clearInterval(this._spinnerTimer);
+    this._spinnerTimer = setInterval(() => {
+      const elapsed = ((Date.now() - spinStart) / 1000).toFixed(1);
+      const tokStr = this._tokenCount > 0 ? ` · ${this._tokenCount} tok` : '';
+      const stepStr = this._toolStepCount > 0 ? ` · step ${this._toolStepCount}` : '';
+      this._setPetMode(1, `${msg} ${elapsed}s${tokStr}${stepStr}`);
+    }, 500);
+  }
+
+  _stopSpinner() {
+    clearInterval(this._spinnerTimer);
+    this._spinnerTimer = null;
+    this._setPetMode(0, ''); // back to idle
+  }
+
+  // ── Header content builder ────────────────────────────────────────────────
+
+  _buildHeaderContent() {
+    const model = this.providers ? this.providers.currentModel() : null;
+    const modelName = model ? 'Vibe Model' : '—';
+    const mode = MODES[this.modeIndex];
+
+    // Tier badge with remaining requests
+    let tierBadge = '';
+    if (this._tier === 'pro') {
+      tierBadge = '{#ffaa00-fg}{bold}PRO{/bold}{/#ffaa00-fg}';
+    } else {
+      const limit = this._dailyLimit || 50;
+      const r = this._remaining !== null && this._remaining !== undefined ? this._remaining : limit;
+      const color = r > 25 ? '#00cc44' : r > 10 ? '#ffaa00' : r > 0 ? '#ff6600' : '#ff4444';
+      tierBadge = `{${color}-fg}${r}/${limit}{/${color}-fg}`;
+    }
+
+    return (
+      ` {#00ff88-fg}{bold}vibsecurity.com{/bold}{/#00ff88-fg}` +
+      `  {#003300-fg}│{/#003300-fg}  ` +
+      `{cyan-fg}{bold}${mode.name}{/bold}{/cyan-fg}` +
+      `  {#003300-fg}│{/#003300-fg}  ` +
+      `{#008844-fg}${esc(modelName)}{/#008844-fg}` +
+      (tierBadge ? `  {#003300-fg}│{/#003300-fg}  ${tierBadge}` : '')
+    );
+  }
+
+  // ── Animated header ──────────────────────────────────────────────────────
+
+  _refreshHeader() {
+    try {
+      this.header.setContent(this._buildHeaderContent());
+      this.screen.render();
+    } catch (_) {}
+  }
+
+  // ── Overlay helper — menu overlay ─────────────────────────────────────────
+  // Returns promise → selected index or -1.
+  // Key handling is on SCREEN level (blessed list with keys:false doesn't
+  // receive keypress events). We intercept in _bindKeys via _menuKeyHandler.
+
+  _openList({ label, items, selectedIndex = 0, width: customWidth, skipFn }) {
+    return new Promise((resolve) => {
+      this._menuOpen = true;
+      const sc = this.screen;
+
+      const listW = customWidth || Math.min(54, sc.width - 6);
+      const listH = Math.min(items.length + 2, sc.height - 6);
+
+      // ── List ──
+      const list = blessed.list({
+        parent: sc,
+        top: 'center',
+        left: 'center',
+        width: listW,
+        height: listH,
+        tags: true,
+        keys: false,
+        vi: false,
+        mouse: true,
+        scrollable: true, alwaysScroll: true,
+        border: { type: 'line' },
+        label: ` ${label} `,
+        scrollbar: { ch: '▐', style: { fg: '#003300', bg: 'black' } },
+        style: {
+          fg: '#88ff88', bg: '#000a00',
+          border: { fg: '#00aa44' },
+          selected: { fg: '#000000', bg: '#00ff88', bold: true },
+          item: { fg: '#77dd77', hover: { fg: '#00ff88' } },
+          label: { fg: '#00ff88', bold: true },
+        },
+        items,
+      });
+
+      // Skip header rows on initial selection
+      let initIdx = selectedIndex;
+      if (skipFn) {
+        while (initIdx < items.length && skipFn(initIdx)) initIdx++;
+        if (initIdx >= items.length) initIdx = 0;
+      }
+      list.select(initIdx);
+      list.focus();
+      sc.render();
+
+      let resolved = false;
+      const done = (idx) => {
+        if (resolved) return;
+        resolved = true;
+        this._menuOpen = false;
+        this._menuKeyHandler = null;
+        try { list.destroy(); } catch (_) {}
+        this.inputBox.focus();
+        sc.render();
+        resolve(idx);
+      };
+
+      // Install screen-level key handler for this menu
+      this._menuKeyHandler = (ch, key) => {
+        if (resolved) return;
+        const name = key ? key.name : '';
+
+        const moveSkip = (dir) => {
+          if (!skipFn) return;
+          let i = list.selected;
+          while (i + dir >= 0 && i + dir < items.length && skipFn(i + dir)) {
+            if (dir > 0) list.down(1); else list.up(1);
+            i += dir;
+          }
+        };
+
+        if (name === 'up') {
+          list.up(1);
+          if (skipFn && skipFn(list.selected)) moveSkip(-1);
+          sc.render();
+        } else if (name === 'down') {
+          list.down(1);
+          if (skipFn && skipFn(list.selected)) moveSkip(1);
+          sc.render();
+        } else if (name === 'enter' || name === 'return') {
+          if (skipFn && skipFn(list.selected)) return; // ignore enter on headers
+          done(list.selected);
+        } else if (name === 'escape') {
+          done(-1);
+        }
+      };
+
+      // Mouse click on item — respect skipFn
+      list.on('select', (_, idx) => {
+        if (skipFn && skipFn(idx)) return;
+        done(idx);
+      });
+    });
+  }
+
+  // ── Submit / run ──────────────────────────────────────────────────────────
+
+  async _submit(text) {
+    if (this.inputHistory[this.inputHistory.length - 1] !== text) {
+      this.inputHistory.push(text);
+    }
+    this.historyIndex = -1;
+    this._inputBuf = '';
+    this._syncInputDisplay();
+
+    if (text.startsWith('/')) {
+      this._runSlashCommand(text);
+      return;
+    }
+
+    this._lastMessage = text; // save for Ctrl+R retry
+
+    // Clean user message block
+    this._log('');
+    this._log('{#003300-fg}  ┌' + '─'.repeat(54) + '{/#003300-fg}');
+    this._log(`{#003300-fg}  │{/#003300-fg} {cyan-fg}{bold}❯ You{/bold}{/cyan-fg}  {#ccffcc-fg}${esc(text)}{/#ccffcc-fg}`);
+    this._log('{#003300-fg}  └' + '─'.repeat(54) + '{/#003300-fg}');
+    this._log('');
+
+    // Reset animation & retry counters
+    this._tokenCount    = 0;
+    this._reqStartTime  = Date.now();
+    this._toolStepCount = 0;
+    this._triedModels.clear();
+    this._retryCount    = 0;
+    // Reset stream-local formatting state
+    this._inCodeBlock   = false;
+    this._codeLang      = '';
+
+    // Check tier limit — run in background, don't block the request
+    // Only block if we already know we're at limit
+    if (this._remaining === 0 && this._tier === 'free') {
+      const allowed = await this._useRequest();
+      if (!allowed) return;
+    } else {
+      // Fire-and-forget: decrement counter async, don't wait
+      this._useRequest().then(allowed => {
+        if (!allowed) {
+          // Limit just hit — abort if still processing
+          if (this._abortCtrl) { try { this._abortCtrl.abort(); } catch (_) {} }
+        }
+      });
+    }
+
+    this.isProcessing = true;
+    const xmlFilter   = new XmlStreamFilter();
+
+    await this._runAgent(text, xmlFilter);
+  }
+
+  // ── Shared agent runner — used by both _submit and _retryWithCurrentModel ──
+
+  async _runAgent(text, xmlFilter) {
+    this._abortCtrl = new AbortController();
+    this._startSpinner('thinking…');
+
+    let headerPrinted = false;
+    let lineBuffer    = '';
+
+    // Display a chunk of visible text (post-filter) line-by-line.
