@kernelonpanic/kitcode 1.2.0 → 1.2.5

package/dist/index.js

@@ -69,9 +69,6 @@ var diagnosticsSchema = z.object({
   autoRun: z.boolean().default(true),
   commands: z.array(z.string().trim().min(1).max(2e4)).max(8).default([])
 });
-var updatesSchema = z.object({
-  checkOnStart: z.boolean().default(true)
-});
 var configSchema = z.object({
   version: z.literal(1).default(1),
   model: z.string().optional(),
@@ -86,7 +83,6 @@ var configSchema = z.object({
     maxSubagentsPerTurn: 3
   }),
   diagnostics: diagnosticsSchema.default({ autoRun: true, commands: [] }),
-  updates: updatesSchema.default({ checkOnStart: false }),
   providers: z.record(providerIdSchema, providerConfigSchema).default({}),
   permissions: z.record(safeRecordKeySchema, permissionModeSchema).default({}),
   mcp: z.record(safeRecordKeySchema, mcpServerSchema).default({})
@@ -153,19 +149,19 @@ var CONNECTION_REASONS = {
   DEPTH_ZERO_SELF_SIGNED_CERT: "the TLS certificate is self-signed",
   UNABLE_TO_VERIFY_LEAF_SIGNATURE: "the TLS certificate chain cannot be verified"
 };
-function describeProviderFailure(error, providerId) {
+function describeProviderFailure(error, providerId, knownSecrets = []) {
   const abort = abortKind(error);
   if (abort === "user") return `Request to "${providerId}" was cancelled.`;
   if (abort === "timeout") {
     return `Request to "${providerId}" ran out of time before the provider answered \u2014 it may be overloaded, try again.`;
   }
   const status = statusOf(error);
-  if (status !== void 0) return describeStatus(status, providerId, error);
-  const reason = connectionReason(error);
+  if (status !== void 0) return describeStatus(status, providerId, error, knownSecrets);
+  const reason = connectionReason(error, knownSecrets);
   if (reason) {
     return `Cannot reach "${providerId}": ${reason}. Check the base URL and your network.`;
   }
-  return `Request to "${providerId}" failed \u2014 ${snippet(messageOf(error))}`;
+  return `Request to "${providerId}" failed \u2014 ${snippet(messageOf(error), 160, knownSecrets)}`;
 }
 function statusOf(error) {
   const value = prop(error, "status") ?? prop(error, "statusCode");
@@ -177,8 +173,8 @@ function isUserAbort(error, signal) {
 function isConnectionFailure(error) {
   return connectionReason(error) !== void 0;
 }
-function toProviderError(error, providerId) {
-  return new ProviderError(describeProviderFailure(error, providerId), providerId, statusOf(error), {
+function toProviderError(error, providerId, knownSecrets = []) {
+  return new ProviderError(describeProviderFailure(error, providerId, knownSecrets), providerId, statusOf(error), {
     cause: error
   });
 }
@@ -226,8 +222,8 @@ async function readHead(stream) {
   }
   return text;
 }
-async function invalidStreamError(providerId, capture, cause) {
-  const excerpt = snippet(await capture.head(), EXCERPT_CHARS);
+async function invalidStreamError(providerId, capture, cause, knownSecrets = []) {
+  const excerpt = snippet(await capture.head(), EXCERPT_CHARS, knownSecrets);
   const detail = excerpt === "" ? "the body was empty" : `the body began: ${excerpt}`;
   return new ProviderError(
     `"${providerId}" returned a response that is not a valid streaming chat completion \u2014 no stream events arrived and ${detail}. The endpoint may speak a different protocol than the one configured for it.`,
@@ -236,8 +232,8 @@ async function invalidStreamError(providerId, capture, cause) {
     cause === void 0 ? void 0 : { cause }
   );
 }
-function describeStatus(status, providerId, error) {
-  const detail = detailOf(error, status);
+function describeStatus(status, providerId, error, knownSecrets) {
+  const detail = detailOf(error, status, knownSecrets);
   const wait = retryAfterSeconds(error);
   const after = wait === void 0 ? void 0 : `retry after ${wait}s`;
   if (status === 401) {
@@ -272,7 +268,7 @@ function abortKind(error) {
   if (name === "AbortError") return "user";
   return void 0;
 }
-function connectionReason(error) {
+function connectionReason(error, knownSecrets = []) {
