npm - @kernelonpanic/kitcode - Versions diffs - 1.2.0 → 1.2.4 - Mend

@kernelonpanic/kitcode 1.2.0 → 1.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.js CHANGED Viewed

@@ -69,9 +69,6 @@ var diagnosticsSchema = z.object({
   autoRun: z.boolean().default(true),
   commands: z.array(z.string().trim().min(1).max(2e4)).max(8).default([])
 });
-var updatesSchema = z.object({
-  checkOnStart: z.boolean().default(true)
-});
 var configSchema = z.object({
   version: z.literal(1).default(1),
   model: z.string().optional(),
@@ -86,7 +83,6 @@ var configSchema = z.object({
     maxSubagentsPerTurn: 3
   }),
   diagnostics: diagnosticsSchema.default({ autoRun: true, commands: [] }),
-  updates: updatesSchema.default({ checkOnStart: false }),
   providers: z.record(providerIdSchema, providerConfigSchema).default({}),
   permissions: z.record(safeRecordKeySchema, permissionModeSchema).default({}),
   mcp: z.record(safeRecordKeySchema, mcpServerSchema).default({})
@@ -153,19 +149,19 @@ var CONNECTION_REASONS = {
   DEPTH_ZERO_SELF_SIGNED_CERT: "the TLS certificate is self-signed",
   UNABLE_TO_VERIFY_LEAF_SIGNATURE: "the TLS certificate chain cannot be verified"
 };
-function describeProviderFailure(error, providerId) {
+function describeProviderFailure(error, providerId, knownSecrets = []) {
   const abort = abortKind(error);
   if (abort === "user") return `Request to "${providerId}" was cancelled.`;
   if (abort === "timeout") {
     return `Request to "${providerId}" ran out of time before the provider answered \u2014 it may be overloaded, try again.`;
   }
   const status = statusOf(error);
-  if (status !== void 0) return describeStatus(status, providerId, error);
-  const reason = connectionReason(error);
+  if (status !== void 0) return describeStatus(status, providerId, error, knownSecrets);
+  const reason = connectionReason(error, knownSecrets);
   if (reason) {
     return `Cannot reach "${providerId}": ${reason}. Check the base URL and your network.`;
   }
-  return `Request to "${providerId}" failed \u2014 ${snippet(messageOf(error))}`;
+  return `Request to "${providerId}" failed \u2014 ${snippet(messageOf(error), 160, knownSecrets)}`;
 }
 function statusOf(error) {
   const value = prop(error, "status") ?? prop(error, "statusCode");
@@ -177,8 +173,8 @@ function isUserAbort(error, signal) {
 function isConnectionFailure(error) {
   return connectionReason(error) !== void 0;
 }
-function toProviderError(error, providerId) {
-  return new ProviderError(describeProviderFailure(error, providerId), providerId, statusOf(error), {
+function toProviderError(error, providerId, knownSecrets = []) {
+  return new ProviderError(describeProviderFailure(error, providerId, knownSecrets), providerId, statusOf(error), {
     cause: error
   });
 }
@@ -226,8 +222,8 @@ async function readHead(stream) {
   }
   return text;
 }
-async function invalidStreamError(providerId, capture, cause) {
-  const excerpt = snippet(await capture.head(), EXCERPT_CHARS);
+async function invalidStreamError(providerId, capture, cause, knownSecrets = []) {
+  const excerpt = snippet(await capture.head(), EXCERPT_CHARS, knownSecrets);
   const detail = excerpt === "" ? "the body was empty" : `the body began: ${excerpt}`;
   return new ProviderError(
     `"${providerId}" returned a response that is not a valid streaming chat completion \u2014 no stream events arrived and ${detail}. The endpoint may speak a different protocol than the one configured for it.`,
@@ -236,8 +232,8 @@ async function invalidStreamError(providerId, capture, cause) {
     cause === void 0 ? void 0 : { cause }
   );
 }
-function describeStatus(status, providerId, error) {
-  const detail = detailOf(error, status);
+function describeStatus(status, providerId, error, knownSecrets) {
+  const detail = detailOf(error, status, knownSecrets);
   const wait = retryAfterSeconds(error);
   const after = wait === void 0 ? void 0 : `retry after ${wait}s`;
   if (status === 401) {
@@ -272,7 +268,7 @@ function abortKind(error) {
   if (name === "AbortError") return "user";
   return void 0;
 }
-function connectionReason(error) {
+function connectionReason(error, knownSecrets = []) {
   const links = chain(error);
   for (const link of links) {
     for (const candidate of [link, ...siblings(link)]) {
@@ -282,9 +278,11 @@ function connectionReason(error) {
     }
   }
   const deepest = links[links.length - 1];
-  if (links.length > 1 && deepest instanceof Error) return snippet(deepest.message);
+  if (links.length > 1 && deepest instanceof Error) {
+    return snippet(deepest.message, 160, knownSecrets);
+  }
   const message = messageOf(error);
-  return /fetch failed|connection error|socket|network/i.test(message) ? snippet(message) : void 0;
+  return /fetch failed|connection error|socket|network/i.test(message) ? snippet(message, 160, knownSecrets) : void 0;
 }
 function chain(error) {
   const links = [];
@@ -317,9 +315,9 @@ function header(error, name) {
   const value = headers[name];
   return typeof value === "string" ? value : void 0;
 }
-function detailOf(error, status) {
+function detailOf(error, status, knownSecrets) {
   const raw = bodyMessage(error) ?? messageOf(error).replace(new RegExp(`^${status}\\s+`), "");
-  const text = snippet(raw);
+  const text = snippet(raw, 160, knownSecrets);
   if (text === "" || text === String(status) || text === "status code (no body)") return "";
   return ` \u2014 ${text}`;
 }
@@ -336,8 +334,8 @@ function messageOf(error) {
   if (error === null || error === void 0) return "unknown error";
   return String(error);
 }
-function snippet(text, limit = 160) {
-  return redactSecrets(oneLine(text)).slice(0, limit);
+function snippet(text, limit = 160, knownSecrets = []) {
+  return redactSecrets(oneLine(text), knownSecrets).slice(0, limit);
 }
 function oneLine(text) {
   return text.replace(/\s+/g, " ").trim();
@@ -454,7 +452,7 @@ async function detectProvider(rawUrl, apiKey2, opts = {}) {
     }
     if (!attempt.ok && attempt.status !== 404 && attempt.status !== 0) break;
   }
-  throw new Error(describeFailure(last));
+  throw new Error(describeFailure(last, apiKey2));
 }
 function normaliseBaseUrl(rawUrl) {
   return rawUrl.trim().replace(/\/+$/, "");
@@ -591,9 +589,9 @@ function stringList(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((item) => typeof item === "string");
 }
-function describeFailure(attempt) {
+function describeFailure(attempt, apiKey2) {
   const status = attempt.status === 0 ? "request failed" : `HTTP ${attempt.status}`;
-  const snippet2 = redactSecrets(attempt.text.trim()).slice(0, 200);
+  const snippet2 = redactSecrets(attempt.text.trim(), [apiKey2]).slice(0, 200);
   const detail = snippet2 === "" ? "" : `: ${snippet2}`;
   return `No OpenAI- or Anthropic-compatible API found at ${attempt.url} (${status})${detail}`;
 }
@@ -757,9 +755,16 @@ async function configLocation() {
   active ??= await resolveConfigLocation();
   return active;
 }
+async function loadConfig(cwd) {
+  const location = await resolveConfigLocation(cwd);
+  return loadConfigAt(location);
+}
 async function loadProjectConfig(dir) {
   return loadConfigAt({ path: projectConfigPath(dir), scope: "project" });
 }
+async function loadGlobalConfig() {
+  return loadConfigAt({ path: configPath, scope: "global" });
+}
 async function loadRuntimeConfig(cwd) {
   const location = await resolveConfigLocation(cwd);
   if (location.scope === "project" && !await isWorkspaceTrusted(cwd)) {
@@ -886,7 +891,7 @@ async function addProvider(url, key, options = {}) {
     await initProjectConfig(cwd);
     await trustWorkspace(cwd);
   }
-  const config = options.local ? await loadProjectConfig(cwd) : (await loadRuntimeConfig(cwd)).config;
+  const config = options.local ? await loadProjectConfig(cwd) : process.env.KITCODE_CONFIG ? await loadConfig(cwd) : await loadGlobalConfig();
   const auth = await loadAuth();
   const configBefore = structuredClone(config);
   const authBefore = { ...auth };
@@ -1299,12 +1304,12 @@ function exportFileName(state) {
 }
 function renderSessionMarkdown(state) {
   const lines = [
-    `# ${state.title || `KitCode session ${shortSessionId(state.id)}`}`,
+    `# ${escapeMarkdownInline(state.title || `KitCode session ${shortSessionId(state.id)}`)}`,
     "",
-    `- Session: ${state.id}`,
-    `- Workspace: ${state.cwd}`,
-    `- Model: ${state.model || "unknown"}`,
-    `- Updated: ${state.updatedAt}`,
+    `- Session: ${escapeMarkdownInline(state.id)}`,
+    `- Workspace: ${escapeMarkdownInline(state.cwd)}`,
+    `- Model: ${escapeMarkdownInline(state.model || "unknown")}`,
+    `- Updated: ${escapeMarkdownInline(state.updatedAt)}`,
     ""
   ];
   for (const message of state.messages) {
@@ -1319,18 +1324,41 @@ function renderMessage(content) {
   const sections = [];
   for (const block of content) {
     if (block.type === "text") sections.push(block.text);
-    else if (block.type === "image") sections.push(`[Image attached: ${block.name}]`);
-    else if (block.type === "file") sections.push(`[File attached: ${block.name}]
+    else if (block.type === "image") {
+      sections.push(`[Image attached: ${escapeMarkdownInline(block.name)}]`);
+    } else if (block.type === "file") {
+      sections.push(
+        `[File attached: ${escapeMarkdownInline(block.name)}]
-${block.text}`);
-    else if (block.type === "tool_use") sections.push(`> Tool: ${block.name}`);
-    else if (block.type === "tool_result") {
+${markdownCodeFence(block.text)}`
+      );
+    } else if (block.type === "tool_use") {
+      sections.push(`> Tool: ${escapeMarkdownInline(block.name)}`);
+    } else if (block.type === "tool_result") {
+      const result = block.content.replace(/\r\n?/g, "\n").split("\n").map((line) => `> ${line}`).join("\n");
       sections.push(`> Tool result${block.isError ? " (error)" : ""}:
-> ${block.content.replace(/\n/g, "\n> ")}`);
+${result}`);
     }
   }
   return sections.join("\n\n").trim();
 }
+function escapeMarkdownInline(value) {
+  return value.replace(/[\r\n\t]+/g, " ").replace(/([\\`*_[\]<>])/g, "\\$1");
+}
+function markdownCodeFence(value) {
+  const normalized = value.replace(/\r\n?/g, "\n");
+  const backtickLength = longestMarkerRun(normalized, /`+/g) + 1;
+  const tildeLength = longestMarkerRun(normalized, /~+/g) + 1;
+  const marker = backtickLength <= tildeLength ? "`" : "~";
+  const fence = marker.repeat(Math.max(3, Math.min(backtickLength, tildeLength)));
+  return `${fence}
+${normalized}${normalized.endsWith("\n") ? "" : "\n"}${fence}`;
+}
+function longestMarkerRun(value, pattern) {
+  let longest = 0;
+  for (const match of value.matchAll(pattern)) longest = Math.max(longest, match[0].length);
+  return longest;
+}
 function readContextUsage(value) {
   if (typeof value !== "object" || value === null) return void 0;
   const candidate = value;
@@ -2509,8 +2537,8 @@ function looksLikeAttachmentPath(value) {
   if (path7.isAbsolute(candidate)) return true;
   if (/^(?:~|\.{1,2})[\\/]/.test(candidate)) return true;
   if (candidate.includes("/") || candidate.includes("\\")) return true;
-  const basename2 = path7.basename(candidate).toLowerCase();
-  return path7.extname(basename2) !== "" || AUTO_PATH_NAMES.has(basename2);
+  const basename3 = path7.basename(candidate).toLowerCase();
+  return path7.extname(basename3) !== "" || AUTO_PATH_NAMES.has(basename3);
 }
 async function loadClipboardImage(platform = process.platform, runner = runClipboardCommand) {
   const commands = clipboardCommands(platform);
@@ -2586,8 +2614,8 @@ function resolveAttachmentPath(cwd, requestedPath) {
   return path7.isAbsolute(expanded) ? path7.normalize(expanded) : path7.resolve(cwd, expanded);
 }
 function isSensitiveAutomaticPath(file) {
-  const basename2 = path7.basename(file).toLowerCase();
-  return basename2.startsWith(".env.") || SENSITIVE_AUTO_NAMES.has(basename2) || SENSITIVE_AUTO_EXTENSIONS.has(path7.extname(basename2));
