@aragon-agent/cli 0.6.26 → 0.6.28

package/CHANGELOG.md

@@ -77,6 +77,57 @@ were written.
 
 ### Fixed
 
+- **A large paste arrived as runs of digits the moment it was sent - on screen,
+  in the model's input, in the prompt history and in the session file.**
+  `sanitisePaste` deleted the C0/C1 *introducer byte* and kept the parameter
+  bytes, so `ESC[38;2;18;52;86m` reached the transcript as the literal text
+  `[38;2;18;52;86m`. The composer collapses a large paste into
+  `[Pasted text #N +20 lines]`, so nothing was visible until submit expanded
+  it: a measured 20-line coloured log produced 80 runs of digits, and the same
+  string was what `/context`, the ↑ history and the session checkpoint stored.
+  Cleaning is now SEQUENCE-based and has one owner (new
+  `input/control-sequences.ts`, ASCII-only, no new dependency): a complete
+  escape goes as a unit, a truncated one loses its introducer and parameters
+  but never the character after them, an unterminated OSC/DCS/APC/PM/SOS goes
+  to the end of its line and never across it, and bare text that merely looks
+  like a sequence body (`[38;2m` with no ESC) is left exactly as it is.
+  `tools/terminal-output.ts`'s `stripAnsi` becomes a thin wrapper over the same
+  syntax, so a tool row and a paste cannot drift apart (both directions are
+  pinned by a cross-check test, and `terminal-output.test.ts` is unchanged).
+  A **single-line** paste carrying ESC - which `classifyChunk` sent down the
+  keystroke path with no cleaning at all - is now framed and cleaned like any
+  other paste; measured on the real component that path either put a live ESC
+  plus `[38;2;18;52;86m` into the draft or threw an uncaught `TypeError` inside
+  Ink's key parser. win32-input-mode records inside a frame are translated
+  rather than deleted, so a `?9001h` paste yields its characters instead of 15
+  visible digits per key (or, with cleaning but no translation, nothing at all).
+- **A pasted TAB-indented block or TSV table lined up differently before and
+  after sending.** One byte had three readings: the composer painted
+  four-column tab stops, the transcript handed the raw `\t` to the terminal
+  (eight), and the exit replay counted code units. New `ui/display-tab.ts`
+  expands a TAB by DISPLAY column (`string-width`, so a `CJK<TAB>X` line lands
+  where the terminal paints it); the composer's stop is the terminal's eight, and
+  `UserEntry`, `QueuedEntry` and the exit replay expand at paint time only -
+  the stored payload keeps its `\t`, so the model still receives the original
+  indentation. `wrappedRows` counts display columns too (with an ASCII fast
+  path, without which a 10 000-entry transcript timed out), because an estimate
+  that reads a TAB as one column keeps the row short while the painted row
+  grows - the under-estimate that file names as the unsafe direction.
+- **`Ctrl+L` opened a window that failed with a PowerShell `ParserError` on
+  Windows.** The script handed to `-EncodedCommand` was the argv joined with
+  quotes but with no call operator, and PowerShell reads a quoted string in command
+  position as an *expression*: with node installed under `C:\Program Files\...`
+  the child was never created - `UnexpectedToken` at column 36 - while the parent
+  TUI still reported that the window opened. `powerShellScript` now emits
+  `& <argv...>`, which is the only form that runs a word of any shape as a
+  command. The failure fallback follows: it is now two labelled lines
+  (`PowerShell:` / `cmd.exe   :`), because one line cannot be correct for both
+  parsers - and the `PowerShell:` line is byte-for-byte the script the window
+  receives. A leading `@` can no longer be left bare either, since `@name` is
+  PowerShell's splat operator and silently swallows an argument. New
+  `powershell-script-parse.test.ts` hands the generated scripts to the real
+  Windows PowerShell parser (and pins the old shape to its exact error), so this
+  class of defect has a guard instead of a green suite.
 - **A conversation saved mid-tool could be resumed into an illegal history.**
   A `tool_call` with no matching `tool_result` makes the next request fail. The
   checkpoint writer closes every dangling call on the copy it writes and re-checks

package/README.md

@@ -539,7 +539,7 @@ completes, `Up` / `Down` moves the selection, `Esc` closes it.
 | `Ctrl+W`, `Alt+Backspace` | Delete the previous word |
 | `Ctrl+U` / `Ctrl+K` | Kill to line start / end |
 | `Up` / `Down` | 按视觉行移动；空草稿或正在浏览历史时，才在边界召回历史，避免覆盖新草稿 |
-| Paste | Inserted as-is up to 6 lines / 400 chars; larger collapses to `[Pasted text #1 +15 lines]`, which deletes as one unit and expands in full when you send. `--no-paste` restores the pre-0.6.3 behaviour |
+| Paste | Inserted up to 6 lines / 400 chars; larger collapses to `[Pasted text #1 +15 lines]`, which deletes as one unit and expands in full when you send. Escape sequences are removed as sequences (so a coloured log arrives as its text, not as `[38;2;18;52;86m`), and a TAB is kept in the payload but laid out at the terminal's 8-column tab stops, so the draft and the echoed message line up. `--no-paste` restores the pre-0.6.3 behaviour |
 | `?` | Open help (empty input) |
 