   const links = chain(error);
   for (const link of links) {
     for (const candidate of [link, ...siblings(link)]) {
@@ -282,9 +278,11 @@ function connectionReason(error) {
     }
   }
   const deepest = links[links.length - 1];
-  if (links.length > 1 && deepest instanceof Error) return snippet(deepest.message);
+  if (links.length > 1 && deepest instanceof Error) {
+    return snippet(deepest.message, 160, knownSecrets);
+  }
   const message = messageOf(error);
-  return /fetch failed|connection error|socket|network/i.test(message) ? snippet(message) : void 0;
+  return /fetch failed|connection error|socket|network/i.test(message) ? snippet(message, 160, knownSecrets) : void 0;
 }
 function chain(error) {
   const links = [];
@@ -317,9 +315,9 @@ function header(error, name) {
   const value = headers[name];
   return typeof value === "string" ? value : void 0;
 }
-function detailOf(error, status) {
+function detailOf(error, status, knownSecrets) {
   const raw = bodyMessage(error) ?? messageOf(error).replace(new RegExp(`^${status}\\s+`), "");
-  const text = snippet(raw);
+  const text = snippet(raw, 160, knownSecrets);
   if (text === "" || text === String(status) || text === "status code (no body)") return "";
   return ` \u2014 ${text}`;
 }
@@ -336,8 +334,8 @@ function messageOf(error) {
   if (error === null || error === void 0) return "unknown error";
   return String(error);
 }
-function snippet(text, limit = 160) {
-  return redactSecrets(oneLine(text)).slice(0, limit);
+function snippet(text, limit = 160, knownSecrets = []) {
+  return redactSecrets(oneLine(text), knownSecrets).slice(0, limit);
 }
 function oneLine(text) {
   return text.replace(/\s+/g, " ").trim();
@@ -454,7 +452,7 @@ async function detectProvider(rawUrl, apiKey2, opts = {}) {
     }
     if (!attempt.ok && attempt.status !== 404 && attempt.status !== 0) break;
   }
-  throw new Error(describeFailure(last));
+  throw new Error(describeFailure(last, apiKey2));
 }
 function normaliseBaseUrl(rawUrl) {
   return rawUrl.trim().replace(/\/+$/, "");
@@ -591,9 +589,9 @@ function stringList(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((item) => typeof item === "string");
 }
-function describeFailure(attempt) {
+function describeFailure(attempt, apiKey2) {
   const status = attempt.status === 0 ? "request failed" : `HTTP ${attempt.status}`;
-  const snippet2 = redactSecrets(attempt.text.trim()).slice(0, 200);
+  const snippet2 = redactSecrets(attempt.text.trim(), [apiKey2]).slice(0, 200);
   const detail = snippet2 === "" ? "" : `: ${snippet2}`;
   return `No OpenAI- or Anthropic-compatible API found at ${attempt.url} (${status})${detail}`;
 }
@@ -757,9 +755,16 @@ async function configLocation() {
   active ??= await resolveConfigLocation();
   return active;
 }
+async function loadConfig(cwd) {
+  const location = await resolveConfigLocation(cwd);
+  return loadConfigAt(location);
+}
 async function loadProjectConfig(dir) {
   return loadConfigAt({ path: projectConfigPath(dir), scope: "project" });
 }
+async function loadGlobalConfig() {
+  return loadConfigAt({ path: configPath, scope: "global" });
+}
 async function loadRuntimeConfig(cwd) {
   const location = await resolveConfigLocation(cwd);
   if (location.scope === "project" && !await isWorkspaceTrusted(cwd)) {
@@ -886,7 +891,7 @@ async function addProvider(url, key, options = {}) {
     await initProjectConfig(cwd);
     await trustWorkspace(cwd);
   }
-  const config = options.local ? await loadProjectConfig(cwd) : (await loadRuntimeConfig(cwd)).config;
+  const config = options.local ? await loadProjectConfig(cwd) : process.env.KITCODE_CONFIG ? await loadConfig(cwd) : await loadGlobalConfig();
   const auth = await loadAuth();
   const configBefore = structuredClone(config);
   const authBefore = { ...auth };
@@ -1299,12 +1304,12 @@ function exportFileName(state) {
 }
 function renderSessionMarkdown(state) {
   const lines = [
-    `# ${state.title || `KitCode session ${shortSessionId(state.id)}`}`,
+    `# ${escapeMarkdownInline(state.title || `KitCode session ${shortSessionId(state.id)}`)}`,