+  const basename3 = path7.basename(file).toLowerCase();
+  return basename3.startsWith(".env.") || SENSITIVE_AUTO_NAMES.has(basename3) || SENSITIVE_AUTO_EXTENSIONS.has(path7.extname(basename3));
 }
 function attachmentLabel(block) {
   if (block.type === "image") return `image: ${block.name}`;
@@ -3424,7 +3452,7 @@ function clip(value) {
 // package.json
 var package_default = {
   name: "@kernelonpanic/kitcode",
-  version: "1.2.0",
+  version: "1.2.4",
   description: "Terminal coding agent with a config you never have to write by hand",
   type: "module",
   license: "MIT",
@@ -3465,6 +3493,7 @@ var package_default = {
     "ink-text-input": "^6.0.0",
     openai: "^7.3.0",
     react: "^19.2.8",
+    "string-width": "^8.2.2",
     zod: "^4.4.3"
   },
   devDependencies: {
@@ -3491,8 +3520,7 @@ var package_default = {
 // src/version.ts
 var KITCODE_VERSION = package_default.version;
-var KITCODE_REPOSITORY = "KernelEditor/KitCode";
-var KITCODE_COMMIT = true ? "c93b03ff85112af7b4c28f543aff6b9377f84ad6" : "development";
+var KITCODE_COMMIT = true ? "84441dfba8c67477cf72b76552e72ffedc8d41a8" : "development";
 // src/mcp/client.ts
 var clientInfo = { name: "kitcode", version: KITCODE_VERSION };
@@ -3633,9 +3661,9 @@ function createMcpManager(servers) {
       serverStates.delete(name);
     },
     async close() {
-      const open2 = [...sessions.values()];
+      const open3 = [...sessions.values()];
       sessions.clear();
-      await Promise.all(open2.map((session) => session.client.close().catch(() => {
+      await Promise.all(open3.map((session) => session.client.close().catch(() => {
       })));
     },
     states() {
@@ -4071,12 +4099,12 @@ function createAnthropicProvider(args) {
   return {
     id: args.id,
     kind: "anthropic",
-    stream: (req) => streamTurn(client, args.id, req),
-    listModels: () => listModels(client, args.id),
+    stream: (req) => streamTurn(client, args.id, args.apiKey, req),
+    listModels: () => listModels(client, args.id, args.apiKey),
     knownModels: () => KNOWN_MODELS
   };
 }
-async function* streamTurn(client, providerId, req) {
+async function* streamTurn(client, providerId, apiKey2, req) {
   const params = {
     model: req.model,
     max_tokens: req.maxTokens,
@@ -4117,9 +4145,9 @@ async function* streamTurn(client, providerId, req) {
     const limits2 = parseRateLimits(capture.headers());
     if (limits2) yield { type: "rate_limits", limits: limits2 };
     if (events === 0 && capture.succeeded() && !isConnectionFailure(error)) {
-      throw await invalidStreamError(providerId, capture, error);
+      throw await invalidStreamError(providerId, capture, error, [apiKey2]);
     }
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
   const stopReason = STOP_REASONS[final.stop_reason ?? ""] ?? "end_turn";
   const content = toContentBlocks(final.content);
@@ -4138,7 +4166,7 @@ async function* streamTurn(client, providerId, req) {
     ...stopReason === "refusal" ? { refusal: toRefusal(final.stop_details) } : {}
   };
 }
-async function listModels(client, providerId) {
+async function listModels(client, providerId, apiKey2) {
   try {
     const models = [];
     for await (const model of client.models.list({ limit: 100 })) {
@@ -4152,7 +4180,7 @@ async function listModels(client, providerId) {
     }
     return models;
   } catch (error) {
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
 }
 function toMessageParams(messages) {
@@ -4256,12 +4284,12 @@ function createOpenAiProvider(args) {
   return {
     id: args.id,
     kind: "openai",
-    stream: (req) => streamTurn2(client, args.id, req),
-    listModels: () => listModels2(client, args.id),
+    stream: (req) => streamTurn2(client, args.id, args.apiKey, req),
+    listModels: () => listModels2(client, args.id, args.apiKey),
     knownModels: () => []
   };
 }
-async function* streamTurn2(client, providerId, req) {
+async function* streamTurn2(client, providerId, apiKey2, req) {
   let text = "";
   let thinking = "";
   let finishReason = null;
@@ -4309,19 +4337,20 @@ async function* streamTurn2(client, providerId, req) {
     if (!isUserAbort(error, req.signal)) {
       const limits2 = parseRateLimits(capture.headers());
       if (limits2) yield { type: "rate_limits", limits: limits2 };
-      throw toProviderError(error, providerId);
+      throw toProviderError(error, providerId, [apiKey2]);
     }
     aborted = true;
   }
-  const content = toContentBlocks2(thinking, text, calls);
   if (aborted || req.signal?.aborted) {
+    const content2 = toTextContentBlocks(thinking, text);
     if (sawUsage) yield { type: "usage", usage };
     const limits2 = parseRateLimits(capture.headers());
     if (limits2) yield { type: "rate_limits", limits: limits2 };
-    yield { type: "done", stopReason: "aborted", content };
+    yield { type: "done", stopReason: "aborted", content: content2 };
     return;
   }
-  if (recognised === 0) throw await invalidStreamError(providerId, capture);
+  if (recognised === 0) throw await invalidStreamError(providerId, capture, void 0, [apiKey2]);
+  const content = toContentBlocks2(providerId, thinking, text, calls);
   for (const block of content) {
     if (block.type === "tool_use") {
       yield { type: "tool_call", id: block.id, name: block.name, input: block.input };
@@ -4338,7 +4367,7 @@ function resolveStop(finishReason, hasCalls) {
   if (hasCalls) return "tool_use";
   return mapped ?? "end_turn";
 }
-async function listModels2(client, providerId) {
+async function listModels2(client, providerId, apiKey2) {
   try {
     const models = [];
     for await (const model of client.models.list()) {
@@ -4347,7 +4376,7 @@ async function listModels2(client, providerId) {
     }
     return models;
   } catch (error) {
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
 }
 function accumulate(calls, delta) {
@@ -4357,10 +4386,8 @@ function accumulate(calls, delta) {
   if (delta.function?.arguments) call.args += delta.function.arguments;
   calls.set(delta.index, call);
 }
-function toContentBlocks2(thinking, text, calls) {
-  const content = [];
-  if (thinking) content.push({ type: "thinking", text: thinking });
-  if (text) content.push({ type: "text", text });
+function toContentBlocks2(providerId, thinking, text, calls) {
+  const content = toTextContentBlocks(thinking, text);
   const sorted = [...calls.entries()].sort((a, b) => a[0] - b[0]);
   const tmpId = (position) => `call_${position}`;
   for (const [position, [, call]] of sorted.entries()) {
@@ -4368,18 +4395,34 @@ function toContentBlocks2(thinking, text, calls) {
       type: "tool_use",
       id: call.id || tmpId(position),
       name: call.name,
-      input: parseArguments(call.args)
+      input: parseArguments(providerId, call.name, call.args)
     });
   }
   return content;
 }
-function parseArguments(args) {
-  if (!args) return {};
+function toTextContentBlocks(thinking, text) {
+  const content = [];
+  if (thinking) content.push({ type: "thinking", text: thinking });
+  if (text) content.push({ type: "text", text });
+  return content;
+}
+function parseArguments(providerId, toolName, args) {
+  let parsed;
   try {
-    return JSON.parse(args);
+    parsed = JSON.parse(args);
   } catch {
-    return {};
+    throw new ProviderError(
+      `Tool "${toolName || "unknown"}" returned malformed JSON arguments; the tool was not run.`,
+      providerId
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ProviderError(
+      `Tool "${toolName || "unknown"}" arguments must be a JSON object; the tool was not run.`,
+      providerId
+    );
   }
+  return parsed;
 }
 function toChatMessages(system, messages) {
   const out = [{ role: "system", content: system }];
@@ -4512,7 +4555,7 @@ function createPermissionEngine(configPermissions) {
     decide(tool, requested) {
       const configured = resolve3(tool, requested);
       if (configured === "deny") return "deny";
-      if (current === "plan" && configured !== "allow") return "deny";
+      if (current === "plan" && tool.readOnly !== true) return "deny";
       if (configured === "allow") return "allow";
       if (bypassEnabled) return "allow";
       if (current === "accept" && isFileEdit(tool)) return "allow";
@@ -4524,8 +4567,9 @@ function createPermissionEngine(configPermissions) {
     },
     denyReason(tool, requested) {
       const configured = resolve3(tool, requested);
+      if (current === "plan" && tool.readOnly !== true) return PLAN_REFUSAL;
       if (configured === "deny" || configured === "allow") return void 0;
-      return current === "plan" ? PLAN_REFUSAL : void 0;
+      return void 0;
     },
     bypass: {
       enable() {
@@ -4555,7 +4599,133 @@ function isFileEdit(tool) {
 }
 // src/tools/edit.ts
-import { lstat as lstat3, readFile as readFile8, stat as stat6, writeFile as writeFile6 } from "fs/promises";
+import { readFile as readFile8, stat as stat6 } from "fs/promises";
+// src/tools/safe-write.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod5, lstat as lstat3, open, rename as rename5, rm as rm3 } from "fs/promises";
+import { basename as basename2, dirname as dirname2, join } from "path";
+var UnsafeFileChangeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsafeFileChangeError";
+  }
+};
+async function readSafeFileSnapshot(file, maxBytes) {
+  const parent = await lstat3(dirname2(file));
+  if (parent.isSymbolicLink() || !parent.isDirectory()) {
+    throw new UnsafeFileChangeError("the parent path is not a real directory");
+  }
+  const parentIdentity = directoryIdentity(parent);
+  const pathInfo = await lstatMaybe(file);
+  if (!pathInfo) return { exists: false, data: null, mode: 438, parent: parentIdentity };
+  if (pathInfo.isSymbolicLink()) {
+    throw new UnsafeFileChangeError("the path is a symbolic link");
+  }
+  if (!pathInfo.isFile()) throw new UnsafeFileChangeError("the path is not a regular file");
+  if (pathInfo.size > maxBytes) throw new UnsafeFileChangeError("the file is too large");
+  const handle = await open(file, "r");
+  try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || !sameObject(pathInfo, opened)) {
+      throw new UnsafeFileChangeError("the file changed while it was being opened");
+    }
+    const data = await readBounded(handle, maxBytes);
+    const afterRead = await handle.stat();
+    if (!sameVersion(opened, afterRead)) {
+      throw new UnsafeFileChangeError("the file changed while it was being read");
+    }
+    return {
+      exists: true,
+      data,
+      mode: opened.mode & 511,
+      identity: fileIdentity(opened),
+      parent: parentIdentity
+    };
+  } finally {
+    await handle.close();
+  }
+}
+async function atomicWriteSafeFile(file, data, snapshot) {
+  const parent = dirname2(file);
+  await assertSameParent(parent, snapshot.parent);
+  const temp = join(parent, `.${basename2(file)}.${process.pid}.${randomUUID3()}.tmp`);
+  let handle;
+  try {
+    handle = await open(temp, "wx", snapshot.mode);
+    await handle.writeFile(data, typeof data === "string" ? { encoding: "utf8" } : void 0);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await chmod5(temp, snapshot.mode);
+    await assertSameParent(parent, snapshot.parent);
+    const current = await lstatMaybe(file);
+    if (!matchesSnapshot2(current, snapshot)) {
+      throw new UnsafeFileChangeError("the destination changed before it could be replaced");
+    }
+    await rename5(temp, file);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    await rm3(temp, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function readBounded(handle, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const remaining = maxBytes + 1 - total;
+    if (remaining <= 0) throw new UnsafeFileChangeError("the file is too large");
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+    if (bytesRead === 0) return Buffer.concat(chunks, total);
+    chunks.push(chunk.subarray(0, bytesRead));
