@jini-ai/chat 0.6.15-rc.2 → 0.6.16

package/dist/core/run-activity.js

@@ -85,8 +85,9 @@ function isAnswerCard(scan, name, data) {
 function scanStatus({ scan, event, index }, _optional = {}) {
     if (event.code === 'api_retry') {
         scan.retry = { index, data: event.data };
+        return;
     }
-    else if (event.code === 'tool_progress') {
+    if (event.code === 'tool_progress') {
         const seconds = numberField(event.data, 'elapsedSeconds');
         if (seconds !== undefined)
             scan.progress = { index, seconds };
@@ -108,15 +109,18 @@ function scanEvent(scan, event, index) {
         scan.pendingQuestionIndex = -1;
         scan.open = scan.open.filter((tool) => tool.id !== event.id);
         scan.open.push({ id: event.id, name: event.name, input: event.input, index });
+        return;
     }
-    else if (event.kind === 'tool_result') {
+    if (event.kind === 'tool_result') {
         // Completion may be unrelated background work or the ask tool returning before human input.
         scan.open = scan.open.filter((tool) => tool.id !== event.toolUseId);
+        return;
     }
-    else if (event.kind === 'ext') {
+    if (event.kind === 'ext') {
         scanCard({ scan, event, index });
+        return;
     }
-    else if (event.kind === 'status') {
+    if (event.kind === 'status') {
         scanStatus({ scan, event, index });
     }
 }

package/dist/core/run-events/entry.js

@@ -8,7 +8,9 @@ import { assistantContentFromEvents } from "../assistant-content.js";
 import { mergeAdjacentTextEvents } from "../compact-events.js";
 import { dedupeToolUsesById } from "../tool-events.js";
 function wireString(v) {
-    return typeof v === "string" ? v : v == null ? "" : JSON.stringify(v);
+    if (typeof v === "string")
+        return v;
+    return v == null ? "" : JSON.stringify(v);
 }
 /** Display a wire scalar or JSON value using the existing empty-null convention. */
 export function asString({ value }, _options = {}) {
@@ -470,7 +472,9 @@ function chunkEvent(raw, channel, carry) {
     if (!frame)
         return [];
     const chunk = wireString(frame.payload?.chunk);
-    const open = carry ? (carry.openEchoChannels ??= new Set()) : undefined;
+    if (carry)
+        carry.openEchoChannels ??= new Set();
+    const open = carry?.openEchoChannels;
     const { kept, statuses, droppedAny } = splitChunk({ chunk, channel }, { open });
     const line = droppedAny ? kept : chunk;
     return line.length > 0 ? [{ kind: "raw", line }, ...statuses] : statuses;

package/dist/core/tool-events.d.ts

@@ -29,7 +29,7 @@ export declare function isDelegatedWrapperToolName({ name }: {
     name: string;
 }): boolean;
 /**
- * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * Drop each delegated or direct MCP wrapper call that the daemon also reported as its own canonical row,
  * so one call shows as one row.
  *
  * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
@@ -39,16 +39,26 @@ export declare function isDelegatedWrapperToolName({ name }: {
  * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
  * name, input and result.
  *
- * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
- * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
- * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
- * hidden.
+ * A direct call (`mcp__jini__theme_read_file`) arrives twice the same way: the CLI's `mcp__<server>__X`
+ * row and the bridge's `X` row with the same input, so every direct Jini MCP call drew two rows.
  *
- * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
+ * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
+ * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
+ * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
+ * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
+ * bridge, e.g. a read-only 403) stays, so its error is not hidden.
+ *
+ * @param events - One assistant turn's events, normally already passed through {@link dedupeToolUsesById}.
  * @returns A new array without the folded wrappers, or the original reference when none fold.
- * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·w·s): n events, w wrappers, s canonical input serialization cost (including key sorting).
+ * O(n + s) extra space; inputs and events are not mutated.
+ * @example foldDelegatedWrapperCalls({ events }); // canonical rows retain their own results
  */
 export declare function foldDelegatedWrapperCalls({ events }: {
     events: AgentEvent[] | undefined;
-}): AgentEvent[];
+}, _options?: Record<string, never>): AgentEvent[];
 //# sourceMappingURL=tool-events.d.ts.map