+    const displayChunk = (chunk) => {
+      if (!chunk) return;
+      const parts = chunk.split('\n');
+      if (parts.length === 1) {
+        lineBuffer += chunk;
+      } else {
+        lineBuffer += parts[0];
+        if (this._inCodeBlock || lineBuffer.trim() || /^\s*`{3}/.test(lineBuffer)) {
+          this._log(this._formatLine(lineBuffer));
+        }
+        lineBuffer = '';
+        for (let i = 1; i < parts.length - 1; i++) {
+          if (this._inCodeBlock || parts[i].trim() || /^\s*`{3}/.test(parts[i])) {
+            this._log(this._formatLine(parts[i]));
+          }
+        }
+        lineBuffer = parts[parts.length - 1];
+      }
+      this._scheduleRender();
+    };
+
+    const flush = () => {
+      if (lineBuffer.trim() || /^\s*`{3}/.test(lineBuffer)) {
+        this._log(this._formatLine(lineBuffer));
+        lineBuffer = '';
+        this._scheduleRender();
+      }
+      lineBuffer = '';
+    };
+
+    try {
+      await this.agent.run({
+        userMessage: text,
+        model: this.providers.currentModel(),
+        signal: this._abortCtrl.signal,
+
+        onToken: (token) => {
+          this._tokenCount++;
+          if (!headerPrinted) {
+            headerPrinted = true;
+            this._stopSpinner();
+            this._log('{#003300-fg}  ┌' + '─'.repeat(54) + '{/#003300-fg}');
+            this._log('{#003300-fg}  │{/#003300-fg} {green-fg}{bold}◈ Vibe Hacker{/bold}{/green-fg}');
+            this._log('{#003300-fg}  └' + '─'.repeat(54) + '{/#003300-fg}');
+          }
+          const visible = xmlFilter.feed(token);
+          if (visible) {
+            displayChunk(visible);
+            const lastLine = visible.split('\n').filter(Boolean).pop();
+            if (lastLine) this._lastToolContext = lastLine.trim().substring(0, 80);
+          }
+        },
+
+        onDone: () => {
+          flush();
+          const elapsed  = ((Date.now() - this._reqStartTime) / 1000).toFixed(1);
+          const stepPart = this._toolStepCount > 0
+            ? `  {#1a3a1a-fg}│{/#1a3a1a-fg}  {#336633-fg}${this._toolStepCount} tool step${this._toolStepCount > 1 ? 's' : ''}{/#336633-fg}`
+            : '';
+          this._log('');
+          this._log(
+            `  {#003300-fg}──{/#003300-fg} {#00aa44-fg}✓{/#00aa44-fg} {#336633-fg}${elapsed}s · ${this._tokenCount} tok{/#336633-fg}` +
+            stepPart +
+            ` {#003300-fg}${'─'.repeat(36)}{/#003300-fg}`
+          );
+          this._log('');
+          this.isProcessing = false;
+          this._abortCtrl   = null;
+          this._stopSpinner();
+          this.screen.render();
+        },
+
+        onError: (err) => {
+          flush();
+          xmlFilter.reset();
+          const errType = err.type || ERR.UNKNOWN;
+          const errMsg  = err.msg || err.message || String(err);
+
+          if (errType === ERR.ABORTED) {
+            const elapsed = this._reqStartTime
+              ? ` {#444444-fg}(${((Date.now() - this._reqStartTime) / 1000).toFixed(1)}s){/#444444-fg}`
+              : '';
+            this._log(`{yellow-fg}⊘ cancelled{/yellow-fg}${elapsed}`);
+            this.isProcessing = false;
+            this._abortCtrl   = null;
+            this._stopSpinner();
+            this.screen.render();
+            return;
+          }
+
+          if (errType === ERR.RATE_LIMIT || errType === ERR.DAILY_LIMIT) {
+            const curModel = this.providers.currentModel();
+
+            if (errType === ERR.DAILY_LIMIT) {
+              this._dailyLimitHit = true;
+              this.isProcessing   = false;
+              this._abortCtrl     = null;
+              this._stopSpinner();
+              this._showDailyLimitWarning(errMsg, true);
+              return;
+            }
+
+            if (curModel) this._triedModels.add(curModel.id);
+            this._retryCount++;
+            if (this._retryCount > this._maxRetries) {
+              this._dailyLimitHit = true;
+              this.isProcessing   = false;
+              this._abortCtrl     = null;
+              this._stopSpinner();
+              this._showDailyLimitWarning(errMsg, true);
+              return;
+            }
+            const found = this._findNextAvailable();
+            if (found) {
+              this._updateModeBar();
+              this._startSpinner('connecting…');
+              this.screen.render();
+              this._retryWithCurrentModel(text, xmlFilter, flush);
+              return;
+            }
+            this._dailyLimitHit = true;
+            this.isProcessing   = false;
+            this._abortCtrl     = null;
+            this._stopSpinner();
+            this._showDailyLimitWarning(errMsg, false);
+            return;
+          }
+
+          if (errType === ERR.NOT_FOUND) {
+            const curModel = this.providers.currentModel();
+            if (curModel) this._triedModels.add(curModel.id);
+            this._retryCount++;
+
+            if (this._retryCount <= this._maxRetries) {
+              const found = this._findNextAvailable();
+              if (found) {
+                this._updateModeBar();
+                this._startSpinner('connecting…');
+                this.screen.render();
+                this._retryWithCurrentModel(text, xmlFilter, flush);
+                return;
+              }
+            }
+            this._log('{red-fg}✗ No available models found{/red-fg}');
+            this._log('{#333333-fg}  Run /refresh to update model list, or /addkey to add a provider{/#333333-fg}');
+            this.isProcessing = false;
+            this._abortCtrl   = null;
+            this._stopSpinner();
+            this.screen.render();
+            return;
+          }
+
+          let userMsg = errMsg;
+          if (errType === ERR.UNKNOWN || !errMsg || errMsg === 'error' || errMsg.includes('undefined')) {
+            userMsg = 'Connection issue — check your network or try /retry';
+          } else if (errMsg.includes('ECONNREFUSED') || errMsg.includes('ENOTFOUND') || errMsg.includes('ETIMEDOUT')) {
+            userMsg = 'Network error — could not reach the API server';
+          } else if (errMsg.includes('401') || errMsg.includes('403')) {
+            userMsg = 'API key invalid or expired — run /key to update';
+          } else if (errMsg.includes('500') || errMsg.includes('502') || errMsg.includes('503')) {
+            userMsg = 'Server error — try again in a moment or switch models with /model';
+          }
+          this._log(`{red-fg}✗ ${esc(userMsg)}{/red-fg}`);
+          this._log('{#333333-fg}  Try: /retry · /model · /addkey{/#333333-fg}');
+          this.isProcessing = false;
+          this._abortCtrl   = null;
+          this._stopSpinner();
+          this.screen.render();
+        },
+
+        onToolCall: (tc) => {
+          flush();
+          xmlFilter.reset();
+          this._toolStepCount++;
+          const argSummary = _fmtToolArgs(tc.name, tc.args);
+          const toolIcon   = _toolIcon(tc.name);
+          this._log('');
+          this._log(
+            `  {#004400-fg}┌─{/#004400-fg} ` +
+            `{#00aa44-fg}${toolIcon}{/#00aa44-fg} ` +
+            `{#00ff88-fg}{bold}${esc(tc.name)}{/bold}{/#00ff88-fg} ` +
+            `{#333333-fg}step ${this._toolStepCount}{/#333333-fg}`
+          );
+          if (argSummary) {
+            this._log(`  {#004400-fg}│{/#004400-fg}  {#555555-fg}${esc(argSummary)}{/#555555-fg}`);
+          }
+          this._stopSpinner();
+          this.screen.render();
+        },
+
+        beforeToolCall: async (tc) => {
+          if (!NEEDS_APPROVAL.has(tc.name)) return 'yes';
+
+          const key = getAllowKey(tc);
+          if (this._alwaysAllowed.has(key)) return 'yes';
+
+          this._menuOpen = true;
+          const decision = await showApproval(this.screen, tc, this._lastToolContext);
+          this._menuOpen = false;
+          this.inputBox.focus();
+
+          if (decision === 'always') {
+            this._alwaysAllowed.add(key);
+            this._log(`{#336633-fg}  ✓ always allowed: {#555555-fg}${esc(key)}{/#555555-fg}{/#336633-fg}`);