+    total += bytesRead;
+  }
+}
+async function assertSameParent(parent, expected) {
+  const current = await lstat3(parent);
+  if (current.isSymbolicLink() || !current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
+    throw new UnsafeFileChangeError("the parent directory changed during the write");
+  }
+}
+function matchesSnapshot2(current, snapshot) {
+  if (!snapshot.exists) return current === null;
+  return Boolean(
+    current && !current.isSymbolicLink() && current.isFile() && sameIdentity(current, snapshot.identity)
+  );
+}
+function sameObject(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function sameVersion(left, right) {
+  return sameObject(left, right) && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function sameIdentity(info, identity2) {
+  return info.dev === identity2.dev && info.ino === identity2.ino && info.size === identity2.size && info.mtimeMs === identity2.mtimeMs && info.ctimeMs === identity2.ctimeMs;
+}
+function fileIdentity(info) {
+  return {
+    dev: info.dev,
+    ino: info.ino,
+    size: info.size,
+    mtimeMs: info.mtimeMs,
+    ctimeMs: info.ctimeMs
+  };
+}
+function directoryIdentity(info) {
+  return { dev: info.dev, ino: info.ino };
+}
+async function lstatMaybe(file) {
+  try {
+    return await lstat3(file);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+// src/tools/edit.ts
 var MAX_FILE_BYTES2 = 5e6;
 function countOccurrences(haystack, needle) {
   if (needle === "") return 0;
@@ -4611,19 +4781,14 @@ var editTool = {
     const { path: path14, oldString, newString, replaceAll = false } = input;
     const safe = resolveInside(ctx.cwd, path14);
     if (!safe.ok) return { content: safe.reason, isError: true };
-    const linkInfo = await lstat3(safe.path).catch(() => null);
-    if (linkInfo?.isSymbolicLink()) {
-      return { content: `Cannot edit ${path14}: the path is a symbolic link. Remove the symlink first.`, isError: true };
-    }
-    const info = await stat6(safe.path).catch(() => null);
-    if (info && info.size > MAX_FILE_BYTES2) {
-      return {
-        content: `Cannot edit ${path14}: the file exceeds the ${MAX_FILE_BYTES2 / 1e6} MB limit.`,
-        isError: true
-      };
+    let snapshot;
+    try {
+      snapshot = await readSafeFileSnapshot(safe.path, MAX_FILE_BYTES2);
+    } catch (error) {
+      return { content: `Cannot edit ${path14}: ${error.message}.`, isError: true };
     }
-    const beforeBuffer = await readFile8(safe.path).catch(() => null);
-    if (beforeBuffer === null) return { content: `Cannot read ${path14}.`, isError: true };
+    if (!snapshot.exists) return { content: `Cannot read ${path14}.`, isError: true };
+    const beforeBuffer = snapshot.data;
     if (beforeBuffer.subarray(0, 8192).includes(0)) {
       return { content: `Cannot edit ${path14}: it is a binary file, not text.`, isError: true };
     }
@@ -4655,7 +4820,7 @@ var editTool = {
       return { content: `Checkpoint capture failed: ${error.message}`, isError: true };
     }
     try {
-      await writeFile6(safe.path, after, "utf8");
+      await atomicWriteSafeFile(safe.path, after, snapshot);
       ctx.checkpoint?.markChanged(safe.path);
     } catch (error) {
       return { content: `Failed to write ${path14}: ${error.message}`, isError: true };
@@ -4675,7 +4840,7 @@ function replacement(before, oldString, newString, replaceAll) {
 }
 // src/tools/glob.ts
-import { join } from "path";
+import { join as join2 } from "path";
 import fg from "fast-glob";
 var MAX_RESULTS = 500;
 var IGNORED_DIRECTORIES = ["**/node_modules/**", "**/.git/**", "**/dist/**"];
@@ -4692,6 +4857,7 @@ var globTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   summarize(input) {
     return `glob(${brief(input.pattern)})`;
   },
@@ -4713,7 +4879,7 @@ var globTool = {
     });
     if (entries.length === 0) return { content: `No files matched ${pattern}` };
     entries.sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0));
-    const paths = entries.slice(0, MAX_RESULTS).map((entry) => join(safe.relative, entry.path));
+    const paths = entries.slice(0, MAX_RESULTS).map((entry) => join2(safe.relative, entry.path));
     if (entries.length > MAX_RESULTS) {
       paths.push(`... truncated: ${entries.length - MAX_RESULTS} more files matched.`);
     }
@@ -4723,7 +4889,7 @@ var globTool = {
 // src/tools/grep.ts
 import { readFile as readFile9, stat as stat7 } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import fg2 from "fast-glob";
 // src/tools/sensitive.ts
@@ -4872,6 +5038,7 @@ var grepTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   permission(input, ctx) {
     const { path: path14, glob } = input ?? {};
     if (isSensitivePath(path14) || mentionsSensitivePattern(glob)) return "ask";
@@ -4910,8 +5077,8 @@ var grepTool = {
       ignore: IGNORED_DIRECTORIES,
       stats: true
     })).sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0)).map((entry) => ({
-      absolute: join2(safe.path, entry.path),
-      relative: join2(safe.relative, entry.path),
+      absolute: join3(safe.path, entry.path),
+      relative: join3(safe.relative, entry.path),
       size: entry.stats?.size ?? 0
     })) : [{ absolute: safe.path, relative: safe.relative, size: target.size }];
     const files = discovered.slice(0, MAX_FILES);
@@ -4979,6 +5146,7 @@ var readTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   permission(input, ctx) {
     const target = input?.path;
     if (isSensitivePath(target)) return "ask";
@@ -5039,8 +5207,8 @@ function toToolSchema(tool) {
 }
 // src/tools/write.ts
-import { lstat as lstat4, mkdir as mkdir4, readFile as readFile11, stat as stat9, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { mkdir as mkdir4, readFile as readFile11, stat as stat9 } from "fs/promises";
+import { dirname as dirname3 } from "path";
 var MAX_FILE_BYTES5 = 5e6;
 var writeTool = {
   name: "write",
@@ -5090,31 +5258,29 @@ var writeTool = {
     }
     const safe = resolveInside(ctx.cwd, path14);
     if (!safe.ok) return { content: safe.reason, isError: true };
-    const linkInfo = await lstat4(safe.path).catch(() => null);
-    if (linkInfo?.isSymbolicLink()) {
-      return { content: `Cannot write ${path14}: the path is a symbolic link. Remove the symlink first.`, isError: true };
-    }
-    const beforeInfo = await stat9(safe.path).catch(() => null);
-    if (beforeInfo && beforeInfo.size > MAX_FILE_BYTES5) {
-      return {
-        content: `Cannot replace ${path14}: the existing file exceeds the ${MAX_FILE_BYTES5 / 1e6} MB limit.`,
-        isError: true
-      };
-    }
-    const beforeBuffer = await readFile11(safe.path).catch(() => null);
-    if (beforeBuffer instanceof Buffer && beforeBuffer.subarray(0, 8192).includes(0)) {
-      return { content: `Cannot write ${path14}: the existing file is binary, not text.`, isError: true };
-    }
-    let before = "";
-    if (beforeBuffer) before = beforeBuffer.toString("utf8");
+    let target = safe.path;
+    let snapshot;
     try {
-      await mkdir4(dirname2(safe.path), { recursive: true });
-      await ctx.checkpoint?.capture(safe.path);
-      await writeFile7(safe.path, content, "utf8");
-      ctx.checkpoint?.markChanged(safe.path);
+      await mkdir4(dirname3(target), { recursive: true });
+      const rechecked = resolveInside(ctx.cwd, path14);
+      if (!rechecked.ok || rechecked.path !== target) {
+        return {
+          content: `Cannot write ${path14}: the path changed while its parent was created.`,
+          isError: true
+        };
+      }
+      target = rechecked.path;
+      snapshot = await readSafeFileSnapshot(target, MAX_FILE_BYTES5);
+      if (snapshot.exists && snapshot.data.subarray(0, 8192).includes(0)) {
+        return { content: `Cannot write ${path14}: the existing file is binary, not text.`, isError: true };
+      }
+      await ctx.checkpoint?.capture(target);
+      await atomicWriteSafeFile(target, content, snapshot);
+      ctx.checkpoint?.markChanged(target);
     } catch (error) {
       return { content: `Failed to write ${path14}: ${error.message}`, isError: true };
     }
+    const before = snapshot.exists ? snapshot.data.toString("utf8") : "";
     const lines = content === "" ? 0 : content.replace(/\n$/, "").split("\n").length;
     return {
       content: `${before === "" ? "Created" : "Updated"} ${path14} (${lines} ${lines === 1 ? "line" : "lines"})`,
@@ -5147,7 +5313,7 @@ function createToolRegistry(tools) {
 }
 // src/prompts/library.ts
-import { chmod as chmod5, readFile as readFile12, readdir as readdir3, unlink as unlink3, writeFile as writeFile8 } from "fs/promises";
+import { chmod as chmod6, readFile as readFile12, readdir as readdir3, unlink as unlink3, writeFile as writeFile6 } from "fs/promises";
 import path10 from "path";
 async function savePrompt(input) {
   const slug = slugify(input.name);
@@ -5161,11 +5327,11 @@ async function savePrompt(input) {
   };
   await ensureDir(promptsDir);
   const file = path10.join(promptsDir, `${slug}.md`);
-  await writeFile8(file, serialize(prompt), {
+  await writeFile6(file, serialize(prompt), {
     encoding: "utf8",
     mode: 384
   });
-  await chmod5(file, 384);
+  await chmod6(file, 384);
   return prompt;
 }
 async function getPrompt(slug) {
@@ -5252,18 +5418,21 @@ function parse(slug, text) {
 }
 // src/skills/library.ts
-import { open, readFile as readFile13, readdir as readdir4, stat as stat10 } from "fs/promises";
+import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
 import path11 from "path";
 var SKILL_FILE = "SKILL.md";
 var FRONTMATTER_BYTES = 8192;
 var MAX_SKILL_BYTES = 5e6;
 var MAX_SKILLS_PER_ROOT = 500;
+var guards = /* @__PURE__ */ new WeakMap();
 async function discoverSkills(dirs) {
   const byName = /* @__PURE__ */ new Map();
   for (const root of dirs) {
-    const entries = await readdir4(root).catch(() => []);
+    const rootInfo = await lstat4(root).catch(() => null);
+    if (!rootInfo?.isDirectory() || rootInfo.isSymbolicLink()) continue;
+    const entries = await readdir4(root, { withFileTypes: true }).catch(() => []);
     const found = await Promise.all(
-      entries.slice(0, MAX_SKILLS_PER_ROOT).map((entry) => readMeta(path11.join(root, entry)))
+      entries.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).slice(0, MAX_SKILLS_PER_ROOT).map((entry) => readMeta(root, rootInfo, path11.join(root, entry.name)))
     );
     for (const meta of found) {
       if (meta && !byName.has(meta.name)) byName.set(meta.name, meta);
@@ -5272,11 +5441,25 @@ async function discoverSkills(dirs) {
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 async function loadSkill(meta) {
-  const info = await stat10(meta.file);
-  if (info.size > MAX_SKILL_BYTES) {
+  const guard = guards.get(meta);
+  if (!guard) throw new Error(`Skill was not discovered through a protected skill root: ${meta.file}`);
+  await assertIdentity(guard.root, guard.rootIdentity, "skill root");
+  await assertIdentity(meta.dir, guard.dirIdentity, "skill directory");
+  const opened = await openVerified(meta.file, guard.fileIdentity);
+  if (opened.info.size > MAX_SKILL_BYTES) {
+    await opened.handle.close();
     throw new Error(`Skill file exceeds the ${MAX_SKILL_BYTES / 1e6} MB limit: ${meta.file}`);
   }
-  const { body } = parseFrontmatter(await readFile13(meta.file, "utf8"));
+  let text;
+  try {
+    text = (await readBounded2(opened.handle, MAX_SKILL_BYTES)).toString("utf8");
+  } finally {
+    await opened.handle.close();
+  }
+  await assertIdentity(guard.root, guard.rootIdentity, "skill root");
+  await assertIdentity(meta.dir, guard.dirIdentity, "skill directory");
+  await assertIdentity(meta.file, guard.fileIdentity, "skill file");
+  const { body } = parseFrontmatter(text);
   return { ...meta, body };
 }
 function formatSkillCatalogue(skills) {
@@ -5286,20 +5469,33 @@ function formatSkillCatalogue(skills) {
     "\n"
