zidane 6.3.5 → 6.3.7

package/dist/tui.js

@@ -1,5 +1,5 @@
-import { $ as InteractionsProvider, $t as countClaudeSessionFiles, A as runOAuthLogin, Bt as ConfigProvider, Cn as discoverAgentsMd, Cr as toolCallPreview, Ct as clampFps, D as formatPathForCwd, Dt as resolveChipColor, Er as usageByModel, F as refreshMcpToolsCatalog, Gt as chainPositionOf, H as indexOfServerRow, Ht as resolveConfig, It as createDiscoverySlot, J as useMcpAuthDispatch, Jt as providerKeySetChanged, Kt as chainsEqual, L as subscribeMcpToolsCache, Ln as TODO_STATUS_GLYPHS, Lt as DiscoveryProvider, N as loadMcpToolsCache, O as fetchOAuthRedirect, Ot as resolveTheme, P as mcpToolsCachePath, Q as ASK_USER_TOOL, Qt as useCompletion, Rt as useDiscovery, Sn as chatAutoCompactBehavior, St as SettingsProvider, T as suggestSafelistEntries, Tr as updateToolEventOutcomes, U as parentServerName, Ut as resolveStoragePaths, V as buildVisibleMcpRows, Vt as useConfig, W as createFileMcpCredentialStore, Wn as pruneTodosByRun, Wt as buildRunModel, X as getMcpAuthStatus, Y as useMcpAuthState, Yt as restoreChainFallbacks, Zt as toggleChainEntry, _ as useSafeModeQueue, _r as marginTopFor, _t as DEFAULT_SETTINGS, a as useSurfaces, an as buildMcpServers, ar as buildPlanSystem, at as pendingInteractionsFromTurns, b as getSafelist, br as stripSpawnTokensLine, bt as SETTINGS_INPUTS, c as useStreamBuffer, cr as createChatTurnsReadTool, ct as useInteractionsQueue, d as discoverProjectSkills, dn as bootTick, dt as hintsLength, en as hasClaudeCodeSetup, et as PRESENT_PLAN_TOOL, fn as buildUpdateHint, fr as deriveSessionTitle, ft as truncateTrailing, g as useSafeModeActions, gr as loadState, gt as useEnabledToggleSet, h as SafeModeProvider, hr as listSessionMeta, ht as listProjectFiles, i as useSelectStyle, in as upsertMcpServer, ir as buildBuildSystem, it as makeRequestInteraction, j as supportsOAuth, jn as accentColor, k as oauthUsesManualCodePaste, l as buildSkillsConfig, ln as tryOpenBrowser, lt as EMPTY_HINTS, m as writeSessionExport, mr as lastContextSizeFromTurns, n as ThemeProvider, nn as mcpsWritePath, nt as createInteractionTools, or as envSection, pn as useUpdateCheck, pr as eventsFromTurns, pt as buildHints, q as McpAuthProvider, qn as useActiveTodos, qt as filterChainFallbacks, r as useColors, rn as removeMcpServer, s as useTheme, sn as discoverProjectMcps, sr as chatReferenceTokensForPrompt, st as useInteractionsActions, t as computeTurnAnchors, tn as importFromClaudeCode, tt as buildResumedToolResultsTurn, u as defaultSkillScanPaths, ur as compactSummaryEvent, ut as clipHintsToWidth, vt as SETTINGS_CATEGORIES, wr as toolResultText, wt as useSettings, x as isOnSafelist, xr as sumRunCosts, xt as SETTINGS_TOGGLES, y as addToSafelist, yr as serverToolResultSummary, yt as SETTINGS_CHOICES, z as useMcpToolToggleMap, zt as useDiscoveryOptional } from "./transcript-anchors-9LKsM0OZ.js";
-import { $t as registerExtensionHostModules, Et as looksBinary, G as installExtensionFromSpec, Gt as keybindingsPath, H as createExtensionPromptBridge, Ht as ensureKeybindingsFile, Kt as matchesBinding, L as summaryToTurn, Ot as createModelSearchTool, Q as discoverAndBuildExtensionRegistry, S as selectFilesFromSession, U as ExtensionInstallError, Ut as formatBindingForDisplay, Vt as KEYBINDING_KEY_COL_WIDTH, Wt as groupBindings, X as updateInstalledExtension, Y as removeInstalledExtension, Z as createExtensionHud, Zt as resolveExtensionKeybindings, _ as resolveMcpWarningsDir, _n as OUTPUT_RESERVE_TOKENS, _t as isSpawnTool, an as parseExtensionScanPathEnv, at as partitionExtensionCatalog, b as buildPostCompactAttachments, c as applyCompactSummaryCutoff, dt as basic_default, g as rehomePersistedStubs, ln as coerceExtensionConfigInput, m as cleanupPersistedSession, mn as sanitizeExtensionConfigActionPatch, nt as disposeExtensionRegistry, on as scanExtensionDirectories, ot as createExtensionHostRuntimeBridge, pn as resolveExtensionConfigValue, rn as inlineLoadedExtension, rt as filterExtensionRegistry, t as createAgent, tt as composeExtensionPreset, v as resolvePersistDir, vn as effectiveContextWindow, w as compactConversation, wt as tailTruncate, y as resolveTasksDir } from "./agent-BJuiohV_.js";