 In **full-screen mode**, PgUp/PgDn, Shift+Up/Down and the right-edge scrollbar
@@ -1838,16 +1838,45 @@ The platform ladder, in order:
 The shell is `pwsh.exe` then `powershell.exe` on Windows, and `$SHELL` then `bash`
 then `/bin/sh` elsewhere. Windows receives the command as `-EncodedCommand` (base64
 of UTF-16LE), because that alphabet has no spaces, quotes or `cmd` metacharacters -
-it survives `cmd` -> `start` -> PowerShell without a quoting argument.
+it survives `cmd` -> `start` -> PowerShell without a quoting argument. The payload
+that gets encoded is `& <argv...>`, and **the leading `&` is load-bearing**: in
+command position PowerShell reads a quoted string as an *expression*, so with a node
+install under `C:\Program Files\...` the script `'C:\Program Files\nodejs\node.exe'
+<script>` is a `ParserError ... UnexpectedToken` and no child is ever created - while
+the parent still reports that the window opened. `&` is PowerShell's call operator:
+it takes the next word as a command name whatever its shape.
 
 When no terminal can be opened - an SSH session, a container, a machine with no
-graphical session - the command opens nothing and prints the fallback instead:
+graphical session - the command opens nothing and prints the fallback instead. On
+Windows that fallback is **two labelled lines**, because one line cannot be correct
+for both parsers (`& 'x'` is right for PowerShell and wrong for `cmd.exe`, which
+keeps the single quotes; `"x"` is right for `cmd.exe` and an expression to
+PowerShell):
+
+```
+No terminal window could be opened here. Run this in another terminal:
+PowerShell: & aragon --resume a4k2m9
+cmd.exe   : aragon --resume a4k2m9
+```
+
+Copy the line that matches the terminal you opened. macOS and Linux keep the single
+line they have always printed:
 
 ```
 No terminal window could be opened here. Run this in another terminal:
 aragon --resume a4k2m9
 ```
 
+A `node <dist/cli.js>` build prints the same two lines with the full paths, quoted:
+
+```
+PowerShell: & 'C:\Program Files\nodejs\node.exe' C:\Users\me\AppData\Roaming\npm\node_modules\@aragon-agent\cli\dist\launcher.js --resume a4k2m9
+cmd.exe   : "C:\Program Files\nodejs\node.exe" C:\Users\me\AppData\Roaming\npm\node_modules\@aragon-agent\cli\dist\launcher.js --resume a4k2m9
+```
+
+The `PowerShell:` line is byte-for-byte the script the new window receives, so the
+fallback can never drift from what the feature actually runs.
+
 Two environment variables exist because neither belongs in a config file:
 
 | Variable | Effect |
@@ -2190,7 +2219,7 @@ env / `.env` → CLI flags**.
 | `planModeDefault` | `false` | Start every session in plan mode. `--no-plan` still overrides it for a single run. |
 | `planModeMaxAskRounds` | `4` | `ask_user` rounds allowed per user message, clamped to `[1, 10]`. The counter resets on your next message; steering does **not** reset it. |
 | `planModeHumanTimeoutMs` | `1800000` | Ceiling on a single question / plan wait, clamped to `[60000, 7200000]`. Thirty minutes is far outside "went to get coffee", but a ceiling has to exist so an unattended terminal cannot wedge a CI job forever. |
-| `paste` | `true` | Recognise pasted text before Ink's key parser sees it: line breaks become buffer newlines instead of fifteen separate messages, control bytes are stripped instead of overwriting the row they land on, and a paste above 6 lines or 400 characters collapses to a one-line placeholder that expands when you send. `false` treats pasted bytes as keystrokes, which is what 0.6.2 did. |
+| `paste` | `true` | Recognise pasted text before Ink's key parser sees it: line breaks become buffer newlines instead of fifteen separate messages, escape SEQUENCES are removed whole (deleting only the introducer byte is what put `[38;2;18;52;86m` on screen and in the model's input) as are stray control bytes, and a paste above 6 lines or 400 characters collapses to a one-line placeholder that expands when you send. `false` treats pasted bytes as keystrokes, which is what 0.6.2 did. |
 | `historyEnabled` | `true` | Record submitted prompts to `prompt-history.jsonl` for `↑` recall. Setting it to `false` stops new writes; it does not delete what is already stored (that is `aragon history clear --yes`) and does not stop reading. See [Prompt history](#prompt-history). |
 | `team.enabled` | `true` | Master switch for team subagents. `false` means the `task` tool is never registered — `/team on` in such a session saves the setting for next launch and says so, rather than advertising a tool that is not there. |
 | `team.maxSubagents` | `5` | Subagents per dispatch, clamped to `[1, 10]`. The 10 is the hard ceiling and is enforced twice — on the config value and again on what the model asks for — so hand-editing this file cannot raise it. |

