wotann 0.5.95 → 0.5.97

package/dist/index.js

@@ -224,7 +224,7 @@ program
     // `--no-fullscreen` or `WOTANN_FULLSCREEN=0`.
     .option("--fullscreen", "Use the alternate screen buffer (default: on)", true)
     .option("--no-fullscreen", "Render in main scrollback (legacy mode)")
-    .option("--renderer <renderer>", "TUI renderer: ink | opentui", "ink")
+    .option("--renderer <renderer>", "TUI renderer: ink (alt-screen) | inline (no-flicker main-buffer)", "ink")
     .action(async (options) => {
     if (options.workspace !== undefined) {
         try {
@@ -399,25 +399,15 @@ program
             "ANTHROPIC_API_KEY / OPENAI_API_KEY / GEMINI_API_KEY etc. " +
             "in your environment. Continuing to TUI in static mode.\n");
     }
-    if (options.renderer === "opentui") {
-        if (!isInteractiveTTY) {
-            process.stderr.write("[wotann] --renderer opentui requires an interactive TTY.\n");
-            return;
-        }
-        const { mountOpenTuiChat } = await import("./ui/opentui-chat.js");
-        const handle = await mountOpenTuiChat({
-            version: VERSION,
-            providers: interactive.providers,
-            initialModel: interactive.initialModel,
-            initialProvider: interactive.initialProvider,
-            runtime: interactive.runtime,
-            fullscreen: options.fullscreen,
-        });
-        await handle.waitUntilExit;
-        return;
-    }
-    if (options.renderer !== undefined && options.renderer !== "ink") {
-        process.stderr.write("[wotann] Unknown renderer. Use --renderer ink or --renderer opentui.\n");
+    // The `opentui` renderer was retired (docs/phase-0-redesign/
+    // renderer-decision.md): @opentui loads its Zig core via bun:ffi, so
+    // it was dead-on-arrival under stock Node — it typechecked but threw
+    // on import for every user. The no-flicker win is delivered on Ink
+    // instead via `--renderer inline` (main-buffer + <Static>).
+    if (options.renderer !== undefined &&
+        options.renderer !== "ink" &&
+        options.renderer !== "inline") {
+        process.stderr.write("[wotann] Unknown renderer. Use --renderer ink (alt-screen) or --renderer inline (no-flicker main-buffer).\n");
         return;
     }
     // Pre-load the heavy UI modules BEFORE entering alt-buffer so the
@@ -426,13 +416,19 @@ program
     // AppV3 + Ink + react-reconciler hydrate, which is exactly the
     // "npx wotann hangs and shows a black screen" symptom users have
     // reported (2026-05-23 P0). Parallel imports cut the wait further.
-    const [{ AppV3 }, { mountInteractiveInk }, altBufferModule] = await Promise.all([
+    const [{ AppV3 }, { mountInteractiveInk }, altBufferModule, { isInlineRenderRequested }] = await Promise.all([
         import("./ui/components/v3/index.js"),
         import("./ui/mount-interactive-ink.js"),
         import("./ui/alt-buffer.js"),
+        import("./ui/inline-render.js"),
     ]);
     const { isAltBufferRequested, enterAltBuffer, exitAltBuffer } = altBufferModule;
-    const wantsAltBuffer = isAltBufferRequested(options.fullscreen !== false);
+    // Inline (main-buffer + <Static>) mode skips alt-buffer entry — the
+    // two are mutually exclusive (the alt buffer has no scrollback for
+    // <Static> to write committed history into). Opt in via
+    // `--renderer inline` OR WOTANN_TUI_INLINE=1; see src/ui/inline-render.ts.
+    const inlineMode = options.renderer === "inline" || isInlineRenderRequested();
+    const wantsAltBuffer = isAltBufferRequested(options.fullscreen !== false) && !inlineMode;
     // Mount the single V3 shell through the ONE guarded gate every
     // interactive Ink mount must use: viewport repair, raw-mode-
     // capable stdin resolution, refuse-cleanly-with-guidance.
@@ -455,6 +451,7 @@ program
             initialModel: interactive.initialModel,
             initialProvider: interactive.initialProvider,
             runtime: interactive.runtime,
+            inline: inlineMode,
         }), {
             onResolved: () => {
                 if (wantsAltBuffer)
@@ -1960,13 +1957,17 @@ program
     // (npx pitch-black fix 2026-05-23). Same fullscreen-mode hook as
     // `wotann start` — env var only here (no CLI flag on `wotann
     // resume`). Default ON; disable via `WOTANN_FULLSCREEN=0`.
-    const [{ AppV3 }, { mountInteractiveInk }, altBufferModule] = await Promise.all([
+    const [{ AppV3 }, { mountInteractiveInk }, altBufferModule, { isInlineRenderRequested }] = await Promise.all([
         import("./ui/components/v3/index.js"),
         import("./ui/mount-interactive-ink.js"),
         import("./ui/alt-buffer.js"),
+        import("./ui/inline-render.js"),
     ]);
     const { isAltBufferRequested, enterAltBuffer, exitAltBuffer } = altBufferModule;
-    const wantsAltBuffer = isAltBufferRequested(true);
+    // Inline main-buffer + <Static> rendering is mutually exclusive with
+    // the alt buffer (phased rollout behind WOTANN_TUI_INLINE=1).
+    const inlineMode = isInlineRenderRequested();
+    const wantsAltBuffer = isAltBufferRequested(true) && !inlineMode;
     // v0.5.89 hotfix: alt-buffer entry is now gated through `onResolved`
     // so a guard refusal never swallows the diagnostic. See start
     // command for the full discussion.
@@ -1979,6 +1980,7 @@ program
             initialProvider: session.provider,
             initialMessages: session.messages,
             runtime: interactive.runtime,
+            inline: inlineMode,
         }), {
             onResolved: () => {
                 if (wantsAltBuffer)
@@ -5377,6 +5379,48 @@ program
             ? chalk.green("  Done — Task completed successfully")
             : chalk.red("  Failed — Task did not complete"));
         console.log();
+        // Independent verify-by-reproduction (opt-in: WOTANN_REPRODUCE=1).
+        // Default-off because re-running the suite in an isolated checkout
+        // roughly doubles run time. Replays the agent's claimed checks in a
+        // clean base+diff worktree (a separate trust boundary, deps symlinked)
+        // and reports a verdict the agent cannot fake. Best-effort — never
+        // breaks the run.
+        if (process.env.WOTANN_REPRODUCE === "1") {
+            try {
+                const [repro, os, path] = await Promise.all([
+                    import("./verification/reproduction/index.js"),
+                    import("node:os"),
+                    import("node:path"),
+                ]);
+                const git = repro.buildExecGitRunner();
+                const lastCycle = result.cycles[result.cycles.length - 1];
+                const verdict = await repro.runWorkspaceReproduction({
+                    cwd: process.cwd(),
+                    claimed: {
+                        testsPass: lastCycle?.testsPass ?? false,
+                        typecheckPass: lastCycle?.typecheckPass ?? false,
+                        lintPass: lastCycle?.lintPass ?? false,
+                    },
+                    commands: { test: ["npm", "test"], typecheck: ["npm", "run", "typecheck"] },
+                    worktreeDir: path.join(os.tmpdir(), `wotann-verify-${Date.now()}`),
+                    linkFromRepo: ["node_modules"],
+                }, { git, replay: repro.buildExecReplayRunner() });
+                const tag = verdict.enforcement.action === "block"
+                    ? chalk.red(`⛔ ${verdict.result.verdict}`)
+                    : verdict.enforcement.action === "allow"
+                        ? chalk.green(`✓ ${verdict.result.verdict}`)
+                        : chalk.yellow(`⚠ ${verdict.result.verdict}`);
+                console.log(chalk.bold("Independent reproduction (separate trust boundary):"));
+                console.log(`  ${tag} — ${verdict.enforcement.reason}`);
+                for (const c of verdict.result.contradictions) {
+                    console.log(chalk.dim(`    • ${c}`));
+                }
+                console.log();
+            }
+            catch (e) {
+                console.log(chalk.dim(`  Reproduction skipped: ${e instanceof Error ? e.message : String(e)}`));
+            }
+        }
         process.exit(result.success ? 0 : 1);
     }
     finally {