+import { $t as toggleChainEntry, A as redirectUriFromAuthUrl, At as resolveTheme, Bt as useDiscovery, Cr as sumRunCosts, Ct as SETTINGS_TOGGLES, D as formatPathForCwd, Dr as updateToolEventOutcomes, Er as toolResultText, Et as useSettings, F as loadMcpToolsCache, G as parentServerName, Gt as resolveStoragePaths, Ht as ConfigProvider, I as mcpToolsCachePath, Jt as chainsEqual, K as createFileMcpCredentialStore, Kn as pruneTodosByRun, Kt as buildRunModel, L as refreshMcpToolsCatalog, M as runOAuthLogin, N as supportsOAuth, Nn as accentColor, O as fetchOAuthRedirect, Or as usageByModel, Q as getMcpAuthStatus, Rt as createDiscoverySlot, Sr as stripSpawnTokensLine, St as SETTINGS_INPUTS, T as suggestSafelistEntries, Tn as discoverAgentsMd, Tr as toolCallPreview, Tt as clampFps, U as buildVisibleMcpRows, Ut as useConfig, V as useMcpToolToggleMap, Vt as useDiscoveryOptional, W as indexOfServerRow, Wt as resolveConfig, X as useMcpAuthDispatch, Xt as providerKeySetChanged, Y as McpAuthProvider, Yn as useActiveTodos, Yt as filterChainFallbacks, Z as useMcpAuthState, Zt as restoreChainFallbacks, _ as useSafeModeQueue, _r as listSessionMeta, _t as listProjectFiles, a as useSurfaces, an as removeMcpServer, b as getSafelist, bt as SETTINGS_CATEGORIES, c as useStreamBuffer, cr as envSection, d as discoverProjectSkills, dn as tryOpenBrowser, dt as EMPTY_HINTS, en as useCompletion, et as ASK_USER_TOOL, fr as compactSummaryEvent, ft as clipHintsToWidth, g as useSafeModeActions, gr as lastContextSizeFromTurns, h as SafeModeProvider, hn as useUpdateCheck, hr as eventsFromTurns, ht as buildHints, i as useSelectStyle, in as mcpsWritePath, it as createInteractionTools, j as oauthUsesManualCodePaste, kt as resolveChipColor, l as buildSkillsConfig, ln as discoverProjectMcps, lr as chatReferenceTokensForPrompt, lt as useInteractionsActions, m as writeSessionExport, mn as buildUpdateHint, mr as deriveSessionTitle, mt as truncateTrailing, n as ThemeProvider, nn as hasClaudeCodeSetup, nt as PRESENT_PLAN_TOOL, on as upsertMcpServer, or as buildBuildSystem, ot as makeRequestInteraction, pn as bootTick, pt as hintsLength, qt as chainPositionOf, r as useColors, rn as importFromClaudeCode, rt as buildResumedToolResultsTurn, s as useTheme, sn as buildMcpServers, sr as buildPlanSystem, st as pendingInteractionsFromTurns, t as computeTurnAnchors, tn as countClaudeSessionFiles, tt as InteractionsProvider, u as defaultSkillScanPaths, ur as createChatTurnsReadTool, ut as useInteractionsQueue, vr as loadState, vt as useEnabledToggleSet, wn as chatAutoCompactBehavior, wt as SettingsProvider, x as isOnSafelist, xr as serverToolResultSummary, xt as SETTINGS_CHOICES, y as addToSafelist, yr as marginTopFor, yt as DEFAULT_SETTINGS, z as subscribeMcpToolsCache, zn as TODO_STATUS_GLYPHS, zt as DiscoveryProvider } from "./transcript-anchors-DhBTqTyc.js";
+import { $ as removeInstalledExtension, At as looksBinary, C as resolveTasksDir, E as selectFilesFromSession, Gt as KEYBINDING_KEY_COL_WIDTH, Jt as groupBindings, K as createExtensionPromptBridge, Kt as ensureKeybindingsFile, Mt as createModelSearchTool, O as compactConversation, Ot as tailTruncate, S as resolveSessionDir, Sn as effectiveContextWindow, V as summaryToTurn, Xt as matchesBinding, Y as installExtensionFromSpec, Yt as keybindingsPath, _ as rehomePersistedStubs, _n as resolveExtensionConfigValue, at as composeExtensionPreset, b as resolveMcpWarningsDir, c as applyCompactSummaryCutoff, et as updateInstalledExtension, ht as basic_default, ln as parseExtensionScanPathEnv, lt as partitionExtensionCatalog, m as cleanupPersistedSession, nt as discoverAndBuildExtensionRegistry, ot as disposeExtensionRegistry, pn as coerceExtensionConfigInput, q as ExtensionInstallError, qt as formatBindingForDisplay, rn as registerExtensionHostModules, sn as inlineLoadedExtension, st as filterExtensionRegistry, t as createAgent, tn as resolveExtensionKeybindings, tt as createExtensionHud, un as scanExtensionDirectories, ut as createExtensionHostRuntimeBridge, v as resolveLegacyPersistDir, vn as sanitizeExtensionConfigActionPatch, w as buildPostCompactAttachments, x as resolvePersistDir, xn as OUTPUT_RESERVE_TOKENS, xt as isSpawnTool, y as resolveLegacySessionDir } from "./agent-Emjeo5Ad.js";
 import { a as formatDuration, c as previewLine, i as fmtTokens, l as shortId, n as compactPath, o as formatTaskStatus, r as fmtCost, s as formatTaskSummary, t as ageString } from "./format-BF745pLL.js";
 import { n as appendCapped } from "./output-cap-C9zukcCj.js";
 import { i as killProcessGroup, n as SUPPORTS_PROCESS_GROUPS, r as createProcessContext } from "./contexts-DWVt7MvF.js";
@@ -7,18 +7,18 @@ import { l as errorMessage } from "./errors-DJUxZg9b.js";
 import { M as findGitRoot } from "./resolve-BPTA1RpX.js";
 import { a as createRingBufferSink, i as createLoggingHooks, l as logFileTimestamp, n as createFileSink, o as fanoutSink, r as createLogger, s as formatLogLine, t as consoleSink } from "./logger-DBX9uYOw.js";
 import { i as sniffImageMediaType } from "./media-sniff-UKijEaiQ.js";
-import { g as hasAuthorizationHeader, m as McpOAuthProvider, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-UIBc81Zm.js";
-import { x as estimateRebilledCostUsd } from "./openai-compat-BF1pSB_F.js";
+import { g as hasAuthorizationHeader, m as McpOAuthProvider, n as connectMcpServers, s as nonOwningMcpView } from "./mcp-8bEHU4WB.js";
+import { C as estimateRebilledCostUsd } from "./openai-compat-Bf9uMTMa.js";