package/dist/core/tool-events.js

@@ -1,3 +1,5 @@
+import { canonicalJson } from '@jini-ai/core/records';
+import { toolPresentation } from './tool-presentation.js';
 /**
  * Drop repeated `tool_use` events that share an `id`. A retried/duplicated
  * stream can replay the same tool-call id (e.g. reconnect-and-replay landing
@@ -46,15 +48,31 @@ const DELEGATED_WRAPPER_PATTERN = /^(?:mcp__.+__)?execute_(?:readonly_)?delegate
 export function isDelegatedWrapperToolName({ name }) {
     return DELEGATED_WRAPPER_PATTERN.test(name);
 }
-function wrapperToolId({ event }) {
-    if (!isDelegatedWrapperToolName({ name: event.name }))
+/** The tool `mcp__<server>__X` names (`X`), or undefined for any other name. O(n) in the name length. */
+function directMcpToolName({ name }) {
+    if (!name.startsWith('mcp__'))
         return undefined;
-    const input = event.input;
-    const toolId = typeof input === 'object' && input !== null ? input.toolId : undefined;
-    return typeof toolId === 'string' && toolId ? toolId : undefined;
+    // The server segment is at least one character, so its closing `__` starts at index 6 or later.
+    const separator = name.indexOf('__', 6);
+    return separator === -1 ? undefined : name.slice(separator + 2);
+}
+/** Resolve the generic wrapper contract or an MCP gateway/direct name. Pure; O(n) in the name.
+ * Legacy gateways retain name-only matching for malformed-input bridge errors;
+ * Antigravity's adapter-described wrappers require equal inner inputs but may arrive buffered.
+ */
+function wrapperCall({ event }, _options = {}) {
+    const wrapper = toolPresentation(event).wrapper;
+    const call = wrapper ?? event;
+    if (!isDelegatedWrapperToolName({ name: call.name })) {
+        const name = wrapper ? wrapper.name : directMcpToolName({ name: call.name });
+        return name ? { name, input: call.input, matchInput: true, buffered: wrapper !== undefined } : undefined;
+    }
+    const args = call.input !== null && typeof call.input === 'object' ? call.input : {};
+    const name = args.toolId;
+    return typeof name === 'string' && name ? { name, input: args.input, matchInput: wrapper !== undefined, buffered: wrapper !== undefined } : undefined;
 }
 /**
- * Drop each delegated-tool wrapper call that the daemon also reported as its own canonical row,
+ * Drop each delegated or direct MCP wrapper call that the daemon also reported as its own canonical row,
  * so one call shows as one row.
  *
  * WHY. A delegated call arrives twice: the vendor CLI's wrapper `tool_use`
@@ -64,16 +82,26 @@ function wrapperToolId({ event }) {
  * failed call showed two red rows. The canonical row is the one to keep: it carries the tool's own
  * name, input and result.
  *
- * A wrapper folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`
- * and that no earlier wrapper has claimed; its `tool_result` events go with it. A wrapper with no
- * such canonical row (refused before the bridge, e.g. a read-only 403) stays, so its error is not
- * hidden.
+ * A direct call (`mcp__jini__theme_read_file`) arrives twice the same way: the CLI's `mcp__<server>__X`
+ * row and the bridge's `X` row with the same input, so every direct Jini MCP call drew two rows.
  *
- * @param events - The event list, normally already passed through {@link dedupeToolUsesById}.
+ * Antigravity buffers CLI receipts: its adapter-described wrappers match equal inner inputs
+ * anywhere in this assistant turn, in appearance order among equal keys. Pass only one turn's events;
+ * no state is retained across calls. Wrapper and bridge rows are each claimed at most once.
+ * A legacy gateway folds onto the first LATER canonical `tool_use` whose name equals its `input.toolId`.
+ * A direct call folds onto the first LATER `X` row with structurally equal JSON input that arrives