   );
 }
-async function readMeta(dir) {
+async function readMeta(root, rootInfo, dir) {
+  const dirInfo = await lstat4(dir).catch(() => null);
+  if (!dirInfo?.isDirectory() || dirInfo.isSymbolicLink()) return null;
   const file = path11.join(dir, SKILL_FILE);
   const head = await readFrontmatterBytes(file);
-  if (head === null) return null;
-  const { fields } = parseFrontmatter(head);
-  return { name: fields.name || path11.basename(dir), description: fields.description ?? "", dir, file };
+  if (!head) return null;
+  const { fields } = parseFrontmatter(head.text);
+  const meta = { name: fields.name || path11.basename(dir), description: fields.description ?? "", dir, file };
+  guards.set(meta, {
+    root,
+    rootIdentity: identity(rootInfo),
+    dirIdentity: identity(dirInfo),
+    fileIdentity: head.identity
+  });
+  return meta;
 }
 async function readFrontmatterBytes(file) {
-  const handle = await open(file, "r").catch(() => null);
+  const before = await lstat4(file).catch(() => null);
+  if (!before?.isFile() || before.isSymbolicLink()) return null;
+  const handle = await open2(file, "r").catch(() => null);
   if (!handle) return null;
   try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || !sameIdentity2(opened, identity(before))) return null;
     const buffer = Buffer.alloc(FRONTMATTER_BYTES);
     const { bytesRead } = await handle.read(buffer, 0, FRONTMATTER_BYTES, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8");
+    return { text: buffer.subarray(0, bytesRead).toString("utf8"), identity: identity(opened) };
   } catch {
     return null;
   } finally {
@@ -5307,6 +5503,44 @@ async function readFrontmatterBytes(file) {
     });
   }
 }
+async function openVerified(file, expected) {
+  const before = await lstat4(file);
+  if (!before.isFile() || before.isSymbolicLink() || !sameIdentity2(before, expected)) {
+    throw new Error(`Refusing changed or symlinked skill file: ${file}`);
+  }
+  const handle = await open2(file, "r");
+  const info = await handle.stat();
+  if (!info.isFile() || !sameIdentity2(info, expected)) {
+    await handle.close();
+    throw new Error(`Refusing skill file changed while opening: ${file}`);
+  }
+  return { handle, info };
+}
+async function assertIdentity(file, expected, label) {
+  const info = await lstat4(file);
+  if (info.isSymbolicLink() || !sameIdentity2(info, expected)) {
+    throw new Error(`Refusing changed or symlinked ${label}: ${file}`);
+  }
+}
+async function readBounded2(handle, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const remaining = maxBytes + 1 - total;
+    if (remaining <= 0) throw new Error(`Skill file exceeds the ${maxBytes / 1e6} MB limit`);
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+    if (bytesRead === 0) return Buffer.concat(chunks, total);
+    chunks.push(chunk.subarray(0, bytesRead));
+    total += bytesRead;
+  }
+}
+function identity(info) {
+  return { dev: info.dev, ino: info.ino };
+}
+function sameIdentity2(info, expected) {
+  return info.dev === expected.dev && info.ino === expected.ino;
+}
 function parseFrontmatter(text) {
   const lines = text.split("\n");
   const fields = {};
@@ -5325,7 +5559,7 @@ function parseFrontmatter(text) {
 }
 // src/skills/install.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { execFileSync } from "child_process";
 import {
   existsSync as existsSync2,
@@ -5337,7 +5571,7 @@ import {
   rmSync,
   writeFileSync
 } from "fs";
-import { chmod as chmod6, mkdir as mkdir5 } from "fs/promises";
+import { chmod as chmod7, mkdir as mkdir5 } from "fs/promises";
 import path12 from "path";
 var TMP_DIR = path12.join(skillsDir, ".tmp");
 var MAX_SKILL_BYTES2 = 5e6;
@@ -5366,7 +5600,7 @@ async function installFromGitHub(url) {
   const { owner, repo, subdir, branch } = parseGitHubUrl(url);
   const name = safeSkillName(subdir ? path12.posix.basename(subdir) : repo);
   const skillDir = safeChildPath(skillsDir, name);
-  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID3()}`);
+  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID4()}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
     const cloneUrl = `https://github.com/${owner}/${repo}.git`;
@@ -5388,7 +5622,7 @@ async function installFromNpm(packageName) {
   if (!parsedName) throw new Error(`Invalid npm package name: ${packageName}`);
   const name = safeSkillName(parsedName);
   const skillDir = safeChildPath(skillsDir, name);
-  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID3()}`);
+  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID4()}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
     execFileSync("npm", ["pack", packageName, "--prefix", tmpDir], {
@@ -5492,7 +5726,7 @@ async function writeSkillFile(dir, body) {
     throw new Error(`Refusing to replace symlinked skill file: ${file}`);
   }
   writeFileSync(file, body, { encoding: "utf8", mode: 384 });
-  await chmod6(file, 384);
+  await chmod7(file, 384);
 }
 function parseGitHubUrl(url) {
   let parsed;
@@ -5586,6 +5820,7 @@ function createSkillTool(skills) {
       additionalProperties: false
     },
     defaultPermission: "allow",
+    readOnly: true,
     summarize(input) {
       return `skill(${brief(input.name)})`;
     },
@@ -5691,50 +5926,94 @@ function field(input, key) {
 }
 // src/core/update.ts
-var UPDATE_URL = `https://api.github.com/repos/${KITCODE_REPOSITORY}/commits/main`;
+var UPDATE_URL = "https://registry.npmjs.org/%40kernelonpanic%2Fkitcode/latest";
+var PACKAGE_URL = "https://www.npmjs.com/package/@kernelonpanic/kitcode";
 var TIMEOUT_MS = 4e3;
 var MAX_RESPONSE_BYTES2 = 128e3;
-async function checkForUpdates(fetcher = fetch, currentCommit = KITCODE_COMMIT) {
-  if (currentCommit === "development") {
-    return { status: "unknown", reason: "development build has no embedded commit" };
+async function checkForUpdates(fetcher = fetch, currentVersion = KITCODE_VERSION) {
+  if (!parseSemver(currentVersion)) {
+    return { status: "unknown", reason: "installed KitCode version is not valid semver" };
   }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
   try {
     const response = await fetcher(UPDATE_URL, {
       headers: {
-        accept: "application/vnd.github+json",
-        "user-agent": `KitCode/${KITCODE_VERSION}`,
-        "x-github-api-version": "2022-11-28"
+        accept: "application/json",
+        "user-agent": `KitCode/${currentVersion}`
       },
       redirect: "error",
       signal: controller.signal
     });
     if (!response.ok) {
       await response.body?.cancel().catch(() => void 0);
-      return { status: "unknown", reason: `GitHub returned ${response.status}` };
+      return { status: "unknown", reason: `npm registry returned ${response.status}` };
     }
     const payload = await readJsonBounded(response);
-    if (!payload) return { status: "unknown", reason: "GitHub response was too large or invalid" };
-    if (typeof payload.sha !== "string" || !/^[0-9a-f]{40}$/i.test(payload.sha)) {
-      return { status: "unknown", reason: "GitHub response did not contain a commit" };
+    if (!payload) return { status: "unknown", reason: "npm response was too large or invalid" };
+    if (typeof payload.version !== "string" || !parseSemver(payload.version)) {
+      return { status: "unknown", reason: "npm response did not contain a valid version" };
     }
-    const current = currentCommit.toLowerCase();
-    const latest = payload.sha.toLowerCase();
-    if (latest.startsWith(current) || current.startsWith(latest)) {
-      return { status: "current", current, latest };
+    const latest = payload.version;
+    if (compareSemver(latest, currentVersion) <= 0) {
+      return { status: "current", current: currentVersion, latest };
     }
-    const url = typeof payload.html_url === "string" && payload.html_url.startsWith("https://github.com/") ? payload.html_url : `https://github.com/${KITCODE_REPOSITORY}/commits/main`;
-    return { status: "available", current, latest, url };
+    return {
+      status: "available",
+      current: currentVersion,
+      latest,
+      url: `${PACKAGE_URL}/v/${encodeURIComponent(latest)}`
+    };
   } catch (error) {
     return {
       status: "unknown",
-      reason: error instanceof Error && error.name === "AbortError" ? "GitHub check timed out" : "GitHub check failed"
+      reason: error instanceof Error && error.name === "AbortError" ? "npm update check timed out" : "npm update check failed"
     };
   } finally {
     clearTimeout(timer);
   }
 }
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) throw new Error("Cannot compare invalid semantic versions");
+  for (let index = 0; index < 3; index += 1) {
+    const x = a.core[index] ?? 0n;
+    const y = b.core[index] ?? 0n;
+    if (x !== y) return x > y ? 1 : -1;
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    if (a.prerelease.length === b.prerelease.length) return 0;
+    return a.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const x = a.prerelease[index];
+    const y = b.prerelease[index];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const xNumeric = /^\d+$/.test(x);
+    const yNumeric = /^\d+$/.test(y);
+    if (xNumeric && yNumeric) return BigInt(x) > BigInt(y) ? 1 : -1;
+    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
+function parseSemver(value) {
+  const match = value.match(
+    /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+  );
+  if (!match) return null;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) {
+    return null;
+  }
+  return {
+    core: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])],
+    prerelease
+  };
+}
 async function readJsonBounded(response) {
   const declared = Number(response.headers.get("content-length"));
   if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES2) {
@@ -5782,7 +6061,7 @@ async function boot(options) {
   const warnings = [];
   const workspaceRoot2 = await canonicalWorkspace(options.cwd);
   const workspaceTrusted = await isWorkspaceTrusted(options.cwd);
-  const startupUpdate = config.updates.checkOnStart ? checkForUpdates() : null;
+  let startupUpdate;
   if (loadedConfig.ignoredProject) {
     warnings.push(
       `Project config ignored until this workspace is trusted: ${loadedConfig.ignoredProject.path}. Review it, then run: kitcode trust`
@@ -6395,7 +6674,7 @@ ${lines.join("\n")}` : null;
       const states = mcp.states();
       const lines = [
         `KitCode ${KITCODE_VERSION} \xB7 ${KITCODE_COMMIT.slice(0, 12)}`,
-        `updates: ${config.updates.checkOnStart ? "enabled" : "disabled"}`,
+        "updates: npm check runs on every app start",
         `runtime: Node ${process.versions.node} \xB7 ${process.platform}/${process.arch}`,
         `workspace: ${options.cwd}`,
         `config: ${location.path}`,
@@ -6423,7 +6702,8 @@ ${lines.join("\n")}` : null;
       );
       return lines.join("\n");
     },
-    startupUpdateCheck: () => startupUpdate,
+    startupUpdateCheck: () => startupUpdate ??= checkForUpdates(),
+    checkForUpdates: () => checkForUpdates(),
     async run(history, hooks, signal) {
       syncMcpTools();
       const runProviderId = parseModelRef(modelRef)?.provider;
@@ -6561,6 +6841,13 @@ async function ask(text, options = {}) {
     mode: options.mode
   });
   for (const warning of warnings) console.error(sanitizeTerminalText(warning));
+  const update = await runtime.startupUpdateCheck();
+  if (update.status === "available") {
+    console.error(
+      `A newer KitCode version is available (${update.latest}). Update with: npm install -g @kernelonpanic/kitcode@latest
+${update.url}`
+    );
+  }
   const controller = new AbortController();
   const onInterrupt = () => controller.abort();
   process.on("SIGINT", onInterrupt);
@@ -6730,7 +7017,7 @@ function validateKey(value) {
 import { render } from "ink";
 // src/ui/App.tsx
-import { Box as Box13, Text as Text12, useApp, useInput as useInput2, useWindowSize as useWindowSize2 } from "ink";