 import { replaceDynamicSection } from "./prompt.js";
-import { a as getExtensionSessionState, c as setExtensionSessionState, i as demoteStaleRunningStatus, o as loadSession, t as createSession } from "./session-BE9_p0sN.js";
+import { a as getExtensionSessionState, c as setExtensionSessionState, i as demoteStaleRunningStatus, o as loadSession, t as createSession } from "./session-Bdk31kA5.js";
 import { n as flattenTurns, r as formatTokenUsage, t as effectiveInputFromTurn } from "./stats-DAKBEKjc.js";
 import { o as withTimeout } from "./timeout-BDetbuN6.js";
 import { i as installCacheBreakLogger } from "./cache-telemetry-ehVdWsg2.js";
 import { a as generateStructuredData, c as shouldAutoGenerateTitle, f as commandBlockToEvent, g as parseCommandInvocation, h as executeCommand, n as patchInlineGhost, p as commandBlocksToContent, r as resolveInlineSuggestion, s as generateSessionTitle, t as createPathAutocompleteProvider } from "./inline-autocomplete-DC2cxprN.js";
 import { s as resolveCompletionSubmit } from "./completion-core-BRo86R_L.js";
 import { i as installSkillFromSpec, r as SkillInstallError } from "./skills-C7eIjWYm.js";
-import { a as ZIDANE_EXTENSION_SKILL_NAME, d as extensionScaffold, f as readSkillEditMarker, h as withZidaneSkillEditSkill, i as SKILL_EDIT_METADATA_KEY, l as editSessionMetadata, m as withZidaneExtensionSkill, o as ZIDANE_SKILL_EDIT_SKILL_NAME, t as loginMcpServer, u as extensionDirForCwd } from "./login-ClSY8pN6.js";
-import { C as restoreModelOptions, S as piIdOf, _ as modelOptionsFor, m as getContextWindow, p as enabledModelOptions, s as setProviderCredential, t as detectAuth, v as modelSupportsReasoning, w as renderDefaultCallbackPage } from "./auth-WkdClN2Y.js";
+import { a as ZIDANE_EXTENSION_SKILL_NAME, d as extensionScaffold, f as readSkillEditMarker, h as withZidaneSkillEditSkill, i as SKILL_EDIT_METADATA_KEY, l as editSessionMetadata, m as withZidaneExtensionSkill, o as ZIDANE_SKILL_EDIT_SKILL_NAME, t as loginMcpServer, u as extensionDirForCwd } from "./login-C41DcRK-.js";
+import { C as restoreModelOptions, S as piIdOf, _ as modelOptionsFor, m as getContextWindow, p as enabledModelOptions, s as setProviderCredential, t as detectAuth, v as modelSupportsReasoning, w as renderDefaultCallbackPage } from "./auth-Dptb8U5J.js";
 import { createDockerContext } from "./contexts/docker.js";
 import { createTuiStore } from "./session/sqlite.js";
 import { $ as clipDiffForRender, B as isTurnHighlighted, C as chunkMarkdownForRender, E as stripHtmlCommentsOutsideCode, F as blendHsl, G as retagUserPromptEvents, H as isVisible, I as buildLinearRamp, J as streamEventSearchText, K as selectableTurnIds, L as BASH_CALL_ID_PREFIX, O as createSkillsCompletionProvider, P as createCommandsCompletionProvider, Q as buildUnifiedDiff, R as EDIT_TOOL_NAMES, T as splitMarkdownCodeBlocks, U as isVisibleDuringSearch, V as isUserBashEvent, W as promptHistoryFromEvents, Y as turnSelectionOwnership, Z as buildContextualDiff, _ as turnContextSize, a as TOOL_DISPLAY, b as filterModelCatalog, ct as buildEditOutcomesAnnotation, d as finalizeStreamingMarkdown, dt as parseEditOutcomesFromResult, f as finalizeStreamingMarkdownForOwner, ft as resolveApprovalForPayload, g as revealEarlierTranscriptEvents, h as replaceTranscriptTurnEvents, ht as summarizeOutcomes, i as turnAsText, it as previewEditPayload, j as createFilesCompletionProvider, k as uniqueSkillNamesFromReferences, mt as stripEditOutcomesAnnotation, n as deleteTurnSafely, nt as extractEditPayload, o as displayNameFor, ot as summarizeEditPayload, p as hiddenEarlierTranscriptCount, pt as rewriteMultiEditHeader, q as selectionAfterTurnRemoval, r as truncateTurnsAt, rt as filetypeFromPath, s as formatToolCall, u as capTranscriptEvents, ut as mergeApprovalAndBodyOutcomes, v as splitPromptSegments, vt as createChatsCompletionProvider, w as normalizeMarkdownCodeFences, y as buildModelCatalog, z as isEditErrorResult } from "./turn-operations-CBdrdYiF.js";
@@ -233,17 +233,43 @@ function inCheckboxZone(event, startCol, width = 4) {
 	const col = event.x - target.x;
 	return col >= startCol && col < startCol + width;
 }
+/**
+* True when a click on a compound hint landed on its SECONDARY chord —
+* `extra.key` or `extra.label` (e.g. the `/l medium fast` run inside
+* `ctrl+m/l claude-opus-4-8 medium fast`). Same coordinate technique as
+* {@link inCheckboxZone}: the hint must stay ONE `<text>` renderable
+* because {@link hintSpans} interleaves primary and secondary spans
+* (`key`, `extra.key`, ` label`, ` extra.label`), so the zones can only
+* be told apart by glyph column.
+*
+* The leading space before `label` belongs to the primary zone; line 0 is
+* pinned so a wrapped continuation line reads as primary. Degrades to
+* `false` (primary semantics) when the target's geometry is unavailable.