package/dist/orchestration/proof-bundles.d.ts

@@ -47,6 +47,14 @@ export interface AutonomousProofBundle {
         readonly visualVerificationEnabled: boolean;
         readonly visualExpectation?: string;
         readonly finalChecks: {
+            /**
+             * Provenance of these checks. "self-reported" = copied from the agent's
+             * own cycle result — a CLAIM, not an independently reproduced result. A
+             * green check is a claim, not proof (verify-by-reproduction, V7); a future
+             * verdict re-runs these in a separate trust boundary and reports a
+             * "reproduced" source instead.
+             */
+            readonly source: "self-reported";
             readonly testsPass: boolean;
             readonly typecheckPass: boolean;
             readonly lintPass: boolean;

package/dist/orchestration/proof-bundles.js

@@ -44,6 +44,8 @@ export function writeAutonomousProofBundle(input) {
             visualExpectation: input.visualExpectation,
             finalChecks: lastCycle
                 ? {
+                    // Self-reported by the agent's own cycle — a claim, not proof (V7).
+                    source: "self-reported",
                     testsPass: lastCycle.testsPass,
                     typecheckPass: lastCycle.typecheckPass,
                     lintPass: lastCycle.lintPass,

package/dist/security/approval-binding.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Exact-bytes approval binding (corpus F4; defeats the OpenClaw CVE-2026-29607
+ * "approval persisted at the wrapper level, not the inner command" class and
+ * the TOCTOU race). Bind the canonicalized action's HMAC at approval time;
+ * re-pin at execution and abort on drift, replay (single-use nonce), or expiry.
+ */
+export interface CanonicalAction {
+    readonly tool: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+}
+export interface ApprovalBinding {
+    readonly bindingId: string;
+    readonly actionHash: string;
+    readonly nonce: string;
+    readonly expiresAt: number;
+}
+export type VerifyResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Deterministic canonical form of an action. The CALLER must pre-resolve shell
+ * expansion / env-substitution / path resolution BEFORE binding, so the bound
+ * bytes ARE exactly what will execute (the literate wrapper is not what runs).
+ */
+export declare function canonicalizeAction(action: CanonicalAction): string;
+export interface ApprovalBinderOptions {
+    readonly ttlMs?: number;
+    readonly now?: () => number;
+}
+/**
+ * Stateful service: the consumed-nonce set lives inside the instance (QB#7
+ * per-call state, not module-global). Inject `now` for deterministic tests.
+ */
+export declare class ApprovalBinder {
+    private readonly secret;
+    private readonly ttlMs;
+    private readonly now;
+    private readonly consumed;
+    private counter;
+    constructor(secret: Buffer | string, opts?: ApprovalBinderOptions);
+    bind(action: CanonicalAction, nonce?: string): ApprovalBinding;
+    /**
+     * Re-pin at execution: recompute the HMAC from the action that is ABOUT to
+     * run and reject on drift, expiry, or replay. Consumes the nonce on success.
+     * Order matters: replay > expiry > drift (cheapest, most-specific first).
+     */
+    verify(binding: ApprovalBinding, action: CanonicalAction): VerifyResult;
+}