+ * before the CLI's own result for it. No canonical row is claimed twice, and a folded wrapper's
+ * `tool_result` events go with it. A wrapper with no such canonical row (refused before the
+ * bridge, e.g. a read-only 403) stays, so its error is not hidden.
+ *
+ * @param events - One assistant turn's events, normally already passed through {@link dedupeToolUsesById}.
  * @returns A new array without the folded wrappers, or the original reference when none fold.
- * @complexity O(n·w): n events, w wrapper calls (a handful per message).
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·w·s): n events, w wrappers, s canonical input serialization cost (including key sorting).
+ * O(n + s) extra space; inputs and events are not mutated.
+ * @example foldDelegatedWrapperCalls({ events }); // canonical rows retain their own results
  */
-export function foldDelegatedWrapperCalls({ events }) {
+export function foldDelegatedWrapperCalls({ events }, _options = {}) {
     if (!events || events.length === 0)
         return [];
     const claimed = new Set();
@@ -81,11 +109,11 @@ export function foldDelegatedWrapperCalls({ events }) {
     events.forEach((event, i) => {
         if (event.kind !== 'tool_use')
             return;
-        const toolId = wrapperToolId({ event });
+        const call = wrapperCall({ event });
         // A replayed wrapper (same id) must not claim a second canonical row.
-        if (toolId === undefined || folded.has(event.id))
+        if (call === undefined || folded.has(event.id))
             return;
-        const match = events.findIndex((other, j) => j > i && !claimed.has(j) && other.kind === 'tool_use' && other.name === toolId);
+        const match = findCanonicalRow({ events, wrapper: event, wrapperIndex: i, call, claimed });
         if (match === -1)
             return;
         claimed.add(match);
@@ -96,4 +124,32 @@ export function foldDelegatedWrapperCalls({ events }) {
     return events.filter((event) => !((event.kind === 'tool_use' && folded.has(event.id)) ||
         (event.kind === 'tool_result' && folded.has(event.toolUseId))));
 }
+/**
+ * Index of the first unclaimed canonical row in the wrapper's matching window, or -1. Legacy gateways match
+ * on name alone; direct calls and adapter-described wrappers also require equal inner input.
+ * @throws CanonicalJsonError if a direct call's input contains non-JSON values.
+ * @complexity O(n·s): n events, s canonical input serialization cost.
+ */
+function findCanonicalRow({ events, wrapper, wrapperIndex, call, claimed }) {
+    const inputKey = call.matchInput ? canonicalJson({ value: { input: call.input } }) : undefined;
+    const [start, end] = canonicalSearchWindow({ events, wrapper, wrapperIndex, call });
+    for (let j = start; j < end; j += 1) {
+        const other = events[j];
+        if (claimed.has(j) || other.kind !== 'tool_use' || other.name !== call.name)
+            continue;
+        if (inputKey === undefined || canonicalJson({ value: { input: other.input } }) === inputKey)
+            return j;
+    }
+    return -1;
+}
+/** Pure matching bounds within one turn; O(n) time, O(1) space for n events.
+ * Antigravity's buffered receipts cannot establish arrival/result boundaries. Direct MCP calls
+ * retain their later-only window so a completed/refused call cannot consume a separate retry.
+ */
+function canonicalSearchWindow({ events, wrapper, wrapperIndex, call }, _options = {}) {
+    if (call.buffered)
+        return [0, events.length];
+    const resultIndex = !call.matchInput ? -1 : events.findIndex(other => other.kind === 'tool_result' && other.toolUseId === wrapper.id);
+    return [wrapperIndex + 1, resultIndex === -1 ? events.length : resultIndex];
+}
 //# sourceMappingURL=tool-events.js.map