+import { Box as Box13, Text as Text12, useApp, useInput as useInput2, useWindowSize as useWindowSize4 } from "ink";
 import { useCallback, useEffect as useEffect2, useMemo as useMemo4, useRef as useRef4, useState as useState5 } from "react";
 // src/mcp/add.ts
@@ -6784,6 +7071,7 @@ var COMMANDS = [
   { name: "mcp", args: "[add|list|delete|enable|disable]" },
   { name: "attach", args: "<path|clipboard|clear>" },
   { name: "compact" },
+  { name: "update" },
   { name: "checker" },
   { name: "sessions", args: "[list|rename|delete [all]|export]" },
   { name: "config" },
@@ -7026,7 +7314,11 @@ var en = {
   sessionActionRename: "rename",
   sessionActionDelete: "delete",
   sessionActionExport: "export Markdown",
-  updateAvailable: (version, url) => `A newer KitCode build is available (${version}): ${url}`,
+  updateAvailable: (version, url) => `A newer KitCode version is available (${version}). Update with:
+npm install -g @kernelonpanic/kitcode@latest
+${url}`,
+  updateCurrent: (version) => `KitCode ${version} is up to date.`,
+  updateFailed: (reason) => `Could not check for updates: ${reason}.`,
   accentSet: (name, hex) => `Accent: ${name} (${hex})`,
   reasoning: (on) => `Reasoning ${on ? "on" : "off"}`,
   effortSet: (value) => `Effort: ${value}`,
@@ -7101,6 +7393,7 @@ var en = {
     "mcp disable": "disconnect without removing an MCP server",
     attach: "attach an image or text file to the next message",
     compact: "summarize older context and keep recent turns",
+    update: "check npm for a newer KitCode version",
     checker: "check local setup without spending model tokens",
     sessions: "search and manage saved sessions",
     "sessions list": "list saved sessions",
@@ -7209,7 +7502,11 @@ var ru = {
   sessionActionRename: "\u043F\u0435\u0440\u0435\u0438\u043C\u0435\u043D\u043E\u0432\u0430\u0442\u044C",
   sessionActionDelete: "\u0443\u0434\u0430\u043B\u0438\u0442\u044C",
   sessionActionExport: "\u044D\u043A\u0441\u043F\u043E\u0440\u0442\u0438\u0440\u043E\u0432\u0430\u0442\u044C Markdown",
-  updateAvailable: (version, url) => `\u0414\u043E\u0441\u0442\u0443\u043F\u043D\u0430 \u043D\u043E\u0432\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode (${version}): ${url}`,
+  updateAvailable: (version, url) => `\u0414\u043E\u0441\u0442\u0443\u043F\u043D\u0430 \u043D\u043E\u0432\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode (${version}). \u041E\u0431\u043D\u043E\u0432\u0438\u0442\u044C:
+npm install -g @kernelonpanic/kitcode@latest
+${url}`,
+  updateCurrent: (version) => `\u0423\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D\u0430 \u0430\u043A\u0442\u0443\u0430\u043B\u044C\u043D\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode ${version}.`,
+  updateFailed: (reason) => `\u041D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C \u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043E\u0431\u043D\u043E\u0432\u043B\u0435\u043D\u0438\u044F: ${reason}.`,
   accentSet: (name, hex) => `\u0426\u0432\u0435\u0442: ${name} (${hex})`,
   reasoning: (on) => `\u0420\u0430\u0437\u043C\u044B\u0448\u043B\u0435\u043D\u0438\u044F ${on ? "\u0432\u043A\u043B\u044E\u0447\u0435\u043D\u044B" : "\u0432\u044B\u043A\u043B\u044E\u0447\u0435\u043D\u044B"}`,
   effortSet: (value) => `\u0413\u043B\u0443\u0431\u0438\u043D\u0430: ${value}`,
@@ -7282,6 +7579,7 @@ var ru = {
     "mcp disable": "\u043E\u0442\u043A\u043B\u044E\u0447\u0438\u0442\u044C MCP \u0431\u0435\u0437 \u0443\u0434\u0430\u043B\u0435\u043D\u0438\u044F",
     attach: "\u043F\u0440\u0438\u043A\u0440\u0435\u043F\u0438\u0442\u044C \u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0443 \u0438\u043B\u0438 \u0442\u0435\u043A\u0441\u0442\u043E\u0432\u044B\u0439 \u0444\u0430\u0439\u043B \u043A \u0441\u043E\u043E\u0431\u0449\u0435\u043D\u0438\u044E",
     compact: "\u0441\u0436\u0430\u0442\u044C \u0441\u0442\u0430\u0440\u044B\u0439 \u043A\u043E\u043D\u0442\u0435\u043A\u0441\u0442, \u0441\u043E\u0445\u0440\u0430\u043D\u0438\u0432 \u043F\u043E\u0441\u043B\u0435\u0434\u043D\u0438\u0435 \u0445\u043E\u0434\u044B",
+    update: "\u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043D\u043E\u0432\u0443\u044E \u0432\u0435\u0440\u0441\u0438\u044E KitCode \u0432 npm",
     checker: "\u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043D\u0430\u0441\u0442\u0440\u043E\u0439\u043A\u0443 \u0431\u0435\u0437 \u0442\u0440\u0430\u0442\u044B \u0442\u043E\u043A\u0435\u043D\u043E\u0432 \u043C\u043E\u0434\u0435\u043B\u0438",
     sessions: "\u043F\u043E\u0438\u0441\u043A \u0438 \u0443\u043F\u0440\u0430\u0432\u043B\u0435\u043D\u0438\u0435 \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u044B\u043C\u0438 \u0441\u0435\u0441\u0441\u0438\u044F\u043C\u0438",
     "sessions list": "\u0441\u043F\u0438\u0441\u043E\u043A \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u044B\u0445 \u0441\u0435\u0441\u0441\u0438\u0439",
@@ -7764,7 +8062,7 @@ var PromptInput = memo(function PromptInput2({
   valueRef.current = safeValue;
   cursorRef.current = inputCursor;
   const suggestions = matchCommands(safeValue);
-  const open2 = suggestions.length > 0;
+  const open3 = suggestions.length > 0;
   const active2 = Math.min(selectionCursor, Math.max(0, suggestions.length - 1));
   useEffect(() => {
     setSelectionCursor(0);
@@ -7817,25 +8115,25 @@ var PromptInput = memo(function PromptInput2({
       onPasteImage();
       return;
     }
-    if (open2 && key.upArrow) {
+    if (open3 && key.upArrow) {
       setSelectionCursor(Math.max(0, active2 - 1));
       return;
     }
-    if (open2 && key.downArrow) {
+    if (open3 && key.downArrow) {
       setSelectionCursor(Math.min(suggestions.length - 1, active2 + 1));
       return;
     }
-    if (open2 && key.tab && !key.shift) {
+    if (open3 && key.tab && !key.shift) {
       const chosen = suggestions[active2];
       if (chosen) change(`/${chosen.name} `);
       return;
     }
-    if (open2 && key.return) {
+    if (open3 && key.return) {
       const chosen = suggestions[active2];
       if (chosen) submit(`/${chosen.name}`);
       return;
     }
-    if (!open2 && (key.upArrow || key.downArrow)) {
+    if (!open3 && (key.upArrow || key.downArrow)) {
       const moved = moveInputHistory(
         history,
         historyIndex,
@@ -7887,7 +8185,7 @@ var PromptInput = memo(function PromptInput2({
   });
   const start = Math.max(0, Math.min(active2 - WINDOW2 + 2, suggestions.length - WINDOW2));
   const visible = suggestions.slice(start, start + WINDOW2);
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginTop: 1, children: [
+  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginTop: 1, flexShrink: 0, children: [
     /* @__PURE__ */ jsxs8(
       Box8,
       {
@@ -7915,7 +8213,7 @@ var PromptInput = memo(function PromptInput2({
       "  ",
       sanitizeTerminalText(hint)
     ] }),
-    open2 && /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginLeft: 2, children: [
+    open3 && /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginLeft: 2, children: [
       visible.map((command, index) => {
         const selected = start + index === active2;
         return /* @__PURE__ */ jsxs8(Text8, { color: selected ? theme.accent : void 0, dimColor: !selected, children: [
@@ -8051,6 +8349,7 @@ function StatusBar({ status }) {
     Box9,
     {
       width: "100%",
+      flexShrink: 0,
       marginTop: 1,
       paddingX: 1,
       borderStyle: "single",
@@ -8182,8 +8481,12 @@ function ContextMeter({
 import { Box as Box10 } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 function interactiveViewportRows(rows) {
-  if (!Number.isFinite(rows)) return 23;
-  return Math.max(1, Math.floor(rows) - 1);
+  if (!Number.isFinite(rows)) return 22;
+  return Math.max(1, Math.floor(rows) - 2);
+}
+var INTERACTIVE_CHROME_ROWS = 14;
+function liveTranscriptRows(rows) {
+  return Math.max(1, interactiveViewportRows(rows) - INTERACTIVE_CHROME_ROWS);
 }
 function TerminalViewport({ children, rows }) {
   return /* @__PURE__ */ jsx10(
@@ -8198,14 +8501,16 @@ function TerminalViewport({ children, rows }) {
 }
 // src/ui/components/Transcript.tsx
-import { Box as Box12, Static, Text as Text11 } from "ink";
+import { Box as Box12, Static, Text as Text11, useWindowSize as useWindowSize3 } from "ink";
 import { memo as memo2, useMemo as useMemo3, useRef as useRef3 } from "react";
 import Spinner2 from "ink-spinner";
+import stringWidth2 from "string-width";
 // src/ui/markdown.tsx
-import { Box as Box11, Text as Text10 } from "ink";
-import { useMemo as useMemo2 } from "react";
-import { Fragment as Fragment4, jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Box as Box11, Text as Text10, useWindowSize as useWindowSize2 } from "ink";
+import { Fragment as Fragment4, useMemo as useMemo2 } from "react";
+import stringWidth from "string-width";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
 function Markdown({ children }) {
   const blocks = useMemo2(() => extractBlocks(children), [children]);
   return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: blocks.map((block, i) => /* @__PURE__ */ jsx11(BlockView, { block }, i)) });
@@ -8213,45 +8518,43 @@ function Markdown({ children }) {
 function BlockView({ block }) {
   switch (block.type) {
     case "heading": {
-      const sizes = [22, 20, 18, 16, 14, 13];
-      const size = sizes[(block.level ?? 1) - 1] ?? 14;
-      return /* @__PURE__ */ jsx11(Box11, { marginTop: block.level === 1 ? 1 : 0, children: /* @__PURE__ */ jsx11(Text10, { bold: true, children: truncateBySize(block.text ?? "", size) }) });
+      return /* @__PURE__ */ jsx11(Box11, { marginTop: block.level === 1 ? 1 : 0, children: /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(block.text ?? "") }) });
     }
     case "blockquote":
-      return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", marginLeft: 2, children: (block.text ?? "").split("\n").map((line, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2502 " }),
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: line })
-      ] }, i)) });
+      return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.text ?? "").split("\n").map((line, i) => /* @__PURE__ */ jsx11(Text10, { dimColor: true, italic: true, children: inline(line) }, i)) });
     case "ul":
       return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.items ?? []).map((item, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2022 " }),
-        /* @__PURE__ */ jsx11(Box11, { marginLeft: 2, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
+        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: item.text?.match(/^[☑☐] /) ? "" : "\u2022 " }),
+        /* @__PURE__ */ jsx11(Box11, { flexGrow: 1, flexShrink: 1, minWidth: 0, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
       ] }, i)) });
     case "ol":
       return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.items ?? []).map((item, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: `${i + 1}. ` }),
-        /* @__PURE__ */ jsx11(Box11, { marginLeft: 2, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
+        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: `${(block.start ?? 1) + i}. ` }),
+        /* @__PURE__ */ jsx11(Box11, { flexGrow: 1, flexShrink: 1, minWidth: 0, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
       ] }, i)) });
     case "paragraph":
-    default:
-      return /* @__PURE__ */ jsx11(Text10, { children: inline(block.text ?? "") });
+    default: {
+      const content = /* @__PURE__ */ jsx11(Text10, { children: inline(block.text ?? "") });
+      if (!block.children?.length) return content;
+      return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
+        content,
+        /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: block.children.map((child, index) => /* @__PURE__ */ jsx11(BlockView, { block: child }, index)) })
+      ] });
+    }
     case "table":
