Harden TUI shutdown, bind Ctrl+W / Ctrl+K, restore cursor on mode toggle

Author: alexylon

CHANGELOG.md

@@ -4,8 +4,19 @@ All notable changes to Sofos are documented in this file.
 
 ## [Unreleased]
 
+### Added
+
+- **`Ctrl+W` and `Ctrl+K` are now bound in the input box.** `Ctrl+W` deletes the word behind the cursor (the readline / bash / zsh / fish binding) and `Ctrl+K` deletes from the cursor to the end of the line. `Ctrl+U` (delete to start of line) is unchanged.
+
 ### Fixed
 
+- **`Ctrl+C` while the slash-command popup is open dismisses the popup.** It used to fall through to the outer handler and quit the session, which surprised users who only wanted to bail out of the suggestion list. Ctrl+C with the popup closed still requests shutdown.
+- **The cursor shape now follows the active mode after `/safe` and `/normal`.** Toggling safe mode mid-session previously updated the status line but left the cursor in its old shape; the cursor now switches to the safe-mode underscore on `/safe` and back to the default block on `/normal`, matching the startup behaviour.
+- **A panic anywhere inside the TUI now restores the terminal before the backtrace prints.** A process-wide panic hook disables raw mode, disables bracketed paste, pops the keyboard enhancement flags, and shows the cursor through a real-tty handle that bypasses the output-capture pipe — so even a panic that strikes before the local Drop chain runs leaves the user with a usable shell.
+- **Quitting while a confirmation modal is on screen no longer hangs the worker.** The event loop now sends the modal's default answer back before tearing down, unblocking the worker thread that was parked waiting for a reply so the `join` on shutdown completes promptly.
+- **Tool output without newlines no longer freezes the UI.** A captured pipe that delivered a multi-kilobyte blob with no `\n` used to keep the reader thread waiting silently; sofos now flushes the partial line to the UI every 4 KB and continues reading.
+- **History rows render correctly on Windows ConPTY.** The cursor save/restore escapes (`ESC [ s` / `ESC [ u`) that legacy ConPTY silently drops have been replaced by relative `MoveUp` / `MoveDown` motion, so wrapped history lines now repaint reliably across Windows terminals.
+
 - **Anthropic decode failures now name the provider and show what came back.** A non-streaming response that doesn't match the expected JSON shape used to surface as the generic "HTTP request failed: error decoding response body" with no provider context; sofos now reads the body as text first and includes a redacted preview in the error so a misconfigured proxy is obvious at a glance.
 - **Cache-cost numbers settle correctly on turns where server-side compaction lands late.** Anthropic emits the final `cache_read_input_tokens` and `cache_creation_input_tokens` only on the trailing `message_delta` event in those cases; sofos now refreshes both totals when they appear there, so the cost summary picks up the cache-creation premium instead of under-reporting.
 - **OpenAI refusals reach the conversation.** A `{type: "refusal", refusal: "..."}` block used to be dropped silently, surfacing as "Assistant returned an empty response"; sofos now lifts the refusal text into the visible response so both the user and the next turn see what the model said.

src/repl/mod.rs

@@ -19,7 +19,7 @@ use crate::error::{Result, SofosError};
 use crate::mcp::McpManager;
 use crate::session::{HistoryManager, SessionState};
 use crate::tools::ToolExecutor;
-use crate::ui::{UI, set_safe_mode_cursor_style};
+use crate::ui::{UI, set_normal_mode_cursor_style, set_safe_mode_cursor_style};
 use colored::Colorize;
 use std::path::PathBuf;
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -582,6 +582,10 @@ impl Repl {
         self.safe_mode = true;
         self.tool_executor.set_safe_mode(true);
         self.refresh_available_tools();
+        // Switch the cursor to the safe-mode shape so the visual
+        // affordance matches the new mode. Best-effort: a failed
+        // SGR write here is purely cosmetic.
+        let _ = set_safe_mode_cursor_style();
 
         self.session_state
             .conversation
@@ -612,6 +616,9 @@ impl Repl {
         self.safe_mode = false;
         self.tool_executor.set_safe_mode(false);
         self.refresh_available_tools();
+        // Restore the default cursor shape so the visual affordance
+        // matches the new mode.
+        let _ = set_normal_mode_cursor_style();
 
         self.session_state
             .conversation

src/repl/tui/event_loop.rs

@@ -221,6 +221,18 @@ pub(super) async fn event_loop(
                 UiEvent::WorkerShutdown(summary) => {
                     app.exit_summary = Some(summary);
                     app.should_quit = true;
+                    // Unblock a worker that is parked on `reply_rx.recv()`
+                    // for a confirmation modal. Without this, the
+                    // `worker_handle.thread.join()` in `mod.rs` would
+                    // hang forever: the worker is waiting for the
+                    // modal's responder, but the event loop is about
+                    // to drop `app` (and the responder with it) only
+                    // after the join returns. Sending the default
+                    // index back unblocks the worker exactly as if
+                    // the user had pressed Esc.
+                    if let Some(prompt) = app.confirmation.take() {
+                        let _ = prompt.responder.send(prompt.default_index);
+                    }
                     // Drain any pending output events before tearing down —
                     // the stderr/stdout reader threads are a different mpsc
                     // sender than the worker, so a pre-shutdown

