Rewrite the TUI on HQTUI

[ralyodio]

The two-pane browser was ~940 lines of hand-rolled ANSI: its own escape codes, its own key parser, its own box drawing, and a full-screen repaint on every keystroke. It now runs on @profullstack/hqtui, and the file is split three ways:

file	holds
model.ts	state and the pure functions over it — no terminal, no ssh, no rsync
view.ts	the whole screen as one pure function of a snapshot
app.ts	state and effects only

That split is what makes the screen testable. The old TUI wrote straight to stdout, so the only way to know what it drew was to run it in a pty and look. A frame is now a value, and view.test.ts asserts on rendered text.

New, beyond the same two panes

• A live transfer panel — progress bar, rate, ETA, running add/update/unchanged counts, and the files as rsync reports them. s used to be a status line that changed once at the end. esc cancels it, through an AbortSignal into runToCompletion.
• / filters a listing as you type; o cycles name/size/time sort (O reverses); . toggles dotfiles; ? lists every binding.
• The endpoint picker filters as you type, over names and hostnames both.
• Modification times, right-aligned beside the sizes.
• The mouse: click a pane to focus it, click a row to select it, wheel to scroll.

Three defects found by rendering frames rather than reading code

• Title and path share the panel's top border row and the box gives the path priority. Budgeted against the full pane width, one pane lost its title and the other lost its path — decided by a one-column rounding difference between two panes showing the very same directory.
• hqtui's truncate keeps the head of a string, which is right for a label and wrong for a path: every worktree under one repo rendered as the identical string. Paths are shortened from the left now.
• A finished transfer showed rsync's last printed figure (80% on a preview that had completed) instead of 100%.

The host-key prompt keeps its behaviour and its regression test: q still quits from inside it, everything else is still swallowed, and a connect that fails still takes its unanswered question with it.

Verification

601 tests pass (59 of them for the TUI, up from 15), pnpm typecheck and pnpm build are clean, and the real binary was driven through a pty: both panes list, the picker loads ~17 ssh_config hosts and narrows to 2 on "see", a real rsync preview and a real sync stream through the transfer panel, and both q and Ctrl+C exit 0 with the alternate screen and cursor restored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKCDDzxxcypufp9u8cjoAk

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​hqtui@​0.2.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @profullstack/hqtui Location: Package overview From: apps/cli/package.json → npm/@profullstack/hqtui@0.2.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/hqtui@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report