fireQueued auto-submits a prompt the user queued mid-turn, once the turn has wound down to idle. Reached only from the natural finish path (here, afte

handleChipKey gives chips atomic-token semantics: Backspace/Delete at a boundary removes the whole chip, ←/→ jumps across it, and a cursor inside a ch

handleCtrlC implements Ctrl+C's three-level precedence: in-flight cancel > popover close > quit arming. Each level fully handles the key, no fallthrou

handleEnter implements the three-way Enter dispatch. Alt+Enter inserts a newline; command-level Enter on an args-taking command advances to the arg po

handleEscInPopover implements Esc inside the popover: arg level steps back to the command menu; command level closes the popover and clears the textar

handlePageKey implements PgUp/PgDn. textarea disables its viewport keymap, so page keys aren't wired, so we translate them to N×CursorUp/CursorDown (o

handleResizeSettle fires once the post-resize debounce expires for the matching gen. Wipes the terminal (so previous-width rows can't soft-wrap into s

handleTab implements the three Tab behaviours: seed "/" on an empty prompt (opens the command popover), complete a unique match when the popover is op

handleWindowSize tracks new dimensions, rebuilds the glamour renderer on a wrap-width change, emits the splash on the first frame, and on a true width

hashFile streams a file through sha256.

historyDown walks one step toward newer entries; -1 is the live draft sentinel and restores an empty textarea.

historyUp walks one step toward older entries; caller gates on cursor-on- first-line and popover closed. Empty history is a no-op.

insertChip splices a chip label in at the cursor, recording the new span at the right ORDER position so the following reconcile() walks the labels lef

isEnvName reports whether s is a POSIX environment variable name ([A-Za-z_][A-Za-z0-9_]*), the only content ${...} expands.

looksLikePaste recognises paste-like key events. Primary signal: the bracketed-paste Paste flag (terminal wraps content in \x1b[200~...\x1b[201~). Som

marker is the status-bar glyph for the frozen finish: ✓ for a clean finish, ✗ for an abort (cancel, error, or a stalled/leaked end). "" suppresses the

maybeSelfUpdate runs the pre-launch auto-update. No-op for local builds, an already-current hash, an unsupported platform (see update.assetName), or a

mustCwd returns the working directory or exits 1, called only where there's nothing sensible to recover to.

newestAssistantUnverified reports whether the turn's final assistant message already carries an "unverified" marker, the honest self-assessment the fi

newestToolGroup returns the assistant that issued the newest tool result together with every tool result answering it, chronologically: the minimal we

newestToolIndex returns the index of the newest tool-result message in history, or -1. Everything after it can only be non-tool (a system nudge, an as

onlyNonSubstantive reports whether kept carries no substantive conversation: only system-role notes (soft nudges) and empty assistant messages (no tex

preGrowTextarea inflates Height to the cap *before* a KeyMsg is processed. bubbles/textarea's repositionView() scrolls the viewport down when the curs

printHamrpassStatus emits the status + how-to block (the no-args path).

printModelList writes the "▸ active, name, llm @ url" rollup to scroll.

probeErrorMessage maps cloud sentinel errors to human hints for the activation line. Falls back to the raw error string for anything else.

queuePrompt stashes the textarea contents to auto-submit when the running turn finishes (see fireQueued), then clears the input so the next prompt can

queuedHeight is the rows renderQueued occupies in View(), 0 when nothing is queued. Subtracted from the textarea cap so a tall queued box can't crowd

reExec replaces the process image via execve(2). Same PID, so the parent shell waits on one process throughout, one continuous session. Success never

readSSE reads OpenAI SSE frames until [DONE] or EOF, forwarding content/reasoning/tool-call events to out. Returns the final assistant message (conten

runeBoundaryDown walks i left to a rune start so out[:i] never ends mid-sequence. Safe for i == len(out).

runeBoundaryUp walks i right to a rune start so out[i:] never starts mid-sequence. Safe for i <= 0.

runeCount is the counting counterpart of runeIndex: non-overlapping occurrences of needle in haystack. Exact for chip labels, which cannot self-overla

runeOffsetToRowCol converts an absolute rune offset into (row, col).

selectInitialIdx picks the starting row: the current row (e.g. active profile), else the first.

sendChat POSTs the request and returns the response on 200. On failure it returns the Event the caller forwards, populated with Kind/Err/Budget. The b

setProcessGroup gives the shell its own process group and a Cancel that SIGKILLs the whole group. Without it, backgrounded children (`cmd &`) outlive

shouldChip collapses a paste when either its line count or char count clears the threshold: lines catch multi-line pastes, chars catch single-line blo

totalBytes is the full combined output size as written, kept or not.

unqueuePrompt pulls the queued prompt back into the textarea and clears the slot, so a queued follow-up can be edited or dropped with one Backspace. R

waitForPID blocks until pidFile contains a parseable PID, then returns it. Fails the test if the file never appears within a short deadline.

TestActiveContextSizePrefersLiveValue: packing reads liveContextSize first, then Profile.ContextSize, then the floor. Cloud profiles ship ContextSize=

TestActiveProfileResolvesByName: the helper returns the right struct.

TestAltEnterInsertsNewline: Alt+Enter composes a multi-line prompt. The alt-flagged KeyEnter ("alt+enter") matches no textarea binding, so the flag mu

TestApplyAcceptsMatchingChecksum: positive case, a download whose hash equals the manifest entry promotes the binary into place.