+*/
+function inHintExtraZone(event, hint) {
+	if (!hint.extra) return false;
+	const target = event.target;
+	if (!target || typeof target.x !== "number" || typeof target.y !== "number") return false;
+	if (event.y - target.y !== 0) return false;
+	const col = event.x - target.x;
+	const keyLen = hint.key === "" ? 0 : hint.key.length;
+	const extraKeyEnd = keyLen + hint.extra.key.length;
+	if (col >= keyLen && col < extraKeyEnd) return true;
+	return col >= extraKeyEnd + (hint.key === "" ? 0 : 1) + hint.label.length;
+}
 /** Spans for one hint's text content — shared by hover and rest states. */
 function hintSpans(hint, COLOR, hovered) {
-	const keyColor = hovered ? COLOR.accent : hint.keyColor ?? COLOR.warn;
-	const labelColor = hovered ? COLOR.accent : hint.labelColor ?? COLOR.dim;
+	const primaryHover = hovered === "primary";
+	const extraHover = hovered === "extra";
+	const keyColor = primaryHover ? COLOR.accent : hint.keyColor ?? COLOR.warn;
+	const labelColor = primaryHover ? COLOR.accent : hint.labelColor ?? COLOR.dim;
 	return /* @__PURE__ */ jsxs(Fragment, { children: [
 		hint.key !== "" && /* @__PURE__ */ jsx$1("span", {
 			fg: keyColor,
 			children: hint.key
 		}),
 		hint.extra && /* @__PURE__ */ jsx$1("span", {
-			fg: hovered ? COLOR.accent : hint.extra.keyColor ?? COLOR.mute,
+			fg: extraHover ? COLOR.accent : hint.extra.keyColor ?? COLOR.mute,
 			children: hint.extra.key
 		}),
 		/* @__PURE__ */ jsx$1("span", {
@@ -251,33 +277,58 @@ function hintSpans(hint, COLOR, hovered) {
 			children: hint.key === "" ? hint.label : ` ${hint.label}`
 		}),
 		hint.extra && /* @__PURE__ */ jsx$1("span", {
-			fg: hovered ? COLOR.accent : hint.extra.labelColor ?? COLOR.dim,
+			fg: extraHover ? COLOR.accent : hint.extra.labelColor ?? COLOR.dim,
 			children: ` ${hint.extra.label}`
 		})
 	] });
 }
 /**
+* Hover zone for a pointer event, or `null` when the zone under the
+* pointer has no key to dispatch (an inert half must not light up).
+* Split out so the render surface stays declarative and the mapping is
+* testable without a renderer.
+*/
+function hoverZoneFor(event, hint, clickable) {
+	if ((inHintExtraZone(event, hint) ? "extra" : "primary") === "extra") return clickable.extra ? "extra" : null;
+	return clickable.primary ? "primary" : null;
+}
+/**
 * One hint as its own `<text>` renderable — clickable when its key spec
 * parses, hover-highlighted in the theme accent. Non-parseable hints
 * render identically but inert, so decorative chips cost nothing.
+*
+* A compound hint (`ctrl+m/l gpt-5 high fast`) carries TWO targets in the
+* one renderable: the primary pair dispatches `hint.key`, the secondary
+* chord + label dispatch `extra.keySpec`. Both click and hover resolve the
+* zone by glyph column ({@link inHintExtraZone}), so hovering the model id
+* highlights only the model id.
 */
 function ClickableHint({ hint }) {
 	const COLOR = useColors();
 	const renderer = useRenderer();
-	const [hovered, setHovered] = useState(false);
-	if (!(parseHintKeySpec(hint.key) !== null)) return /* @__PURE__ */ jsx$1("text", {
+	const [hovered, setHovered] = useState(null);
+	const primaryClickable = parseHintKeySpec(hint.key) !== null;
+	const extraSpec = hint.extra ? hint.extra.keySpec ?? hint.extra.key : null;
+	const extraClickable = extraSpec !== null && parseHintKeySpec(extraSpec) !== null;
+	if (!primaryClickable && !extraClickable) return /* @__PURE__ */ jsx$1("text", {
 		selectable: false,
-		children: hintSpans(hint, COLOR, false)
+		children: hintSpans(hint, COLOR, null)
 	});
+	const clickable = {
+		primary: primaryClickable,
+		extra: extraClickable
+	};
 	return /* @__PURE__ */ jsx$1("text", {
 		selectable: false,
 		onMouseDown: (event) => {
 			event.stopPropagation();
 			event.preventDefault();
-			dispatchHintKey(renderer, hint.key);
+			if (extraClickable && inHintExtraZone(event, hint)) dispatchHintKey(renderer, extraSpec);
+			else if (primaryClickable) dispatchHintKey(renderer, hint.key);
 		},
-		onMouseOver: () => setHovered(true),
-		onMouseOut: () => setHovered(false),
+		onMouseOver: (event) => setHovered(hoverZoneFor(event, hint, clickable)),
+		onMouseMove: (event) => setHovered(hoverZoneFor(event, hint, clickable)),
+		onMouseOut: () => setHovered(null),
 		children: hintSpans(hint, COLOR, hovered)
 	});
 }
@@ -2280,7 +2331,8 @@ function StatusSpinner({ color }) {
 	});
 }
 /**
-* Bordered container for one run of subagent events. The box's border +
+* Bordered container for one subagent's events inside a run — concurrent
+* siblings each get their own box (see {@link partitionTranscript}). The box's border +
 * left padding give the visual "this is a subagent" affordance, so events
 * inside render with `depthOffset: 1` — a direct child of the parent
 * (depth 1) sits flush against the box's inner padding rather than being
@@ -2857,18 +2909,21 @@ function partitionTranscript(events, settings, searchReveal) {
 	const groupKeys = settings.groupToolCalls && searchReveal === void 0 ? computeToolGroupKeys(visible) : null;
 	const groups = /* @__PURE__ */ new Map();
 	const items = [];
-	let run = [];
+	let lanes = /* @__PURE__ */ new Map();
 	let runPrevious;
 	const flush = () => {
-		if (run.length > 0) {
+		if (lanes.size === 0) return;
+		let previous = runPrevious;
+		for (const lane of lanes.values()) {
 			items.push({
 				kind: "child-run",
-				events: run,
-				previous: runPrevious
+				events: lane,
+				previous
 			});
-			run = [];
-			runPrevious = void 0;
+			previous = lane[lane.length - 1];
 		}
+		lanes = /* @__PURE__ */ new Map();
+		runPrevious = void 0;
 	};
 	for (let i = 0; i < visible.length; i++) {
 		const event = visible[i];
@@ -2890,8 +2945,10 @@ function partitionTranscript(events, settings, searchReveal) {
 			continue;
 		}
 		if (!settings.hideSubagentOutput && isChild(event)) {
-			if (run.length === 0) runPrevious = visible[i - 1];
-			run.push(event);
+			if (lanes.size === 0) runPrevious = visible[i - 1];
+			const lane = lanes.get(event.childId ?? "");
+			if (lane) lane.push(event);
+			else lanes.set(event.childId ?? "", [event]);
 		} else {
 			flush();
 			items.push({
@@ -3418,7 +3475,7 @@ function UserPromptBlock({ text, refs, attachments, searchQuery }) {
 	});
 }
 /** Click-feedback delay before `[copied]` reverts to `[copy]`, in ms. */
-const COPY_FEEDBACK_MS = 1200;
+const COPY_FEEDBACK_MS$1 = 1200;
 /**
 * BoxRenderable subclass that hosts a `[lang]  …  [copy]` header above
 * an inner {@link CodeRenderable} body. Returned from
@@ -3526,7 +3583,7 @@ var CodeBlockWrapper = class extends BoxRenderable {
 				if (this.button.isDestroyed) return;
 				this.button.content = "[copy]";
 				this.button.fg = this.bag.colors.warn;
-			}, COPY_FEEDBACK_MS);
+			}, COPY_FEEDBACK_MS$1);
 		};
 		this.header.add(this.langLabel);
 		this.header.add(this.spacer);
@@ -9362,11 +9419,12 @@ function OptionList({ items, initialCursor, onPick }) {
 * budget — default 14 fits a typical modal; pass a smaller value for
 * less-padded containers (e.g. 6 for the auth wizard panel).
