fix(cli): decode arrow keys in curses model menus

[ESKRiPO]

What changed

• made curses menus translate raw arrow-key escape sequences in addition to KEY_UP/KEY_DOWN
• switched nested model-selection menus off simple_term_menu onto the shared curses menu helpers
• added regression coverage for raw arrow escape sequences and session-browser navigation

Why

Some terminals were sending arrow keys as raw escape sequences such as ESC [ B, so the initial provider picker could appear to work while later model-selection menus treated navigation input incorrectly. This made hermes model and related setup flows unreliable.

Impact

• provider and model selection menus now behave consistently across more terminals
• nested selection flows reuse one input stack instead of mixing curses and simple_term_menu
• users can navigate the affected menus with arrow keys without the input being misread as cancel or confirm

Root cause

The shared menu code only handled curses.KEY_* values, and some later pickers still used simple_term_menu. In affected terminals that split arrows into escape sequences, the menus interpreted the input incorrectly.

Validation

• ./.venv/bin/python -m pytest tests/hermes_cli/test_curses_ui_navigation.py tests/hermes_cli/test_session_browse.py tests/hermes_cli/test_setup_prompt_menus.py tests/hermes_cli/test_plugins_cmd.py -q

[ESKRiPO]

Rebased on latest main — conflicts resolved and PR is now mergeable again. Both the new navigation tests (tests/hermes_cli/test_curses_ui_navigation.py) and test_session_browse.py pass locally.

Quick summary of what this fixes: on some terminals the curses model/provider pickers would eat arrow-key CSI/SS3 escape sequences and jump to odd rows (or drop input entirely). This PR decodes those sequences explicitly so up/down behave consistently, and adds a non-TTY fallback for the single-select path.

@teknium1 would appreciate a look when you get a moment — this touches the same area as #7167 (flush_stdin after terminal menus), so it felt like the natural follow-up. Happy to iterate on anything.

[ESKRiPO]

Follow-up: pushed a third commit addressing two regressions caught in self-review of the curses switch:

1. Multi-line title rendering — _prompt_model_selection builds a multi-line title that embeds the In / Out / Cache /Mtok column header. The previous curses_single_select drew the whole title on row 0 and then overwrote row 1 with the navigation hint, so priced menus lost their legend. The helper now splits the title by newlines and renders each line on its own row before the hint.
2. Unavailable-model disclosure preserved — the fallback path printed a dim "Unavailable models (requires paid tier — upgrade at …)" block, but the curses path silently dropped it and truncated the title to (free models). Added an optional footer_lines argument to curses_single_select (rendered dimly below the items) and pipe the unavailable models + upgrade URL through it.

Added two unit tests covering both behaviors in tests/hermes_cli/test_curses_ui_navigation.py. All 38 curses-UI / session-browse tests pass locally.

[ESKRiPO]

Follow-up round 2 — self-review caught two more curses regressions:

1. Non-arrow escape sequences were leaking into input buffers. When keypad(True) doesn't translate keys like Delete/Home/End, the terminal delivers their raw CSI form (ESC [ 3 ~, ESC [ H, ESC [ F). read_curses_key() previously recognized only arrows and requeued the tail bytes back into _PENDING_KEYS — so pressing Delete while the session-browse filter was active first cleared the search (via the ESC branch) and then injected [3~ as printable chars into it. Now the decoder reads through to the CSI terminator (any byte in 0x40–0x7E) / the single SS3 function byte and returns a neutral 0 for unrecognized sequences, so menu/filter loops simply ignore them.

2. Long unavailable-model footers were crushing the selectable list. visible_rows subtracted the full len(footer) up front, so a provider with ~20 unavailable paid models left only one selectable row on a 24-row terminal. The footer is now capped at one-third of the rows below the hint, overflow is clipped, and the last shown footer line is annotated with (+N more) so users know extra info is available in the numbered fallback.

Added two more unit tests: one verifies that a Delete-style ESC [ 3 ~ sequence neither returns ESC nor leaves bytes in the pending buffer; the other checks that a 40-line footer still leaves at least 10 items visible on a 24-row terminal. All 41 curses-UI / session-browse tests pass locally.