TestApplyCleansTempOnFailure: a failed download (server returns 500) must not leave a half-written temp file in the install directory.

TestApplyKeepsPreviousBinaryAsOld is the cross-platform-parity guard: Apply must rename execPath aside to execPath+".old" before moving the new downlo

TestApplyRejectsChecksumMismatch: a binary whose hash doesn't match the manifest must NOT replace the local executable, else a corrupted CDN response

TestApplyRejectsMissingManifestEntry: a manifest that exists but doesn't list our asset (a bad release) must make Apply abort, not skip verification a

TestApplyReportsRestoreFailure covers the doubly-bad path: the promote rename fails AND the restore of the moved-aside binary also fails. Apply must s

TestApplyRespectsContextCancel: a cancelled ctx aborts the download and the local exec stays untouched.

TestApplyRestoresBinaryWhenPromoteFails covers the most dangerous failure: the running binary is moved aside to execPath+".old", then the promote rena

TestArgPopoverOpensForModels: "/models " shows the profile names (no synthetic "next", Tab cycles instead) with the active profile preselected.

TestArgPopoverReloadsCfgOnEntry: the arg popover builds its list from m.cfg.Models. Without the cmd→arg reload in refreshSuggest, the first "/models "

TestArgPopoverSkipsConfigReloadMidTurn: typing is allowed mid-turn, but the cmd→arg popover transition must not reload config then: a reload can rebui

TestAssetNameCoversEveryReleasedPlatform: every goos/goarch goreleaser publishes a binary for MUST be reachable from assetName. A missing case silentl

TestAssetNameMatchesGoreleaserMatrix asserts the set of platforms assetName resolves is EXACTLY the set goreleaser builds: no more, no less. Derived f

TestAssetNameRejectsUnreleasedPlatform: the inverse, anything goreleaser doesn't build for must return ok=false so Check short-circuits before the net

TestBackendLabelReflectsConnectedState asserts the backend label renders differently when connected vs not: the user's at-a-glance "are we talking to

TestBackendLabelShowsActiveProfile: the label echoes the currently-active profile name. Default Bootstrap ships one profile called "local". No bracket

TestBackspaceAtChipEndRemovesWholeChip: Backspace with the cursor right after the label deletes the whole chip and leaves surrounding text intact.

TestBackspaceImmediatelyAfterChipRemovesIt: atomic-delete regression guard, after a paste the cursor sits at chip.end, so one Backspace deletes the ch

TestBackspaceNotAtChipBoundaryFallsThrough: Backspace away from a chip boundary deletes one char normally, chip untouched.

TestBashBackgroundedChildReturnsCleanOutput: backgrounding a child that holds the pipes open trips exec.ErrWaitDelay (shell already exited 0), not an

TestBashBoundsRunawayOutput: a firehose command must not grow an unbounded buffer (the old CombinedOutput OOM-killed the whole TUI on `cat big.iso` we

TestBashExactExitMarkerFormat pins the exact non-zero-exit shape: output, then a single "\n(exit: ...)" marker. The model parses these, and the other

TestBashHonorsAlreadyCancelledParent: a pre-cancelled parent (Ctrl+C raced the dispatch) must report "(cancelled)", not "(empty command)" or, worse, s

TestBashKillsBackgroundedChildOnCancel proves bash's process-group kill reaches backgrounded grandchildren. A naked `cmd &` outlives /bin/sh; without

TestBashParentCancelMidRun: parent cancel mid-sleep returns "(cancelled)", not a misleading "(timeout after Xs)" or stale exit code. Parent cancel alw

TestBashTimeoutOverflowClamped: extreme floats must be clamped BEFORE the Duration multiply. `time.Duration(1e18) * time.Second` overflows int64 to a

TestBootstrapCoercesBogusContextSize: context_size 0 (or missing) is coerced to the default rather than degrading Pack() to "newest message only".

TestBootstrapCoercesUnknownActive: an unknown `active:` is coerced to the first profile in sorted order so ActiveProfile never returns nil.

TestBootstrapDoesNotRestoreDeletedHamrpass: once config.yaml exists the user owns its profile list. A removed hamrpass stays gone across restarts (re-

TestBootstrapDoesNotRestoreRenamedLocal: renaming `local` (e.g. to `ollama`) must not resurrect a duplicate `local` on next start. Same invariant as t

TestBootstrapHamrpassHasNoContextSizeOnDisk: a fresh config.yaml must carry no context_size for hamrpass: that field is server-authoritative via X-Con

TestBootstrapLoadsMultipleProfiles: a two-profile config round-trips and Bootstrap picks the declared `active`.

TestBootstrapPreservesExistingHamrpassKey: a user-supplied hamrpass key must round-trip untouched. Guards against any future "tidy on read" that would

TestBootstrapRefusesSymlinkedDir: a co-tenant could plant .codehamr → an attacker-controlled dir before first run. Bootstrap must Lstat (not Stat) and

TestBootstrapRejectsEmptyModels: an empty `models:` block leaves Active nothing to point at; Bootstrap must error readably (how to recover) rather tha

TestBootstrapRejectsNilProfile: `models: { local: ~ }` decodes to a nil *Profile the ContextSize coercion loop would deref-panic on. Bootstrap must re

TestBootstrapTightensLooseDirPerms: a .codehamr/ created loose (older release, or by hand at 0o755) must be tightened on the next Bootstrap, the direc

TestBootstrapWritesSandboxHintHeader pins the comment header writeYAML re-prepends on every write. yaml.Marshal drops comments, so this is the only pl