+          }
+          if (decision === 'no') {
+            this._log(`{yellow-fg}  ⊘ denied: ${esc(tc.name)}{/yellow-fg}`);
+            this.screen.render();
+          } else {
+            this._startSpinner(`${_toolIcon(tc.name)} ${esc(tc.name)}…`);
+          }
+          this.screen.render();
+          return decision;
+        },
+
+        onToolResult: (tc, result) => {
+          const lines  = result.split('\n').filter(Boolean);
+          const header = (lines[0] || '').substring(0, 60);
+          this._log(
+            `  {#004400-fg}└─{/#004400-fg} {#00aa44-fg}✓{/#00aa44-fg} {#444444-fg}${esc(header)}{/#444444-fg}`
+          );
+          this._startSpinner('thinking…');
+          this.screen.render();
+        },
+      });
+    } catch (err) {
+      const msg = err.message || String(err);
+      if (!msg.includes('aborted')) {
+        this._log(`  {red-fg}✗ ${esc(msg.substring(0, 80))}{/red-fg}`);
+      }
+      this.isProcessing = false;
+      this._abortCtrl   = null;
+      this._stopSpinner();
+      this.screen.render();
+    }
+  }
+
+  // ── Markdown-ish formatter ────────────────────────────────────────────────
+
+  // Coalesce screen.render() calls — saves 10-100x render work during streaming
+  _scheduleRender() {
+    if (this._renderPending) return;
+    this._renderPending = true;
+    // Batch renders at ~30fps during streaming (saves CPU), 60fps otherwise
+    const delay = this.isProcessing ? 33 : 16;
+    setTimeout(() => {
+      this._renderPending = false;
+      try { this.screen.render(); } catch (_) {}
+    }, delay);
+  }
+
+  _formatLine(line) {
+    if (line === undefined || line === null) return '';
+
+    // ── Code fence toggle — ``` opens/closes block ──
+    if (/^\s*`{3}/.test(line)) {
+      if (this._inCodeBlock) {
+        // Closing fence
+        this._inCodeBlock = false;
+        const lang = this._codeLang;
+        this._codeLang = '';
+        return `  {#006633-fg}└${'─'.repeat(48)}${lang ? ' ' + lang + ' ' : ''}${'─'.repeat(Math.max(0, 6 - lang.length))}┘{/#006633-fg}`;
+      } else {
+        // Opening fence
+        this._inCodeBlock = true;
+        const lang = line.replace(/^\s*`{3}/, '').trim() || 'code';
+        this._codeLang = lang;
+        const pad = Math.max(0, 50 - lang.length - 4);
+        return `  {#006633-fg}┌─ {bold}{#44ffaa-fg}${esc(lang)}{/#44ffaa-fg}{/bold} ${'─'.repeat(pad)}┐{/#006633-fg}`;
+      }
+    }
+
+    // ── Inside a code block — render as monospace, no markdown parsing ──
+    if (this._inCodeBlock) {
+      return `  {#006633-fg}│{/#006633-fg} {#bbddbb-fg}${esc(line)}{/#bbddbb-fg}`;
+    }
+
+    // Blank line
+    if (!line.trim()) return '';
+
+    // ── Markdown outside code blocks ──
+    // H1 / H2 / H3
+    if (/^#{1,3} /.test(line)) {
+      const level = line.match(/^(#{1,3})/)[1].length;
+      const text  = line.replace(/^#{1,3}\s+/, '');
+      if (level === 1) return `\n  {bold}{#00ffaa-fg}▎ ${esc(text)}{/#00ffaa-fg}{/bold}`;
+      if (level === 2) return `\n  {bold}{#44ffaa-fg}▸ ${esc(text)}{/#44ffaa-fg}{/bold}`;
+      return `  {bold}{#88ffcc-fg}${esc(text)}{/#88ffcc-fg}{/bold}`;
+    }
+    // Bullet lists
+    if (/^[-*] /.test(line)) {
+      return `  {#00aa66-fg}•{/#00aa66-fg} ${this._inline(line.slice(2))}`;
+    }
+    // Numbered lists
+    if (/^\d+\. /.test(line)) {
+      const m = line.match(/^(\d+)\.\s+(.*)$/);
+      if (m) return `  {#00cc88-fg}${m[1]}.{/#00cc88-fg} ${this._inline(m[2])}`;
+    }
+    // Blockquotes
+    if (line.startsWith('> ')) {
+      return `  {#005500-fg}│{/#005500-fg} {#888888-fg}${esc(line.slice(2))}{/#888888-fg}`;
+    }
+    // Horizontal rule
+    if (/^-{3,}$/.test(line.trim())) {
+      return `  {#003300-fg}${'─'.repeat(50)}{/#003300-fg}`;
+    }
+    // Regular paragraph — apply inline formatting (bold, inline-code)
+    return `  {#ccffcc-fg}${this._inline(line)}{/#ccffcc-fg}`;
+  }
+
+  // Inline markdown: **bold**, `code`
+  _inline(text) {
+    let out = esc(text);
+    // Inline code
+    out = out.replace(/`([^`]+)`/g, '{#001a00-bg}{#00ffaa-fg} $1 {/#00ffaa-fg}{/#001a00-bg}');
+    // Bold
+    out = out.replace(/\*\*([^*]+)\*\*/g, '{bold}{#ffffff-fg}$1{/#ffffff-fg}{/bold}');
+    return out;
+  }
+
+  // ── Slash commands ────────────────────────────────────────────────────────
+
+  _runSlashCommand(text) {
+    const parts = text.slice(1).trim().split(/\s+/);
+    const cmd   = parts[0].toLowerCase();
+    const args  = parts.slice(1);
+
+    switch (cmd) {
+      case 'clear': case 'cls':
+        this.chat.setContent('');
+        this.agent.clearHistory();
+        this._log('{#444444-fg}[chat cleared — context reset]{/#444444-fg}');
+        break;
+
+      case 'undo': {
+        const { getLastEdit } = require('./tools');
+        const last = getLastEdit();
+        if (!last) {
+          this._log('{#888888-fg}  No edits to undo.{/#888888-fg}');
+        } else {
+          const relPath = path.relative(this.agent.cwd, last.path);
+          if (last.before === null) {
+            // File was created — delete it
+            try {
+              require('fs').unlinkSync(last.path);
+              this._log(`{#00aa44-fg}  ↩ Undone: deleted {bold}${esc(relPath)}{/bold} (was newly created){/#00aa44-fg}`);
+            } catch (e) {
+              this._log(`{red-fg}  ✗ Could not undo: ${esc(e.message)}{/red-fg}`);
+            }
+          } else {
+            // Restore previous content
+            try {
+              require('fs').writeFileSync(last.path, last.before, 'utf8');
+              this._log(`{#00aa44-fg}  ↩ Undone: restored {bold}${esc(relPath)}{/bold}{/#00aa44-fg}`);
+            } catch (e) {
+              this._log(`{red-fg}  ✗ Could not undo: ${esc(e.message)}{/red-fg}`);
+            }
+          }
+        }
+        this._log('');
+        break;
+      }
+
+      case 'modified': case 'changes': {
+        const { getModifiedFiles } = require('./tools');
+        const files = getModifiedFiles();
+        if (!files.length) {
+          this._log('{#888888-fg}  No files modified this session.{/#888888-fg}');
+        } else {
+          this._log('{#00aa44-fg}  Modified files this session:{/#00aa44-fg}');
+          for (const f of files) {
+            this._log(`  {#44ff88-fg}${esc(path.relative(this.agent.cwd, f))}{/#44ff88-fg}`);
+          }
+        }
+        this._log('');
+        break;
+      }
+
+      case 'help':
+        this._showHelp();
+        break;
+
+      case 'logout': case 'signout': {
+        const cfg2 = require('./config');
+        cfg2.setApiKey('');
+        this._log('');
+        this._log('{yellow-fg}{bold}  ⟐ Logged out{/bold}{/yellow-fg}');
+        this._log('{#444444-fg}  API key cleared. Use /login or /addkey to reconnect.{/#444444-fg}');
+        this._log('');
+        this._updateModeBar();
+        break;
+      }
+
+      case 'login': case 'auth': {
+        // Redirect to /addkey — no separate login flow
+        this._log('');
+        this._log('{#444444-fg}  Use {#00ff88-fg}/addkey <paste-key>{/#00ff88-fg} to add a provider key.{/#444444-fg}');
+        this._log('{#444444-fg}  Get a free key: {cyan-fg}vibsecurity.com{/cyan-fg}{/#444444-fg}');
+        this._log('');
+        this.screen.render();
+        break;
+      }
+
+      case 'model': case 'models':
+        if (!this._menuOpen) this._showModelPicker();
+        break;
+
+      case 'mode':
+        this.modeIndex = (this.modeIndex + 1) % MODES.length;
+        this.agent.setMode(MODES[this.modeIndex].id);
+        this._updateModeBar();
+        break;
+
+      case 'cwd': case 'pwd':
+        this._log(`{#00cc00-fg}cwd{/} {#88ff88-fg}${esc(this.agent.cwd)}{/#88ff88-fg}`);
+        break;
+
+      case 'cd': {
+        const dir = args.join(' ');
+        if (!dir) { this._log('{red-fg}usage: /cd <path>{/red-fg}'); break; }
+        const newDir = path.resolve(this.agent.cwd, dir);
+        try {
+          require('fs').accessSync(newDir);
+          this.agent.setCwd(newDir);
+          try { process.chdir(newDir); } catch (_) {}