package/dist/input/control-sequences.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Control-SEQUENCE removal for text that crosses a boundary where a terminal
+ * escape must never become content (paste-control-sequence-residue, fix A'-1).
+ *
+ * WHY A DELETE-THE-WHOLE-SEQUENCE RULE EXISTS. Deleting only the introducer
+ * byte turns an escape into visible text: `ESC [ 3 8 ; 2 m` loses its ESC and
+ * leaves `[38;2m`, which is a run of digits and semicolons somebody then reads
+ * on screen and sends to the model. The bytes were never content; the sequence
+ * has to go as a unit.
+ *
+ * WHY IT IS NOT `tools/terminal-output.ts`'s REGEXES MOVED HERE. Those four
+ * regexes answer "what does this look like" for a terminal row that is still
+ * being written, and they are fed text whose unfinished tail has ALREADY been
+ * cut off and parked in a carry by the caller (`sanitizeChunk`,
+ * `toDisplayRow`). Pasted text is one-shot: there is no next chunk, so a
+ * truncated sequence needs a rule of its own. Measured against the stream
+ * version of the same input, `ESC [ 3 8 ; 2 ; 1 8 ; 5 2 ; 8 6` followed by
+ * prose loses the first letter of the prose (`n`), and an unterminated OSC
+ * leaves its whole body behind.
+ *
+ * THE FOUR DECISIONS THIS MODULE ENCODES:
+ *
+ * 1. A sequence introduced by a real introducer byte (`0x1B`, `0x9B`, `0x9D`,
+ *    ...) is removed as a unit; bare text that merely LOOKS like the inside of
+ *    one (`[38;2;18;52;86m` typed or pasted without an ESC) is left exactly as
+ *    it is, character for character.
+ * 2. A string-type sequence (OSC / DCS / SOS / PM / APC) runs to BEL or ST, and
+ *    an unterminated one is removed UP TO THE END OF ITS LINE. It never crosses
+ *    `\n` and never guesses at a terminator: a truncated sequence is the most
+ *    common shape in a clipboard, and the only safe reading of it is "the rest
+ *    of this line was never text".
+ * 3. A truncated CSI loses its introducer and its parameter bytes and NOTHING
+ *    ELSE. `ESC [ 3 1 m` split mid-parameter is parameters, not prose, but the
+ *    byte after them is the user's own character and must survive.
+ * 4. A C1 CSI (`0x9B`) with no parameter byte at all is treated as the stray
+ *    control byte it is most likely to be rather than as a sequence, because a
+ *    lone `0x9B` followed by one letter is otherwise indistinguishable from a
+ *    non-UTF-8 file's stray byte followed by content -- and consuming that
+ *    letter would be the very data loss this module exists to prevent.
+ *
+ * Pure, ASCII-only, React-free, Ink-free, and TOTAL: it never throws and it
+ * never reorders or mangles the bytes it keeps. No new dependency.
+ */
+/**
+ * Remove every escape/control sequence, keeping all other bytes in order.
+ *
+ * KEEPS `\t`, `\n` AND `\r`: they are line structure, and `\t` inside pasted
+ * indentation is content the model is supposed to receive. Stray C0/C1 bytes
+ * (and DEL) are NOT this function's job -- they are removed by the caller that
+ * wants them gone, so one rule has one owner.
+ */
+export declare function stripControlSequences(text: string): string;
+/**
+ * True when `text` carries a sequence a KEYBOARD cannot physically produce.
+ *
+ * Used at the keystroke branch of the stdin filter: a single-line paste that
+ * carries ESC fails `classifyChunk`'s two rules (no line break, and
+ * `HAS_CONTROL_EXCEPT_TAB`) and would otherwise reach Ink as raw bytes --
+ * either typing `[38;2;18;52;86m` with a live ESC into the draft, or throwing
+ * an uncaught `TypeError` inside Ink's key parser.
+ *
+ * THREE THINGS MUST NOT MATCH, and the shapes below are why:
+ * - SGR mouse reports (`ESC [ < 0 ; 1 ; 2 m`) are stripped by `splitMouseEvents`
+ *   BEFORE this test, and `<` is not a parameter byte, so the SGR rule cannot
+ *   see them anyway.
+ * - Arrow / function / Home / End keys (`ESC [ A`, `ESC [ 1 ; 5 D`, `ESC [ 3 ~`,
+ *   `ESC [ Z`) never end in `m`.
+ * - `Alt`+letter (`ESC` followed by one character) has no introducer body, so
+ *   the string-type rule does not fire.
+ */
+export declare function hasPasteOnlySequence(text: string): boolean;

