Cut the interactive TUI over to OpenTUI

[TheGreatAxios]

Hard cutover of the interactive TUI from Ink/React to OpenTUI. The Ink path is deleted, not feature-flagged — there is no fallback renderer, so rollback is checking out the prior tag rather than flipping a flag.

What changed

• Renderer. createCliRenderer replaces render(<App />). Layout is a zone-based geometry resolver with min/max/idle rows per zone and an explicit collapse order, rather than React reconciliation.
• Look. A warm bronze/sand/ember ramp replaces Summit Blue across chrome, centralized in theme.ts behind a Theme type and registry.
• Composer. Multi-line prompt on TextareaRenderable, wrapping and growing to 40vh before it scrolls.
• Transcript. Streaming rows repaint in place via a 1:1 log-index-to-child mapping; markdown renders through tree-sitter with async highlighting.
• Permissions. The gate overlay is sized to its content, and the decision is recorded in the transcript after the operator chooses.

Defects found and fixed during review

CI had been dark since July over an Actions billing limit. It is re-enabled in this branch, and re-enabling it immediately paid for itself.

Would not have started on a user's machine. build:bin passed --external '@opentui/core-*' to a --compile standalone binary, so the native module had no node_modules to resolve from. Verified by building and running from an empty directory.

A production memory leak. Renderable.destroy() frees only its own native buffer and detaches children without destroying them. Six product sites dropped whole subtrees, so every transcript repaint, landing clear and shell dispose stranded its descendants. Instrumented FFI tracking showed 16,061 of 26,481 buffers live; now zero. Seventeen of the eighteen "known flakes" were this.

A crash ate the terminal. An uncaught throw left the alternate screen, mouse reporting and raw mode all on, and the process survived — OpenTUI registers an uncaughtException handler that only logs, which suppresses Bun's default exit, while raw-mode stdin holds the loop open. Verified under a real PTY against a baseline.

Trojan Source in the approval overlay. The control-character stripper let bidirectional overrides through, so text could read as one thing and run as another at the exact moment the operator approves it. Model output also reached the screen unsanitized, including sequences split across streaming deltas.

Ctrl+D quit mid-edit. Unconditional, so deleting a character — the shell default for that chord — ended the session and lost the draft.

Batched tool calls dropped their results. Eight identical calls produced one folded row and seven orphans. The existing test passed because it drove a different code path than the app.

Grep never honored its byte cap. On a breach it settled with everything accumulated — 153 KB against a 200 byte limit in one measured run — so far more than the cap could reach the model's context.

The approval modal wrapped by code units, not columns, so CJK text overflowed the subject the operator is asked to approve.

Four event channels had no listeners, so lifecycle hook status, subagent progress, MCP status and grant confirmations were silently absent.

A retried turn duplicated itself — inference.retry reached the bridge and was dropped, leaving the failed attempt painted and its tool row stranded.

Onboarding truncated a pasted API key at 1000 characters without saying so, which is the first thing a new user does.

Five help rows described behavior that did not exist, including a quit key documented as delete-character. The catalog now has a guard that presses the bytes each row claims.

Also: resumed sessions silently dropped view, plan and tasks blocks (verified against all 49 sessions on one machine); mouse reporting is off by default so the terminal owns selection, with Alt+M to take it back; Alt+C copy mode had never written to the system clipboard.

Verification

bun run typecheck, bun run build clean. bun test ./src ./tests ./evals: 3871 pass, 0 fail.

Most of the above was found by running the app or capturing the pty byte stream, not by the suite. The headless test renderer cannot see paint, real modifier reporting, the system clipboard, or terminal-owned selection.

Open

• CL-5550 — one CI assertion on the grep byte cap fails on Linux only. The unbounded-payload defect it exposed is fixed; the CI symptom itself is not yet explained, and is being worked rather than skipped.
• CL-5551 — the 600-block transcript retention cap died with the deleted Ink stream state and was not ported. Every index into streamLog is absolute, so head-trimming needs an offset base threaded through the shell.
• Shift+Enter does not insert a newline on terminals that do not report the modifier. Ctrl+Enter and Ctrl+J do. The kitty path was verified working end to end, so this is terminal reporting, not a decode defect.
• Markdown flickers mildly while streaming. The deterministic cause — a bare #### painting as literal text — is fixed and guarded; a residual flicker remains from the async highlighter.
• Real-terminal sign-off is unsigned. docs/tui-tty-signoff.md, 29 checks at 80x24 and 120x40.

Rejected during this work

A measured double-frame commit per update was diagnosed as the cause of horizontal jitter. Four fix variants were built and every one produced an identical capture, including with the frame hook removed entirely — the second commit originates inside OpenTUI's paint path, below our layout code. All of it was reverted rather than shipped as an unverified refactor of the frame path. The actual cause was a partial heading marker re-classifying mid-stream.