+          this._log(`{#00cc00-fg}[cwd → ${esc(newDir)}]{/}`);
+        } catch (_) {
+          this._log(`{red-fg}[not found: ${esc(newDir)}]{/red-fg}`);
+        }
+        break;
+      }
+
+      case 'history':
+        if (!this.inputHistory.length) {
+          this._log('{#444444-fg}(no history){/#444444-fg}');
+        } else {
+          this.inputHistory.forEach((h, i) => {
+            this._log(`  {#444444-fg}${i + 1}.{/#444444-fg} {#88ff88-fg}${esc(h)}{/#88ff88-fg}`);
+          });
+        }
+        break;
+
+      case 'key': case 'apikey': {
+        const newKey = args.join(' ').trim();
+        const applyKey = (k) => {
+          k = k.trim();
+          const type = this.providers.add(k); // also handles config.setApiKey for OR keys
+          this._dailyLimitHit = false;
+          this.providers.clearLimits();
+          this._updateModeBar();
+          const pname = (PROVIDERS[type] || {}).name || type;
+          this._log(`{#00cc00-fg}[${pname} key saved · limits cleared · /test to verify]{/}`);
+          this.screen.render();
+        };
+        if (!newKey) {
+          this._promptInput('Enter API key (sk-or-v1-… · gsk_… · csk-… · AIza…):', applyKey);
+        } else {
+          applyKey(newKey);
+        }
+        break;
+      }
+
+      case 'addkey': case 'addprovider': {
+        const newKey = args.join(' ').trim();
+        const doAdd = (k) => {
+          k = k.trim();
+          if (!k) return;
+          const type  = this.providers.add(k);
+          const pdef  = PROVIDERS[type] || {};
+          this._dailyLimitHit = false;
+          this.providers.clearLimits();
+          this._updateModeBar();
+          this._log('');
+          this._log(`{#00cc00-fg}[{bold}${esc(pdef.name || type)}{/bold} added!]{/}`);
+          this._log(`{#444444-fg}  ${esc(pdef.freeNote || '')}  ·  auto-rotation enabled{/#444444-fg}`);
+          if (this.providers.list().length > 1) {
+            this._log(`{#444444-fg}  Providers: ${this.providers.list().map(p => p.name).join(' → ')}{/#444444-fg}`);
+          }
+          this._log('');
+          this.screen.render();
+        };
+        if (!newKey) {
+          this._log('');
+          this._log('{green-fg}{bold}Free provider API keys — no credit card needed:{/bold}{/green-fg}');
+          this._log('');
+          Object.values(PROVIDERS).forEach(def => {
+            const has = this.providers.list().some(p => p.type === def.type);
+            this._log(
+              `  {#44ff88-fg}${def.name.padEnd(12)}{/#44ff88-fg}` +
+              `{#444444-fg}${def.freeNote.padEnd(22)}{/#444444-fg}` +
+              `{cyan-fg}${def.getKey()}{/cyan-fg}` +
+              (has ? '  {#336633-fg}✓ added{/#336633-fg}' : '')
+            );
+          });
+          this._log('');
+          this._log('  {#444444-fg}Then: /addkey <paste-key-here>{/#444444-fg}');
+          this._log('');
+          this.screen.render();
+          return;
+        }
+        doAdd(newKey);
+        // Silently refresh models — auto-rotation handles the rest
+        this._silentModelRefresh();
+        return;
+      }
+
+      case 'providers': case 'provider': {
+        const list = this.providers.list();
+        this._log('');
+        this._log('{green-fg}{bold}Configured Providers:{/bold}{/green-fg}');
+        this._log('');
+        list.forEach((p, i) => {
+          const active  = p.active ? '{yellow-fg}▶{/yellow-fg}' : ' ';
+          const limited = p.limited ? '  {red-fg}(rate-limited){/red-fg}' : '';
+          const keyHint = p.apiKey ? `{#333333-fg}${p.apiKey.substring(0, 14)}…{/#333333-fg}` : '';
+          this._log(
+            `  ${active} {#44ff88-fg}{bold}${esc(p.name || p.type)}{/bold}{/#44ff88-fg}` +
+            `  {#444444-fg}${esc(p.freeNote || '')}  ${keyHint}{/#444444-fg}${limited}`
+          );
+        });
+        this._log('');
+        this._log('{#444444-fg}  Add more: /addkey <key>  ·  Remove: /rmprovider <name>{/#444444-fg}');
+        this._log('');
+        break;
+      }
+
+      case 'rmprovider': case 'removeprovider': {
+        const typeName = (args[0] || '').toLowerCase();
+        const match    = Object.keys(PROVIDERS).find(t => t.startsWith(typeName));
+        if (!match || match === 'openrouter') {
+          this._log('{red-fg}usage: /rmprovider <groq|cerebras|gemini|mistral>{/red-fg}');
+          break;
+        }
+        this.providers.remove(match);
+        this._updateModeBar();
+        this._log(`{#00cc00-fg}[${PROVIDERS[match].name} removed]{/}`);
+        break;
+      }
+
+      case 'tokens': case 'maxtokens': {
+        const cfg = require('./config');
+        const n   = parseInt(args[0], 10);
+        if (!n || n < 128 || n > 200000) {
+          this._log(
+            `{#00cc00-fg}max_tokens{/} {#88ff88-fg}${cfg.maxTokens}{/#88ff88-fg}  ` +
+            `{#444444-fg}· usage: /tokens <128-200000>  e.g. /tokens 2048{/#444444-fg}`
+          );
+          break;
+        }
+        cfg.maxTokens = n;
+        // Persist
+        const { saveConfig } = (() => {
+          // inline save via config module's saveConfig (not exported, so re-do it)
+          const os   = require('os');
+          const path = require('path');
+          const fs   = require('fs');
+          const dir  = path.join(os.homedir(), '.vibehacker');
+          const file = path.join(dir, 'config.json');
+          return {
+            saveConfig: (data) => {
+              try {
+                if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+                let existing = {};
+                try { existing = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (_) {}
+                fs.writeFileSync(file, JSON.stringify({ ...existing, ...data }, null, 2));
+              } catch (_) {}
+            },
+          };
+        })();
+        saveConfig({ maxTokens: n });
+        this._log(`{#00cc00-fg}[max_tokens → {#88ff88-fg}${n}{/#88ff88-fg}]{/}  {#444444-fg}less tokens = fewer rate-limit hits{/#444444-fg}`);
+        if (this._dailyLimitHit) {
+          this._dailyLimitHit = false;
+          this.providers.clearLimits();
+          this._log('{#444444-fg}[rate-limit flags cleared — try your message again]{/#444444-fg}');
+        }
+        break;
+      }
+
+      case 'retry': {
+        if (this.isProcessing || !this._lastMessage) {
+          this._log('{#444444-fg}(nothing to retry){/#444444-fg}');
+          break;
+        }
+        this._log('{#444444-fg}[retrying last message…]{/#444444-fg}');
+        this.screen.render();
+        this._submit(this._lastMessage);
+        return;
+      }
+
+      case 'approve': case 'trust': {
+        // /approve list  — show currently always-allowed patterns
+        // /approve clear — clear all always-allowed patterns
+        const sub = (args[0] || 'list').toLowerCase();
+        if (sub === 'clear') {
+          this._alwaysAllowed.clear();
+          this._log('{#00cc00-fg}[all always-allowed rules cleared]{/}');
+        } else {
+          if (this._alwaysAllowed.size === 0) {
+            this._log('{#444444-fg}(no always-allowed rules — approve with "Yes, always" during tool calls){/#444444-fg}');
+          } else {
+            this._log('{green-fg}{bold}Always-allowed tool patterns:{/bold}{/green-fg}');
+            for (const k of this._alwaysAllowed) {
+              this._log(`  {#44ff88-fg}✓{/#44ff88-fg}  {#888888-fg}${esc(k)}{/#888888-fg}`);
+            }
+          }
+        }
+        break;
+      }
+
+      case 'test':
+        this._testApiKey();
+        break;
+
+      case 'refresh':
+        this._refreshModels();
+        break;
+
+      case 'new-session': case 'newsession': case 'new': {
+        this.chat.setContent('');
+        this.agent.clearHistory();
+        this._tokenCount = 0;
+        this._toolStepCount = 0;
+        this._log('');
+        this._log('{#003300-fg}  ══════════════════════════════════════════════{/#003300-fg}');
+        this._log('');
+        this._log('{green-fg}{bold}  ⟐ New Session Started{/bold}{/green-fg}');
+        this._log('{#444444-fg}  Chat history and context cleared.{/#444444-fg}');