package/dist/input/control-sequences.js

@@ -0,0 +1,222 @@
+/**
+ * Control-SEQUENCE removal for text that crosses a boundary where a terminal
+ * escape must never become content (paste-control-sequence-residue, fix A'-1).
+ *
+ * WHY A DELETE-THE-WHOLE-SEQUENCE RULE EXISTS. Deleting only the introducer
+ * byte turns an escape into visible text: `ESC [ 3 8 ; 2 m` loses its ESC and
+ * leaves `[38;2m`, which is a run of digits and semicolons somebody then reads
+ * on screen and sends to the model. The bytes were never content; the sequence
+ * has to go as a unit.
+ *
+ * WHY IT IS NOT `tools/terminal-output.ts`'s REGEXES MOVED HERE. Those four
+ * regexes answer "what does this look like" for a terminal row that is still
+ * being written, and they are fed text whose unfinished tail has ALREADY been
+ * cut off and parked in a carry by the caller (`sanitizeChunk`,
+ * `toDisplayRow`). Pasted text is one-shot: there is no next chunk, so a
+ * truncated sequence needs a rule of its own. Measured against the stream
+ * version of the same input, `ESC [ 3 8 ; 2 ; 1 8 ; 5 2 ; 8 6` followed by
+ * prose loses the first letter of the prose (`n`), and an unterminated OSC
+ * leaves its whole body behind.
+ *
+ * THE FOUR DECISIONS THIS MODULE ENCODES:
+ *
+ * 1. A sequence introduced by a real introducer byte (`0x1B`, `0x9B`, `0x9D`,
+ *    ...) is removed as a unit; bare text that merely LOOKS like the inside of
+ *    one (`[38;2;18;52;86m` typed or pasted without an ESC) is left exactly as
+ *    it is, character for character.
+ * 2. A string-type sequence (OSC / DCS / SOS / PM / APC) runs to BEL or ST, and
+ *    an unterminated one is removed UP TO THE END OF ITS LINE. It never crosses
+ *    `\n` and never guesses at a terminator: a truncated sequence is the most
+ *    common shape in a clipboard, and the only safe reading of it is "the rest
+ *    of this line was never text".
+ * 3. A truncated CSI loses its introducer and its parameter bytes and NOTHING
+ *    ELSE. `ESC [ 3 1 m` split mid-parameter is parameters, not prose, but the
+ *    byte after them is the user's own character and must survive.
+ * 4. A C1 CSI (`0x9B`) with no parameter byte at all is treated as the stray
+ *    control byte it is most likely to be rather than as a sequence, because a
+ *    lone `0x9B` followed by one letter is otherwise indistinguishable from a
+ *    non-UTF-8 file's stray byte followed by content -- and consuming that
+ *    letter would be the very data loss this module exists to prevent.
+ *
+ * Pure, ASCII-only, React-free, Ink-free, and TOTAL: it never throws and it
+ * never reorders or mangles the bytes it keeps. No new dependency.
+ */
+/** ESC -- the introducer every terminal shares. */
+const ESC = 0x1b;
+/** LF. No rule in this module may consume it (decision 2). */
+const LF = 0x0a;
+/** BEL terminates an OSC. */
+const BEL = 0x07;
+/** `[` after ESC is CSI, and `\` after ESC is the two-byte ST. */
+const BRACKET = 0x5b;
+const BACKSLASH = 0x5c;
+/** The ASCII second byte of each string-type sequence (`ESC ]`, `ESC P`, ...). */
+const ESC_DCS = 0x50;
+const ESC_SOS = 0x58;
+const ESC_OSC = 0x5d;
+const ESC_PM = 0x5e;
+const ESC_APC = 0x5f;
+/** C1 introducers, as written by a source that is not UTF-8 clean. */
+const C1_CSI = 0x9b;
+const C1_ST = 0x9c;
+const C1_OSC = 0x9d;
+const C1_DCS = 0x90;
+const C1_SOS = 0x98;
+const C1_PM = 0x9e;
+const C1_APC = 0x9f;
+/** Every byte that can START a sequence this module removes. */
+const ANY_INTRODUCER = /[\u001b\u0090\u0098\u009b\u009d\u009e\u009f]/;
+/**
+ * `CSI ... m` (SGR), in both encodings: `ESC [ digits ; m` and the single-byte
+ * C1 form `0x9B digits ; m`. NO KEY PRESS PRODUCES ONE, which is what makes it
+ * usable as the discriminator for an unframed paste in `stdin-filter.ts`.
+ */
+const SGR_SEQUENCE = /\u001b\[[0-9;]*m|\u009b[0-9;]*m/;
+/**
+ * A string-type introducer followed by at least one body byte. An `Alt`+key
+ * press is exactly two bytes, so "introducer plus a body" is already outside
+ * what a keyboard can emit.
+ */
+const STRING_SEQUENCE = /(?:\u001b[\u0050\u0058\u005d\u005e\u005f]|[\u0090\u0098\u009d\u009e\u009f])[\s\S]/;
+/** CSI final byte: `@` through `~`. */
+function isFinalByte(code) {
+    return code >= 0x40 && code <= 0x7e;
+}
+/** CSI parameter byte: `0` through `?`. */
+function isParamByte(code) {
+    return code >= 0x30 && code <= 0x3f;
+}
+/**
+ * CSI intermediate byte: `!` through `/`.
+ *
+ * SPACE (`0x20`) IS DELIBERATELY EXCLUDED (decision 3). The standard allows it,
+ * but a pasted sequence cut mid-parameter is followed by ` ` and then prose,