package/dist/security/approval-binding.js

@@ -0,0 +1,57 @@
+import { timingSafeEqual } from "node:crypto";
+import { computeBoundaryHmac } from "./prompt-injection-quarantine.js";
+/**
+ * Deterministic canonical form of an action. The CALLER must pre-resolve shell
+ * expansion / env-substitution / path resolution BEFORE binding, so the bound
+ * bytes ARE exactly what will execute (the literate wrapper is not what runs).
+ */
+export function canonicalizeAction(action) {
+    return JSON.stringify({ tool: action.tool.trim(), args: action.args, cwd: action.cwd });
+}
+/**
+ * Stateful service: the consumed-nonce set lives inside the instance (QB#7
+ * per-call state, not module-global). Inject `now` for deterministic tests.
+ */
+export class ApprovalBinder {
+    secret;
+    ttlMs;
+    now;
+    consumed = new Set();
+    counter = 0;
+    constructor(secret, opts = {}) {
+        this.secret = secret;
+        this.ttlMs = opts.ttlMs ?? 5 * 60_000;
+        this.now = opts.now ?? (() => Date.now());
+    }
+    bind(action, nonce) {
+        const actionHash = computeBoundaryHmac(canonicalizeAction(action), this.secret);
+        const id = ++this.counter;
+        return {
+            bindingId: `bind-${id}`,
+            actionHash,
+            nonce: nonce ?? `n-${this.now()}-${id}`,
+            expiresAt: this.now() + this.ttlMs,
+        };
+    }
+    /**
+     * Re-pin at execution: recompute the HMAC from the action that is ABOUT to
+     * run and reject on drift, expiry, or replay. Consumes the nonce on success.
+     * Order matters: replay > expiry > drift (cheapest, most-specific first).
+     */
+    verify(binding, action) {
+        if (this.consumed.has(binding.nonce)) {
+            return { ok: false, reason: "replay: nonce already consumed" };
+        }
+        if (this.now() > binding.expiresAt) {
+            return { ok: false, reason: "expired: approval window elapsed" };
+        }
+        const recomputed = computeBoundaryHmac(canonicalizeAction(action), this.secret);
+        const a = Buffer.from(recomputed, "utf-8");
+        const b = Buffer.from(binding.actionHash, "utf-8");
+        if (a.length !== b.length || !timingSafeEqual(a, b)) {
+            return { ok: false, reason: "hash drift: action changed since approval" };
+        }
+        this.consumed.add(binding.nonce);
+        return { ok: true };
+    }
+}

package/dist/security/human-approval.d.ts

@@ -19,6 +19,8 @@ export interface ApprovalRequest {
     readonly tool: string;
     readonly args: string;
     readonly reason: string;
+    /** Optional exact-bytes approval-binding hash (see security/approval-binding.ts). */
+    readonly hash?: string;
     readonly risk: "low" | "medium" | "high" | "critical";
     readonly riskLevel: "moderate" | "high" | "critical";
     readonly createdAt: number;

package/dist/security/human-approval.js

@@ -26,7 +26,10 @@ const DEFAULT_POLICIES = [
         riskLevel: "moderate",
         channels: ["cli", "desktop"],
         timeoutMs: 60_000, // 1 minute
-        defaultOnTimeout: "approve",
+        // Fail CLOSED: an absent/stalled human must never auto-approve a write or
+        // edit. An adversarial agent could otherwise stall past the timeout to win
+        // an automatic approval. (bash is already fail-closed; this matches it.)
+        defaultOnTimeout: "deny",
     },
 ];
 // ── Approval Manager ─────────────────────────────────────
@@ -71,7 +74,7 @@ export class HumanApprovalManager {
                         feedback: `Approval timed out after ${timeoutMs}ms. Default: ${defaultOnTimeout}.`,
                         respondedAt: Date.now(),
                     };
-                    this.history.push(response);
+                    this.history.push({ request, response });
                     resolve(response);
                 }
             }, timeoutMs);
@@ -80,7 +83,7 @@ export class HumanApprovalManager {
                 request,
                 resolve: (response) => {
                     clearTimeout(timer);
-                    this.history.push(response);
+                    this.history.push({ request, response });
                     resolve(response);
                 },
             });
@@ -113,7 +116,7 @@ export class HumanApprovalManager {
      * Get approval history.
      */
     getHistory() {
-        return this.history;
+        return this.history.map((record) => record.response);
     }
     /**
      * Add a custom policy.
@@ -146,30 +149,18 @@ export class HumanApprovalManager {
      * Get full audit log of all approval decisions (request + result pairs).
      */
     getAuditLog() {
-        return this.history.map((response) => {
-            // Look up the original request from pending or reconstruct from response
-            const request = {
-                id: response.requestId,
-                action: "tool_call",
-                description: response.feedback ?? "",
-                tool: "",
-                args: "",
-                reason: "",
-                risk: "medium",
-                riskLevel: "moderate",
-                createdAt: response.respondedAt,
-                timestamp: response.respondedAt,
-                timeoutMs: 0,
-                channels: [],
-            };
-            const result = {
+        // The REAL request is recorded at decision time and read back verbatim —
+        // never reconstructed — so the audit trail can never drift from what was
+        // actually approved.
+        return this.history.map(({ request, response }) => ({
+            request,
+            result: {
                 approved: response.decision === "approve",
                 approvedBy: response.respondedBy,
                 feedback: response.feedback,
                 decidedAt: response.respondedAt,
-            };
-            return { request, result };
-        });
+            },
+        }));
     }
     // ── Private ────────────────────────────────────────────
     assessRisk(tool, args) {