package/dist/core/tool-presentation.d.ts

@@ -0,0 +1,14 @@
+type Call = {
+    name: string;
+    input: unknown;
+};
+/** Display-only call and, when present, the transport's inner call to correlate with the bridge. */
+export type ToolPresentation = Call & {
+    wrapper?: Call;
+};
+/** Resolve CLI argument dialects at one boundary. Raw/persisted events remain untouched.
+ * Pure; O(k) only when an adapter copies k argument keys, otherwise O(1).
+ */
+export declare function toolPresentation(call: Call, _options?: Record<string, never>): ToolPresentation;
+export {};
+//# sourceMappingURL=tool-presentation.d.ts.map

package/dist/core/tool-presentation.js

@@ -0,0 +1,8 @@
+import { antigravityToolPresentation } from './antigravity/tool-presentation.js';
+/** Resolve CLI argument dialects at one boundary. Raw/persisted events remain untouched.
+ * Pure; O(k) only when an adapter copies k argument keys, otherwise O(1).
+ */
+export function toolPresentation(call, _options = {}) {
+    return antigravityToolPresentation(call) ?? call;
+}
+//# sourceMappingURL=tool-presentation.js.map

package/dist/core/transcript.js

@@ -1,3 +1,4 @@
+import { fencedCodeRanges } from './util/markdown-context.js';
 /**
  * @module transcript
  *
@@ -152,12 +153,7 @@ export function sanitizePriorAssistantTurn({ content }, { persistedArtifactFiles
     // Strip ```json (or plain ```) fenced blocks whose body matches the form
     // schema shape — `"questions": [` is the strongest tell. A generic JSON
     // snippet without that key is left intact.
-    sanitized = sanitized.replace(/```(?:json)?\s*\n([\s\S]*?)\n```/g, (match, body) => {
-        if (/"questions"\s*:\s*\[/.test(body)) {
-            return '[form schema was echoed here on a prior turn; stripped to avoid a loop.]';
-        }
-        return match;
-    });
+    sanitized = stripEchoedFormFences({ content: sanitized });
     // Replace prior-turn `<artifact>` HTML with a one-line summary for
     // artifacts CONFIRMED persisted (see summarizeArtifactsForTranscript's own
     // doc for why an unconfirmed save is left verbatim).
@@ -192,4 +188,15 @@ export function buildTranscript({ history }, options = {}) {
     const warning = buildPriorRunContextWarning(scopedHistory, largeToolResultChars, highInputTokenWarningThreshold);
     return warning ? `${warning}\n\n${transcript}` : transcript;
 }
+function stripEchoedFormFences({ content }) {
+    const chunks = [];
+    let copied = 0;
+    for (const range of fencedCodeRanges({ content, opener: /```(?:json)?/g })) {
+        if (!/"questions"\s*:\s*\[/.test(range.body))
+            continue;
+        chunks.push(content.slice(copied, range.start), '[form schema was echoed here on a prior turn; stripped to avoid a loop.]');
+        copied = range.end;
+    }
+    return chunks.join('') + content.slice(copied);
+}
 //# sourceMappingURL=transcript.js.map

package/dist/core/turn-usage.js

@@ -32,6 +32,9 @@ export function replySegments({ events }, _optional = {}) {
             started = false;
             continue;
         }
+        // Repeated delivery receipts are bookkeeping, never content of the reply they already split.
+        if (isReplyBoundary({ event }))
+            continue;
         const lateResult = event.kind === 'usage' && !started && segments.length > 1;
         started ||= producesReplyOutput({ event });
         segments[segments.length - (lateResult ? 2 : 1)].push(event);
@@ -52,8 +55,10 @@ function usageCost({ event, agentId, sessions }, _optional = {}) {
     const key = JSON.stringify([agentId, sessionId]);
     const chargedUsd = sessions.get(key)?.chargedUsd ?? 0;
     const cumulative = validCost(event.cumulativeCostUsd);
-    const cost = cumulative === undefined ? validCost(event.costUsd)
-        : cumulative < chargedUsd ? cumulative : cumulative - chargedUsd;
+    let snapshotCost;
+    if (cumulative !== undefined)
+        snapshotCost = cumulative < chargedUsd ? cumulative : cumulative - chargedUsd;
+    const cost = cumulative === undefined ? validCost(event.costUsd) : snapshotCost;
     // Interim interrupted-segment charges are already paid; later snapshots subtract them.
     // After a counter reset the new snapshot, rather than the old epoch's total, is the baseline.
     sessions.set(key, { sessionId, chargedUsd: cumulative ?? chargedUsd + (cost ?? 0) });

