Resolve conflicts:
- packages/ui/tui/src/index.ts: keep the color-scheme detection block; drop the
obsolete static autocomplete list (master moved to refreshCommandAutocomplete).
- docs/config-catalog.md: regenerate (tui Config source line shifted to :104).
The color-scheme detection block left packages/ui/tui/src/index.ts below
the 100% per-file coverage gate on three counts: the .then callback's
`scheme === undefined` branch was reachable only via the 2s query
timeout, the .catch only via a query-write failure, and the
`editor.borderColor` assignment inside applyColorScheme was dead code —
the next line's setStatus() immediately reassigns editor.borderColor.
Register the scheme listener before firing the startup query so the
query's own reply is delivered through the listener (the same path as
later theme switches), which removes the redundant .then re-application
and its uncoverable undefined branch, and closes the theoretical window
where a synchronous reply lands before the listener exists. Drop the
dead editor.borderColor line. Cover the rest: a same-scheme report
(early return) and a terminal that throws on the query write (the
swallowed .catch).
A TUI run against an unreachable endpoint failed with only 'fetch failed':
undici wraps transport failures in a bare TypeError whose diagnosis lives
on .cause, and every diagnostic seam rendered only error.message. The
readline front door additionally rendered failed turns as pure silence.
- dsh-llm: new errorChain(value) renders the full cause chain and
AggregateError members with circular/hostile-coercion containment.
- llm-deepseek: pre-response transport failures throw LlmError('NETWORK')
naming the endpoint and chaining the fetch TypeError; aborts keep their
DOMException so the loop still classifies them as cancellation.
- agent-loop: durable turn/end error messages and logger warnings render
through errorChain; local renderThrown copies removed.
- ui-stdio: failure turn/end reasons now render ([turn failed <code>],
[turn aborted], [turn rejected], output-token-limit); startup-failure
logs use errorChain.
- ui-tui: agent/error notices and the startup-failure line use errorChain.
A TUI run against an unreachable endpoint failed with only 'fetch failed':
undici wraps transport failures in a bare TypeError whose diagnosis lives
on .cause, and every diagnostic seam rendered only error.message. The
readline front door additionally rendered failed turns as pure silence.
- dsh-llm: new errorChain(value) renders the full cause chain and
AggregateError members with circular/hostile-coercion containment.
- llm-deepseek: pre-response transport failures throw LlmError('NETWORK')
naming the endpoint and chaining the fetch TypeError; aborts keep their
DOMException so the loop still classifies them as cancellation.
- agent-loop: durable turn/end error messages and logger warnings render
through errorChain; local renderThrown copies removed.
- ui-stdio: failure turn/end reasons now render ([turn failed <code>],
[turn aborted], [turn rejected], output-token-limit); startup-failure
logs use errorChain.
- ui-tui: agent/error notices and the startup-failure line use errorChain.
The two transcript tests that assert footer token counters inherited
process.cwd() as the session cwd. In a checkout deep enough that the
footer label exceeds the 88-column fake terminal, the counters never
render and the assertions fail. Pin those tests to a short fixed cwd;
cwd rendering keeps its dedicated variants test.
The existing /opt footer case reaches the ordinary outside-home return on POSIX, but Windows resolves it on the checkout drive while the user profile is on another drive. That exercises the cross-drive guard instead and leaves the same-volume fallback uncovered in Windows coverage.
Add the resolved parent of the home directory as a platform-neutral outside-home path. The case now covers the fallback on every host while retaining /opt to exercise the Windows cross-drive path, restoring per-file branch, statement, and line coverage without platform-specific expectations.
Treat an absolute path.relative() result as a cross-volume path instead of incorrectly abbreviating it beneath the user's home directory.
Allow embeddings to project a logical footer cwd without changing the operational session cwd. The recorded-session harness now uses a POSIX-shaped display alias for both the footer and filesystem result paths, preserving the existing pre-normalization layout width on every host.
Keep runtime-provided labels behind terminal-control escaping, cover that boundary, and document the embedding contract.
Master unifies every live agent with its exact SessionId and moves declarative startup failures to agent-loop/config-start-failed. Keeping the branch’s AgentId label binding would let the TUI target the wrong lifecycle after reload and would miss asynchronous resume failures.
Resolve that contract migration by giving the selected terminal front door the same generated or resumed SessionId as agent-core, mounting the front door first, and entering fullscreen only after the matching root appears. Refresh the source-derived catalogs and keyless terminal goldens so Code Mode, workflow, Cordis-tool, and transient UI scenarios all exercise the merged identity model.
formatCwd has distinct branches for the home directory itself, a descendant of home, an unset cwd, and a path outside home. The descendant branch was exercised only indirectly because the test harness defaulted to process.cwd(), so the per-file coverage gate changed with the checkout location and failed in detached worktrees under /private/tmp even though every behavior assertion passed.
Derive the home-root case from homedir() and add an explicit synthetic child with platform-aware path joins. Keep the unset and outside-home cases unchanged. The suite now drives every formatting branch regardless of where the repository is checked out, and the expected child form follows the host path separator on macOS, Linux, and Windows.
Model responses, replayed session data, tool presenter output, question metadata, configuration, and diagnostics all cross into ANSI-aware pi-tui renderers. Passing their C0 or C1 controls through unchanged lets an otherwise ordinary transcript emit OSC, CSI, cursor, or title operations in the user terminal.
Introduce one displayText boundary that preserves line-feed layout but renders every other C0/C1 control as visible \\xNN text before application styling is applied. Route transcript blocks, streaming output, tool cards, diffs, plans, dialogs, headers, cwd/title data, notices, errors, and pre-mount startup failures through that boundary while leaving pi-tui and the theme responsible for legitimate terminal control sequences.
Pin the contract at three levels: a settled headless-terminal golden spans the main untrusted display sources, unit coverage checks the pre-fullscreen failure path, and the real Loader/PTY conversation streams hostile OSC, cursor, and C1 probes and proves only their inert textual forms reach the terminal stream.