 */
-function OAuthUrlBlock({ url, fg, maxLineWidth, chromeWidth = 14 }) {
+function OAuthUrlBlock({ url, fg, bg, maxLineWidth, chromeWidth = 14 }) {
 	const { width: termWidth } = useTerminalDimensions();
 	return /* @__PURE__ */ jsx$1(Fragment, { children: chunkString(url, Math.max(20, Math.min(maxLineWidth, termWidth - chromeWidth))).map((line, i) => /* @__PURE__ */ jsx$1("text", {
 		wrapMode: "none",
 		fg,
+		...bg ? { bg } : {},
 		children: /* @__PURE__ */ jsx$1("a", {
 			href: url,
 			children: line
@@ -9384,6 +9442,45 @@ function chunkString(s, n) {
 /** Keystroke shown next to the open-browser button. */
 const OPEN_BROWSER_KEY = "ctrl+b";
 /**
+* Keystroke shown next to the copy-URL button. `ctrl+y` is the global
+* `openKeybindings` chord, but it can't collide here: every surface that
+* mounts this block is either a modal (`app.tsx` bails on `modal.isOpen`
+* before dispatching global bindings) or the auth screen (excluded by
+* `screen !== 'auth'`). It's also absent from OpenTUI's input key table,
+* so the focused paste field ignores it.
+*/
+const COPY_URL_KEY = "ctrl+y";
+/** How long a `copied` confirmation stays on screen. */
+const COPY_FEEDBACK_MS = 4e3;
+/**
+* Paste-input capacity. OpenTUI's `InputRenderable` defaults to 1000 chars
+* and silently drops the overflow — long enough to truncate a callback URL
+* carrying a fat `code` + `state` and make a correct paste look corrupt.
+*/
+const PASTE_MAX_LENGTH = 4096;
+/**
+* Copy-to-clipboard with a self-clearing "copied" flag. Every copy
+* affordance in this module shares it so the timers are cleaned up on
+* unmount in exactly one place.
+*/
+function useCopyFlash() {
+	const [copied, setCopied] = useState(false);
+	const timer = useRef(null);
+	const copy = useCallback((text) => {
+		if (!writeToClipboard(text)) return;
+		setCopied(true);
+		if (timer.current) clearTimeout(timer.current);
+		timer.current = setTimeout(setCopied, COPY_FEEDBACK_MS, false);
+	}, []);
+	useEffect(() => () => {
+		if (timer.current) clearTimeout(timer.current);
+	}, []);
+	return {
+		copied,
+		copy
+	};
+}
+/**
 * Device-authorization affordance (RFC 8628): the user code the user must see
 * on the consent screen, plus the verification URI they type it into.
 *
@@ -9395,19 +9492,13 @@ const OPEN_BROWSER_KEY = "ctrl+b";
 */
 function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 	const COLOR = useColors();
-	const [copied, setCopied] = useState(false);
-	const copyTimer = useRef(null);
+	const { copied, copy } = useCopyFlash();
 	useKeyboard((key) => {
 		if (key.name === "u" && key.ctrl) {
 			key.preventDefault();
-			setCopied(writeToClipboard(userCode));
-			if (copyTimer.current) clearTimeout(copyTimer.current);
-			copyTimer.current = setTimeout(setCopied, 4e3, false);
+			copy(userCode);
 		}
 	});
-	useEffect(() => () => {
-		if (copyTimer.current) clearTimeout(copyTimer.current);
-	}, []);
 	return /* @__PURE__ */ jsxs("box", {
 		style: { flexDirection: "column" },
 		children: [
@@ -9432,23 +9523,29 @@ function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 	});
 }
 /**
-* Unified affordance for surfacing an OAuth authorization URL in the TUI:
+* Unified affordance for surfacing an OAuth authorization URL in the TUI,
+* laid out as two numbered steps so the remote-session path reads as a
+* first-class option instead of a footnote:
 *
-*   1. A prominent OSC 8 hyperlink button — "Click here to open auth URL in
-*      browser". Honored by every terminal that supports clickable links
-*      (iTerm2, Kitty, WezTerm, Ghostty, Alacritty, …). Lands on the user's
-*      LOCAL terminal even over SSH because OSC 8 is interpreted client-side.
-*   2. The full URL rendered greyed below, chunked into per-row hyperlinks
-*      via {@link OAuthUrlBlock}. Backup channel for terminals without OSC 8,
-*      and for users who'd rather copy via drag-select than click.