+        this._log('');
+        this._log('{#003300-fg}  ══════════════════════════════════════════════{/#003300-fg}');
+        this._log('');
+        break;
+      }
+
+      case 'account': case 'acct': case 'profile': {
+        const cfg3 = require('./config');
+        this._log('');
+        this._log('{#003300-fg}  ══════════════════════════════════════════════{/#003300-fg}');
+        this._log('{green-fg}{bold}  ⟐ Account{/bold}{/green-fg}');
+        this._log('{#003300-fg}  ══════════════════════════════════════════════{/#003300-fg}');
+        this._log('');
+        if (!cfg3.hasKey()) {
+          this._log('{#888888-fg}  Not logged in.{/#888888-fg}');
+          this._log('{#444444-fg}  Use /login or /addkey to connect.{/#444444-fg}');
+        } else {
+          // Tier info
+          const tierLabel = this._tier === 'pro'
+            ? '{#ffaa00-fg}{bold}PRO{/bold}{/#ffaa00-fg}'
+            : this._tier === 'free'
+              ? '{#00cc44-fg}FREE{/#00cc44-fg}'
+              : '{#888888-fg}unknown{/#888888-fg}';
+          this._log(`  {#00ff88-fg}Tier:{/#00ff88-fg}       ${tierLabel}`);
+
+          // Usage
+          if (this._remaining !== null && this._remaining !== undefined) {
+            const limit = this._dailyLimit || 50;
+            const used = limit - this._remaining;
+            const pct = Math.round((used / limit) * 100);
+            const barW = 20;
+            const filled = Math.round((used / limit) * barW);
+            const bar = '{#00ff88-fg}' + '█'.repeat(Math.min(filled, barW)) + '{/#00ff88-fg}' +
+                        '{#1a3a1a-fg}' + '░'.repeat(Math.max(0, barW - filled)) + '{/#1a3a1a-fg}';
+            this._log(`  {#00ff88-fg}Usage:{/#00ff88-fg}      ${bar} ${used}/${limit} (${pct}%)`);
+            this._log(`  {#00ff88-fg}Remaining:{/#00ff88-fg}  {#88ff88-fg}${this._remaining}{/#88ff88-fg} requests today`);
+          } else {
+            this._log(`  {#00ff88-fg}Usage:{/#00ff88-fg}      {#888888-fg}(checking…){/#888888-fg}`);
+            // Trigger a check
+            this._checkTier();
+          }
+
+          // Provider info
+          const provs = this.providers.list();
+          if (provs.length > 0) {
+            this._log(`  {#00ff88-fg}Providers:{/#00ff88-fg}  ${provs.map(p => `{#44ff88-fg}${esc(p.name)}{/#44ff88-fg}`).join(', ')}`);
+          }
+
+          if (this._tier === 'free') {
+            this._log('');
+            this._log('  {#ffaa00-fg}Go Pro for unlimited requests:{/#ffaa00-fg}');
+            this._log('  {cyan-fg}https://vibsecurity.com{/cyan-fg}');
+          }
+        }
+        this._log('');
+        this._log('{#003300-fg}  ══════════════════════════════════════════════{/#003300-fg}');
+        this._log('');
+        break;
+      }
+
+      case 'update': case 'upgrade-cli': {
+        this._log('');
+        this._log('{#00aa44-fg}  ⟳ Checking for updates…{/#00aa44-fg}');
+        this.screen.render();
+        this._runUpdate();
+        break;
+      }
+
+      case 'pro': case 'upgrade': case 'pricing': {
+        const { openBrowser } = require('./auth');
+        const url = 'https://vibsecurity.com/pricing';
+        this._log('');
+        this._log('{#ffaa00-fg}{bold}  ⟐ Upgrade to Vibe Hacker Pro{/bold}{/#ffaa00-fg}');
+        this._log(`  {cyan-fg}${url}{/cyan-fg}`);
+        this._log('{#444444-fg}  Unlimited requests · priority models · no rate limits{/#444444-fg}');
+        this._log('');
+        openBrowser(url).catch(() => {});
+        break;
+      }
+
+      case 'exit': case 'quit':
+        this._exit();
+        return; // MUST return — screen is destroyed, do not call render() below
+
+      case '': // bare "/" or accidental submit
+        if (!this._menuOpen) this._showSlashMenu();
+        return;
+
+      default:
+        this._log(`{red-fg}✗ unknown: /${esc(cmd)}{/red-fg}  {#444444-fg}try /help{/#444444-fg}`);
+    }
+    this.screen.render();
+  }
+
+  // ── Overlays ──────────────────────────────────────────────────────────────
+
+  async _showSlashMenu() {
+    const cfg = require('./config');
+    const hasKey = cfg.hasKey();
+
+    const cmds = [
+      ...(!hasKey ? [
+        { label: ' {green-fg}▸ Login with Vibe Hacker{/green-fg}         {#336633-fg}browser{/#336633-fg}', value: '/login'     },
+        { label: ' {green-fg}▸ Paste API Key{/green-fg}               {#336633-fg}manual{/#336633-fg}',  value: '!pastekey'  },
+        { label: ' {#003300-fg}───────────────────────────────────────{/#003300-fg}', value: null },
+      ] : []),
+      { label: ' {#00ff88-fg}◈{/#00ff88-fg}  Switch Mode              {#336633-fg}Tab{/#336633-fg}',    value: '/mode'      },
+      { label: ' {#00ff88-fg}↻{/#00ff88-fg}  Retry Last Message       {#336633-fg}Ctrl+R{/#336633-fg}', value: '/retry'     },
+      { label: ' {#00ff88-fg}✕{/#00ff88-fg}  Clear Chat & Context',                                     value: '/clear'     },
+      { label: ' {#003300-fg}───────────────────────────────────────{/#003300-fg}', value: null },
+      { label: ' {#00cc66-fg}+{/#00cc66-fg}  Add Provider Key         {#336633-fg}Groq/Gemini{/#336633-fg}', value: '!pastekey' },
+      { label: ' {#00cc66-fg}⊞{/#00cc66-fg}  List Providers',                                               value: '/providers'},
+      { label: ' {#003300-fg}───────────────────────────────────────{/#003300-fg}', value: null },
+      { label: ' {#00cc66-fg}⊕{/#00cc66-fg}  New Session              {#336633-fg}clear all{/#336633-fg}',     value: '/new-session' },
+      ...(hasKey ? [
+        { label: ' {#00cc66-fg}⊡{/#00cc66-fg}  Account & Usage',                                           value: '/account'  },
+        { label: ' {#ffaa00-fg}★{/#ffaa00-fg}  Upgrade to Pro           {#664400-fg}vibsecurity.com{/#664400-fg}', value: '/pro'      },
+      ] : []),
+      { label: ' {#00cc66-fg}⟳{/#00cc66-fg}  Check for Updates        {#336633-fg}npm{/#336633-fg}',        value: '/update'   },
+      { label: ' {#003300-fg}───────────────────────────────────────{/#003300-fg}', value: null },
+      { label: ' {#888888-fg}▸{/#888888-fg}  Set Max Tokens',                                              value: '/tokens '  },
+      { label: ' {#888888-fg}▸{/#888888-fg}  Change Directory',                                            value: '/cd '      },
+      { label: ' {#888888-fg}?{/#888888-fg}  Help',                                                        value: '/help'     },
+      ...(hasKey ? [
+        { label: ' {#888888-fg}↳{/#888888-fg}  Re-login / Switch Account',                                 value: '/login'    },
+        { label: ' {#666666-fg}⏻{/#666666-fg}  Logout',                                                    value: '/logout'   },
+      ] : []),
+      { label: ' {red-fg}✕{/red-fg}  Exit Vibe Hacker',                                                      value: '/exit'     },
+    ];
+
+    const idx = await this._openList({
+      label: '{bold}⚡ Commands{/bold}',
+      items: cmds.map(c => c.label),
+      selectedIndex: 0,
+    });
+
+    this._inputBuf = '';
+    this._syncInputDisplay();
+
+    if (idx < 0 || !cmds[idx].value) return;
+
+    const val = cmds[idx].value;
+
+    // Special action: paste API key via input prompt
+    if (val === '!pastekey') {
+      this._promptInput('Paste API key (sk-or-v1-… / gsk_… / csk-… / AIza…):', (k) => {
+        if (k && k.length >= 10) {
+          this._runSlashCommand(`/addkey ${k}`);
+        } else {
+          this._log('{red-fg}  Key too short — paste a valid API key{/red-fg}');
+          this.screen.render();
+        }
+      });
+      return;
+    }
+
+    if (val.endsWith(' ')) {
+      this._inputBuf = val;
+      this._syncInputDisplay();
+    } else {
+      this._runSlashCommand(val);
+    }
+  }
+
+  async _showModelPicker() {
+    const curModel    = this.providers.currentModel();
+    const curId       = (curModel || {}).id;
+    const configured  = new Set(this.providers.list().map(p => p.type));
+
+    // Build flat list: for each provider, a header row + its models.