       return /* @__PURE__ */ jsx11(TableView, { block });
     case "code":
-      return /* @__PURE__ */ jsx11(CodeBlock, { lang: block.lang, code: block.text ?? "" });
+      return /* @__PURE__ */ jsx11(CodeBlock, { code: block.text ?? "" });
     case "hr":
-      return /* @__PURE__ */ jsx11(Box11, { marginTop: 1, marginBottom: 1, children: /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2500".repeat(60) }) });
+      return /* @__PURE__ */ jsx11(Box11, { marginTop: 1, marginBottom: 1, children: /* @__PURE__ */ jsx11(Text10, { dimColor: true, wrap: "truncate-end", children: "\u2500".repeat(60) }) });
   }
 }
-function CodeBlock({ lang, code }) {
-  const theme = useTheme();
+function CodeBlock({ code }) {
   const lines = code.split("\n");
-  return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, children: [
-    lang && /* @__PURE__ */ jsx11(Text10, { dimColor: true, color: theme.accent, children: lang }),
-    /* @__PURE__ */ jsx11(Box11, { borderColor: "gray", borderStyle: "round", paddingX: 1, children: /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: lines.map((line, i) => /* @__PURE__ */ jsx11(Text10, { color: "cyan", children: line }, i)) }) })
-  ] });
+  return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", marginTop: 1, children: lines.map((line, i) => /* @__PURE__ */ jsx11(Text10, { color: "cyan", children: line }, i)) });
 }
 function TableView({ block }) {
+  const { columns } = useWindowSize2();
   const headers = block.headers ?? [];
   const rows = block.rows ?? [];
   if (headers.length === 0 && rows.length === 0) {
@@ -8261,77 +8564,104 @@ function TableView({ block }) {
   if (colCount === 0) {
     return /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "(empty table)" });
   }
-  const colWidths = new Array(colCount).fill(0);
-  const allRows = [headers, ...rows];
+  const allRows = [headers, ...rows].map(
+    (row) => Array.from({ length: colCount }, (_, index) => inlineDisplayText(row[index] ?? ""))
+  );
+  const naturalWidths = new Array(colCount).fill(1);
   for (const row of allRows) {
     for (let i = 0; i < colCount; i++) {
       const cell = row[i] ?? "";
-      colWidths[i] = Math.max(colWidths[i], [...cell].length);
+      naturalWidths[i] = Math.max(naturalWidths[i] ?? 1, stringWidth(cell));
     }
   }
-  const separator = colWidths.map((w) => "\u2500".repeat(w)).join("\u253C");
+  const colWidths = fitColumnWidths(naturalWidths, Math.max(1, columns));
+  const separator = colWidths.map((width, index) => {
+    const edge = index === 0 || index === colWidths.length - 1;
+    return "\u2500".repeat(width + (edge ? 1 : 2));
+  }).join("\u253C");
   const lines = [];
   allRows.forEach((row, rowIdx) => {
     const cells = [];
     for (let i = 0; i < colCount; i++) {
       const cell = row[i] ?? "";
       const align = block.colAligns?.[i] ?? "left";
-      const visualWidth = [...cell].length;
-      const padWidth = colWidths[i] + (cell.length - visualWidth);
+      const width = colWidths[i] ?? 1;
+      const fitted = truncateToWidth(cell, width);
+      const visualWidth = stringWidth(fitted);
+      const totalPad = Math.max(0, width - visualWidth);
       let padded;
       if (align === "right") {
-        padded = cell.padStart(padWidth);
+        padded = `${" ".repeat(totalPad)}${fitted}`;
       } else if (align === "center") {
-        const totalPad = padWidth - visualWidth;
         const left = Math.floor(totalPad / 2);
-        padded = " ".repeat(left) + cell + " ".repeat(totalPad - left);
+        padded = `${" ".repeat(left)}${fitted}${" ".repeat(totalPad - left)}`;
       } else {
-        padded = cell.padEnd(padWidth);
+        padded = `${fitted}${" ".repeat(totalPad)}`;
       }
       cells.push(padded);
     }
     lines.push(
-      /* @__PURE__ */ jsx11(Text10, { bold: rowIdx === 0, children: cells.join(" \u2502 ") }, `row-${rowIdx}`)
+      /* @__PURE__ */ jsx11(Text10, { bold: rowIdx === 0, wrap: "truncate-end", children: cells.join(" \u2502 ") }, `row-${rowIdx}`)
     );
     if (rowIdx === 0) {
-      lines.push(/* @__PURE__ */ jsx11(Text10, { dimColor: true, children: separator }, `sep-${rowIdx}`));
+      lines.push(/* @__PURE__ */ jsx11(Text10, { dimColor: true, wrap: "truncate-end", children: separator }, `sep-${rowIdx}`));
     }
   });
   return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: lines });
 }
-var CHARS_PER_FONT_LEVEL = 3;
-function truncateBySize(text, size) {
-  const maxLen = size * CHARS_PER_FONT_LEVEL;
-  return text.length > maxLen ? text.slice(0, maxLen) + "\u2026" : text;
-}
-var HEADING_RE = /^(#{1,6})\s+(.*)$/;
+function fitColumnWidths(natural, maxLineWidth) {
+  const widths = natural.map((width) => Math.max(1, width));
+  const separatorWidth = Math.max(0, widths.length - 1) * 3;
+  const available = Math.max(widths.length, maxLineWidth - separatorWidth);
+  let excess = widths.reduce((sum, width) => sum + width, 0) - available;
+  while (excess > 0) {
+    const shrinkable = widths.map((width, index) => ({ width, index })).filter(({ width }) => width > 1);
+    if (shrinkable.length === 0) break;
+    const share = Math.max(1, Math.ceil(excess / shrinkable.length));
+    for (const { index } of shrinkable) {
+      const current = widths[index] ?? 1;
+      const amount = Math.min(current - 1, share, excess);
+      widths[index] = current - amount;
+      excess -= amount;
+      if (excess === 0) break;
+    }
+  }
+  return widths;
+}
+var graphemeSegmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function truncateToWidth(text, maxWidth) {
+  if (stringWidth(text) <= maxWidth) return text;
+  if (maxWidth <= 1) return "\u2026";
+  let result = "";
+  for (const { segment } of graphemeSegmenter.segment(text)) {
+    if (stringWidth(result + segment) > maxWidth - 1) break;
+    result += segment;
+  }
+  return `${result}\u2026`;
+}
+function inlineDisplayText(text) {
+  return text.replace(/!\[([^\]]*)\]\(([^)]*)\)/g, "[$1]").replace(/\[([^\]]*)\]\(([^)]*)\)/g, "$1($2)").replace(/(`+)(.*?)\1/g, "$2").replace(/(\*\*|__|~~)(?=\S)(.*?\S)\1/g, "$2").replace(/(?<!\\)(\*|_)(?=\S)(.*?\S)\1/g, "$2").replace(/\\([\\`*_[\]{}()#+\-.!|>])/g, "$1");
+}
+var HEADING_RE = /^ {0,3}(#{1,6})(?:[ \t]+(.*)|[ \t]*)$/;
 var UL_RE = /^([-*+])\s+(.*)$/;
-var OL_RE = /^(\d+)\.\s+(.*)$/;
+var OL_RE = /^(\d{1,9})[.)]\s+(.*)$/;
 var QUOTE_RE = /^>\s?(.*)$/;
-var TASK_RE = /^[-*+]\s+\[([ xX])\]\s+(.*)$/;
-var INDENT_RE = /^(\s*)(.*)$/;
-var HR_RE = /^([-*_])\1{2,}$/;
-var FENCE_RE = /^(`{3,}|~{3,})(\w*)\s*$/;
+var TASK_CONTENT_RE = /^\[([ xX])\]\s+(.*)$/;
+var SETEXT_RE = /^ {0,3}(=+|-+)[ \t]*$/;
+var MAX_TABLE_COLUMNS = 20;
+var MAX_LIST_DEPTH = 20;
 function extractBlocks(src) {
-  const lines = src.replace(/\r\n/g, "\n").split("\n");
+  const lines = src.replace(/\r\n?/g, "\n").split("\n");
   const blocks = [];
   let paragraph = [];
-  let list = null;
   let quote = [];
   let code = null;
-  let table = null;
   const flushParagraph = () => {
     if (paragraph.length) {
-      blocks.push({ type: "paragraph", text: paragraph.join(" ").trim() });
+      blocks.push({ type: "paragraph", text: joinParagraphLines(paragraph) });
       paragraph = [];
     }
   };
-  const flushList = () => {
-    if (list && list.items.length) {
-      blocks.push({ type: list.ordered ? "ol" : "ul", items: list.items });
-      list = null;
-    }
-  };
   const flushQuote = () => {
     if (quote.length) {
       blocks.push({ type: "blockquote", text: quote.join("\n") });
@@ -8346,238 +8676,360 @@ function extractBlocks(src) {
   };
   const flushAll = () => {
     flushParagraph();
-    flushList();
     flushQuote();
     flushCode();
   };
-  const flushTable = () => {
-    if (table && table.headers.length > 0) {
-      blocks.push({
-        type: "table",
-        headers: table.headers,
-        rows: table.rows,
-        colAligns: table.colAligns
-      });
-    }
-    table = null;
-  };
-  const parseListItem = (text, indent) => {
-    const task = text.match(TASK_RE);
-    if (task) {
-      const done = task[1].toLowerCase() === "x";
-      return {
-        type: "paragraph",
-        text: `${done ? "\u2611" : "\u2610"} ${task[2]}`
-      };
-    }
-    return { type: "paragraph", text };
-  };
   for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
+    const line = lines[i] ?? "";
     const trimmed = line.trim();
     if (code) {
-      const endMatch = trimmed.match(FENCE_RE);
-      if (endMatch && endMatch[1][0] === code.fence[0] && endMatch[1].length >= code.fence.length) {
+      if (isClosingFence(line, code.fence)) {
         flushCode();
         continue;
       }
       code.lines.push(line);
       continue;
     }
-    const fenceMatch = trimmed.match(FENCE_RE);
-    if (fenceMatch) {
+    const fence = parseOpeningFence(line);
+    if (fence) {
       flushAll();
-      flushTable();
-      code = { fence: fenceMatch[1], lang: fenceMatch[2], lines: [] };
+      code = { fence: fence.fence, lang: fence.lang, lines: [] };
       continue;
     }
     if (trimmed === "") {
-      flushTable();
       flushAll();
       continue;
     }
-    const hrMatch = trimmed.match(HR_RE);
-    if (hrMatch) {
-      flushTable();
+    const heading = line.match(HEADING_RE);
+    if (heading) {
       flushAll();
-      blocks.push({ type: "hr" });
+      const text = (heading[2] ?? "").replace(/[ \t]+#+[ \t]*$/, "").trim();
+      blocks.push({ type: "heading", level: heading[1].length, text });
       continue;
     }
-    const heading = trimmed.match(HEADING_RE);
-    if (heading) {
-      flushTable();
+    const setext = lines[i + 1]?.match(SETEXT_RE);
+    if (setext && isSetextHeadingText(line)) {
+      flushAll();
+      blocks.push({ type: "heading", level: setext[1][0] === "=" ? 1 : 2, text: trimmed });
+      i += 1;
+      continue;
+    }
+    if (isHorizontalRule(trimmed)) {
       flushAll();
-      blocks.push({ type: "heading", level: heading[1].length, text: heading[2].trim() });
+      blocks.push({ type: "hr" });
       continue;
     }
     const quoteMatch = trimmed.match(QUOTE_RE);
     if (quoteMatch) {
-      flushTable();
       flushParagraph();
-      flushList();
       flushCode();
       quote.push(quoteMatch[1]);
       continue;
     }
-    const indentMatch = line.match(INDENT_RE);
-    const indent = indentMatch?.[1].length ?? 0;
-    const taskMatch = trimmed.match(TASK_RE);
-    if (taskMatch) {
-      flushTable();
+    const parsedList = parseListBlock(lines, i);
+    if (parsedList) {
       flushParagraph();
       flushQuote();
       flushCode();
-      if (!list || list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: false, items: [], indent };
-      }
-      list.items.push(parseListItem(trimmed, indent));
+      blocks.push(parsedList.block);
+      i = parsedList.nextIndex - 1;
       continue;
     }
-    const ulMatch = trimmed.match(UL_RE);
-    if (ulMatch) {
-      flushTable();
-      flushParagraph();
-      flushQuote();
-      flushCode();
-      if (!list || list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: false, items: [], indent };
-      }
-      list.items.push(parseListItem(ulMatch[2], indent));
+    const markdownTable = parseMarkdownTable(lines, i);
+    if (markdownTable) {
+      flushAll();
+      blocks.push(markdownTable.block);
+      i = markdownTable.nextIndex - 1;
       continue;
     }
-    const olMatch = trimmed.match(OL_RE);
-    if (olMatch) {
-      flushTable();
-      flushParagraph();
-      flushQuote();
-      flushCode();
-      if (!list || !list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: true, items: [], indent };
-      }
-      list.items.push(parseListItem(olMatch[2], indent));
+    const asciiTable = parseAsciiTable(lines, i);
+    if (asciiTable) {
+      flushAll();
+      blocks.push(asciiTable.block);
+      i = asciiTable.nextIndex - 1;
       continue;
     }