+ * and the first letter of that prose is a legal final byte -- so honouring the
+ * space would silently eat it. `CSI Ps SP q` (cursor style) is the only shape
+ * that gets worse, and no child process writes that to its stdout.
+ */
+function isIntermediateByte(code) {
+    return code >= 0x21 && code <= 0x2f;
+}
+/** True for the C1 introducers that open a string, not a CSI. */
+function isC1StringIntroducer(code) {
+    return code === C1_OSC || code === C1_DCS || code === C1_SOS || code === C1_PM || code === C1_APC;
+}
+/**
+ * End of the string-type sequence whose body starts at `from`.
+ *
+ * Stops AT the line break rather than past it, and reports "consumed to here"
+ * for a body that never terminates (decision 2).
+ */
+function stringEnd(text, from) {
+    let i = from;
+    while (i < text.length) {
+        const code = text.charCodeAt(i);
+        if (code === BEL || code === C1_ST)
+            return i + 1;
+        if (code === LF)
+            return i;
+        if (code === ESC && text.charCodeAt(i + 1) === BACKSLASH)
+            return i + 2;
+        i += 1;
+    }
+    return i;
+}
+/**
+ * End of the CSI whose parameter run starts at `from`.
+ *
+ * `requireParams` implements decision 4: with no parameter byte at all, a C1
+ * CSI is only the introducer byte, and its "final byte" is content.
+ */
+function csiEnd(text, from, requireParams) {
+    let i = from;
+    let sawParams = false;
+    while (i < text.length && isParamByte(text.charCodeAt(i))) {
+        sawParams = true;
+        i += 1;
+    }
+    if (requireParams && !sawParams)
+        return from;
+    while (i < text.length && isIntermediateByte(text.charCodeAt(i)))
+        i += 1;
+    if (i < text.length && isFinalByte(text.charCodeAt(i)))
+        return i + 1;
+    return i;
+}
+/** End of the sequence starting with ESC at `index` (decision 1 / 3). */
+function escapeEnd(text, index) {
+    if (index + 1 >= text.length)
+        return index + 1;
+    const next = text.charCodeAt(index + 1);
+    if (next === BRACKET)
+        return csiEnd(text, index + 2, false);
+    if (next === ESC_OSC || next === ESC_DCS || next === ESC_SOS || next === ESC_PM
+        || next === ESC_APC) {
+        return stringEnd(text, index + 2);
+    }
+    if (next === LF)
+        return index + 1;
+    return index + 2;
+}
+/**
+ * End of the sequence starting at `index`, or `-1` when no sequence starts
+ * there.
+ */
+function sequenceEnd(text, index) {
+    const code = text.charCodeAt(index);
+    if (code === ESC)
+        return escapeEnd(text, index);
+    if (code === C1_CSI)
+        return csiEnd(text, index + 1, true);
+    if (isC1StringIntroducer(code)) {
+        return index + 1 >= text.length ? index + 1 : stringEnd(text, index + 1);
+    }
+    return -1;
+}
+/**
+ * Remove every escape/control sequence, keeping all other bytes in order.
+ *
+ * KEEPS `\t`, `\n` AND `\r`: they are line structure, and `\t` inside pasted
+ * indentation is content the model is supposed to receive. Stray C0/C1 bytes
+ * (and DEL) are NOT this function's job -- they are removed by the caller that
+ * wants them gone, so one rule has one owner.
+ */
+export function stripControlSequences(text) {
+    if (!ANY_INTRODUCER.test(text))
+        return text;
+    let out = '';
+    let kept = 0;
+    let i = 0;
+    while (i < text.length) {
+        const end = sequenceEnd(text, i);
+        if (end === -1) {
+            i += 1;
+            continue;
+        }
+        out += text.slice(kept, i);
+        i = end;
+        kept = end;
+    }
+    return kept === 0 ? text : out + text.slice(kept);
+}
+/**
+ * True when `text` carries a sequence a KEYBOARD cannot physically produce.
+ *
+ * Used at the keystroke branch of the stdin filter: a single-line paste that
+ * carries ESC fails `classifyChunk`'s two rules (no line break, and
+ * `HAS_CONTROL_EXCEPT_TAB`) and would otherwise reach Ink as raw bytes --
+ * either typing `[38;2;18;52;86m` with a live ESC into the draft, or throwing
+ * an uncaught `TypeError` inside Ink's key parser.
+ *
+ * THREE THINGS MUST NOT MATCH, and the shapes below are why:
+ * - SGR mouse reports (`ESC [ < 0 ; 1 ; 2 m`) are stripped by `splitMouseEvents`
+ *   BEFORE this test, and `<` is not a parameter byte, so the SGR rule cannot
+ *   see them anyway.
+ * - Arrow / function / Home / End keys (`ESC [ A`, `ESC [ 1 ; 5 D`, `ESC [ 3 ~`,
+ *   `ESC [ Z`) never end in `m`.
+ * - `Alt`+letter (`ESC` followed by one character) has no introducer body, so
+ *   the string-type rule does not fire.
+ */
+export function hasPasteOnlySequence(text) {
+    return SGR_SEQUENCE.test(text) || STRING_SEQUENCE.test(text);
+}