     "",
-    `- Session: ${state.id}`,
-    `- Workspace: ${state.cwd}`,
-    `- Model: ${state.model || "unknown"}`,
-    `- Updated: ${state.updatedAt}`,
+    `- Session: ${escapeMarkdownInline(state.id)}`,
+    `- Workspace: ${escapeMarkdownInline(state.cwd)}`,
+    `- Model: ${escapeMarkdownInline(state.model || "unknown")}`,
+    `- Updated: ${escapeMarkdownInline(state.updatedAt)}`,
     ""
   ];
   for (const message of state.messages) {
@@ -1319,18 +1324,41 @@ function renderMessage(content) {
   const sections = [];
   for (const block of content) {
     if (block.type === "text") sections.push(block.text);
-    else if (block.type === "image") sections.push(`[Image attached: ${block.name}]`);
-    else if (block.type === "file") sections.push(`[File attached: ${block.name}]
+    else if (block.type === "image") {
+      sections.push(`[Image attached: ${escapeMarkdownInline(block.name)}]`);
+    } else if (block.type === "file") {
+      sections.push(
+        `[File attached: ${escapeMarkdownInline(block.name)}]
 
-${block.text}`);
-    else if (block.type === "tool_use") sections.push(`> Tool: ${block.name}`);
-    else if (block.type === "tool_result") {
+${markdownCodeFence(block.text)}`
+      );
+    } else if (block.type === "tool_use") {
+      sections.push(`> Tool: ${escapeMarkdownInline(block.name)}`);
+    } else if (block.type === "tool_result") {
+      const result = block.content.replace(/\r\n?/g, "\n").split("\n").map((line) => `> ${line}`).join("\n");
       sections.push(`> Tool result${block.isError ? " (error)" : ""}:
-> ${block.content.replace(/\n/g, "\n> ")}`);
+${result}`);
     }
   }
   return sections.join("\n\n").trim();
 }
+function escapeMarkdownInline(value) {
+  return value.replace(/[\r\n\t]+/g, " ").replace(/([\\`*_[\]<>])/g, "\\$1");
+}
+function markdownCodeFence(value) {
+  const normalized = value.replace(/\r\n?/g, "\n");
+  const backtickLength = longestMarkerRun(normalized, /`+/g) + 1;
+  const tildeLength = longestMarkerRun(normalized, /~+/g) + 1;
+  const marker = backtickLength <= tildeLength ? "`" : "~";
+  const fence = marker.repeat(Math.max(3, Math.min(backtickLength, tildeLength)));
+  return `${fence}
+${normalized}${normalized.endsWith("\n") ? "" : "\n"}${fence}`;
+}
+function longestMarkerRun(value, pattern) {
+  let longest = 0;
+  for (const match of value.matchAll(pattern)) longest = Math.max(longest, match[0].length);
+  return longest;
+}
 function readContextUsage(value) {
   if (typeof value !== "object" || value === null) return void 0;
   const candidate = value;
@@ -2509,8 +2537,8 @@ function looksLikeAttachmentPath(value) {
   if (path7.isAbsolute(candidate)) return true;
   if (/^(?:~|\.{1,2})[\\/]/.test(candidate)) return true;
   if (candidate.includes("/") || candidate.includes("\\")) return true;
-  const basename2 = path7.basename(candidate).toLowerCase();
-  return path7.extname(basename2) !== "" || AUTO_PATH_NAMES.has(basename2);
+  const basename3 = path7.basename(candidate).toLowerCase();
+  return path7.extname(basename3) !== "" || AUTO_PATH_NAMES.has(basename3);
 }
 async function loadClipboardImage(platform = process.platform, runner = runClipboardCommand) {
   const commands = clipboardCommands(platform);
@@ -2586,8 +2614,8 @@ function resolveAttachmentPath(cwd, requestedPath) {
   return path7.isAbsolute(expanded) ? path7.normalize(expanded) : path7.resolve(cwd, expanded);
 }
 function isSensitiveAutomaticPath(file) {
-  const basename2 = path7.basename(file).toLowerCase();
-  return basename2.startsWith(".env.") || SENSITIVE_AUTO_NAMES.has(basename2) || SENSITIVE_AUTO_EXTENSIONS.has(path7.extname(basename2));
+  const basename3 = path7.basename(file).toLowerCase();
+  return basename3.startsWith(".env.") || SENSITIVE_AUTO_NAMES.has(basename3) || SENSITIVE_AUTO_EXTENSIONS.has(path7.extname(basename3));
 }
 function attachmentLabel(block) {
   if (block.type === "image") return `image: ${block.name}`;
@@ -3424,7 +3452,7 @@ function clip(value) {
 // package.json
 var package_default = {