+    // Entries are: { kind: 'header'|'model', providerType, providerName, model?, configured }
+    const entries = [];
+    const providerOrder = ['vibehacker', 'openrouter', 'groq', 'cerebras', 'gemini', 'mistral', 'anthropic', 'openai', 'deepseek', 'xai', 'together'];
+
+    for (const type of providerOrder) {
+      const def = PROVIDERS[type];
+      if (!def) continue;
+      let models = def.models || [];
+      // For the active OpenRouter/Vibe Hacker provider, use live-refreshed models
+      if ((type === 'openrouter' || type === 'vibehacker') && configured.has(type)) {
+        const live = this.models.list();
+        if (live && live.length) models = live;
+      }
+      if (!models.length) continue;
+      const hasKey = configured.has(type);
+      entries.push({ kind: 'header', providerType: type, providerName: def.name, hasKey });
+      for (const m of models) {
+        entries.push({ kind: 'model', providerType: type, providerName: def.name, model: m, hasKey });
+      }
+    }
+
+    // Build display items
+    let curIdx = 0;
+    const items = entries.map((e, i) => {
+      if (e.kind === 'header') {
+        const status = e.hasKey
+          ? '{#00aa44-fg}● configured{/#00aa44-fg}'
+          : '{#664400-fg}○ add key{/#664400-fg}';
+        return `{#003300-fg}── {/#003300-fg}{bold}{#44ffaa-fg}${esc(e.providerName)}{/#44ffaa-fg}{/bold} {#003300-fg}──{/#003300-fg}  ${status}`;
+      }
+      const m = e.model;
+      const active = (m.id === curId && e.hasKey) ? '{#00ff88-fg}▸{/#00ff88-fg}' : ' ';
+      if (m.id === curId && e.hasKey) curIdx = i;
+      const freeBadge = m.free === true  ? '{#00cc44-fg}FREE{/#00cc44-fg}'
+                      : m.free === false ? '{yellow-fg}PAID{/yellow-fg}'
+                      : '{#444444-fg} ?  {/}';
+      const ctxStr  = fmtCtx(m.contextWindow);
+      const nameStr = esc(m.name);
+      const lockIcon = e.hasKey ? '' : ' {#664400-fg}🔒{/#664400-fg}';
+      const nameColor = e.hasKey ? '{#88ff88-fg}' : '{#555555-fg}';
+      return ` ${active} ${nameColor}${nameStr.padEnd(26)}{/}  ${freeBadge}  {#333333-fg}${ctxStr} ctx{/}${lockIcon}`;
+    });
+
+    // Disable header selection — skip them
+    const idx = await this._openList({
+      label: '{bold}⟐ All Models — Vibe Hacker · Anthropic · OpenAI · Groq · Gemini · More{/bold}',
+      items,
+      selectedIndex: curIdx,
+      width: Math.min(78, (this.screen.width || 80) - 4),
+      skipFn: (i) => entries[i] && entries[i].kind === 'header',
+    });
+
+    if (idx < 0) return;
+    const chosen = entries[idx];
+    if (!chosen || chosen.kind !== 'model') return;
+
+    // Provider not configured → prompt for key
+    if (!chosen.hasKey) {
+      const def = PROVIDERS[chosen.providerType] || {};
+      this._log('');
+      this._log(`{#ffaa00-fg}  ${esc(chosen.providerName)} requires an API key{/#ffaa00-fg}`);
+      this._log(`{#444444-fg}  Get one at: ${esc(def.getKey ? def.getKey() : 'provider website')}{/#444444-fg}`);
+      this._log('');
+      this.screen.render();
+      this._promptInput(`Paste your ${chosen.providerName} API key:`, (k) => {
+        k = (k || '').trim();
+        if (!k) return;
+        try {
+          this.providers.add(k);
+          this.providers.selectByType(chosen.providerType);
+          this.providers.selectModelById(chosen.model.id);
+          this._pinnedModel = true;
+          this._updateModeBar();
+          this._log(`{green-fg}  ✓ ${esc(chosen.providerName)} added — using ${esc(chosen.model.name)}{/green-fg}`);
+          this.screen.render();
+        } catch (err) {
+          this._log(`{red-fg}  ✗ ${esc(err.message || 'invalid key')}{/red-fg}`);
+          this.screen.render();
+        }
+      });
+      return;
+    }
+
+    // Provider already configured — switch to it and pick the model
+    this.providers.selectByType(chosen.providerType);
+    this.providers.selectModelById(chosen.model.id);
+    this._pinnedModel = true;
+    this._updateModeBar();
+    this._log(`{#444444-fg}  model → {#88ff88-fg}${esc(chosen.model.name)}{/#88ff88-fg} · ${esc(chosen.providerName)} · ${fmtCtx(chosen.model.contextWindow)} ctx · {#006600-fg}pinned{/#006600-fg}{/#444444-fg}`);
+    this.screen.render();
+  }
+
+  async _showPalette() {
+    const actions = [
+      { label: ' {#00ff88-fg}◈{/#00ff88-fg}  Cycle Mode',                  fn: () => { this.modeIndex = (this.modeIndex + 1) % MODES.length; this.agent.setMode(MODES[this.modeIndex].id); this._updateModeBar(); } },
+      { label: ' {#00ff88-fg}✕{/#00ff88-fg}  Clear Chat & Context',        fn: () => this._runSlashCommand('/clear') },
+      { label: ' {#00ff88-fg}↩{/#00ff88-fg}  Undo Last Edit',              fn: () => this._runSlashCommand('/undo') },
+      { label: ' {#00ff88-fg}📄{/#00ff88-fg} Modified Files',               fn: () => this._runSlashCommand('/modified') },
+      { label: ' {#888888-fg}?{/#888888-fg}  Help',                         fn: () => this._showHelp() },
+      { label: ' {#888888-fg}▸{/#888888-fg}  Change Directory',             fn: () => this._promptInput('New directory:', (d) => this._runSlashCommand(`/cd ${d}`)) },
+      { label: ' {red-fg}✕{/red-fg}  Exit',                                fn: () => this._exit() },
+    ];
+
+    const idx = await this._openList({
+      label: '{bold}⚡ Palette{/bold}',
+      items: actions.map(a => a.label),
+      selectedIndex: 0,
+    });
+
+    if (idx >= 0 && actions[idx]) actions[idx].fn();
+  }
+
+  _promptInput(label, callback) {
+    if (this._menuOpen) return;
+    this._menuOpen = true;
+    const sc = this.screen;
+
+    const prompt = blessed.prompt({
+      parent: sc,
+      top: 'center', left: 'center',
+      width: 56, height: 8,
+      tags: true,
+      border: { type: 'line' },
+      label: ` {#00ff88-fg}{bold}Input{/bold}{/#00ff88-fg} `,
+      style: { fg: '#00ff88', bg: '#000a00', border: { fg: '#00aa44' } },
+    });
+
+    prompt.input(label, '', (err, value) => {
+      this._menuOpen = false;
+      prompt.destroy();
+      this.inputBox.focus();
+      sc.render();
+      if (!err && value && value.trim()) callback(value.trim());
+    });
+
+    sc.render();
+  }
+
+  _showHelp() {
+    const lines = [
+      '',
+      `{bold}{green-fg}◈ Vibe Hacker v${require('./config').version} — Command Reference{/green-fg}{/bold}`,
+      '',
+      '{cyan-fg}Keys{/cyan-fg}',
+      '  {#555555-fg}[Tab]{/#555555-fg}         Cycle mode: Chat → Hunt',
+      '  {#555555-fg}[Ctrl+P]{/#555555-fg}      Command palette',
+      '  {#555555-fg}[Ctrl+L]{/#555555-fg}      Clear output',
+      '  {#555555-fg}[Ctrl+X]{/#555555-fg}      Cancel request',
+      '  {#555555-fg}[Ctrl+R]{/#555555-fg}      Retry last message',
+      '  {#555555-fg}[↑ / ↓]{/#555555-fg}       Input history',
+      '  {#555555-fg}[PageUp/Dn]{/#555555-fg}   Scroll output',
+      '  {#555555-fg}[Escape]{/#555555-fg}      Clear input',
+      '  {#555555-fg}[Ctrl+C]{/#555555-fg}      Exit',
+      '',
+      '{cyan-fg}Commands{/cyan-fg}',
+      '  {#00ff88-fg}/clear{/#00ff88-fg}              Clear chat + context',
+      '  {#00ff88-fg}/undo{/#00ff88-fg}               Undo last file edit',
+      '  {#00ff88-fg}/modified{/#00ff88-fg}            Show files changed this session',
+      '  {#00ff88-fg}/mode{/#00ff88-fg}               Cycle mode (Chat ↔ Hunt)',
+      '  {#00ff88-fg}/retry{/#00ff88-fg}              Retry last message',
+      '  {#00ff88-fg}/cd <path>{/#00ff88-fg}          Change working directory',
+      '  {#00ff88-fg}/cwd{/#00ff88-fg}                Show current directory',
+      '  {#00ff88-fg}/addkey <key>{/#00ff88-fg}       Add provider (Groq/Cerebras/Gemini)',
+      '  {#00ff88-fg}/providers{/#00ff88-fg}          List providers',
+      '  {#00ff88-fg}/tokens <n>{/#00ff88-fg}         Set max_tokens',
+      '  {#00ff88-fg}/approve{/#00ff88-fg}            Manage auto-approved tools',
+      '  {#00ff88-fg}/update{/#00ff88-fg}             Check for CLI updates',
+      '  {#00ff88-fg}/pro{/#00ff88-fg}                Upgrade to Pro',
+      '  {#00ff88-fg}/help{/#00ff88-fg}               This help',
