[codex] fix sessions browse raw arrow navigation

[hzhaoy]

What does this PR do?

Fixes raw CSI arrow-key handling in hand-rolled Hermes curses pickers. In affected terminals, Up/Down can arrive as raw escape sequences (ESC [ A / ESC [ B) instead of translated curses.KEY_UP / curses.KEY_DOWN constants. The old loops treated the leading ESC byte as cancel/exit before reading the CSI continuation.

This PR now routes both affected pickers through the existing shared curses menu decoder:

• hermes sessions browse
• hermes plugins composite toggle picker

The change preserves existing text-filter behavior in the session browser and existing plugin picker behavior for page/home/end, toggle, select, and cancel.

Related Issue

N/A. Reproduced locally with scripts/keystroke_diagnostic.py: Up emitted \x1b[A, Down emitted \x1b[B.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/main.py: route non-printable keys in _session_browse_picker through the existing curses escape-sequence decoder, while keeping printable filter input, q, Backspace, Enter, and lone Esc semantics intact.
• tests/hermes_cli/test_session_browse.py: add regression coverage for raw ESC [ B and ESC [ A arrow sequences, and make the fake curses input model support short escape continuation timeouts.
• hermes_cli/plugins_cmd.py: route the composite plugins picker through the same shared decoder so raw CSI arrows navigate instead of exiting, while preserving PageUp/PageDown/Home/End handling on raw curses keys.
• tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py: add regression coverage proving raw ESC [ B toggles the second plugin and raw ESC [ A wraps to the last plugin instead of exiting.

How to Test

1. scripts/run_tests.sh tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py tests/hermes_cli/test_session_browse.py tests/hermes_cli/test_curses_arrow_keys.py
2. $HOME/.hermes/hermes-agent/venv/bin/python -m ruff check hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py tests/hermes_cli/test_session_browse.py hermes_cli/main.py
3. $HOME/.hermes/hermes-agent/venv/bin/python scripts/check-windows-footguns.py hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py hermes_cli/main.py tests/hermes_cli/test_session_browse.py
4. git diff --check -- hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py hermes_cli/main.py tests/hermes_cli/test_session_browse.py

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass (not run; targeted tests above passed)
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS, targeted automated checks

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — ran check-windows-footguns.py
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Relevant verification output:

=== Summary: 3 files, 58 tests passed, 0 failed (100% complete)
All checks passed!
✓ No Windows footguns found (4 file(s) scanned).

[tonydwb]

Code Review Summary

Verdict: LGTM

Fixes raw CSI arrow key navigation in the sessions browse curses picker. Uses _decode_menu_key to translate raw escape sequences (ESC [ A/B) into NAV_UP/NAV_DOWN actions, making navigation work in terminals that don't emit curses.KEY_UP/KEY_DOWN constants.

Looks Good

• Correct ordering: check backspace and printable chars before key decode
• Tests use FakeStdscr that simulates real terminal behavior (timeout-based getch)
• Raw CSI sequence tests confirm fix works

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused regression fix. The reported session-browser bug is present on current main: hermes_cli/main.py:1083-1104 handles raw ESC as cancellation before it can read a CSI continuation. The proposed _decode_menu_key integration matches the existing decoder in hermes_cli/curses_ui.py:295-342, and the added CSI tests cover the stated behavior.

Problems

• A sibling hand-rolled picker remains vulnerable: hermes_cli/plugins_cmd.py:1532-1539 only handles translated KEY_UP/KEY_DOWN, while :1615-1618 treats raw ESC as exit despite advertising arrow navigation at :1440.

Suggested changes

• Please cover that selector with the same shared decoder in a focused follow-up (or extend this change if desired), including raw ESC [ A/B regression coverage.

Automated hermes-sweeper review.

[hzhaoy]

Addressed the sweeper follow-up for the sibling hermes plugins composite picker.

Changes added in db151519f:

• routes _run_composite_ui() through the shared curses _decode_menu_key() for raw CSI arrows
• preserves existing PageUp/PageDown/Home/End raw-key handling
• adds regression coverage for raw ESC [ B toggling the second plugin and raw ESC [ A wrapping to the last plugin

Validation rerun:

• scripts/run_tests.sh tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py tests/hermes_cli/test_session_browse.py tests/hermes_cli/test_curses_arrow_keys.py
• python -m ruff check hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py tests/hermes_cli/test_session_browse.py hermes_cli/main.py
• python scripts/check-windows-footguns.py hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py hermes_cli/main.py tests/hermes_cli/test_session_browse.py
• git diff --check -- hermes_cli/plugins_cmd.py tests/hermes_cli/test_plugins_cmd_enable_disable_nested.py hermes_cli/main.py tests/hermes_cli/test_session_browse.py