   name: "@kernelonpanic/kitcode",
-  version: "1.2.0",
+  version: "1.2.5",
   description: "Terminal coding agent with a config you never have to write by hand",
   type: "module",
   license: "MIT",
@@ -3465,6 +3493,7 @@ var package_default = {
     "ink-text-input": "^6.0.0",
     openai: "^7.3.0",
     react: "^19.2.8",
+    "string-width": "^8.2.2",
     zod: "^4.4.3"
   },
   devDependencies: {
@@ -3491,8 +3520,7 @@ var package_default = {
 
 // src/version.ts
 var KITCODE_VERSION = package_default.version;
-var KITCODE_REPOSITORY = "KernelEditor/KitCode";
-var KITCODE_COMMIT = true ? "c93b03ff85112af7b4c28f543aff6b9377f84ad6" : "development";
+var KITCODE_COMMIT = true ? "e9d5bdd60b06f2ee8d2d28f0d53b13d68298ae6b" : "development";
 
 // src/mcp/client.ts
 var clientInfo = { name: "kitcode", version: KITCODE_VERSION };
@@ -3633,9 +3661,9 @@ function createMcpManager(servers) {
       serverStates.delete(name);
     },
     async close() {
-      const open2 = [...sessions.values()];
+      const open3 = [...sessions.values()];
       sessions.clear();
-      await Promise.all(open2.map((session) => session.client.close().catch(() => {
+      await Promise.all(open3.map((session) => session.client.close().catch(() => {
       })));
     },
     states() {
@@ -4071,12 +4099,12 @@ function createAnthropicProvider(args) {
   return {
     id: args.id,
     kind: "anthropic",
-    stream: (req) => streamTurn(client, args.id, req),
-    listModels: () => listModels(client, args.id),
+    stream: (req) => streamTurn(client, args.id, args.apiKey, req),
+    listModels: () => listModels(client, args.id, args.apiKey),
     knownModels: () => KNOWN_MODELS
   };
 }
-async function* streamTurn(client, providerId, req) {
+async function* streamTurn(client, providerId, apiKey2, req) {
   const params = {
     model: req.model,
     max_tokens: req.maxTokens,
@@ -4117,9 +4145,9 @@ async function* streamTurn(client, providerId, req) {
     const limits2 = parseRateLimits(capture.headers());
     if (limits2) yield { type: "rate_limits", limits: limits2 };
     if (events === 0 && capture.succeeded() && !isConnectionFailure(error)) {
-      throw await invalidStreamError(providerId, capture, error);
+      throw await invalidStreamError(providerId, capture, error, [apiKey2]);
     }
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
   const stopReason = STOP_REASONS[final.stop_reason ?? ""] ?? "end_turn";
   const content = toContentBlocks(final.content);
@@ -4138,7 +4166,7 @@ async function* streamTurn(client, providerId, req) {
     ...stopReason === "refusal" ? { refusal: toRefusal(final.stop_details) } : {}
   };
 }
-async function listModels(client, providerId) {
+async function listModels(client, providerId, apiKey2) {
   try {
     const models = [];
     for await (const model of client.models.list({ limit: 100 })) {
@@ -4152,7 +4180,7 @@ async function listModels(client, providerId) {
     }
     return models;
   } catch (error) {
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
 }
 function toMessageParams(messages) {
@@ -4256,12 +4284,12 @@ function createOpenAiProvider(args) {
   return {
     id: args.id,
     kind: "openai",
-    stream: (req) => streamTurn2(client, args.id, req),
-    listModels: () => listModels2(client, args.id),
+    stream: (req) => streamTurn2(client, args.id, args.apiKey, req),
+    listModels: () => listModels2(client, args.id, args.apiKey),
     knownModels: () => []
   };
 }
-async function* streamTurn2(client, providerId, req) {
+async function* streamTurn2(client, providerId, apiKey2, req) {
   let text = "";
   let thinking = "";
   let finishReason = null;
@@ -4309,19 +4337,20 @@ async function* streamTurn2(client, providerId, req) {
     if (!isUserAbort(error, req.signal)) {
       const limits2 = parseRateLimits(capture.headers());
       if (limits2) yield { type: "rate_limits", limits: limits2 };
-      throw toProviderError(error, providerId);
+      throw toProviderError(error, providerId, [apiKey2]);
     }
     aborted = true;
   }
-  const content = toContentBlocks2(thinking, text, calls);