-*   3. Optional paste-back input. When `paste` is provided, an `<input>`
-*      renders below the URL so the user can paste the FULL redirect URL
-*      their browser ended up at after authorizing — useful when zidane runs
-*      over SSH and the browser-side redirect to loopback can't reach the
-*      remote callback server. The caller's `onSubmit` typically pipes the
-*      pasted value through {@link fetchOAuthRedirect} so the in-process
-*      server receives the request and the OAuth promise resolves through
-*      the same happy path a real browser would have taken.
+*   **1 — get to the consent screen.** Two real buttons (mouse-clickable
+*   AND keyed): {@link OPEN_BROWSER_KEY} opens the URL via the OS handler,
+*   {@link COPY_URL_KEY} copies it to the clipboard (OSC 52 → lands on the
+*   user's LOCAL clipboard over SSH). Below them the URL itself sits in a
+*   framed panel with its own `[copy]` button, chunked into per-row OSC 8
+*   hyperlinks by {@link OAuthUrlBlock} — the backup channel for terminals
+*   without clickable links and for drag-select copying.
+*
+*   **2 — hand the redirect back.** When `paste` is provided, an `<input>`
+*   accepts whatever the browser (or consent page) produced. This is THE
+*   path for `zidane` running over SSH: the browser sits on the user's
+*   laptop and cannot reach the remote box's loopback callback server, so
+*   they copy the failed `http://127.0.0.1:<port>/callback?code=…` out of
+*   the URL bar and paste it here. Servers that render the code on the
+*   page instead of redirecting have no failed URL to copy — paste the
+*   code itself; `normalizeRedirectPaste` completes it against the
+*   authorization URL's `redirect_uri` + `state`. We name that exact
+*   address (parsed out of the authorization URL) so there's no guessing
+*   about which string to copy.
 *
 * The component owns presentation only — keyboard focus, input ref, and
 * the submit handler stay with the caller so the affordance composes
@@ -9456,31 +9553,40 @@ function OAuthDeviceCodeBlock({ userCode, verificationUri, expiresInSeconds }) {
 */
 function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 	const COLOR = useColors();
+	const callbackUri = redirectUriFromAuthUrl(authUrl);
+	const pasteRef = paste?.inputRef;
+	const pasteFocused = paste?.focused ?? false;
+	useEffect(() => {
+		if (pasteFocused) pasteRef?.current?.focus();
+	}, [pasteFocused, pasteRef]);
 	return /* @__PURE__ */ jsxs("box", {
 		style: {
 			flexDirection: "column",
 			gap: 1
 		},
 		children: [
-			/* @__PURE__ */ jsx$1(OpenBrowserButton, { authUrl }),
 			/* @__PURE__ */ jsxs("box", {
 				style: { flexDirection: "column" },
-				children: [/* @__PURE__ */ jsx$1("text", {
-					fg: COLOR.mute,
-					children: "or copy the URL manually:"
-				}), /* @__PURE__ */ jsx$1(OAuthUrlBlock, {
-					url: authUrl,
-					fg: COLOR.dim,
-					maxLineWidth,
-					chromeWidth
-				})]
+				children: [/* @__PURE__ */ jsx$1(StepHeading, {
+					step: paste ? "1" : void 0,
+					text: "open this URL in your browser to authorize"
+				}), /* @__PURE__ */ jsx$1(ActionButtons, { authUrl })]
+			}),
+			/* @__PURE__ */ jsx$1(AuthUrlPanel, {
+				url: authUrl,
+				maxLineWidth,
+				chromeWidth
 			}),
 			paste && /* @__PURE__ */ jsxs("box", {
 				style: { flexDirection: "column" },
 				children: [
+					/* @__PURE__ */ jsx$1(StepHeading, {
+						step: "2",
+						text: "no browser on this machine? (SSH, headless, firewalled)"
+					}),
 					/* @__PURE__ */ jsx$1("text", {
-						fg: COLOR.mute,
-						children: "or — if the browser couldn't reach this machine (SSH, firewall) — paste the URL it tried to redirect to:"
+						fg: COLOR.dim,
+						children: callbackUri ? `after you authorize, the browser lands on ${callbackUri} and fails — copy that whole address from its URL bar and paste it below.` : "after you authorize, copy the address the browser failed to reach (it starts with http://127.0.0.1) and paste it below."
 					}),
 					paste.hint && /* @__PURE__ */ jsx$1("text", {
 						fg: toneColor(paste.hint.tone, COLOR),
@@ -9497,7 +9603,8 @@ function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 						children: /* @__PURE__ */ jsx$1("input", {
 							ref: paste.inputRef,
 							focused: paste.focused,
-							placeholder: paste.placeholder ?? "paste redirect URL and press enter…",
+							maxLength: PASTE_MAX_LENGTH,
+							placeholder: paste.placeholder ?? "paste redirect URL (or just the code) and press enter…",
 							onSubmit: paste.onSubmit,
 							style: { flexGrow: 1 }
 						})
@@ -9508,76 +9615,181 @@ function OAuthAuthBlock({ authUrl, maxLineWidth, chromeWidth = 14, paste }) {
 	});
 }
 /**
-* Real button: a bordered, brand-colored box hosting a labeled keystroke
-* hint. Pressing `ctrl+b` (anywhere this block is mounted) calls
-* {@link tryOpenBrowser} to launch the URL via the OS handler AND
-* {@link writeToClipboard} so the URL also lands in the user's clipboard
-* (OSC 52 → works over SSH, native helper → works locally). Both fire
-* because either alone can fail silently — `open`/`xdg-open` are no-ops
-* on a headless box, and OSC 52 is disabled on some terminals — and the
-* combination covers both failure modes without prompting again.
+* Numbered step label. The numeral is dropped when the block has only one
+* step (no paste input) — "1" with no "2" reads like a truncated list.
+*/
+function StepHeading({ step, text }) {
+	const COLOR = useColors();
+	return /* @__PURE__ */ jsxs("text", { children: [step !== void 0 && /* @__PURE__ */ jsx$1("span", {
+		fg: COLOR.brand,
+		attributes: 1,
+		children: `${step}  `
+	}), /* @__PURE__ */ jsx$1("span", {
+		fg: COLOR.mute,
+		children: text
+	})] });
+}
+/**
+* The two primary buttons, side by side: open-in-browser and copy-URL.