package/dist/input/paste-parse.d.ts

@@ -56,16 +56,28 @@ export declare function classifyChunk(text: string, minBurstChars?: number): 'pa
  *    newline in pasted text, and a lone LF is dropped by Ink's key parser
  *    entirely, so both have to be normalised here or a pasted line break either
  *    submits the message or silently vanishes.
- * 2. Every C0 byte except `\n` and `\t` is removed. Ink writes `<Text>` children
- *    to the terminal without escaping anything, so a surviving `\r` overwrites
- *    the row it is drawn on and a surviving `\x1b` repaints the frame's colours.
- * 3. DEL and every C1 byte (U+0080..U+009F) go too, and that is NOT padding:
- *    U+009B is the single-byte CSI and U+0085 is NEL, and a terminal that decodes
- *    them acts on them exactly as it acts on `\x1b[`. A file pasted out of a
- *    non-UTF-8 editor walks straight through a "strip C0" rule.
- * 4. TAB is KEPT. Indentation is content, and it is what the model receives.
+ * 2. Every escape SEQUENCE is removed AS A SEQUENCE (`stripControlSequences`).
+ *    Deleting only the introducer byte is what produced the reported defect:
+ *    `ESC [ 3 8 ; 2 ; 1 8 ; 5 2 ; 8 6 m` minus its ESC is `[38;2;18;52;86m`,
+ *    a run of digits Ink then writes to the terminal as ordinary text -- and it
+ *    reached the model, the prompt history and the session file too, because
+ *    this function is the only cleaning the payload ever gets.
+ * 3. Every remaining C0 byte except `\n` and `\t` is removed. Ink writes
+ *    `<Text>` children to the terminal without escaping anything, so a
+ *    surviving `\r` overwrites the row it is drawn on and a surviving `ESC`
+ *    repaints the frame colours. Sequences are gone by this point, so what is
+ *    left for this step is a stray byte, never half of one.
+ * 4. DEL and every C1 byte (U+0080..U+009F) go too, and that is NOT padding:
+ *    U+009B is the single-byte CSI and U+0085 is NEL, and a terminal that
+ *    decodes them acts on them exactly as it acts on `ESC [`. A file pasted out
+ *    of a non-UTF-8 editor walks straight through a "strip C0" rule.
+ * 5. TAB is KEPT. Indentation is content, and it is what the model receives.
+ *    Expanding it is the RENDERERS' job (`ui/display-tab.ts`), so the model
+ *    keeps the original indentation while the screen, the composer and the
+ *    terminal all agree on what column a TAB lands on.
  *
  * Applied to PAYLOAD ONLY, never to keystrokes, so `Ctrl+A` and Escape keep
- * working. Non-ASCII text (CJK, emoji) is untouched.
+ * working. Non-ASCII text (CJK, emoji) is untouched. Idempotent, so the
+ * second pass in `ui/paste-frames.ts` stays a byte-identical no-op.
  */
 export declare function sanitisePaste(raw: string): string;