+      '  {#00ff88-fg}/exit{/#00ff88-fg}               Exit',
+      '',
+      '{cyan-fg}Free Providers (add with /addkey){/cyan-fg}',
+      '  {#44ff88-fg}Groq{/#44ff88-fg}      14,400 req/day  console.groq.com',
+      '  {#44ff88-fg}Cerebras{/#44ff88-fg}  1M tokens/day   inference.cerebras.ai',
+      '  {#44ff88-fg}Gemini{/#44ff88-fg}    1000 req/day    aistudio.google.com',
+      '  {#44ff88-fg}Mistral{/#44ff88-fg}   ~1B tok/month   console.mistral.ai',
+      '',
+      '{cyan-fg}Modes{/cyan-fg}',
+      '  {bold}Hunt{/bold}   Autonomous agent — reads/writes/edits files, runs commands, grep/glob',
+      '  {bold}Chat{/bold}   Expert Q&A — security, engineering, threat intel',
+      '',
+      '{cyan-fg}Hunt Mode Tools{/cyan-fg}',
+      '  read_file · edit_file · write_file · execute_command',
+      '  grep · glob · list_files · search_files · create_directory · delete_file',
+      '',
+    ];
+    lines.forEach(l => this._log(l));
+    this.screen.render();
+  }
+
+  // ── Smart model/provider rotation — completely silent ───────────────────
+
+  _findNextAvailable() {
+    const curProv = this.providers.current();
+
+    // Step 1: Try other models on the SAME provider (skip if circuit breaker open)
+    if (!isCircuitOpen(curProv.baseURL)) {
+      if (curProv.type === 'openrouter') {
+        const allModels = this.models.list();
+        const untried   = allModels.find(m => !this._triedModels.has(m.id));
+        if (untried) {
+          this.models.selectById(untried.id);
+          return true;
+        }
+      } else {
+        const models  = curProv.models || [];
+        const untried = models.find(m => !this._triedModels.has(m.id));
+        if (untried) {
+          this.providers.selectModelById(untried.id);
+          return true;
+        }
+      }
+    }
+
+    // Step 2: Switch to next non-limited provider, preferring healthy ones
+    const switched = this.providers.markRateLimited();
+    if (switched) {
+      const newProv = this.providers.current();
+
+      // If the new provider's circuit breaker is open, try to find another
+      if (isCircuitOpen(newProv.baseURL)) {
+        const allProvs = this.providers.list();
+        for (let i = 0; i < allProvs.length; i++) {
+          if (!isCircuitOpen(allProvs[i].baseURL) && allProvs[i].type !== curProv.type) {
+            // Found a healthy provider — switch to it
+            this.providers.markRateLimited(); // skip the circuit-broken one
+            break;
+          }
+        }
+      }
+
+      // Check if the new provider's current model was already tried
+      const newModel = this.providers.currentModel();
+      if (newModel && this._triedModels.has(newModel.id)) {
+        const activeProv = this.providers.current();
+        const newModels  = activeProv.type === 'openrouter' ? this.models.list() : (activeProv.models || []);
+        const untried2   = newModels.find(m => !this._triedModels.has(m.id));
+        if (untried2) {
+          this.providers.selectModelById(untried2.id);
+        }
+      }
+      return true;
+    }
+
+    return false; // everything exhausted
+  }
+
+  // ── Retry with currently selected model (after auto-switch) ─────────────
+  // Reuses the shared _runAgent helper — no code duplication.
+
+  async _retryWithCurrentModel(text, xmlFilter, prevFlush) {
+    // Remove the user message pushed by the failed run — agent.run will re-add it
+    const hist = this.agent.history;
+    while (hist.length && hist[hist.length - 1].role === 'user' &&
+           hist[hist.length - 1].content === text) {
+      hist.pop();
+    }
+
+    if (prevFlush) prevFlush();
+    xmlFilter.reset();
+
+    await this._runAgent(text, xmlFilter);
+  }
+
+  // ── Daily-limit warning banner ────────────────────────────────────────────
+
+  _showDailyLimitWarning(msg, isDailyLimit) {
+    const configured = new Set(this.providers.list().map(p => p.type));
+    const tried = this._triedModels.size;
+
+    this._log('');
+    this._log('{#005500-fg}  ┌──────────────────────────────────────────────────────┐{/#005500-fg}');
+    this._log(`{#005500-fg}  │{/#005500-fg}  {yellow-fg}{bold}⚠ Daily limit reached{/bold}{/yellow-fg}                                  {#005500-fg}│{/#005500-fg}`);
+    this._log('{#005500-fg}  │{/#005500-fg}                                                        {#005500-fg}│{/#005500-fg}');
+    this._log("{#005500-fg}  │{/#005500-fg}  {#888888-fg}You've used all 50 free requests for today.{/#888888-fg}      {#005500-fg}│{/#005500-fg}");
+    this._log('{#005500-fg}  │{/#005500-fg}  {#888888-fg}Resets in 24 hours or upgrade for unlimited.{/#888888-fg}     {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  │{/#005500-fg}                                                        {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  │{/#005500-fg}  {#00ff88-fg}{bold}Go Pro → vibsecurity.com{/bold}{/#00ff88-fg}                         {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  │{/#005500-fg}  {#555555-fg}Unlimited requests · Priority models{/#555555-fg}             {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  │{/#005500-fg}                                                        {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  │{/#005500-fg}  {#00aa44-fg}/addkey <key>{/#00aa44-fg}  {#555555-fg}add your own provider key{/#555555-fg}        {#005500-fg}│{/#005500-fg}');
+    this._log('{#005500-fg}  └──────────────────────────────────────────────────────┘{/#005500-fg}');
+    this._log('');
+    this._dailyLimitHit = true;
+    this.screen.render();
+  }
+
+  // ── Silent background key check ──────────────────────────────────────────
+  async _silentKeyCheck() {
+    try {
+      const cfg = require('./config');
+      if (!cfg.apiKey) return; // no key yet, skip
+
+      // Use the proper checkKey function instead of raw request
+      const { checkKey } = require('./api');
+      const result = await checkKey(cfg.apiKey);
+
+      if (!result.ok && (result.status === 401 || result.status === 403)) {
+        this._log('{red-fg}⚠ API key invalid — run {cyan-fg}/key{/cyan-fg} to update{/red-fg}');
+        this.screen.render();
+      }
+      // Otherwise stay silent — key is valid or provider doesn't have a check endpoint
+    } catch (err) {
+      // Network error on startup — ignore silently
+    }
+  }
+
+  // ── API helpers ───────────────────────────────────────────────────────────
+
+  async _testApiKey() {
+    const prov  = this.providers.current();
+    const model = this.providers.currentModel();
+    this._log(`{#444444-fg}[testing ${prov.name} key with ${model ? model.name : '?'}…]{/#444444-fg}`);
+    this.screen.render();
+    try {
+      const axios = require('axios');
+      const cfg   = require('./config');
+      const r = await axios.post(`${cfg.baseURL}/chat/completions`, {
+        model: model ? model.id : '',
+        messages: [{ role: 'user', content: 'Reply with one word: OK' }],
+        max_tokens: 5,
+      }, {
+        headers: {
+          'Authorization': `Bearer ${cfg.apiKey}`,
+          'Content-Type': 'application/json',
+          'HTTP-Referer': cfg.httpReferer,
+          'X-Title': cfg.xTitle,
+        },
+        timeout: 20000,
+      });
+      const reply = r.data?.choices?.[0]?.message?.content?.trim() || '(empty)';
+      this._log(`{green-fg}[${prov.name} OK — ${model ? model.name : '?'} responded: "${esc(reply)}"]{/green-fg}`);
+    } catch (err) {
+      const status = err.response?.status;
+      const msg    = err.response?.data?.error?.message || err.message;
+      if (status === 401) {
+        this._log(`{red-fg}[401 invalid key: ${esc(msg)}]{/red-fg}`);
+        this._log('{yellow-fg}  → /key sk-or-v1-YOUR_KEY to update{/yellow-fg}');
+      } else if (status === 429) {
+        this._log(`{yellow-fg}[429 rate limited — try another model]{/yellow-fg}`);
+      } else if (status === 404) {
+        this._log(`{yellow-fg}[404 model unavailable — run /refresh or /model]{/yellow-fg}`);
+      } else {