+*
+* Both are bordered boxes with a labeled keystroke, both are clickable
+* (`onMouseDown`), and both keys work regardless of which input owns focus
+* (`preventDefault` keeps the focused field from double-handling). Splitting
+* copy out of open matters over SSH: `open`/`xdg-open` on a headless remote
+* box does nothing, and the user's real intent is "give me the URL".
 *
-* The visible label is also wrapped in an OSC 8 hyperlink so a mouse
-* click in a supporting terminal (iTerm2, Kitty, WezTerm, …) reaches the
-* same browser. The keybind is the authoritative path — it doesn't
-* depend on terminal capability — and the hyperlink is the bonus.
+* The open button's label is additionally wrapped in an OSC 8 hyperlink so
+* a click in a terminal that supports links (iTerm2, Kitty, WezTerm, …)
+* reaches the browser on the user's LOCAL machine even over SSH.
 */
-function OpenBrowserButton({ authUrl }) {
+function ActionButtons({ authUrl }) {
 	const COLOR = useColors();
-	const [feedback, setFeedback] = useState(null);
-	const feedbackTimer = useRef(null);
-	const trigger = useCallback(() => {
+	const [opened, setOpened] = useState(false);
+	const openedTimer = useRef(null);
+	const { copied, copy } = useCopyFlash();
+	const open = useCallback(() => {
 		tryOpenBrowser(authUrl);
-		const copied = writeToClipboard(authUrl);
-		setFeedback(copied ? "opened in browser · URL copied to clipboard" : "opened in browser");
-		if (feedbackTimer.current) clearTimeout(feedbackTimer.current);
-		feedbackTimer.current = setTimeout(setFeedback, 4e3, null);
+		setOpened(true);
+		if (openedTimer.current) clearTimeout(openedTimer.current);
+		openedTimer.current = setTimeout(setOpened, COPY_FEEDBACK_MS, false);
 	}, [authUrl]);
+	useEffect(() => () => {
+		if (openedTimer.current) clearTimeout(openedTimer.current);
+	}, []);
 	useKeyboard((key) => {
-		if (key.ctrl && key.name === "b") {
+		if (!key.ctrl) return;
+		if (key.name === "b") {
 			key.preventDefault();
-			trigger();
+			open();
+			return;
+		}
+		if (key.name === "y") {
+			key.preventDefault();
+			copy(authUrl);
 		}
 	});
-	useEffect(() => () => {
-		if (feedbackTimer.current) clearTimeout(feedbackTimer.current);
-	}, []);
 	return /* @__PURE__ */ jsxs("box", {
 		style: { flexDirection: "column" },
-		children: [/* @__PURE__ */ jsx$1("box", {
+		children: [/* @__PURE__ */ jsxs("box", {
+			style: {
+				flexDirection: "row",
+				gap: 2,
+				flexWrap: "wrap"
+			},
+			children: [/* @__PURE__ */ jsx$1(Button, {
+				color: COLOR.brand,
+				chord: OPEN_BROWSER_KEY,
+				onPress: open,
+				children: /* @__PURE__ */ jsx$1("a", {
+					href: authUrl,
+					fg: COLOR.brand,
+					children: "↗ Open in browser"
+				})
+			}), /* @__PURE__ */ jsx$1(Button, {
+				color: COLOR.warn,
+				chord: COPY_URL_KEY,
+				onPress: () => copy(authUrl),
+				children: /* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: "⧉ Copy URL"
+				})
+			})]
+		}), (opened || copied) && /* @__PURE__ */ jsx$1("text", {
+			fg: COLOR.accent,
+			children: `✓ ${[opened ? "opened in browser" : null, copied ? "URL copied to clipboard" : null].filter(Boolean).join(" · ")}`
+		})]
+	});
+}
+/**
+* Bordered, clickable button hosting a label plus its keystroke hint.
+* The handler lives on the outer box: mouse events bubble from whatever
+* renderable was hit (label, padding, border) up through ancestors, so
+* the whole framed area is the target — not just the label text. Same
+* pattern as the settings-modal rows (`settings-modal.tsx:4006`).
+*/
+function Button({ color, chord, onPress, children }) {
+	const COLOR = useColors();
+	return /* @__PURE__ */ jsx$1("box", {
+		style: {
+			border: true,
+			borderColor: color,
+			paddingLeft: 1,
+			paddingRight: 1,
+			alignSelf: "flex-start"
+		},
+		onMouseDown: (event) => {
+			event.stopPropagation();
+			event.preventDefault();
+			onPress();
+		},
+		children: /* @__PURE__ */ jsxs("text", {
+			wrapMode: "none",
+			selectable: false,
+			children: [
+				children,
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.mute,
+					children: "   "
+				}),
+				/* @__PURE__ */ jsx$1("span", {
+					fg: COLOR.warn,
+					children: chord
+				})
+			]
+		})
+	});
+}
+/**
+* The authorization URL as a framed, copy-able panel — same idea as a
+* fenced code block in the transcript (`auth url` label left, clickable
+* `[copy]` right), so "here is a literal string you need to move
+* somewhere else" reads the same everywhere in the app.
+*
+* Framed rather than background-tinted because this block renders inside
+* containers that are already painted with the elevated modal surface; a
+* border is the only contrast that survives every host.