package/dist/input/paste-parse.js

@@ -16,6 +16,7 @@
  * `DECSET 2004`. Both are about what a keyboard can physically emit.
  */
 import { PASTE_MIN_BURST_CHARS } from './limits.js';
+import { stripControlSequences } from './control-sequences.js';
 /** `DECSET 2004` wraps a paste in these two markers. */
 export const PASTE_BEGIN_MARK = '\x1b[200~';
 export const PASTE_END_MARK = '\x1b[201~';
@@ -76,20 +77,31 @@ export function classifyChunk(text, minBurstChars = PASTE_MIN_BURST_CHARS) {
  *    newline in pasted text, and a lone LF is dropped by Ink's key parser
  *    entirely, so both have to be normalised here or a pasted line break either
  *    submits the message or silently vanishes.
- * 2. Every C0 byte except `\n` and `\t` is removed. Ink writes `<Text>` children
- *    to the terminal without escaping anything, so a surviving `\r` overwrites
- *    the row it is drawn on and a surviving `\x1b` repaints the frame's colours.
- * 3. DEL and every C1 byte (U+0080..U+009F) go too, and that is NOT padding:
- *    U+009B is the single-byte CSI and U+0085 is NEL, and a terminal that decodes
- *    them acts on them exactly as it acts on `\x1b[`. A file pasted out of a
- *    non-UTF-8 editor walks straight through a "strip C0" rule.
- * 4. TAB is KEPT. Indentation is content, and it is what the model receives.
+ * 2. Every escape SEQUENCE is removed AS A SEQUENCE (`stripControlSequences`).
+ *    Deleting only the introducer byte is what produced the reported defect:
+ *    `ESC [ 3 8 ; 2 ; 1 8 ; 5 2 ; 8 6 m` minus its ESC is `[38;2;18;52;86m`,
+ *    a run of digits Ink then writes to the terminal as ordinary text -- and it
+ *    reached the model, the prompt history and the session file too, because
+ *    this function is the only cleaning the payload ever gets.
+ * 3. Every remaining C0 byte except `\n` and `\t` is removed. Ink writes
+ *    `<Text>` children to the terminal without escaping anything, so a
+ *    surviving `\r` overwrites the row it is drawn on and a surviving `ESC`
+ *    repaints the frame colours. Sequences are gone by this point, so what is
+ *    left for this step is a stray byte, never half of one.
+ * 4. DEL and every C1 byte (U+0080..U+009F) go too, and that is NOT padding:
+ *    U+009B is the single-byte CSI and U+0085 is NEL, and a terminal that
+ *    decodes them acts on them exactly as it acts on `ESC [`. A file pasted out
+ *    of a non-UTF-8 editor walks straight through a "strip C0" rule.
+ * 5. TAB is KEPT. Indentation is content, and it is what the model receives.
+ *    Expanding it is the RENDERERS' job (`ui/display-tab.ts`), so the model
+ *    keeps the original indentation while the screen, the composer and the
+ *    terminal all agree on what column a TAB lands on.
  *
  * Applied to PAYLOAD ONLY, never to keystrokes, so `Ctrl+A` and Escape keep
- * working. Non-ASCII text (CJK, emoji) is untouched.
+ * working. Non-ASCII text (CJK, emoji) is untouched. Idempotent, so the
+ * second pass in `ui/paste-frames.ts` stays a byte-identical no-op.
  */
 export function sanitisePaste(raw) {
-    return raw
-        .replace(/\r\n?/g, '\n')
+    return stripControlSequences(raw.replace(/\r\n?/g, '\n'))
         .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F-\u009F]/g, '');
 }