package/dist/core/user-text-redaction.d.ts

@@ -1,8 +1,5 @@
-import type { ChatMessage } from './messages.js';
-export interface SecretRedactionSignal {
-    readonly secretRedacted: true;
-    readonly count: number;
-}
+import type { ChatMessage, SecretRedactionSignal } from './messages.js';
+export type { SecretRedactionSignal } from './messages.js';
 export interface UserTextRedaction {
     readonly text: string;
     readonly secretRedacted: boolean;
@@ -22,7 +19,8 @@ export interface UserTextRedactionOptions {
 export declare const SECRET_REDACTED_NOTICE = "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.";
 export declare const CREDENTIAL_CARD_GUIDANCE = "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.";
 /** Stricter than error redaction: also detects unlabelled long tokens, while retaining ordinary URLs,
- * hexadecimal hashes, identifiers and prose. Strong credential syntax inside a URL is still caught. */
+ * filesystem paths, hexadecimal hashes, identifiers and prose. Strong credential syntax inside
+ * URLs or paths is still caught. */
 export declare function redactUserText({ text }: {
     readonly text: string;
 }, { secretField }?: {

package/dist/core/user-text-redaction.js

@@ -10,9 +10,9 @@ const CHAT_RULES = [
     // Kept on top of the shared Slack rule: that rule refuses a token preceded by `-` (e.g. a URL path
     // segment `/-xoxb-…`) and the entropy fallback below exempts URLs, so without this rule such a token
     // would reach storage and model history. Only drop it once the shared rule covers that case.
-    { kind: 'chat_key', pattern: /(?<![A-Za-z0-9_])xox[baprs]-[A-Za-z0-9-]{16,}/g, replacement: () => INTERNAL_REMOVED },
+    { kind: 'chat_key', pattern: /(?<!\w)xox[baprs]-[A-Za-z0-9-]{16,}/g, replacement: () => INTERNAL_REMOVED },
     // Explicit authorization syntax catches even short values. Exempt scheme descriptions in prose.
-    { kind: 'chat_bearer', pattern: /\bBearer[ \t]+(?!\[REDACTED)(?!(?:token|tokens|authentication|authorization|auth|scheme|credentials?)\b)[A-Za-z0-9._~+\/=-]+/gi, replacement: () => 'Bearer ' + INTERNAL_REMOVED },
+    { kind: 'chat_bearer', pattern: /\bBearer[ \t]+(?!\[REDACTED)(?!(?:token|tokens|authentication|authorization|auth|scheme|credentials?)\b)[\w.~+\/=-]+/gi, replacement: () => 'Bearer ' + INTERNAL_REMOVED },
 ];
 function entropy(text) {
     const counts = new Map();
@@ -26,7 +26,8 @@ function entropy(text) {
     return bits;
 }
 /** Stricter than error redaction: also detects unlabelled long tokens, while retaining ordinary URLs,
- * hexadecimal hashes, identifiers and prose. Strong credential syntax inside a URL is still caught. */
+ * filesystem paths, hexadecimal hashes, identifiers and prose. Strong credential syntax inside
+ * URLs or paths is still caught. */
 export function redactUserText({ text }, { secretField = false } = {}) {
     // Existing removal markers must survive a second pass through assignment rules (api_key=…).
     const literalMarkers = new Map();
@@ -40,16 +41,22 @@ export function redactUserText({ text }, { secretField = false } = {}) {
     }).replaceAll(REMOVED, INTERNAL_REMOVED);
     const base = redactSecretShapes({ text: protectedText, policy: { additionalRules: CHAT_RULES } });
     let count = base.redactions;
-    const urls = [...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+/gi)]
+    // Exempt locations only AFTER specific secret rules. Only quoted paths may contain whitespace;
+    // unquoted paths end there so an adjacent slash-bearing secret cannot inherit the exemption.
+    // A quoted path ends at its first matching quote, which must sit on a word boundary, so an
+    // apostrophe later in the line ("don't") cannot close an unterminated quote and exempt the gap.
+    // Require a root boundary so a slash inside an opaque token cannot exempt that token, and a
+    // folder after the root so a bare "/" + token is not mistaken for a path.
+    const locations = [...base.text.matchAll(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+|(?<!\w)(["'`])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\r\n"'`\\/]+[\\/](?:(?!\1)[^\r\n])*\1(?!\w)|(?<![\w+\/=\\~.-])(?:~\/|[a-z]:[\\/]|\\\\|\/)[^\s<>"'`\\/]+[\\/][^\s<>"'`]*/gi)]
         .map(match => ({ start: match.index, end: match.index + match[0].length }));
     let cleaned = base.text.replace(/(?<![A-Za-z0-9_+\/=-])[A-Za-z0-9_+\/=-]{40,}(?![A-Za-z0-9_+\/=-])/g, (candidate, offset) => {
-        if (urls.some(url => offset >= url.start && offset < url.end))
+        if (locations.some(location => offset >= location.start && offset < location.end))
             return candidate;
         if (/^[a-f0-9]+$/i.test(candidate) || !/[A-Za-z]/.test(candidate))
             return candidate;
         const bits = entropy(candidate);
         const mixedAlphabet = /[A-Z]/.test(candidate) && /[a-z]/.test(candidate);
-        if (bits < 4 || (!/[0-9]/.test(candidate) && (!mixedAlphabet || bits < 4.5)))
+        if (bits < 4 || (!/\d/.test(candidate) && (!mixedAlphabet || bits < 4.5)))
             return candidate;
         count += 1;
         return INTERNAL_REMOVED;