+*/
+function AuthUrlPanel({ url, maxLineWidth, chromeWidth }) {
+	const COLOR = useColors();
+	const { copied, copy } = useCopyFlash();
+	return /* @__PURE__ */ jsx$1("box", {
+		style: { flexDirection: "column" },
+		children: /* @__PURE__ */ jsxs("box", {
 			style: {
+				flexDirection: "column",
 				border: true,
-				borderColor: COLOR.brand,
+				borderColor: COLOR.border,
 				paddingLeft: 1,
-				paddingRight: 1,
-				alignSelf: "flex-start"
+				paddingRight: 1
 			},
-			children: /* @__PURE__ */ jsxs("text", {
-				wrapMode: "none",
+			children: [/* @__PURE__ */ jsxs("box", {
+				style: { flexDirection: "row" },
 				children: [
-					/* @__PURE__ */ jsx$1("a", {
-						href: authUrl,
-						fg: COLOR.brand,
-						children: "↗ Open auth URL in browser"
-					}),
-					/* @__PURE__ */ jsx$1("span", {
+					/* @__PURE__ */ jsx$1("text", {
 						fg: COLOR.mute,
-						children: "   "
+						children: "auth url"
 					}),
-					/* @__PURE__ */ jsx$1("span", {
-						fg: COLOR.warn,
-						children: OPEN_BROWSER_KEY
-					}),
-					/* @__PURE__ */ jsx$1("span", {
-						fg: COLOR.mute,
-						children: " open · click also works"
+					/* @__PURE__ */ jsx$1("box", { style: { flexGrow: 1 } }),
+					/* @__PURE__ */ jsx$1("box", {
+						onMouseDown: (event) => {
+							event.stopPropagation();
+							event.preventDefault();
+							copy(url);
+						},
+						children: /* @__PURE__ */ jsx$1("text", {
+							selectable: false,
+							fg: copied ? COLOR.accent : COLOR.warn,
+							children: copied ? "[copied]" : "[copy]"
+						})
 					})
 				]
-			})
-		}), feedback && /* @__PURE__ */ jsx$1("text", {
-			fg: COLOR.accent,
-			children: `✓ ${feedback}`
-		})]
+			}), /* @__PURE__ */ jsx$1(OAuthUrlBlock, {
+				url,
+				fg: COLOR.dim,
+				maxLineWidth: maxLineWidth - 4,
+				chromeWidth: chromeWidth + 4
+			})]
+		})
 	});
 }
 function toneColor(tone, COLOR) {
@@ -9596,7 +9808,9 @@ function toneColor(tone, COLOR) {
 *     MCP SDK's loopback callback server resolves the OAuth promise
 *     through the same code path a real browser-redirect would have
 *     taken — works over SSH where the browser can't reach the remote
-*     callback server directly.
+*     callback server directly. `authUrl` rides along so a partial paste
+*     (bare code, query string) is completed against the callback URI
+*     the authorization request was minted with.
 *
 * `inputFocused` is forwarded as the input's `focused` prop AND read by
 * the parent picker's `useKeyboard` (via a ref) to suppress single-key
@@ -9616,7 +9830,7 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 		});
 		(async () => {
 			try {
-				const result = await fetchOAuthRedirect(value);
+				const result = await fetchOAuthRedirect(value, { ...authUrl ? { authUrl } : {} });
 				if (result.status >= 200 && result.status < 300) setHint({
 					text: "redirect accepted — finalizing…",
 					tone: "accent"
@@ -9632,7 +9846,7 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 				});
 			}
 		})();
-	}, []);
+	}, [authUrl]);
 	return /* @__PURE__ */ jsxs("box", {
 		style: {
 			flexDirection: "column",
@@ -9651,13 +9865,12 @@ function McpAuthorizingPanel({ serverName, authUrl, maxLineWidth, chromeWidth, i
 				/* @__PURE__ */ jsx$1(Spinner, { label: status }),
 				authUrl !== null && /* @__PURE__ */ jsx$1(OAuthAuthBlock, {
 					authUrl,
-					maxLineWidth,
+					maxLineWidth: maxLineWidth - 4,
 					chromeWidth: (chromeWidth ?? 14) + 4,
 					paste: {
 						inputRef,
 						focused: inputFocused,
 						onSubmit,
-						placeholder: "paste redirect URL and press enter…",
 						hint: hint?.tone === "error" ? hint : void 0
 					}
 				}),
@@ -10470,7 +10683,7 @@ function OAuthRunningStep({ descriptor, dataDir, onSuccess, onError }) {
 		});
 		(async () => {
 			try {
-				const result = await fetchOAuthRedirect(value);
+				const result = await fetchOAuthRedirect(value, { ...url ? { authUrl: url } : {} });
 				if (result.status >= 200 && result.status < 300) {
 					setPasteHint({
 						text: "redirect accepted — exchanging code…",
@@ -10488,7 +10701,7 @@ function OAuthRunningStep({ descriptor, dataDir, onSuccess, onError }) {
 				});
 			}
 		})();
-	}, []);
+	}, [url]);
 	return /* @__PURE__ */ jsxs(WizardPanel, {
 		title: `configure ${descriptor.label} — OAuth`,
 		children: [
@@ -22111,13 +22324,19 @@ function AppShell() {
 			store,
 			...source.projectRoot ? { projectRoot: source.projectRoot } : {}
 		});
-		const rehomed = await rehomePersistedStubs(slice, resolvePersistDir({
+		const forkPersistDir = resolvePersistDir({
+			userDir: cacheDir,
+			sessionId: fork.id
+		});
+		let rehomed = await rehomePersistedStubs(slice, resolvePersistDir({
 			userDir: cacheDir,
 			sessionId: source.id
-		}), resolvePersistDir({
+		}), forkPersistDir);
+		const legacyPersistDir = resolveLegacyPersistDir({
 			userDir: cacheDir,
-			sessionId: fork.id
-		}));
+			sessionId: source.id
+		});
+		if (legacyPersistDir !== void 0) rehomed = await rehomePersistedStubs(rehomed, legacyPersistDir, forkPersistDir);
 		fork.setTurns(rehomed);
 		fork.setRuns(inheritedRuns);
 		try {
@@ -22216,18 +22435,17 @@ function AppShell() {
 			debugLog("delete session failed", err);
 			return;
 		}
-		cleanupPersistedSession(resolvePersistDir({
+		cleanupPersistedSession(resolveSessionDir({
 			userDir: cacheDir,
 			sessionId: id
 		}));
-		cleanupPersistedSession(resolveTasksDir({
+		for (const stale of [resolveLegacyPersistDir({
 			userDir: cacheDir,
 			sessionId: id
-		}));
-		cleanupPersistedSession(resolveMcpWarningsDir({
+		}), resolveLegacySessionDir({
 			userDir: cacheDir,
 			sessionId: id
-		}));
+		})]) if (stale !== void 0) cleanupPersistedSession(stale);
 		const wasCurrent = id === currentSession?.id;
 		if (wasCurrent) {
 			await teardown();