package/dist/input/stdin-filter.js

@@ -33,8 +33,9 @@
  */
 import { PassThrough } from 'node:stream';
 import { MAX_PENDING_MOUSE_CHARS, splitMouseEvents, isMousePrefix, } from './mouse-events.js';
-import { ENTER_NEWLINE_FRAME, PASTE_ASSEMBLY_MAX_MS, PASTE_BURST_MS, PASTE_CLOSE, PASTE_MAX_BYTES, PASTE_OPEN, formatPasteSize, } from './limits.js';
+import { ENTER_NEWLINE_FRAME, INDEX_KEY_FRAME, PASTE_ASSEMBLY_MAX_MS, PASTE_BURST_MS, PASTE_CLOSE, PASTE_MAX_BYTES, PASTE_OPEN, formatPasteSize, } from './limits.js';
 import { PASTE_BEGIN_MARK, PASTE_END_MARK, classifyChunk, sanitisePaste, trailingPastePrefixLength, } from './paste-parse.js';
+import { hasPasteOnlySequence } from './control-sequences.js';
 import { splitEnterSequences, trailingEnterPrefixLength } from './enter-sequences.js';
 import { splitCsiUKeys, trailingCsiUPrefixLength, translateCsiUKey } from './csiu-keys.js';
 import { splitWin32KeySequences, trailingWin32PrefixLength, translateWin32Key, } from './win32-input-mode.js';
@@ -206,8 +207,8 @@ export function createStdinFilter(real, features, bridge, onWarn) {
     // The scan (section 5.1, and the ORDER below is the specification)
     // -----------------------------------------------------------------------
     /**
-     * Text that reached the pass-through: Tier 2 classification, then mouse
-     * stripping, then Ink.
+     * Text that reached the pass-through: a sequence a KEYBOARD cannot produce
+     * first (R-2), then Tier 2 classification, then mouse stripping, then Ink.
      *
      * MOUSE PARSING IS SUSPENDED FOR THE DURATION OF ANY PASTE BODY (I-3), burst
      * and bracketed alike. The Tier 2 population is precisely the terminals with
@@ -225,6 +226,23 @@ export function createStdinFilter(real, features, bridge, onWarn) {
             burstTimer = arm(flushBurst, PASTE_BURST_MS);
             return;
         }
+        // A SEQUENCE A KEYBOARD CANNOT PRODUCE IS A PASTE, FRAMED OR NOT (R-2).
+        //
+        // WHY THE CLASSIFIER BELOW IS NOT ENOUGH. `classifyChunk` needs either a
+        // line break or a chunk with no control byte but TAB, and a SINGLE-LINE
+        // paste carrying ESC satisfies neither -- so it travels the keystroke path
+        // with `sanitisePaste` never called. Measured on the real component that
+        // cost either a draft holding `[38;2;18;52;86m` ALONGSIDE A LIVE ESC (which
+        // then reached the model, the history and the session file) or an uncaught
+        // `TypeError` in Ink's parser, because `parse-keypress.js` maps `ESC [ 3 2 m`
+        // to a ctrl key whose `name` is undefined. Framing it here routes it through
+        // the ONE cleaning path every other paste already takes.
+        if (features.paste && hasPasteOnlySequence(text)) {
+            paste = { kind: 'burst', body: text, bytes: byteLength(text) };
+            burstTimer = clearTimer(burstTimer);
+            burstTimer = arm(flushBurst, PASTE_BURST_MS);
+            return;
+        }
         if (features.paste && classifyChunk(text) === 'paste') {
             paste = { kind: 'burst', body: text, bytes: byteLength(text) };
             burstTimer = clearTimer(burstTimer);
@@ -300,14 +318,47 @@ export function createStdinFilter(real, features, bridge, onWarn) {
             }
         }
     };
+    /**
+     * win32-input-mode records that arrived INSIDE a paste frame (R-4).
+     *
+     * DATA FIDELITY, NOT POLISH. Every character of a `?9001h` session arrives as
+     * `ESC [ vk ; sc ; char ; down ; mods ; rep _`, and once the frame opens
+     * nothing translated them: `sanitisePaste` then removed each record's ESC and
+     * left 15 visible characters of digits per key. Translating them is also what
+     * keeps the fix honest in the OTHER direction -- a whole-sequence stripper
+     * deletes such a record outright, so "clean" would have meant the user's
+     * characters silently vanishing. A record carrying a key FRAME (modified
+     * Enter, Ctrl+I) becomes the byte that frame stands for, because a frame
+     * inside a body is content and never a key.
+     */
+    const translateInPaste = (text) => {
+        if (!enhancedKeys || !text.includes('\x1b['))
+            return text;
+        let out = '';
+        for (const segment of splitWin32KeySequences(text)) {
+            if (segment.kind === 'text') {
+                out += segment.text;
+                continue;
+            }
+            const legacy = translateWin32Key(segment.record);
+            if (legacy === ENTER_NEWLINE_FRAME)
+                out += '\n';
+            else if (legacy === INDEX_KEY_FRAME)
+                out += '\t';
+            else
+                out += legacy;
+        }
+        return out;
+    };
     const appendBracketed = (text) => {
         if (paste.kind !== 'bracketed' || text.length === 0 || discardBracketed)
             return;
-        const bytes = paste.bytes + byteLength(text);
+        const body = translateInPaste(text);
+        const bytes = paste.bytes + byteLength(body);
         const overflow = paste.overflow || bytes > PASTE_MAX_BYTES;
         paste = {
             kind: 'bracketed',
-            body: overflow ? paste.body : paste.body + text,
+            body: overflow ? paste.body : paste.body + body,
             bytes,
             overflow,
         };

package/dist/proc/terminal-plan.d.ts

@@ -65,7 +65,10 @@ export interface TerminalPlanInput {
     /** New window title, ASCII, already truncated to the cell budget. */
     title: string;
     cwd: string;
-    /** `joinCommandLine(command)` - the pasteable fallback shown to the user. */
+    /**
+     * `renderManualCommand(command, platform)`'s product: two lines on win32
+     * (`PowerShell:` / `cmd.exe   :`), one line everywhere else.
+     */
     manual: string;
 }
 /** The env var that overrides the shell the new window runs (D-7). */
@@ -80,7 +83,22 @@ export declare const ARAGON_BRANCH_SHELL_ENV = "ARAGON_BRANCH_SHELL";
  * so there is exactly one place that number lives.
  */
 export declare function planTerminalLaunch(input: TerminalPlanInput): TerminalPlanResult;
-/** PowerShell: the whole command as one base64(UTF-16LE) blob (D-20). */
+/**
+ * The PowerShell statement that runs the aragon command (D-1).
+ *
+ * THE LEADING `&` IS NOT DECORATION. In command position PowerShell reads a quoted
+ * string as an EXPRESSION, so `'C:\Program Files\nodejs\node.exe' <script>` is a
+ * parse error - "unexpected token ..." at column 36 - and the child is never
+ * created, while the parent still believes the window opened (K-1: `wt`/`start`
+ * forward and exit). That is exactly the report this branch exists to fix.
+ * `&` is the call operator: it takes the following word as a command name whatever
+ * its shape, and it does not change name resolution (`& 'npm.cmd'` still finds
+ * `npm` through PATH/PATHEXT, appendix B-8).
+ *
+ * `posixScript` MUST NOT be given the same treatment: in sh `&` means run in the
+ * background, so the window would reach the trailing `exec <shell> -i` immediately
+ * and the branch would start behind a prompt that looks idle (I-3 / K-1).
+ */
 export declare function powerShellScript(parts: readonly string[]): string;
 /** Bare words stay bare; everything else becomes a single-quoted literal. */
 export declare function powerShellQuote(value: string): string;