package/dist/core/util/manifest.js

@@ -1,19 +1,21 @@
+const CODE_SNIPPET = 'code-snippet';
+const REACT_COMPONENT = 'react-component';
 const MANIFEST_VERSION = 1;
 const ALLOWED_KINDS = new Set([
     'html',
     'deck',
-    'react-component',
+    REACT_COMPONENT,
     'markdown-document',
     'svg',
     'diagram',
-    'code-snippet',
+    CODE_SNIPPET,
     'mini-app',
     'design-system',
 ]);
 const ALLOWED_RENDERERS = new Set([
     'html',
     'deck-html',
-    'react-component',
+    REACT_COMPONENT,
     'markdown',
     'svg',
     'diagram',
@@ -32,20 +34,20 @@ const LEGACY_KIND_BY_EXT = new Map([
     ['.htm', 'html'],
     ['.svg', 'svg'],
     ['.md', 'markdown-document'],
-    ['.jsx', 'react-component'],
-    ['.tsx', 'react-component'],
-    ['.js', 'code-snippet'],
-    ['.ts', 'code-snippet'],
-    ['.json', 'code-snippet'],
-    ['.css', 'code-snippet'],
+    ['.jsx', REACT_COMPONENT],
+    ['.tsx', REACT_COMPONENT],
+    ['.js', CODE_SNIPPET],
+    ['.ts', CODE_SNIPPET],
+    ['.json', CODE_SNIPPET],
+    ['.css', CODE_SNIPPET],
 ]);
 /** Renderer and export set for every kind `inferLegacyManifest` can resolve to (the inferred kinds plus the deck-name heuristic's `deck`). */
 const LEGACY_KIND_INFO = {
     html: { renderer: 'html', exports: ['html', 'pdf', 'zip'] },
     deck: { renderer: 'deck-html', exports: ['html', 'pdf', 'zip'] },
     'markdown-document': { renderer: 'markdown', exports: ['md', 'html', 'pdf', 'zip'] },
-    'react-component': { renderer: 'react-component', exports: ['jsx', 'html', 'zip'] },
-    'code-snippet': { renderer: 'code', exports: ['txt', 'zip'] },
+    [REACT_COMPONENT]: { renderer: REACT_COMPONENT, exports: ['jsx', 'html', 'zip'] },
+    [CODE_SNIPPET]: { renderer: 'code', exports: ['txt', 'zip'] },
     svg: { renderer: 'svg', exports: ['svg', 'zip'] }, // 'svg' is a valid ArtifactRendererId as-is
 };
 /** The manifest sidecar file name convention for a given artifact entry file name. */