+        this._log(`{red-fg}[API error ${status || '?'}: ${esc(msg)}]{/red-fg}`);
+      }
+    }
+    this.screen.render();
+  }
+
+  async _refreshModels() {
+    this._log('{#444444-fg}[refreshing model list…]{/#444444-fg}');
+    this.screen.render();
+    try {
+      const cfg = require('./config');
+      const count = await this.models.refresh(cfg.apiKey, cfg.baseURL);
+      if (count > 0) {
+        this._log(`{green-fg}[refreshed — ${count} free models available]{/green-fg}`);
+        this._updateModeBar();
+      } else {
+        this._log('{yellow-fg}[no new models found — using built-in list]{/yellow-fg}');
+      }
+    } catch (err) {
+      this._log(`{red-fg}[refresh failed: ${esc(err.message)}]{/red-fg}`);
+    }
+    this.screen.render();
+  }
+
+  // ── Tier check — fetch plan info from Supabase ─────────────────────────────
+  async _checkTier() {
+    try {
+      const cfg = require('./config');
+      const { checkApiKey } = require('./supabase');
+      const info = await checkApiKey(cfg.apiKey);
+      if (info && info.valid) {
+        this._tier = info.tier;
+        this._remaining = info.remaining;
+        this._dailyLimit = info.daily_limit === -1 ? null : info.daily_limit;
+        this._refreshHeader();
+      }
+    } catch (_) {}
+  }
+
+  // ── Use request — decrement counter, check limit ──────────────────────────
+  async _useRequest() {
+    try {
+      const cfg = require('./config');
+      const { useRequest } = require('./supabase');
+      const result = await useRequest(cfg.apiKey);
+      if (!result) return true; // network error — allow
+
+      if (!result.allowed && result.error === 'FREE_TIER_LIMIT') {
+        this._remaining = 0;
+        this._refreshHeader();
+        this._log('');
+        this._log('{red-fg}{bold}  ⚠ Daily request limit reached{/bold}{/red-fg}');
+        this._log(`{#888888-fg}  Free tier: ${this._dailyLimit || 50} requests/day{/#888888-fg}`);
+        this._log('');
+        this._log('{#00ff88-fg}  Go Pro for unlimited requests:{/#00ff88-fg}');
+        this._log('  {cyan-fg}{bold}https://vibsecurity.com{/bold}{/cyan-fg}');
+        this._log('');
+        this.screen.render();
+        return false;
+      }
+
+      // Update remaining count
+      if (result.remaining !== undefined) {
+        this._remaining = result.remaining;
+        this._tier = result.tier;
+        this._refreshHeader();
+      }
+      return true;
+    } catch (_) {
+      return true; // network error — allow
+    }
+  }
+
+  // ── Silent model refresh on startup ─────────────────────────────────────────
+  async _silentModelRefresh() {
+    try {
+      const cfg = require('./config');
+      const count = await this.models.refresh(cfg.apiKey, cfg.baseURL);
+      if (count > 0) {
+        this._updateModeBar();
+      }
+    } catch (_) {
+      // Network error on startup — keep using built-in list
+    }
+  }
+
+  // ── Update checker — queries npm registry for latest vibehacker version ────
+  async _checkForUpdate() {
+    try {
+      const https = require('https');
+      const current = require('../package.json').version;
+      const latest = await new Promise((resolve, reject) => {
+        const req = https.get('https://registry.npmjs.org/vibehacker/latest', {
+          headers: { 'Accept': 'application/json' },
+          timeout: 4000,
+        }, (res) => {
+          let data = '';
+          res.on('data', c => data += c);
+          res.on('end', () => {
+            try { resolve(JSON.parse(data).version); } catch (e) { reject(e); }
+          });
+        });
+        req.on('error', reject);
+        req.on('timeout', () => { req.destroy(); reject(new Error('timeout')); });
+      });
+      if (latest && this._isNewer(latest, current)) {
+        this._updateAvailable = latest;
+        this._log('');
+        this._log(`  {#ffaa00-fg}{bold}★ Update available:{/bold}{/#ffaa00-fg} {#888888-fg}v${current} → {/}{bold}{#00ff88-fg}v${latest}{/#00ff88-fg}{/bold}`);
+        this._log('  {#444444-fg}Run {#00ff88-fg}/update{/#00ff88-fg} to upgrade automatically{/#444444-fg}');
+        this._log('');
+        this.screen.render();
+      }
+    } catch (_) { /* silent — network error or offline */ }
+  }
+
+  _isNewer(a, b) {
+    const pa = a.split('.').map(n => parseInt(n, 10) || 0);
+    const pb = b.split('.').map(n => parseInt(n, 10) || 0);
+    for (let i = 0; i < 3; i++) {
+      if ((pa[i] || 0) > (pb[i] || 0)) return true;
+      if ((pa[i] || 0) < (pb[i] || 0)) return false;
+    }
+    return false;
+  }
+
+  // ── /update — run npm install -g vibehacker@latest ─────────────────────────
+  _runUpdate() {
+    const { spawn } = require('child_process');
+    const current = require('../package.json').version;
+
+    // Check latest first
+    const https = require('https');
+    https.get('https://registry.npmjs.org/vibehacker/latest', {
+      headers: { 'Accept': 'application/json' },
+      timeout: 5000,
+    }, (res) => {
+      let data = '';
+      res.on('data', c => data += c);
+      res.on('end', () => {
+        let latest;
+        try { latest = JSON.parse(data).version; } catch (_) {
+          this._log('{red-fg}  ✗ Could not reach npm registry{/red-fg}');
+          this.screen.render();
+          return;
+        }
+        if (!this._isNewer(latest, current)) {
+          this._log(`{green-fg}  ✓ Already up to date (v${current}){/green-fg}`);
+          this._log('');
+          this.screen.render();
+          return;
+        }
+        this._log(`{#00ff88-fg}  Found v${latest} — installing…{/#00ff88-fg}`);
+        this._log('{#444444-fg}  Running: npm install -g vibehacker@latest{/#444444-fg}');
+        this.screen.render();
+
+        const isWin = process.platform === 'win32';
+        const proc  = spawn(isWin ? 'npm.cmd' : 'npm', ['install', '-g', 'vibehacker@latest'], {
+          stdio: ['ignore', 'pipe', 'pipe'],
+          windowsHide: true,
+        });
+
+        let errOut = '';
+        proc.stderr.on('data', (d) => { errOut += d.toString(); });
+        proc.on('error', (err) => {
+          this._log(`{red-fg}  ✗ Update failed: ${esc(err.message)}{/red-fg}`);
+          this._log('{#444444-fg}  Try manually: npm install -g vibehacker@latest{/#444444-fg}');
+          this.screen.render();
+        });
+        proc.on('close', (code) => {
+          if (code === 0) {
+            this._log('');
+            this._log(`{green-fg}{bold}  ✓ Updated to v${latest}{/bold}{/green-fg}`);
+            this._log('{#444444-fg}  Restart Vibe Hacker to use the new version.{/#444444-fg}');
+            this._log('');
+          } else {
+            this._log(`{red-fg}  ✗ npm exited with code ${code}{/red-fg}`);
+            if (errOut.includes('EACCES') || errOut.includes('permission')) {
+              this._log('{#444444-fg}  Permission denied — try: sudo npm install -g vibehacker@latest{/#444444-fg}');
+            } else {
+              this._log('{#444444-fg}  Try manually: npm install -g vibehacker@latest{/#444444-fg}');
+            }
+          }
+          this.screen.render();
+        });
+      });
+    }).on('error', () => {
+      this._log('{red-fg}  ✗ Could not reach npm registry (offline?){/red-fg}');
+      this.screen.render();
+    });
+  }
+
+  // (_refreshModelsAndPick removed — models refresh silently, auto-rotation handles switching)
+
+  // ── Exit ──────────────────────────────────────────────────────────────────
+
+  _exit() {
+    if (this._exiting) return; // prevent double-call
+    this._exiting = true;
+    clearInterval(this._spinnerTimer);
+    clearInterval(this._petTimer);
+    if (this._abortCtrl) { try { this._abortCtrl.abort(); } catch (_) {} }
+    try { this.screen.destroy(); } catch (_) {}
+    // Restore terminal state then exit
+    process.stdout.write('\x1b[?25h\x1b[0m\r\n');
+    process.stderr.write('\r\n  \x1b[32m◈ Vibe Hacker\x1b[0m — session terminated.\r\n\r\n');
+    // Use setImmediate so stdout flushes before exit
+    setImmediate(() => process.exit(0));
+  }
+}
+
+module.exports = { HackerCLIApp };