-    const sepMatch = trimmed.match(/^\|?\s*(\s*:?-+:?\s*\|)+\s*:?-+:?\s*\|?$/);
-    if (sepMatch) {
-      const cells = trimmed.split("|").map((c) => c.trim()).filter((c) => c.length > 0);
-      if (cells.length >= 2 && cells.every((c) => /^:?-+:?$/.test(c))) {
-        if (table) {
-          table.colAligns = cells.map((c) => {
-            if (c.startsWith(":") && c.endsWith(":")) return "center";
-            if (c.endsWith(":")) return "right";
-            return "left";
-          });
-          continue;
-        }
-      }
+    if (quote.length > 0) {
+      quote.push(trimmed);
+      continue;
     }
-    const rowMatch = trimmed.match(/^\|?.+\|.+\|?$/);
-    if (rowMatch) {
-      const cells = trimmed.split("|").map((c) => c.trim()).filter((c, idx, arr) => {
-        if (idx === 0 && c === "") return false;
-        if (idx === arr.length - 1 && c === "") return false;
-        return true;
-      });
-      const isWindowsPath = cells.length === 2 && (/^[A-Za-z]:\\/.test(cells[0]) || /^\\\\/.test(cells[0]));
-      if (cells.length >= 2 && cells.every((c) => c.length > 0) && !isWindowsPath) {
-        if (table) {
-          table.rows.push(cells);
-        } else {
-          flushAll();
-          table = { headers: cells, rows: [], colAligns: [] };
+    flushQuote();
+    flushCode();
+    paragraph.push(paragraphLine(line));
+  }
+  flushAll();
+  return blocks;
+}
+function paragraphLine(line) {
+  const hardBreak = /(?: {2,}|\\)$/.test(line);
+  const text = line.trim().replace(/\\$/, "");
+  return hardBreak ? `${text}
+` : text;
+}
+function joinParagraphLines(lines) {
+  let result = "";
+  for (const line of lines) {
+    if (result && !result.endsWith("\n")) result += " ";
+    result += line;
+  }
+  return result.trim();
+}
+function parseListMarker(line) {
+  const match = line.match(/^(\s*)(?:(\d{1,9})[.)]|([-+*]))\s+(.*)$/);
+  if (!match) return null;
+  return {
+    indent: match[1].replace(/\t/g, "    ").length,
+    ordered: Boolean(match[2]),
+    start: match[2] ? Number.parseInt(match[2], 10) : 1,
+    text: match[4]
+  };
+}
+function parseListItem(text) {
+  const task = text.match(TASK_CONTENT_RE);
+  return {
+    type: "paragraph",
+    text: task ? `${task[1].toLowerCase() === "x" ? "\u2611" : "\u2610"} ${task[2]}` : text
+  };
+}
+function parseListBlock(lines, start, depth = 0) {
+  const first2 = parseListMarker(lines[start] ?? "");
+  if (!first2) return null;
+  const items = [];
+  let nextIndex = start;
+  while (nextIndex < lines.length) {
+    const marker = parseListMarker(lines[nextIndex] ?? "");
+    if (!marker || marker.indent !== first2.indent || marker.ordered !== first2.ordered) break;
+    const item = parseListItem(marker.text);
+    nextIndex += 1;
+    while (nextIndex < lines.length) {
+      if ((lines[nextIndex] ?? "").trim() === "") {
+        let afterBlank = nextIndex;
+        while (afterBlank < lines.length && (lines[afterBlank] ?? "").trim() === "") {
+          afterBlank += 1;
         }
-        continue;
-      }
-    }
-    const asciiSepMatch = trimmed.match(/^[\s\-─┄┈━┅]{3,}$/);
-    if (asciiSepMatch) {
-      if (table && table.headers.length > 0 && table.colAligns.length === 0) {
-        table.colAligns = table.headers.map(() => "left");
-        continue;
-      }
-      if (paragraph.length === 1) {
-        const prevLine = paragraph[0].trim();
-        const tokens3 = prevLine.split(/\s{2,}/).map((c) => c.trim()).filter((c) => c.length > 0);
-        if (tokens3.length >= 2 && tokens3.length <= 10) {
-          paragraph = [];
-          flushList();
-          flushQuote();
-          flushCode();
-          table = { headers: tokens3, rows: [], colAligns: tokens3.map(() => "left") };
-          continue;
+        const followingMarker2 = parseListMarker(lines[afterBlank] ?? "");
+        if (!followingMarker2 || followingMarker2.indent < first2.indent) {
+          nextIndex = afterBlank;
+          break;
         }
+        nextIndex = afterBlank;
+        if (followingMarker2.indent === first2.indent) break;
       }
-    }
-    if (table && table.headers.length > 0 && !trimmed.includes("|")) {
-      const tokens3 = trimmed.split(/\s{2,}/).map((c) => c.trim()).filter((c) => c.length > 0);
-      if (tokens3.length >= 2 && tokens3.length <= table.headers.length + 2) {
-        const looksLikeCode = tokens3.some((t) => t.startsWith("//") || t.startsWith("#") || t.startsWith("/*"));
-        const looksLikePath = tokens3.length === 2 && (/^[A-Za-z]:\\/.test(tokens3[0]) || /^\\\\/.test(tokens3[0]));
-        if (!looksLikeCode && !looksLikePath) {
-          table.rows.push(tokens3);
+      const followingMarker = parseListMarker(lines[nextIndex] ?? "");
+      if (followingMarker) {
+        if (followingMarker.indent <= first2.indent) break;
+        if (depth >= MAX_LIST_DEPTH) {
+          item.text = `${item.text ?? ""} ${followingMarker.text}`.trim();
+          nextIndex += 1;
           continue;
         }
+        const nested = parseListBlock(lines, nextIndex, depth + 1);
+        if (!nested) break;
+        item.children ??= [];
+        item.children.push(nested.block);
+        nextIndex = nested.nextIndex;
+        continue;
       }
-    }
-    flushTable();
-    flushList();
-    flushQuote();
-    flushCode();
-    paragraph.push(trimmed);
+      if (interruptsList(lines, nextIndex)) break;
+      const continuation = (lines[nextIndex] ?? "").trim();
+      item.text = `${item.text ?? ""} ${continuation}`.trim();
+      nextIndex += 1;
+    }
+    items.push(item);
+  }
+  const block = { type: first2.ordered ? "ol" : "ul", items };
+  if (first2.ordered && first2.start !== 1) block.start = first2.start;
+  return { block, nextIndex };
+}
+function interruptsList(lines, index) {
+  const line = lines[index] ?? "";
+  const trimmed = line.trim();
+  return Boolean(
+    line.match(HEADING_RE) || trimmed.match(QUOTE_RE) || parseOpeningFence(line) || isHorizontalRule(trimmed) || parseMarkdownTable(lines, index) || parseAsciiTable(lines, index)
+  );
+}
+function parseOpeningFence(line) {
+  const match = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+  if (!match) return null;
+  const info = match[2].trim();
+  if (match[1][0] === "`" && info.includes("`")) return null;
+  return { fence: match[1], lang: info.split(/\s+/, 1)[0] ?? "" };
+}
+function isClosingFence(line, opening) {
+  const match = line.match(/^ {0,3}(`+|~+)[ \t]*$/);
+  return Boolean(
+    match && match[1][0] === opening[0] && match[1].length >= opening.length
+  );
+}
+function isHorizontalRule(line) {
+  return /^(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/.test(line);
+}
+function isSetextHeadingText(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !HEADING_RE.test(line) && !QUOTE_RE.test(trimmed) && !UL_RE.test(trimmed) && !OL_RE.test(trimmed) && !parseOpeningFence(line);
+}
+function parseMarkdownTable(lines, start) {
+  const headers = splitTableRow(lines[start] ?? "");
+  const delimiter = splitTableRow(lines[start + 1] ?? "");
+  if (!headers || !delimiter || headers.length < 2 || headers.length > MAX_TABLE_COLUMNS || delimiter.length !== headers.length || !delimiter.every((cell) => /^:?-{3,}:?$/.test(cell))) {
+    return null;
   }
-  flushTable();
-  flushAll();
-  return blocks;
+  const colAligns = delimiter.map((cell) => {
+    if (cell.startsWith(":") && cell.endsWith(":")) return "center";
+    if (cell.endsWith(":")) return "right";
+    return "left";
+  });
+  const rows = [];
+  let nextIndex = start + 2;
+  while (nextIndex < lines.length) {
+    const cells = splitTableRow(lines[nextIndex] ?? "");
+    if (!cells) break;
+    rows.push(headers.map((_, index) => cells[index] ?? ""));
+    nextIndex += 1;
+  }
+  return {
+    block: { type: "table", headers, rows, colAligns },
+    nextIndex
+  };
+}
+function splitTableRow(line) {
+  const source = line.trim();
+  if (!source.includes("|")) return null;
+  const cells = [];
+  let cell = "";
+  let codeFenceLength = 0;
+  let foundSeparator = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const character = source[index] ?? "";
+    if (character === "\\" && source[index + 1] === "|") {
+      cell += "|";
+      index += 1;
+      continue;
+    }
+    if (character === "`") {
+      let end = index + 1;
+      while (source[end] === "`") end += 1;
+      const runLength = end - index;
+      if (codeFenceLength === 0) codeFenceLength = runLength;
+      else if (codeFenceLength === runLength) codeFenceLength = 0;
+      cell += source.slice(index, end);
+      index = end - 1;
+      continue;
+    }
+    if (character === "|" && codeFenceLength === 0) {
+      foundSeparator = true;
+      cells.push(cell.trim());
+      cell = "";
+      continue;
+    }
+    cell += character;
+  }
+  cells.push(cell.trim());
+  if (!foundSeparator) return null;
+  if (cells[0] === "") cells.shift();
+  if (cells[cells.length - 1] === "") cells.pop();
+  return cells.length >= 2 ? cells : null;
+}
+function parseAsciiTable(lines, start) {
+  const headers = splitAsciiCells(lines[start] ?? "");
+  if (headers.length < 2 || headers.length > MAX_TABLE_COLUMNS) return null;
+  const separator = (lines[start + 1] ?? "").trim();
+  const separatorCells = splitAsciiCells(separator);
+  const validSeparator = /^[─┄┈━┅-]{3,}$/.test(separator) || separatorCells.length === headers.length && separatorCells.every((cell) => /^[─┄┈━┅-]{3,}$/.test(cell));
+  if (!validSeparator) return null;
+  const rows = [];
+  let nextIndex = start + 2;
+  while (nextIndex < lines.length) {
+    const cells = splitAsciiCells(lines[nextIndex] ?? "");
+    if (cells.length !== headers.length) break;
+    rows.push(cells);
+    nextIndex += 1;
+  }
+  if (rows.length === 0) return null;
+  return {
+    block: {
+      type: "table",
+      headers,
+      rows,
+      colAligns: headers.map(() => "left")
+    },
+    nextIndex
+  };
+}
+function splitAsciiCells(line) {
+  return line.trim().split(/\s{2,}/).map((cell) => cell.trim()).filter(Boolean);
 }
 var MAX_INLINE_DEPTH = 10;
+var INLINE_ESCAPE_BASE = 57344;
+var ESCAPABLE_MARKDOWN = ["\\", "`", "*", "_", "[", "]", "{", "}", "(", ")", "#", "+", "-", ".", "!", "|", ">"];
+function protectInlineEscapes(text) {
+  return text.replace(/\\([\\`*_[\]{}()#+\-.!|>])/g, (_match, character) => {
+    const index = ESCAPABLE_MARKDOWN.indexOf(character);
+    return String.fromCodePoint(INLINE_ESCAPE_BASE + index);
+  });
+}
+function restoreInlineEscapes(text) {
+  return [...text].map((character) => {
+    const index = character.codePointAt(0) - INLINE_ESCAPE_BASE;
+    return index >= 0 && index < ESCAPABLE_MARKDOWN.length ? ESCAPABLE_MARKDOWN[index] : character;
+  }).join("");
+}
 function inline(text, depth = 0) {
   if (depth > MAX_INLINE_DEPTH) {
-    return text;
+    return restoreInlineEscapes(text);
   }
   const nodes = [];
-  let rest = text;
+  let rest = protectInlineEscapes(text);
   let key = 0;
   const matchers = [
     {
-      re: /(!\[)([^\]]*)\]\(([^)]+)\)/,
+      re: /(!\[)([^\]]*)\]\(((?:[^()\\]|\\.|\([^()]*\))+?)\)/,
       handler: (m) => /* @__PURE__ */ jsxs10(Text10, { color: "cyan", bold: true, children: [
         "[img: ",
-        m[2],
+        restoreInlineEscapes(m[2]),
         "]"
       ] }, key++)
     },
     {
-      re: /(\[)([^\]]*)\]\(([^)]+)\)/,
-      handler: (m) => /* @__PURE__ */ jsxs10(Fragment4, { children: [
-        /* @__PURE__ */ jsx11(Text10, { color: "cyan", underline: true, children: inline(m[2], depth + 1) }, key++),
-        /* @__PURE__ */ jsxs10(Text10, { dimColor: true, color: "gray", children: [
-          "(",
-          m[3],
-          ")"
-        ] }, key++)
-      ] })
+      re: /(\[)([^\]]*)\]\(((?:[^()\\]|\\.|\([^()]*\))+?)\)/,
+      handler: (m) => {
+        const fragmentKey = key++;
+        return /* @__PURE__ */ jsxs10(Fragment4, { children: [