package/dist/core/util/markdown-context.d.ts

@@ -52,4 +52,18 @@ export declare function rangeContains({ ranges, p }: {
     ranges: ReadonlyArray<Range>;
     p: number;
 }): boolean;
+export interface FencedCodeRange {
+    start: number;
+    end: number;
+    body: string;
+}
+/** Permissive model-output fences used for recovery/transcript cleanup, independent of the
+ * renderer's line-anchored fence grammar above. Opening whitespace is greedy through its last
+ * newline; an empty block may require giving that last newline back to the closing delimiter.
+ * Each opener and closing delimiter is scanned directly instead of backtracking across the body.
+ */
+export declare function fencedCodeRanges({ content, opener }: {
+    content: string;
+    opener: RegExp;
+}, _options?: {}): Generator<FencedCodeRange>;
 //# sourceMappingURL=markdown-context.d.ts.map

package/dist/core/util/markdown-context.js

@@ -98,19 +98,21 @@ function visitLineOutsideFence(scan, line) {
     if (line.hasNewline && FENCE_OPEN_RE.test(line.text)) {
         closeBlockBefore(scan, line.start);
         scan.fenceStart = line.start;
+        return;
     }
-    else if (line.text.trim() === '') {
+    if (line.text.trim() === '') {
         closeBlockBefore(scan, line.start);
+        return;
     }
-    else if (HEADING_RE.test(line.text) || UL_ITEM_RE.test(line.text) || OL_ITEM_RE.test(line.text)) {
+    if (HEADING_RE.test(line.text) || UL_ITEM_RE.test(line.text) || OL_ITEM_RE.test(line.text)) {
         // Each heading/list-item line is its own inline-scan region rather
         // than joining adjacent paragraphs.
         closeBlockBefore(scan, line.start);
         scan.blockRegions.push([line.start, line.end]);
+        return;
     }
-    else if (scan.blockStart === -1) {
+    if (scan.blockStart === -1)
         scan.blockStart = line.start;
-    }
 }
 /** `true` when position `p` falls inside one of `ranges` (half-open intervals). */
 export function rangeContains({ ranges, p }) {
@@ -120,4 +122,40 @@ export function rangeContains({ ranges, p }) {
     }
     return false;
 }
+/** Permissive model-output fences used for recovery/transcript cleanup, independent of the
+ * renderer's line-anchored fence grammar above. Opening whitespace is greedy through its last
+ * newline; an empty block may require giving that last newline back to the closing delimiter.
+ * Each opener and closing delimiter is scanned directly instead of backtracking across the body.
+ */
+export function* fencedCodeRanges({ content, opener }, _options = {}) {
+    const openings = new RegExp(opener.source, 'g');
+    let opening = openings.exec(content);
+    while (opening !== null) {
+        const body = fencedBodyRange({ content, after: opening.index + opening[0].length });
+        if (body === null)
+            return; // No later closing fence exists for any subsequent opener either.
+        if (body !== undefined) {
+            yield { start: opening.index, end: body.end, body: content.slice(body.start, body.end - 4) };
+            openings.lastIndex = body.end;
+        }
+        opening = openings.exec(content);
+    }
+}
+/** Undefined is an invalid opener; null is a valid opener with no possible closing fence. */
+function fencedBodyRange({ content, after }) {
+    let whitespaceEnd = after;
+    while (whitespaceEnd < content.length && /\s/.test(content.charAt(whitespaceEnd)))
+        whitespaceEnd += 1;
+    const newlineOffset = content.slice(after, whitespaceEnd).indexOf('\n');
+    if (newlineOffset === -1)
+        return undefined;
+    const firstNewline = after + newlineOffset;
+    const lastNewline = content.lastIndexOf('\n', whitespaceEnd - 1);
+    const close = content.indexOf('\n```', lastNewline + 1);
+    if (close !== -1)
+        return { start: lastNewline + 1, end: close + 4 };
+    if (lastNewline === firstNewline || !content.startsWith('\n```', lastNewline))
+        return null;
+    return { start: content.lastIndexOf('\n', lastNewline - 1) + 1, end: lastNewline + 4 };
+}
 //# sourceMappingURL=markdown-context.js.map