package/dist/ui/components/v3/AppV3.d.ts

@@ -50,6 +50,15 @@ export interface AppV3Props {
     readonly initialProvider?: ProviderName;
     readonly initialMessages?: readonly AgentMessage[];
     readonly runtime?: WotannRuntime;
+    /**
+     * AppV4 inline render mode — committed history renders in Ink `<Static>`
+     * (written once into the terminal's native scrollback) and only the
+     * in-flight turn repaints, eliminating streaming flicker. The mount path
+     * (src/index.ts) also skips the alt-screen buffer when this is set, since
+     * `<Static>` needs main-buffer scrollback. Phased rollout behind
+     * `WOTANN_TUI_INLINE=1`; defaults off.
+     */
+    readonly inline?: boolean;
     /**
      * Optional capability-profile override — primarily for tests so the
      * tier is deterministic without manipulating `process.env`. When
@@ -107,4 +116,4 @@ export interface AppV3Props {
  * renders without a missing-style crash.
  */
 export declare function toTranscriptMessages(messages: readonly AgentMessage[]): readonly TranscriptMessageV3[];
-export declare function AppV3({ version: _version, providers, initialModel, initialProvider, initialMessages, runtime, profileOverride, columnsOverride, rowsOverride, uiStatePathOverride, statuslineConfigPathOverride, layoutConfigPathOverride, snippetDbPathOverride, }: AppV3Props): React.ReactElement;
+export declare function AppV3({ version: _version, providers, initialModel, initialProvider, initialMessages, runtime, inline, profileOverride, columnsOverride, rowsOverride, uiStatePathOverride, statuslineConfigPathOverride, layoutConfigPathOverride, snippetDbPathOverride, }: AppV3Props): React.ReactElement;