src/repl/tui/input.rs

@@ -78,6 +78,15 @@ pub(super) fn handle_idle_key(
             KeyCode::Char('u') if ctrl => {
                 app.textarea.delete_line_by_head();
             }
+            // Ctrl+W deletes the previous word, matching bash/zsh/readline.
+            KeyCode::Char('w') if ctrl => {
+                app.textarea.delete_word();
+            }
+            // Ctrl+K deletes from the cursor to the end of the line, also
+            // standard readline. Mirrors Ctrl+U on the trailing side.
+            KeyCode::Char('k') if ctrl => {
+                app.textarea.delete_line_by_end();
+            }
             // Alt+Up / Alt+Down cycle previously-submitted messages
             // without shadowing the textarea's own Up/Down cursor keys.
             KeyCode::Up if alt && !ctrl => {
@@ -153,6 +162,16 @@ fn handle_slash_popup_key(
             app.slash_popup.dismiss(&snapshot);
             true
         }
+        // Ctrl+C while the popup is open dismisses the popup rather
+        // than quitting the session — the user is mid-input and almost
+        // certainly meant to bail out of the suggestion list, not to
+        // exit. Outside the popup, Ctrl+C keeps its shutdown behaviour
+        // through the outer handler.
+        KeyCode::Char('c') if ctrl => {
+            let snapshot = app.input_text();
+            app.slash_popup.dismiss(&snapshot);
+            true
+        }
         KeyCode::Tab if bare => {
             apply_selected_command(app);
             true

src/repl/tui/mod.rs

@@ -26,7 +26,7 @@ pub mod worker;
 use std::fs::OpenOptions;
 use std::sync::atomic::AtomicBool;
 use std::sync::mpsc as std_mpsc;
-use std::sync::{Arc, Mutex};
+use std::sync::{Arc, Mutex, OnceLock};
 use std::time::Duration;
 
 use ratatui::backend::CrosstermBackend;
@@ -43,6 +43,42 @@ use input::spawn_input_reader;
 use keymap::install_confirm_handler;
 use output::OutputCapture;
 
+/// Real-tty handle saved by [`install_panic_hook`] so the hook can
+/// route restoration sequences past any `OutputCapture` redirection
+/// still in place at panic time. `OnceLock` because the hook is
+/// installed once per process and the handle never needs to change
+/// afterwards.
+static PANIC_TTY: OnceLock<Mutex<std::fs::File>> = OnceLock::new();
+
+/// Install a process-global panic hook that restores the terminal
+/// before chaining to the previous hook. Best-effort on every step:
+/// raw mode comes off, bracketed paste is disabled, kitty keyboard
+/// enhancement flags are popped, and the cursor is shown — written
+/// through [`PANIC_TTY`] (when set) so output reaches the real
+/// terminal even if `OutputCapture` has redirected stdout into a
+/// pipe. Chaining to the previous hook keeps the backtrace flowing
+/// to stderr so the user can still file a useful bug report.
+fn install_panic_hook() {
+    static INIT: std::sync::Once = std::sync::Once::new();
+    INIT.call_once(|| {
+        let prev = std::panic::take_hook();
+        std::panic::set_hook(Box::new(move |info| {
+            if let Some(tty_mutex) = PANIC_TTY.get() {
+                if let Ok(mut tty) = tty_mutex.lock() {
+                    let _ = crossterm::execute!(
+                        &mut *tty,
+                        crossterm::event::PopKeyboardEnhancementFlags,
+                        crossterm::event::DisableBracketedPaste,
+                        crossterm::cursor::Show,
+                    );
+                }
+            }
+            let _ = crossterm::terminal::disable_raw_mode();
+            prev(info);
+        }));
+    });
+}
+
 /// Background tick cadence — frame rate vs. event-loop responsiveness
 /// tradeoff. ~11 Hz is fast enough that streamed output looks fluid
 /// without burning CPU on a quiet conversation.
@@ -197,6 +233,14 @@ pub fn run(mut repl: Repl) -> Result<()> {
     #[cfg(windows)]
     let tty = OpenOptions::new().write(true).open("CONOUT$")?;
     let tty_for_backend = tty.try_clone()?;
+    // Stash a real-tty handle for the panic hook so a panic between
+    // here and the normal teardown can still write disable-raw-mode +
+    // disable-bracketed-paste + show-cursor through a writer that
+    // bypasses the upcoming output-capture redirection.
+    if let Ok(tty_for_panic) = tty.try_clone() {
+        let _ = PANIC_TTY.set(Mutex::new(tty_for_panic));
+    }
+    install_panic_hook();
 
     let (ui_tx, ui_rx) = mpsc::unbounded_channel::<UiEvent>();
     let (job_tx, job_rx) = std_mpsc::channel::<Job>();

src/repl/tui/output.rs

@@ -245,6 +245,51 @@ fn pipe_writer_into_fd(writer: PipeWriter) -> std::io::Result<libc::c_int> {
     }
 }
 