package/dist/core/util/markup-attributes.js

@@ -17,7 +17,7 @@
  * string (the content between the tag name and the closing `>`).
  */
 export function parseQuotedAttrs({ raw }) {
-    const re = /(\w+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+    const re = /(?<!\w)(\w+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
     const out = {};
     let m = re.exec(raw);
     while (m !== null) {

package/dist/core/util/parser.js

@@ -86,13 +86,12 @@ function findTagEnd({ buffer, from }) {
         if (quote !== null) {
             if (c === quote)
                 quote = null;
+            continue;
         }
-        else if (c === '"' || c === "'") {
-            quote = c;
-        }
-        else if (c === '>') {
+        if (c === '>')
             return j;
-        }
+        if (c === '"' || c === "'")
+            quote = c;
     }
     return -1;
 }
@@ -198,7 +197,8 @@ export function createArtifactParser(_requiredArgs) {
         return true;
     }
     function* flush(_requiredArgs) {
-        if (state.inside) {
+        const wasInside = state.inside;
+        if (wasInside) {
             if (state.buffer.length > 0) {
                 state.content += state.buffer;
                 yield { type: 'artifact:chunk', identifier: state.identifier, delta: state.buffer };
@@ -206,7 +206,7 @@ export function createArtifactParser(_requiredArgs) {
             }
             yield { type: 'artifact:end', identifier: state.identifier, fullContent: state.content };
         }
-        else if (state.buffer.length > 0) {
+        if (!wasInside && state.buffer.length > 0) {
             yield { type: 'text', delta: state.buffer };
         }
         state.buffer = '';

package/dist/core/util/pointer.js

@@ -1,7 +1,24 @@
+import { trimChars } from '@jini-ai/core/primitives';
 const MAX_POINTER_TEXT_BYTES = 100;
-const POINTER_TARGET_RE = /^(?:见|see)(?:\s*[:：]\s*|\s+)[`"'“”‘’]?(.+?\.html?)[`"'“”‘’]?[.。]?$/iu;
+// Matching only runs after the 100-byte visible-text guard; bound each run to that same ceiling.
+const POINTER_TARGET_RE = /^(?:见|see)(?:\s{0,100}[:：]\s{0,100}|\s{1,100})[`"'“”‘’]?(.{1,100}?\.html?)[`"'“”‘’]?[.。]?$/iu;
 const SCRIPT_OR_STYLE_RE = /<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi;
-const HTML_TAG_RE = /<[^>]+>/g;
+function stripPointerTags(content) {
+    const chunks = [];
+    let copied = 0;
+    let open = content.indexOf('<');
+    while (open !== -1) {
+        const close = content.indexOf('>', open + 1);
+        if (close === -1)
+            break;
+        if (close > open + 1) {
+            chunks.push(content.slice(copied, open), ' ');
+            copied = close + 1;
+        }
+        open = content.indexOf('<', close + 1);
+    }
+    return chunks.join('') + content.slice(copied);
+}
 /**
  * Resolve a short "see foo.html"-style reply to the referenced file name, if
  * `content` is (after stripping tags) nothing but such a pointer and the
@@ -40,12 +57,11 @@ function resolveAgainstProjectFiles({ target, candidateFileName, projectFiles })
 function visiblePointerText(content) {
     const stripped = content
         .replace(/^/, '')
-        .replace(SCRIPT_OR_STYLE_RE, ' ')
-        .replace(HTML_TAG_RE, ' ');
-    return decodeBasicHtmlEntities(stripped).replace(/\s+/g, ' ').trim();
+        .replace(SCRIPT_OR_STYLE_RE, ' ');
+    return decodeBasicHtmlEntities(stripPointerTags(stripped)).replace(/\s+/g, ' ').trim();
 }
 function normalizeTarget(value) {
-    return value.trim().replace(/^[`"'“”‘’]+|[`"'“”‘’]+$/g, '');
+    return trimChars({ text: value.trim(), chars: "`\"'“”‘’" });
 }
 function isSafeHtmlTarget(value) {
     if (!/\.(?:html?|HTML?)$/.test(value))