package/dist/ui/components/v3/AppV3.js

@@ -224,7 +224,7 @@ function NoProviderHint() {
     const choices = useMemo(() => buildOnboardingAuthChoices().slice(0, 4), []);
     return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { color: tone.muted, children: "No provider configured \u2014 authenticate the standard way:" }), choices.map((c) => (_jsxs(Text, { color: tone.muted, children: ["  • ", c.label, ": ", c.hint] }, c.id)))] }));
 }
-function AppV3Inner({ providers, initialModel, initialProvider, messages, isStreaming, setIsStreaming, draftValue, setDraftValue, setMessages, profile, terminalCapabilities, runtime, escPrimed, quitConfirm, bannerVariant, setBannerVariant, slashRouter, slashContext, themeManager, tourResolved, setTourResolved, persistedOnboarded, sidePaneVisible, sidePaneSnapshotMessages, sidePaneLocalMessages, sidePaneStreaming, setSidePaneLocalMessages, setSidePaneStreaming, closeSidePane, toggleSidePane, statuslineSegments, sessionStartedAt, activeGoal, vimMode, petMode, statusBarPosition, }) {
+function AppV3Inner({ providers, initialModel, initialProvider, messages, isStreaming, setIsStreaming, draftValue, setDraftValue, setMessages, profile, terminalCapabilities, runtime, escPrimed, quitConfirm, bannerVariant, setBannerVariant, slashRouter, slashContext, themeManager, tourResolved, setTourResolved, persistedOnboarded, sidePaneVisible, sidePaneSnapshotMessages, sidePaneLocalMessages, sidePaneStreaming, setSidePaneLocalMessages, setSidePaneStreaming, closeSidePane, toggleSidePane, statuslineSegments, sessionStartedAt, activeGoal, vimMode, petMode, statusBarPosition, inline, staticEpoch, }) {
     const { tone } = useThemeTone();
     const overlay = useOverlayManager();
     const { columns, rows } = useTerminalWidth();
@@ -237,6 +237,11 @@ function AppV3Inner({ providers, initialModel, initialProvider, messages, isStre
     const maxTranscriptScrollOffset = Math.max(0, transcriptMessages.length - transcriptVisibleCount);
     const [transcriptScrollOffset, setTranscriptScrollOffset] = useState(0);
     const activeRunRef = useRef(null);
+    // AppV4 inline render — the committed-prefix length captured at turn
+    // start. While streaming, messages[0..streamBoundary) stay frozen in
+    // <Static> and only the in-flight turn (the suffix) repaints. See the
+    // `committedCount` derivation below.
+    const streamBoundaryRef = useRef(0);
     const sideActiveRunRef = useRef(null);
     // Hermes Gap 2 — interrupt-and-redirect: persistent channel for the
     // host composer's mid-stream redirects. Ctrl+R captures the current
@@ -247,6 +252,13 @@ function AppV3Inner({ providers, initialModel, initialProvider, messages, isStre
     const redirectChannelRef = useRef(new InMemoryRedirectChannel());
     const [sidePaneDraft, setSidePaneDraft] = useState("");
     const [nowMs, setNowMs] = useState(() => Date.now());
+    // AppV4 inline render boundary. Streaming → freeze the committed prefix
+    // at the turn-start length (only the in-flight turn repaints). Idle →
+    // everything is committed (→ <Static>). The min() guards against a stale
+    // boundary briefly exceeding the live length (e.g. right after /clear).
+    const committedCount = isStreaming
+        ? Math.min(streamBoundaryRef.current, transcriptMessages.length)
+        : transcriptMessages.length;
     useEffect(() => {
         setTranscriptScrollOffset(0);
     }, [messages.length]);
@@ -388,6 +400,12 @@ function AppV3Inner({ providers, initialModel, initialProvider, messages, isStre
         const turnContext = messages;
         const abortController = new AbortController();
         activeRunRef.current = abortController;
+        // Freeze the inline-render commit boundary at the pre-turn length so
+        // the prior history stays in <Static> and only this turn (user msg +
+        // streaming assistant + tool rows) repaints live. On finalize,
+        // isStreaming flips false and committedCount jumps to the full
+        // length, committing the whole turn to scrollback at once.
+        streamBoundaryRef.current = messages.length;
         setIsStreaming(true);
         setMessages((prev) => [...prev, userMessage]);
         void (async () => {
@@ -852,7 +870,7 @@ function AppV3Inner({ providers, initialModel, initialProvider, messages, isStre
     // "the UI isnt quite what I like… Minimal yet powerful. It's just a bit
     // too much." Provider status moved to the /providers slash command.
     const heavyChrome = process.env["WOTANN_TUI_HEAVY"] === "1";
-    const mainSurface = showSplash ? (_jsxs(Box, { flexDirection: "column", children: [heavyChrome ? (_jsxs(_Fragment, { children: [_jsx(GradientBanner, { profile: profile, state: bannerState, variant: bannerVariant }), _jsx(ModeCycle, { profile: profile, currentMode: currentMode })] })) : null, showTour ? (_jsx(Box, { marginTop: heavyChrome ? 1 : 0, children: _jsx(OnboardingTour, { profile: profile, authChoices: tourAuthChoices, themeChoices: tourThemeChoices, onComplete: finishTour, onDismiss: skipTour }) })) : (_jsxs(Box, { flexDirection: "column", marginTop: heavyChrome ? 1 : 0, marginBottom: 1, paddingLeft: 2, children: [!heavyChrome && (_jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: tone.primary, bold: true, children: "WOTANN" }) })), _jsx(Text, { color: tone.muted, children: "Ready. Type to begin, / for commands, @ to reference files." }), providers.length === 0 ? (_jsx(Box, { marginTop: 1, children: _jsx(NoProviderHint, {}) })) : heavyChrome ? (_jsx(Box, { marginTop: 1, children: _jsx(ProviderStrip, { providers: providers, profile: profile }) })) : null] }))] })) : (_jsx(Box, { flexDirection: "column", marginTop: 1, marginBottom: 1, children: _jsx(Transcript, { messages: transcriptMessages, profile: profile, terminalCapabilities: terminalCapabilities, visibleCount: transcriptVisibleCount, scrollOffset: transcriptScrollOffset }) }));
+    const mainSurface = showSplash ? (_jsxs(Box, { flexDirection: "column", children: [heavyChrome ? (_jsxs(_Fragment, { children: [_jsx(GradientBanner, { profile: profile, state: bannerState, variant: bannerVariant }), _jsx(ModeCycle, { profile: profile, currentMode: currentMode })] })) : null, showTour ? (_jsx(Box, { marginTop: heavyChrome ? 1 : 0, children: _jsx(OnboardingTour, { profile: profile, authChoices: tourAuthChoices, themeChoices: tourThemeChoices, onComplete: finishTour, onDismiss: skipTour }) })) : (_jsxs(Box, { flexDirection: "column", marginTop: heavyChrome ? 1 : 0, marginBottom: 1, paddingLeft: 2, children: [!heavyChrome && (_jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: tone.primary, bold: true, children: "WOTANN" }) })), _jsx(Text, { color: tone.muted, children: "Ready. Type to begin, / for commands, @ to reference files." }), providers.length === 0 ? (_jsx(Box, { marginTop: 1, children: _jsx(NoProviderHint, {}) })) : heavyChrome ? (_jsx(Box, { marginTop: 1, children: _jsx(ProviderStrip, { providers: providers, profile: profile }) })) : null] }))] })) : (_jsx(Box, { flexDirection: "column", marginTop: 1, marginBottom: 1, children: _jsx(Transcript, { messages: transcriptMessages, profile: profile, terminalCapabilities: terminalCapabilities, visibleCount: transcriptVisibleCount, scrollOffset: transcriptScrollOffset, inline: inline, committedCount: committedCount, staticEpoch: staticEpoch }) }));
     const statusBarRow = (_jsx(Box, { marginTop: statusBarPosition === "bottom" ? 1 : 0, marginBottom: statusBarPosition === "top" ? 1 : 0, children: _jsx(StatusBar, { model: initialModel, provider: initialProvider, mode: currentMode, usedTokens: usedTokens, maxTokens: maxTokens, costUsd: sessionCostUsd, reads: 0, edits: 0, bashCalls: 0, isStreaming: isStreaming, contextTrend: contextTrend, profile: profile }) }));
