In an "are you sure?" dialog, Enter can delete or discard if the wrong button has focus #483

Opportunity

Every "are you sure?" in TuiCode starts with Cancel focused, but Enter presses whichever button has focus. A Tab or a mouse click moves focus onto Don't save, Overwrite, Reload, Delete or Revert, and the next Enter loses work. No choice has its own key, so the only way to pick one is Tab-Tab-Enter, which is exactly how the wrong one gets picked. And all the buttons are the same [ bracketed ] text, so the dangerous choice looks like the safe one.

It happens in the confirms you see most in a working day:

Evidence:

• MentalDesk.Tui 0.2.2+ (Bump MentalDesk.Tui from 0.2.0 to 0.2.2 #482) carries the style guide's Dialog buttons rule (tui-style-guide#26, #30): Esc cancels. Left/Right or Tab move between buttons and Space presses one. Each action has its own key, shown on its button, that works without Alt. Enter is optional and never a Danger action. Buttons are filled Primary / Danger / Secondary blocks (#21, #23). Swatch's Theme › Close… and Delete… already work this way.
• The guide is revising that rule in tui-style-guide#53: Ctrl+Enter confirms every dialog (the main action, Danger included), Enter never does, other actions keep their own key, and ConfirmDialog enforces it.
• TuiCode's ConfirmView binds only Esc and leaves Enter to the focused button. KeybindingConflictDialog is a second, separate copy.
• AGENTS.md: "Where the library has a type, use it rather than a TuiCode copy; a change it needs goes to the style guide first, as its own PR."

Options considered

1. Leave it. Cancel-first focus already stops a stray Enter straight after the dialog opens. But it's no protection once focus has moved, picking a choice still means Tab-Enter, and TuiCode keeps disagreeing with the guide it's meant to follow. No.
2. Patch ConfirmView in TuiCode. Add letter keys, make Enter do nothing, and draw filled buttons with AppButton. It's quick, but it's the TuiCode copy AGENTS.md rules out, and it would drift from Swatch. No.
3. Make the destructive actions undoable and drop the confirms. Delete to the Trash (Deleting a file in the explorer can't be taken back, even when git can't restore it #128), Revert is already undoable with Ctrl+Z, and so on. That's the better answer for delete, and Deleting a file in the explorer can't be taken back, even when git can't restore it #128 is pitched for it. But there's no undo for "Don't save" or "Overwrite", so the dialogs that matter most stay as they are. It doesn't solve this.
4. Host the library's ConfirmDialog in TuiCode for every confirm. One implementation of the rule, shared with Swatch. The catch is that ConfirmDialog runs only under the library's AppShell, which TuiCode doesn't use; TuiCode has its own key-scope stack. So the library needs a small change first: a way for an app without AppShell to run a ConfirmDialog and route keys to it. Chosen.

Proposal

Every confirm in the table becomes the library's ConfirmDialog, following the guide's revised rule (tui-style-guide#53):

• Ctrl+Enter presses the main action, shown on its button, key first. It's the same key that saves Settings and posts a review comment today.
• Every other choice has its own key, shown on its button, that works without Alt. Esc cancels. Space presses the focused button; Left/Right and Tab move between them.
• Enter does nothing, whichever button has focus.
• Buttons are filled blocks: a safe main action is Primary, anything that throws work away is Danger (red), and Cancel is Secondary. Cancel still starts focused.
• TuiCode's four bundled themes gain the guide's ButtonPrimary / ButtonDanger / ButtonSecondary schemes.

Mockup

▓ … ▓ is a filled button (Primary accent, Danger red, Secondary muted); ▶ marks focus.

┌ Unsaved changes ──────────────────────────────────────────────────┐
│ Save changes to 'Program.cs' before closing?                      │
│ Your changes will be lost if you don't save them.                 │
│                                                                   │
│   ▓ Ctrl+Enter Save ▓   ▓ D Don't save ▓   ▶▓ Esc Cancel ▓         │   Button (Primary), Button (Danger), Button (Secondary)
└───────────────────────────────────────────────────────────────────┘
   Ctrl+Enter saves and closes · D closes without saving · Esc cancels · Enter: nothing

┌ Delete ───────────────────────────────────────────────────┐
│ Permanently delete 'old-notes.md'?                        │
│ This action is irreversible!                              │
│                                                           │
│              ▓ Ctrl+Enter Delete ▓   ▶▓ Esc Cancel ▓       │   Button (Danger), Button (Secondary)
└───────────────────────────────────────────────────────────┘

Scope

In: the seven dialogs above, including Settings' "Shortcut in use", switched to ConfirmDialog. The three button schemes added to every bundled theme. Updating AGENTS.md's description of the confirm.

Out:

• Buttons outside confirms (Document Info, the review comment box, Open Folder, the terminal-integration picker, Settings' "Conflict" OK box): I can't tell at a glance which button is the main action, which is destructive, or which has focus #484.
• Delete to the Trash: Deleting a file in the explorer can't be taken back, even when git can't restore it #128. Whichever lands second updates the Delete dialog's wording and kind.
• Making these keys rebindable. They're dialog navigation, like the find bar's keys.
• TuiCode's own Windows Ctrl+LineFeed rewrite stays, since TuiCode doesn't run under the library's AppShell.

Delivery

One TuiCode PR. It waits on two library changes being released: tui-style-guide#53 (ConfirmDialog confirms on Ctrl+Enter and refuses Enter) and tui-style-guide#44 (an app without AppShell can run a ConfirmDialog).

Decided

All the Lead's, accepted by the stakeholder when they approved the pitch.

• TuiCode follows Switch release publish to Native AOT #53 as pitched there. If Switch release publish to Native AOT #53 changes before it ships, this follows it.
• Danger main actions confirm on Ctrl+Enter too (Delete, Revert, Reload). A chord can't be pressed by accident, which is Switch release publish to Native AOT #53's reasoning; focus still never starts on Danger.
• Compare is the main action when a file changed on disk: it loses nothing, and both other choices do.
• Cancel still starts focused, as today and as in Swatch.
• D for Don't save, as in Swatch's Close.
• Reload counts as Danger even when the tab has no unsaved edits. One kind per button is simpler to learn.
• Replace in "Shortcut in use" is Primary, not Danger. It overwrites one binding you can rebind straight away.
• I can't tell at a glance which button is the main action, which is destructive, or which has focus #484 stays a separate pitch. Whichever lands first adds the theme schemes.

Original idea

When TuiCode asks "are you sure?" (delete a file, discard unsaved changes, overwrite a file changed on disk, revert all changes in a diff), the only safe habit is to read which button has focus before pressing Enter. Cancel starts focused, but Tab or the mouse moves focus onto Delete, Don't save, Overwrite or Revert, and then Enter does the destructive thing. None of the choices has its own key, so the quick way out is always Tab-Tab-Enter, which is exactly the motion that goes wrong. The buttons are also all the same bracketed text, so a destructive choice doesn't look any different from a harmless one.

Notes from discovery: TuiCode bundles its own themes.json, so the three button schemes need adding to every bundled theme. ConfirmDialog is an AppDialog with its own commands and keys, while ConfirmView plugs into TuiCode's input-scope stack.