fix: harden leader chord handling for paste, modifiers, and validation

- Cancel the armed prefix when a paste arrives so the PREFIX indicator
  cannot get stuck and the next key is no longer consumed as a follow-up.
- Match the leader chord on exact Ctrl/Alt/Shift so Ctrl+Alt+<leader> and
  Ctrl+Shift+<leader> pass through to the PTY instead of being swallowed.
- Restrict parse_leader to ascii letters: digits and punctuation have no
  single control-byte encoding, so they broke literal <leader><leader>
  pass-through. Update the architecture doc to match.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: baudouin-iv

docs/architecture.md

@@ -109,7 +109,7 @@ trait TerminalBackend {
 
 라우팅은 leader(prefix) 모델을 따른다. 1순위 사용자는 패널에서 LLM CLI를 굴리는 cockpit 사용자이므로, `Ctrl+W`/`Ctrl+L` 같은 프롬프트 편집 Ctrl 키가 nightcrow에 가로채이지 않고 PTY로 통과해야 한다. 앱 전역 명령은 leader 뒤에 한 키를 눌러야만 실행된다.
 
-- **Leader (prefix)**: 기본값 `Ctrl+G`(tmux 자체 prefix인 `Ctrl+B`와 겹치지 않아 tmux 안에서도 사용 가능), `[input] leader`로 변경 가능(`config.rs::parse_leader`가 `ctrl+<ascii>`만 허용하고 예약키는 거부). leader를 누르면 `App.prefix_armed` 플래그가 켜지고, 다음 키 한 개가 앱 명령(`input::prefix_action`)으로 해석된다. **타임아웃은 없다** — armed 상태는 follow-up 키나 `Esc`/`Ctrl+C`로만 해제된다. 해제 경로는 셋뿐이다: 매핑된 키 → Action 실행 후 해제, 미매핑 키 → 소비 후 해제, `Esc`/`Ctrl+C` → 취소. `<L> <L>`는 terminal focus에서 leader를 `encode_key`로 리터럴 PTY 전송한다. prefix 매핑: `t`=NewPane, `w`=ClosePane, `l`=ToggleLogView, `f`=ToggleFullscreen, `o`=ChangeRepo, `p`=CycleTheme, `q`=Quit, `1`–`7`=SwitchPane.
+- **Leader (prefix)**: 기본값 `Ctrl+G`(tmux 자체 prefix인 `Ctrl+B`와 겹치지 않아 tmux 안에서도 사용 가능), `[input] leader`로 변경 가능(`config.rs::parse_leader`가 `ctrl+<letter>`만 허용하고 예약키·인코딩 불가 chord는 거부). leader를 누르면 `App.prefix_armed` 플래그가 켜지고, 다음 키 한 개가 앱 명령(`input::prefix_action`)으로 해석된다. **타임아웃은 없다** — armed 상태는 follow-up 키나 `Esc`/`Ctrl+C`로만 해제된다. 해제 경로는 셋뿐이다: 매핑된 키 → Action 실행 후 해제, 미매핑 키 → 소비 후 해제, `Esc`/`Ctrl+C` → 취소. `<L> <L>`는 terminal focus에서 leader를 `encode_key`로 리터럴 PTY 전송한다. prefix 매핑: `t`=NewPane, `w`=ClosePane, `l`=ToggleLogView, `f`=ToggleFullscreen, `o`=ChangeRepo, `p`=CycleTheme, `q`=Quit, `1`–`7`=SwitchPane.
 - **No-prefix 예약키**: `F1`/`F2`(focus jump), `F3`–`F9`(pane jump), `Shift+←/→`(focus cycle), `Shift+↑/↓`·`Shift+PgUp/PgDn`(터미널 스크롤)는 leader 없이 항상 앱이 먼저 처리한다. modifier 또는 F-key라서 프롬프트 텍스트와 혼동되지 않는다.
 - **Upper panel focused**: leader 명령과 no-prefix 예약키를 제외한 나머지는 로컬 네비게이션(`j`/`k`, `/`, `v`, `n`/`N`, `Enter`, `Esc`, 화살표, `PgUp`/`PgDn`)으로 처리된다. `j`/`k`는 upper-pane handler 내부에서 vim navigation으로 변환되며, `map_key`는 plain character로 통과시켜 terminal focus에서 PTY로 그대로 전달되게 한다.
 - **Lower panel focused (terminal)**: leader/예약키가 아닌 모든 키는 active backend의 stdin으로 직접 통과한다(`encode_key`가 화살표/F-key/제어문자를 VT100 시퀀스로 인코딩). 단독 `Ctrl+T/W/L/F/O/P/Q`도 더 이상 앱 명령이 아니므로 control byte로 PTY에 전달된다.

src/app.rs

@@ -182,11 +182,14 @@ impl App {
         }
     }
 
-    /// True when `key` matches the configured leader chord.
+    /// True when `key` matches the configured leader chord. Only Ctrl/Alt/Shift
+    /// distinguish a chord, so we compare exactly those: a bare `Ctrl+<leader>`
+    /// matches, while `Ctrl+Alt+<leader>` / `Ctrl+Shift+<leader>` do not and
+    /// pass straight through to the PTY instead of being swallowed.
     pub fn is_leader_key(&self, key: KeyEvent) -> bool {
+        let relevant = KeyModifiers::CONTROL | KeyModifiers::ALT | KeyModifiers::SHIFT;
         key.code == self.leader.code
-            && key.modifiers.contains(KeyModifiers::CONTROL)
-                == self.leader.modifiers.contains(KeyModifiers::CONTROL)
+            && (key.modifiers & relevant) == (self.leader.modifiers & relevant)
     }
 }
 