     return (_jsxs(Box, { flexDirection: "column", children: [statusBarPosition === "top" && statusBarRow, _jsxs(Box, { flexDirection: sidePaneVisible && columns >= 80 ? "row" : "column", gap: 1, children: [_jsx(Box, { flexDirection: "column", flexGrow: 1, flexShrink: 1, children: mainSurface }), _jsx(SidePane, { visible: sidePaneVisible, snapshotMessages: sidePaneSnapshotMessages, localMessages: sidePaneLocalMessages, profile: profile, onDismiss: closeSidePane, onPinToHost: () => promoteSidePaneToHost(), children: _jsx(PromptInput, { onSubmit: handleSidePaneSubmit, onChange: setSidePaneDraft, onAbort: handleSidePaneAbort, isStreaming: sidePaneStreaming, value: sidePaneDraft, vimMode: vimMode, placeholder: "Ask in this fork (/pin, /unfork, /clear)", mode: "side" }) })] }), showTypedSlashPanel && (_jsx(Box, { marginBottom: 0, children: _jsx(TypedSlashPanel, { draft: draftValue, commands: paletteCommands }) })), isStreaming && (_jsx(Box, { paddingX: 2, marginTop: 1, children: _jsx(RavensFlight, { active: isStreaming, tone: tone, label: "thinking", width: 16 }) })), !isStreaming && petMode === "raven" && (_jsx(Box, { paddingX: 2, marginTop: 1, children: _jsx(RavensFlight, { active: true, tone: tone, label: "companion", width: 16 }) })), _jsx(Box, { marginTop: 1, paddingX: 2, children: _jsxs(Box, { gap: 1, children: [_jsx(SigilStamp, { kind: sigilKind, tone: tone, nonce: sigilNonce }), _jsx(Statusline, { profile: profile, segments: statuslineSegments, model: initialModel, effort: currentMode, sandbox: runtime?.getPermissionMode?.() ?? "—", tokensUsed: usedTokens, tokensTotal: maxTokens, cost: sessionCostUsd, goal: activeGoal, uptimeMs: nowMs - sessionStartedAt })] }) }), _jsx(Composer, { profile: profile, children: _jsx(PromptInput, { onSubmit: handleSubmit, onChange: handleChange, onAbort: handleAbort, onPasteImageText: handlePasteImageText, imageAttachmentCount: pendingImages.length, disabled: sidePaneVisible, isStreaming: isStreaming, value: draftValue, vimMode: vimMode, placeholder: sidePaneVisible ? "Side fork owns input (/unfork to return)" : "Ask anything" }) }), _jsx(OverlayPaletteMount, { commands: paletteCommands, onSelect: (cmd) => {
                     // Dispatch through the router with the empty arg + the real
@@ -901,10 +919,15 @@ export function AppV3({
 // (the gradient banner replaced the version-tagged splash). Prefixed
 // with `_` so the noUnusedParameters check is satisfied while the
 // prop stays in the public interface.
-version: _version, providers, initialModel = "", initialProvider = "", initialMessages = [], runtime, profileOverride, columnsOverride, rowsOverride, uiStatePathOverride, statuslineConfigPathOverride, layoutConfigPathOverride, snippetDbPathOverride, }) {
+version: _version, providers, initialModel = "", initialProvider = "", initialMessages = [], runtime, inline = false, profileOverride, columnsOverride, rowsOverride, uiStatePathOverride, statuslineConfigPathOverride, layoutConfigPathOverride, snippetDbPathOverride, }) {
     const themeManager = useThemeManager(uiStatePathOverride);
     const [palette, setPalette] = useState(themeManager.getCurrent().colors);
     const [messages, setMessages] = useState([...initialMessages]);
+    // AppV4 inline render: bumping this remounts the <Static> committed-
+    // history region with a fresh append-index. Bumped by clearTranscript
+    // (/clear) — Static only appends, so without a remount it would silently
+    // drop every row added after a clear (its lastIndex stays stale).
+    const [staticEpoch, setStaticEpoch] = useState(0);
     const [isStreaming, setIsStreaming] = useState(false);
     const [draftValue, setDraftValue] = useState("");
     const [activeModel, setActiveModel] = useState(initialModel);
@@ -1021,7 +1044,13 @@ version: _version, providers, initialModel = "", initialProvider = "", initialMe
                 providerRef.current = next;
                 setActiveProvider(next);
             },
-            clearTranscript: () => setMessages([]),
+            clearTranscript: () => {
+                setMessages([]);
+                // Remount <Static> so the inline-render append-index resets; the
+                // already-emitted rows remain in native scrollback (Claude-Code
+                // semantics: /clear starts a fresh surface below).
+                setStaticEpoch((epoch) => epoch + 1);
+            },
             setVimMode: (enabled) => {
                 vimModeRef.current = enabled;
                 setVimMode(enabled);
@@ -1211,5 +1240,5 @@ version: _version, providers, initialModel = "", initialProvider = "", initialMe
         }, 2000);
         return () => clearTimeout(id);
     }, [escPrimed, quitConfirm]);
-    return (_jsx(ThemeProvider, { palette: palette ?? PALETTES.dark, children: _jsx(WidthAwareLayout, { overrideColumns: columnsOverride, overrideRows: rowsOverride, children: _jsx(OverlayManager, { closeOnEscape: false, children: _jsx(AppV3Inner, { providers: providers, initialModel: activeModel, initialProvider: activeProvider, messages: messages, isStreaming: isStreaming, setIsStreaming: setIsStreaming, draftValue: draftValue, setDraftValue: setDraftValue, setMessages: setMessages, profile: profile, terminalCapabilities: terminalCapabilities, runtime: runtime, escPrimed: escPrimed, quitConfirm: quitConfirm, bannerVariant: bannerVariant, setBannerVariant: setBannerVariant, slashRouter: slashRouter, slashContext: slashContextRef.current, themeManager: themeManager, tourResolved: tourResolved, setTourResolved: setTourResolved, persistedOnboarded: persistedOnboarded, sidePaneVisible: sidePaneVisible, sidePaneSnapshotMessages: sidePaneSnapshotMessages, sidePaneLocalMessages: sidePaneLocalMessages, sidePaneStreaming: sidePaneStreaming, setSidePaneLocalMessages: setSidePaneLocalMessages, setSidePaneStreaming: setSidePaneStreaming, closeSidePane: closeSidePane, toggleSidePane: toggleSidePane, statuslineSegments: statuslineSegments, sessionStartedAt: sessionStartedAtRef.current, activeGoal: activeGoal, vimMode: vimMode, petMode: petMode, statusBarPosition: statusBarPosition }) }) }) }));
+    return (_jsx(ThemeProvider, { palette: palette ?? PALETTES.dark, children: _jsx(WidthAwareLayout, { overrideColumns: columnsOverride, overrideRows: rowsOverride, children: _jsx(OverlayManager, { closeOnEscape: false, children: _jsx(AppV3Inner, { providers: providers, initialModel: activeModel, initialProvider: activeProvider, messages: messages, isStreaming: isStreaming, setIsStreaming: setIsStreaming, draftValue: draftValue, setDraftValue: setDraftValue, setMessages: setMessages, profile: profile, terminalCapabilities: terminalCapabilities, runtime: runtime, escPrimed: escPrimed, quitConfirm: quitConfirm, bannerVariant: bannerVariant, setBannerVariant: setBannerVariant, slashRouter: slashRouter, slashContext: slashContextRef.current, themeManager: themeManager, tourResolved: tourResolved, setTourResolved: setTourResolved, persistedOnboarded: persistedOnboarded, sidePaneVisible: sidePaneVisible, sidePaneSnapshotMessages: sidePaneSnapshotMessages, sidePaneLocalMessages: sidePaneLocalMessages, sidePaneStreaming: sidePaneStreaming, setSidePaneLocalMessages: setSidePaneLocalMessages, setSidePaneStreaming: setSidePaneStreaming, closeSidePane: closeSidePane, toggleSidePane: toggleSidePane, statuslineSegments: statuslineSegments, sessionStartedAt: sessionStartedAtRef.current, activeGoal: activeGoal, vimMode: vimMode, petMode: petMode, statusBarPosition: statusBarPosition, inline: inline, staticEpoch: staticEpoch }) }) }) }));
 }