[ESKRiPO]

Follow-up round 3 — self-review caught three more regressions:

1. [P2] Headless stdin now returns cancel instead of blocking. curses_single_select previously fell back to _numbered_single_fallback when stdin wasn't a TTY, which internally calls input() — so CI / piped invocations could block or swallow piped bytes. It now returns None directly, matching curses_checklist's long-standing cancel-on-headless behavior.

2. [P2] Split ESC sequences on slow PTYs are no longer misread as cancel. The arrow-key decoder was polling with nodelay(True), which returns -1 immediately when the continuation byte hadn't arrived yet. On slower SSH/tmux PTYs where ESC, [, A arrive across three separate reads, the decoder saw just ESC and cancelled the picker. Switched to stdscr.timeout(50) so we wait up to 50 ms for each continuation byte before giving up — enough for SSH jitter but not perceptible to users pressing ESC alone.

3. [P3] Priced-model column header re-aligned. The header pad was still 5 (old simple_term_menu layout = 3-char cursor + 2-char label prefix), but curses_single_select renders rows as " {arrow} {label}" (3-char prefix). That shifted the In/Out/Cache labels past their values. Pad is now 3; added a regression test that verifies the header's In right edge aligns with the first priced column in an item row.

All 45 curses-UI / session-browse / reasoning-effort-menu tests pass locally.

[ESKRiPO]

Follow-up round 4 — self-review caught a P1 regression that the previous round introduced:

The previous "make curses_single_select return None on non-TTY" change (meant to match curses_checklist's cancel-on-headless behavior) broke scripted callers. Four Hermes CLI test suites pipe a numeric choice through stdin into _prompt_model_selection / _prompt_reasoning_effort_selection / _remove_custom_provider / _model_flow_named_custom and expect that number to resolve the menu. Returning None turned every one of those flows into a silent Cancelled. / No change., and test_terminal_menu_fallbacks + test_custom_provider_model_switch failed accordingly.

Reverted to dispatching into _numbered_single_fallback() when stdin isn't a TTY. That helper prints the numbered prompt, reads one line via input(), and already catches EOFError — so scripted callers with buffered input keep working, and truly detached contexts (closed stdin, /dev/null) still cancel cleanly without blocking.

Added two regression tests: one asserts a piped "2" resolves to index 1 via the numbered fallback, the other asserts EOFError surfaces as None. All 56 curses-UI / session-browse / reasoning-effort / terminal-menu-fallback / custom-provider-model-switch tests pass locally.

Honest lesson from this round: the "simple" arrow-key fix is really a simple_term_menu → home-grown curses_single_select migration, and each round of review has surfaced cases the old library silently handled — headless input routing being the latest. Keeping the iteration transparent here rather than squashing so the history shows the correctness trajectory.

[ESKRiPO]

Follow-up round 5 — two P3 fixes:

1. EOF from custom-model entry now cancels cleanly. _prompt_model_selection wrapped the whole curses flow (including the input("Enter model name: ") call) in a broad except Exception. Ctrl-D / pipe-close during that input raised EOFError, which got swallowed and the function fell through to the numbered fallback — redrawing the menu a second time. Now catches EOFError/KeyboardInterrupt at the input() call so EOF surfaces as an immediate cancel.

2. Footer separator row now budgeted correctly. curses_single_select subtracted footer_shown from visible_rows but rendered the footer starting at last_item_row + 2 — spending a blank separator row that wasn't accounted for. On a 6-row tmux split the reserved-but-never-rendered footer slot shrank the selectable list for no visible gain. Now the separator is included in the budget, and the footer is skipped entirely when the terminal is too short for even one footer row.

Added two regression tests: one asserts that an EOF during custom-entry returns None without re-entering the picker; the other asserts that on a 6-row terminal the 3 items stay visible and no footer-* line is drawn. All 58 relevant tests pass locally.

[ESKRiPO]

ok