+          /* @__PURE__ */ jsx11(Text10, { color: "cyan", underline: true, children: inline(m[2], depth + 1) }),
+          /* @__PURE__ */ jsxs10(Text10, { dimColor: true, color: "gray", children: [
+            "(",
+            restoreInlineEscapes(m[3]),
+            ")"
+          ] })
+        ] }, fragmentKey);
+      }
     },
     {
       re: /(`+)([^`]+?)\1/,
-      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, color: "cyan", children: m[2] }, key++)
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, color: "cyan", children: restoreInlineEscapes(m[2]) }, key++)
     },
     {
-      re: /(\*\*)(.+?)\1/,
+      re: /(\*\*\*|___)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, italic: true, children: inline(m[2], depth + 1) }, key++)
+    },
+    {
+      re: /(\*\*)(?=\S)(.*?\S)\1/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(__)(.+?)\1/,
+      re: /(__)(?=\S)(.*?\S)\1/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(~~)(.+?)\1/,
-      handler: (m) => /* @__PURE__ */ jsx11(Text10, { strikethrough: true, children: m[2] }, key++)
+      re: /(~~)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { strikethrough: true, children: inline(m[2], depth + 1) }, key++)
+    },
+    {
+      re: /(\*)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { italic: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(\*)(.+?)\1/,
+      re: /(?<!\w)(_)(?=\S)(.*?\S)\1(?!\w)/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { italic: true, children: inline(m[2], depth + 1) }, key++)
     }
   ];
@@ -8590,11 +9042,11 @@ function inline(text, depth = 0) {
       }
     }
     if (!best) {
-      nodes.push(rest);
+      nodes.push(restoreInlineEscapes(rest));
       break;
     }
     const idx = best.match.index ?? 0;
-    if (idx > 0) nodes.push(rest.slice(0, idx));
+    if (idx > 0) nodes.push(restoreInlineEscapes(rest.slice(0, idx)));
     nodes.push(best.handler(best.match));
     rest = rest.slice(idx + best.match[0].length);
   }
@@ -8604,12 +9056,19 @@ function inline(text, depth = 0) {
 // src/ui/components/Transcript.tsx
 import { Fragment as Fragment5, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
 var HEADER = { kind: "header" };
+function assistantThinkingForFrame(bubble, frozenThinking) {
+  return bubble.streaming && bubble.text !== "" ? frozenThinking ?? bubble.thinking : bubble.thinking;
+}
 function firstMutableBubbleIndex(bubbles) {
   return bubbles.findIndex(
     (bubble) => bubble.kind === "assistant" && bubble.streaming || bubble.kind === "tool" && bubble.state === "running" || bubble.kind === "subagent" && bubble.state === "running"
   );
 }
-var Transcript = memo2(function Transcript2({ bubbles, workspace }) {
+var Transcript = memo2(function Transcript2({
+  bubbles,
+  workspace,
+  maxLiveRows = 12
+}) {
   const liveAt = firstMutableBubbleIndex(bubbles);
   const stableCount = liveAt === -1 ? bubbles.length : liveAt;
   const stableRef = useRef3([]);
@@ -8623,21 +9082,36 @@ var Transcript = memo2(function Transcript2({ bubbles, workspace }) {
   }
   const live = liveAt === -1 ? [] : bubbles.slice(liveAt);
   const staticItems = [HEADER, ...stableRef.current];
-  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginBottom: 1, flexShrink: 1, overflowY: "hidden", children: [
-    /* @__PURE__ */ jsx12(Static, { items: staticItems, children: (item) => item.kind === "header" ? /* @__PURE__ */ jsx12(Logo, { workspace }, "kitcode-header") : /* @__PURE__ */ jsx12(BubbleView, { bubble: item }, item.id) }),
-    /* @__PURE__ */ jsx12(
-      Box12,
-      {
-        flexDirection: "column",
-        flexShrink: 1,
-        overflowY: "hidden",
-        justifyContent: "flex-end",
-        children: live.map((bubble) => /* @__PURE__ */ jsx12(BubbleView, { bubble }, bubble.id))
-      }
-    )
-  ] });
+  return /* @__PURE__ */ jsxs11(
+    Box12,
+    {
+      flexDirection: "column",
+      marginBottom: 1,
+      flexShrink: 1,
+      minHeight: 0,
+      overflowY: "hidden",
+      children: [
+        /* @__PURE__ */ jsx12(Static, { items: staticItems, children: (item) => item.kind === "header" ? /* @__PURE__ */ jsx12(Logo, { workspace }, "kitcode-header") : /* @__PURE__ */ jsx12(BubbleView, { bubble: item }, item.id) }),
+        /* @__PURE__ */ jsx12(
+          Box12,
+          {
+            flexDirection: "column",
+            flexShrink: 1,
+            minHeight: 0,
+            maxHeight: maxLiveRows,
+            overflowY: "hidden",
+            justifyContent: "flex-end",
+            children: live.map((bubble) => /* @__PURE__ */ jsx12(BubbleView, { bubble, maxRows: maxLiveRows }, bubble.id))
+          }
+        )
+      ]
+    }
+  );
 });
-var BubbleView = memo2(function BubbleView2({ bubble }) {
+var BubbleView = memo2(function BubbleView2({
+  bubble,
+  maxRows
+}) {
   const theme = useTheme();
   if (bubble.kind === "user") {
     return /* @__PURE__ */ jsx12(Box12, { marginTop: 1, children: /* @__PURE__ */ jsxs11(Text11, { color: theme.accent, bold: true, children: [
@@ -8650,20 +9124,62 @@ var BubbleView = memo2(function BubbleView2({ bubble }) {
     return /* @__PURE__ */ jsx12(Box12, { marginTop: 1, children: /* @__PURE__ */ jsx12(Text11, { color, children: bubble.text }) });
   }
   if (bubble.kind === "assistant") {
-    return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginTop: 1, children: [
-      bubble.thinking.trim() !== "" && /* @__PURE__ */ jsx12(Text11, { dimColor: true, italic: true, children: bubble.thinking.trim() }),
-      bubble.streaming ? /* @__PURE__ */ jsx12(Text11, { children: bubble.text }) : /* @__PURE__ */ jsx12(Markdown, { children: bubble.text }),
-      bubble.streaming && bubble.text === "" && /* @__PURE__ */ jsxs11(Text11, { dimColor: true, children: [
-        /* @__PURE__ */ jsx12(Spinner2, { type: "dots" }),
-        " thinking"
-      ] })
-    ] });
+    return /* @__PURE__ */ jsx12(AssistantView, { bubble, maxRows });
   }
   if (bubble.kind === "subagent") {
     return /* @__PURE__ */ jsx12(SubagentView, { bubble });
   }
   return /* @__PURE__ */ jsx12(ToolView, { bubble });
 });
+function AssistantView({ bubble, maxRows }) {
+  const { columns } = useWindowSize3();
+  const frozenThinking = useRef3(void 0);
+  const answering = bubble.streaming && bubble.text !== "";
+  if (!answering) frozenThinking.current = void 0;
+  if (answering && frozenThinking.current === void 0) {
+    frozenThinking.current = bubble.thinking;
+  }
+  const visibleThinking = assistantThinkingForFrame(bubble, frozenThinking.current);
+  const liveBudget = bubble.streaming && maxRows !== void 0 ? Math.max(1, maxRows - 1) : void 0;
+  const thinkingBudget = liveBudget === void 0 ? void 0 : bubble.text !== "" ? Math.min(3, Math.max(0, liveBudget - 1)) : Math.max(0, liveBudget - 1);
+  const frameThinking = thinkingBudget === void 0 ? visibleThinking.trim() : clipTextToRows(visibleThinking.trim(), thinkingBudget, columns);
+  const usedThinkingRows = frameThinking === "" ? 0 : frameThinking.split("\n").length;
+  const frameText = liveBudget === void 0 ? bubble.text : clipTextToRows(bubble.text, Math.max(1, liveBudget - usedThinkingRows), columns);
+  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginTop: 1, children: [
+    frameThinking !== "" && /* @__PURE__ */ jsx12(Text11, { dimColor: true, italic: true, children: frameThinking }),
+    bubble.streaming ? /* @__PURE__ */ jsx12(Text11, { children: frameText }) : /* @__PURE__ */ jsx12(Markdown, { children: bubble.text }),
+    bubble.streaming && bubble.text === "" && /* @__PURE__ */ jsxs11(Text11, { dimColor: true, children: [
+      /* @__PURE__ */ jsx12(Spinner2, { type: "dots" }),
+      " thinking"
+    ] })
+  ] });
+}
+function clipTextToRows(text, maxRows, columns) {
+  if (text === "" || maxRows <= 0) return "";
+  const width = Number.isFinite(columns) ? Math.max(1, Math.floor(columns)) : 80;
+  const rows = text.replace(/\r\n?/g, "\n").split("\n").flatMap((line) => wrapVisualLine(line, width));
+  if (rows.length <= maxRows) return rows.join("\n");
+  const tail2 = rows.slice(-Math.max(1, maxRows - 1));
+  return maxRows === 1 ? tail2.at(-1) ?? "" : ["\u2026", ...tail2].join("\n");
+}
+function wrapVisualLine(line, columns) {
+  if (line === "") return [""];
+  const rows = [];
+  let current = "";
+  let currentWidth = 0;
+  for (const character of line) {
+    const width = Math.max(1, stringWidth2(character));
+    if (current !== "" && currentWidth + width > columns) {
+      rows.push(current);
+      current = "";
+      currentWidth = 0;
+    }
+    current += character;
+    currentWidth += width;
+  }
+  if (current !== "" || rows.length === 0) rows.push(current);
+  return rows;
+}
 function ToolView({ bubble }) {
   const theme = useTheme();
   const mark = bubble.state === "running" ? "\u25CC" : bubble.state === "ok" ? "\u25CF" : "\u2717";
@@ -8971,7 +9487,7 @@ function App({
   warnings = []
 }) {
   const { exit } = useApp();
-  const { rows } = useWindowSize2();
+  const { rows } = useWindowSize4();
   const [transcript, setTranscript] = useState5(
     () => warnings.reduce((state, text) => pushNotice(state, "warn", text), fromHistory(initialHistory))
   );
@@ -9064,11 +9580,10 @@ function App({
   );
   useEffect2(() => {
     const check = runtime.startupUpdateCheck();
-    if (!check) return;
     let active2 = true;
     void check.then((result) => {
       if (active2 && result.status === "available") {
-        notice("info", strings.updateAvailable(result.latest.slice(0, 12), result.url));
+        notice("info", strings.updateAvailable(result.latest, result.url));
       }
     });
     return () => {
@@ -9364,6 +9879,17 @@ function App({
         case "config":
           notice("info", strings.configAt(runtime.configPath()));
           return;
+        case "update": {
+          const result = await runtime.checkForUpdates();
+          if (result.status === "available") {
+            notice("info", strings.updateAvailable(result.latest, result.url));
+          } else if (result.status === "current") {
+            notice("info", strings.updateCurrent(result.current));
+          } else {
+            notice("warn", strings.updateFailed(result.reason));
+          }
+          return;
+        }
         case "login":
           setSetup(true);
           return;
@@ -10091,6 +10617,10 @@ Rename the file if you want a different name.`);
       return;
     }
     if (!key.escape) return;
+    if (input !== "") {
+      setInput("");
+      return;
+    }
     if (busy && abort.current) {
       abort.current.abort();
       queueRef.current = [];
@@ -10151,7 +10681,8 @@ ${strings.configAt(runtime.configPath())}`);
         Transcript,
         {
           bubbles: transcript.bubbles,
-          workspace: runtime.cwd
+          workspace: runtime.cwd,
+          maxLiveRows: liveTranscriptRows(rows)
         },
         transcriptRevision
       ),
@@ -10349,6 +10880,12 @@ import { jsx as jsx14 } from "react/jsx-runtime";
 function clearTerminal() {
   if (process.stdout.isTTY) process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
 }
+var TUI_RENDER_OPTIONS = {
+  // Keep unchanged streamed lines in place instead of clearing and redrawing
+  // the whole live region on every frame.
+  incrementalRendering: true,
+  maxFps: 30
+};
 async function startTui(options) {
   const { runtime, history, warnings, shutdown } = await boot({
     cwd: options.cwd ?? process.cwd(),
@@ -10358,10 +10895,10 @@ async function startTui(options) {
     mode: options.mode
   });
   clearTerminal();
-  const instance = render(/* @__PURE__ */ jsx14(App, { runtime, initialHistory: history, warnings }), {
-    incrementalRendering: true,
-    maxFps: 30
-  });
+  const instance = render(
+    /* @__PURE__ */ jsx14(App, { runtime, initialHistory: history, warnings }),
+    TUI_RENDER_OPTIONS
+  );
   try {
     await instance.waitUntilExit();
   } finally {