package/dist/ui/components/v3/Transcript.d.ts

@@ -45,6 +45,26 @@ export interface TranscriptProps {
      */
     readonly scrollOffset?: number;
     readonly terminalCapabilities: TerminalCapabilities;
+    /**
+     * AppV4 inline mode: render committed history via Ink `<Static>`
+     * (write-once into native terminal scrollback) and only the in-flight
+     * turn live. Off (default) keeps the legacy windowed alt-buffer render.
+     */
+    readonly inline?: boolean;
+    /**
+     * Count of finalized (committed) messages. In inline mode,
+     * `messages[0..committedCount)` render in `<Static>` and
+     * `messages[committedCount..)` render live. Defaults to `messages.length`
+     * (everything committed — the idle state) when omitted.
+     */
+    readonly committedCount?: number;
+    /**
+     * Monotonic epoch that remounts the `<Static>` region. Bumped on
+     * `/clear` so Static's internal append-index resets to 0 — required
+     * because Static only ever appends and would otherwise silently drop
+     * every row added after a clear.
+     */
+    readonly staticEpoch?: number;
 }
 export interface TranscriptWindow {
     readonly messages: readonly TranscriptMessageV3[];
@@ -53,4 +73,4 @@ export interface TranscriptWindow {
     readonly scrollOffset: number;
 }
 export declare function selectTranscriptWindow(messages: readonly TranscriptMessageV3[], visibleCount: number | undefined, scrollOffset?: number): TranscriptWindow;
-export declare function Transcript({ messages, profile, visibleCount, scrollOffset, terminalCapabilities, }: TranscriptProps): React.ReactElement;
+export declare function Transcript({ messages, profile, visibleCount, scrollOffset, terminalCapabilities, inline, committedCount, staticEpoch, }: TranscriptProps): React.ReactElement;