src/config.rs

@@ -59,7 +59,7 @@ pub fn parse_leader(spec: &str) -> Result<KeyEvent> {
     let rest = normalized.strip_prefix("ctrl+").ok_or_else(|| {
         anyhow::anyhow!(
             "input.leader \"{spec}\" must be a ctrl chord like \"ctrl+b\" \
-             (only ctrl+<letter/ascii> leaders are supported)"
+             (only ctrl+<letter> leaders are supported)"
         )
     })?;
     let mut chars = rest.chars();
@@ -71,14 +71,15 @@ pub fn parse_leader(spec: &str) -> Result<KeyEvent> {
         unreachable!()
     };
     anyhow::ensure!(
-        c.is_ascii_graphic(),
-        "input.leader \"{spec}\" must use a printable ascii character after ctrl+ \
-         (e.g. ctrl+b, ctrl+a, ctrl+space is not allowed)"
+        c.is_ascii_alphabetic(),
+        "input.leader \"{spec}\" must use an ascii letter after ctrl+ \
+         (e.g. ctrl+b; ctrl+1, ctrl+-, ctrl+space are not allowed)"
     );
-    // A control chord that encode_key cannot turn into a single control byte
-    // would make `<L><L>` literal pass-through impossible. The ascii-graphic
-    // gate above already excludes space/control inputs, so every accepted
-    // char maps to a control byte via the xterm convention.
+    // Restricting to letters guarantees `<L><L>` literal pass-through works:
+    // `encode_key` maps Ctrl+A..Ctrl+Z to control bytes 1..26 via the xterm
+    // convention. Digits and punctuation (e.g. ctrl+1) have no single-control-
+    // byte encoding, so encode_key would send the literal char instead and the
+    // pass-through would break — hence they are rejected above.
     Ok(KeyEvent::new(KeyCode::Char(c), KeyModifiers::CONTROL))
 }
 
@@ -738,6 +739,24 @@ command = "cargo test"
         assert!(leader.modifiers.contains(KeyModifiers::CONTROL));
     }
 
+    #[test]
+    fn parse_leader_rejects_unencodable_ctrl_chords() {
+        // Digits and punctuation have no single control-byte encoding, so they
+        // would break `<L><L>` literal pass-through and must be rejected.
+        for spec in ["ctrl+1", "ctrl+-", "ctrl+/", "ctrl+@"] {
+            assert!(
+                parse_leader(spec).is_err(),
+                "{spec} must be rejected as a leader"
+            );
+        }
+    }
+
+    #[test]
+    fn parse_leader_rejects_non_ctrl_and_multichar() {
+        assert!(parse_leader("g").is_err(), "bare key is not a ctrl chord");
+        assert!(parse_leader("ctrl+ab").is_err(), "leader is a single key");
+    }
+
     #[test]
     fn input_leader_parses_from_toml() {
         let toml = r#"

src/main.rs

@@ -260,6 +260,11 @@ fn main_loop(
 /// paste from interactive input (crossterm consumes the outer markers when
 /// surfacing `Event::Paste`).
 fn handle_paste(app: &mut App, text: &str) {
+    // A paste arriving while the prefix is armed would otherwise leave the
+    // PREFIX indicator stuck and make the next key resolve as a follow-up.
+    // Resolve the prefix first (tmux treats a non-command event as a cancel),
+    // then route the paste normally.
+    app.cancel_prefix();
     if app.repo_input.active {
         for ch in text.chars().filter(|c| !c.is_control()) {
             app.repo_input_push(ch);
@@ -755,6 +760,58 @@ mod tests {
         assert!(!app.prefix_armed(), "Esc must cancel the armed prefix");
     }
 
+    #[test]
+    fn handle_key_leader_ctrl_c_cancels() {
+        let mut app = app_with_terminal_pane();
+        let _ = handle_key(&mut app, leader());
+        assert!(app.prefix_armed());
+
+        let outcome = handle_key(&mut app, press(KeyCode::Char('c'), KeyModifiers::CONTROL));
+        assert!(matches!(outcome, KeyOutcome::Continue));
+        assert!(!app.prefix_armed(), "Ctrl+C must cancel the armed prefix");
+        // The cancel is consumed, never leaked to the PTY.
+        assert!(
+            backend_payloads(&app).is_empty(),
+            "Ctrl+C cancel must not send bytes to the PTY"
+        );
+    }
+
+    #[test]
+    fn handle_key_ctrl_alt_leader_passes_through() {
+        // Ctrl+Alt+<leader> carries an extra modifier, so it is NOT the leader
+        // chord — it must reach the PTY rather than arm the prefix.
+        let mut app = app_with_terminal_pane();
+
+        let outcome = handle_key(
+            &mut app,
+            press(KeyCode::Char('g'), KeyModifiers::CONTROL | KeyModifiers::ALT),
+        );
+
+        assert!(matches!(outcome, KeyOutcome::Continue));
+        assert!(
+            !app.prefix_armed(),
+            "Ctrl+Alt+leader must not arm the prefix"
+        );
+        assert!(
+            !backend_payloads(&app).is_empty(),
+            "Ctrl+Alt+leader must pass through to the PTY"
+        );
+    }
+
+    #[test]
+    fn paste_while_prefix_armed_cancels_prefix() {
+        let mut app = app_with_terminal_pane();
+        let _ = handle_key(&mut app, leader());
+        assert!(app.prefix_armed());
+
+        handle_paste(&mut app, "hello");
+
+        assert!(
+            !app.prefix_armed(),
+            "a paste must resolve (cancel) the armed prefix"
+        );
+    }
+
     #[test]
     fn handle_key_leader_unmapped_followup_cancels() {
         let mut app = app_with_terminal_pane();