+/// Soft cap on a single captured "line" emitted to the UI when the
+/// writer never delivers a `\n`. Without it a tool that streams a
+/// large blob (a base64 attachment, a one-line JSON dump) would
+/// freeze the UI for the lifetime of the read — the reader thread
+/// sits in `read_until` waiting for a newline that never arrives.
+/// Beyond this, we send the partial buffer and continue reading.
+const READER_CHUNK_BYTES: usize = 4 * 1024;
+
+/// Read until `\n` OR until `cap` bytes have been accumulated into
+/// `line`, whichever comes first. Returns the number of new bytes
+/// pushed onto `line`. `0` means EOF.
+fn read_until_or_cap(
+    buf: &mut BufReader<PipeReader>,
+    delim: u8,
+    line: &mut Vec<u8>,
+    cap: usize,
+) -> std::io::Result<usize> {
+    let start = line.len();
+    loop {
+        let available = match buf.fill_buf() {
+            Ok(slice) => slice,
+            Err(ref e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+            Err(e) => return Err(e),
+        };
+        if available.is_empty() {
+            return Ok(line.len() - start);
+        }
+        if let Some(pos) = available.iter().position(|b| *b == delim) {
+            line.extend_from_slice(&available[..=pos]);
+            buf.consume(pos + 1);
+            return Ok(line.len() - start);
+        }
+        let remaining_cap = cap.saturating_sub(line.len() - start);
+        if remaining_cap == 0 {
+            return Ok(line.len() - start);
+        }
+        let take = available.len().min(remaining_cap);
+        line.extend_from_slice(&available[..take]);
+        buf.consume(take);
+        if line.len() - start >= cap {
+            return Ok(line.len() - start);
+        }
+    }
+}
+
 fn spawn_reader(
     reader: PipeReader,
     kind: OutputKind,
@@ -268,7 +313,7 @@ fn spawn_reader(
             let mut state = SgrState::default();
             loop {
                 line.clear();
-                match buf.read_until(b'\n', &mut line) {
+                match read_until_or_cap(&mut buf, b'\n', &mut line, READER_CHUNK_BYTES) {
                     Ok(0) => break,
                     Ok(_) => {
                         // Log the *raw* bytes — including the `\n` /

src/repl/tui/scrollback.rs

@@ -37,8 +37,7 @@ use crossterm::Command;
 use crossterm::cursor::MoveDown;
 use crossterm::cursor::MoveTo;
 use crossterm::cursor::MoveToColumn;
-use crossterm::cursor::RestorePosition;
-use crossterm::cursor::SavePosition;
+use crossterm::cursor::MoveUp;
 use crossterm::queue;
 use crossterm::style::Color as CColor;
 use crossterm::style::Colors;
@@ -258,13 +257,19 @@ fn emit_history_line<W: Write>(writer: &mut W, line: &Line, wrap_width: usize) -
     queue!(writer, MoveToColumn(0))?;
 
     let physical_rows = (line.width().max(1).div_ceil(wrap_width)) as u16;
-    if physical_rows > 1 {
-        queue!(writer, SavePosition)?;
-        for _ in 1..physical_rows {
+    let extra_rows = physical_rows.saturating_sub(1);
+    if extra_rows > 0 {
+        // Walk DOWN to pre-clear each continuation row, then walk back
+        // UP the same amount. Pure relative motion — `MoveUp` plus
+        // `MoveToColumn(0)` — instead of `Save/RestorePosition` (`ESC [
+        // s` / `ESC [ u`), which Windows ConPTY in legacy mode silently
+        // drops and modern ConPTY can land outside the active DECSTBM
+        // scroll region.
+        for _ in 0..extra_rows {
             queue!(writer, MoveDown(1), MoveToColumn(0))?;
             queue!(writer, Clear(ClearType::UntilNewLine))?;
         }
-        queue!(writer, RestorePosition)?;
+        queue!(writer, MoveUp(extra_rows), MoveToColumn(0))?;
     }
     queue!(
         writer,

src/ui/mod.rs

@@ -341,3 +341,10 @@ fn set_cursor_style(style: SetCursorStyle) -> io::Result<()> {
 pub fn set_safe_mode_cursor_style() -> io::Result<()> {
     set_cursor_style(SetCursorStyle::BlinkingUnderScore)
 }
+
+/// Reset the terminal cursor to the default blinking block used in
+/// normal (non-safe) mode. Mirror of [`set_safe_mode_cursor_style`]
+/// so the `/normal` toggle can put the cursor shape back.
+pub fn set_normal_mode_cursor_style() -> io::Result<()> {
+    set_cursor_style(SetCursorStyle::DefaultUserShape)
+}