package/dist/ui/components/v3/Transcript.js

@@ -1,36 +1,9 @@
-import { jsxs as _jsxs, jsx as _jsx } from "#wotann-jsx/jsx-runtime";
-import { Box, Text } from "ink";
-import { glyph } from "../../theme/tokens.js";
+import { jsx as _jsx, jsxs as _jsxs } from "#wotann-jsx/jsx-runtime";
+import { Box, Static, Text } from "ink";
 import { useThemeTone } from "../../theme/context.js";
 import { spacingForWidth } from "../../theme/tokens-v3.js";
 import { useTerminalWidth } from "./WidthAwareLayout.js";
-import { parseSlashResultMessage, SystemMessageCard } from "./SystemMessageCard.js";
-import { KittyGraphics } from "./KittyGraphics.js";
-// Minimal role markers — Claude Code / Codex parity. User gets a
-// single subtle ❯ (same glyph as the composer prompt); the assistant
-// is PURE content (no badge, no label, no gutter) — the biggest
-// declutter; system/tool get a dim · marker. No per-message gutter
-// bar, no Norse runes, nothing bold.
-const ROLE_STYLES_AB = {
-    user: { gutterTone: "primary", badge: glyph.prompt, label: "" },
-    assistant: { gutterTone: "muted", badge: "", label: "" },
-    system: { gutterTone: "warning", badge: "·", label: "system" },
-    tool: { gutterTone: "muted", badge: "·", label: "tool" },
-};
-const ROLE_STYLES_C = {
-    user: { gutterTone: "primary", badge: ">", label: "" },
-    assistant: { gutterTone: "muted", badge: "", label: "" },
-    system: { gutterTone: "warning", badge: "*", label: "system" },
-    tool: { gutterTone: "muted", badge: "*", label: "tool" },
-};
-function formatTime(timestamp) {
-    if (typeof timestamp !== "number" || !Number.isFinite(timestamp))
-        return null;
-    const d = new Date(timestamp);
-    const hh = String(d.getHours()).padStart(2, "0");
-    const mm = String(d.getMinutes()).padStart(2, "0");
-    return `${hh}:${mm}`;
-}
+import { TranscriptRow } from "./TranscriptRow.js";
 export function selectTranscriptWindow(messages, visibleCount, scrollOffset = 0) {
     const capacity = typeof visibleCount === "number" && Number.isFinite(visibleCount)
         ? Math.max(1, Math.floor(visibleCount))
@@ -54,36 +27,23 @@ export function selectTranscriptWindow(messages, visibleCount, scrollOffset = 0)
         scrollOffset: clampedOffset,
     };
 }
-export function Transcript({ messages, profile, visibleCount, scrollOffset = 0, terminalCapabilities, }) {
+export function Transcript({ messages, profile, visibleCount, scrollOffset = 0, terminalCapabilities, inline = false, committedCount, staticEpoch = 0, }) {
     const { tone } = useThemeTone();
     const { breakpoint } = useTerminalWidth();
     const spacing = spacingForWidth(breakpoint);
-    const styles = profile.tier === "C" ? ROLE_STYLES_C : ROLE_STYLES_AB;
+    // AppV4 inline render: committed history → Ink <Static> (written once
+    // into the terminal's native scrollback), and ONLY the in-flight turn
+    // repaints. This is the streaming-flicker fix. It requires the main
+    // buffer (the alt buffer has no scrollback); the mount path guarantees
+    // alt-buffer is skipped whenever inline is on. The windowed
+    // selectTranscriptWindow paging below is replaced by native scrollback.
+    if (inline) {
+        const boundary = Math.max(0, Math.min(committedCount ?? messages.length, messages.length));
+        const committed = messages.slice(0, boundary);
+        const live = messages.slice(boundary);
+        const pad = spacing.transcriptRowPaddingX;
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: committed, children: (msg) => (_jsx(Box, { paddingX: pad, children: _jsx(TranscriptRow, { msg: msg, profile: profile, terminalCapabilities: terminalCapabilities }) }, msg.id)) }, staticEpoch), live.length > 0 && (_jsx(Box, { flexDirection: "column", paddingX: pad, children: live.map((msg) => (_jsx(TranscriptRow, { msg: msg, profile: profile, terminalCapabilities: terminalCapabilities }, msg.id))) }))] }));
+    }
     const window = selectTranscriptWindow(messages, visibleCount, scrollOffset);
-    return (_jsxs(Box, { flexDirection: "column", paddingX: spacing.transcriptRowPaddingX, children: [window.hiddenBefore > 0 && _jsxs(Text, { color: tone.muted, children: ["\u2191 ", window.hiddenBefore, " earlier"] }), window.messages.map((msg) => {
-                // Route slash-command results to the richer SystemMessageCard so
-                // a `/model` dispatch reads as a harness response rather than a
-                // user message. The marker-based handshake keeps the Transcript
-                // schema unchanged — system messages without the marker fall
-                // through to the default render below.
-                if (msg.role === "system") {
-                    const payload = parseSlashResultMessage(msg.content);
-                    if (payload !== null) {
-                        return _jsx(SystemMessageCard, { payload: payload, profile: profile }, msg.id);
-                    }
-                }
-                const style = styles[msg.role];
-                const gutterColor = tone[style.gutterTone];
-                const timeString = formatTime(msg.timestamp);
-                const lines = msg.content.length === 0 ? [""] : msg.content.split("\n");
-                const attachments = msg.attachments ?? [];
-                const hasHeader = style.badge !== "" || style.label !== "" || timeString !== null;
-                return (_jsxs(Box, { flexDirection: "column", marginBottom: 1, children: [hasHeader && (_jsxs(Box, { justifyContent: "space-between", children: [_jsxs(Box, { gap: 1, children: [style.badge !== "" && _jsx(Text, { color: gutterColor, children: style.badge }), style.label !== "" && _jsx(Text, { color: gutterColor, children: style.label })] }), timeString !== null && _jsx(Text, { color: tone.muted, children: timeString })] })), lines.map((line, i) => (_jsx(Text, { color: tone.text, children: line.length === 0 ? " " : line }, `msg-${msg.id}-line-${i}`))), attachments.map((attachment, i) => {
-                            if (attachment.kind === "image" && attachment.dataUri !== undefined) {
-                                return (_jsx(KittyGraphics, { source: attachment.dataUri, capabilities: terminalCapabilities, rows: profile.tier === "C" ? 3 : 5, columns: profile.tier === "C" ? 28 : 40, caption: attachment.path }, `msg-${msg.id}-att-${i}`));
-                            }
-                            const label = attachment.kind === "image" ? "image" : "file";
-                            return (_jsxs(Text, { color: tone.muted, italic: true, children: ["[", label, ": ", attachment.path, "]"] }, `msg-${msg.id}-att-${i}`));
-                        })] }, msg.id));
-            }), window.hiddenAfter > 0 && _jsxs(Text, { color: tone.muted, children: ["\u2193 ", window.hiddenAfter, " newer"] })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: spacing.transcriptRowPaddingX, children: [window.hiddenBefore > 0 && _jsxs(Text, { color: tone.muted, children: ["\u2191 ", window.hiddenBefore, " earlier"] }), window.messages.map((msg) => (_jsx(TranscriptRow, { msg: msg, profile: profile, terminalCapabilities: terminalCapabilities }, msg.id))), window.hiddenAfter > 0 && _jsxs(Text, { color: tone.muted, children: ["\u2193 ", window.hiddenAfter, " newer"] })] }));
 }