   if (aborted || req.signal?.aborted) {
+    const content2 = toTextContentBlocks(thinking, text);
     if (sawUsage) yield { type: "usage", usage };
     const limits2 = parseRateLimits(capture.headers());
     if (limits2) yield { type: "rate_limits", limits: limits2 };
-    yield { type: "done", stopReason: "aborted", content };
+    yield { type: "done", stopReason: "aborted", content: content2 };
     return;
   }
-  if (recognised === 0) throw await invalidStreamError(providerId, capture);
+  if (recognised === 0) throw await invalidStreamError(providerId, capture, void 0, [apiKey2]);
+  const content = toContentBlocks2(providerId, thinking, text, calls);
   for (const block of content) {
     if (block.type === "tool_use") {
       yield { type: "tool_call", id: block.id, name: block.name, input: block.input };
@@ -4338,7 +4367,7 @@ function resolveStop(finishReason, hasCalls) {
   if (hasCalls) return "tool_use";
   return mapped ?? "end_turn";
 }
-async function listModels2(client, providerId) {
+async function listModels2(client, providerId, apiKey2) {
   try {
     const models = [];
     for await (const model of client.models.list()) {
@@ -4347,7 +4376,7 @@ async function listModels2(client, providerId) {
     }
     return models;
   } catch (error) {
-    throw toProviderError(error, providerId);
+    throw toProviderError(error, providerId, [apiKey2]);
   }
 }
 function accumulate(calls, delta) {
@@ -4357,10 +4386,8 @@ function accumulate(calls, delta) {
   if (delta.function?.arguments) call.args += delta.function.arguments;
   calls.set(delta.index, call);
 }
-function toContentBlocks2(thinking, text, calls) {
-  const content = [];
-  if (thinking) content.push({ type: "thinking", text: thinking });
-  if (text) content.push({ type: "text", text });
+function toContentBlocks2(providerId, thinking, text, calls) {
+  const content = toTextContentBlocks(thinking, text);
   const sorted = [...calls.entries()].sort((a, b) => a[0] - b[0]);
   const tmpId = (position) => `call_${position}`;
   for (const [position, [, call]] of sorted.entries()) {
@@ -4368,18 +4395,34 @@ function toContentBlocks2(thinking, text, calls) {
       type: "tool_use",
       id: call.id || tmpId(position),
       name: call.name,
-      input: parseArguments(call.args)
+      input: parseArguments(providerId, call.name, call.args)
     });
   }
   return content;
 }
-function parseArguments(args) {
-  if (!args) return {};
+function toTextContentBlocks(thinking, text) {
+  const content = [];
+  if (thinking) content.push({ type: "thinking", text: thinking });
+  if (text) content.push({ type: "text", text });
+  return content;
+}
+function parseArguments(providerId, toolName, args) {
+  let parsed;
   try {
-    return JSON.parse(args);
+    parsed = JSON.parse(args);
   } catch {
-    return {};
+    throw new ProviderError(
+      `Tool "${toolName || "unknown"}" returned malformed JSON arguments; the tool was not run.`,
+      providerId
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ProviderError(
+      `Tool "${toolName || "unknown"}" arguments must be a JSON object; the tool was not run.`,
+      providerId
+    );
   }
+  return parsed;
 }
 function toChatMessages(system, messages) {
   const out = [{ role: "system", content: system }];
@@ -4512,7 +4555,7 @@ function createPermissionEngine(configPermissions) {
     decide(tool, requested) {
       const configured = resolve3(tool, requested);
       if (configured === "deny") return "deny";
-      if (current === "plan" && configured !== "allow") return "deny";
+      if (current === "plan" && tool.readOnly !== true) return "deny";
       if (configured === "allow") return "allow";
       if (bypassEnabled) return "allow";
       if (current === "accept" && isFileEdit(tool)) return "allow";
@@ -4524,8 +4567,9 @@ function createPermissionEngine(configPermissions) {
     },
     denyReason(tool, requested) {
       const configured = resolve3(tool, requested);
+      if (current === "plan" && tool.readOnly !== true) return PLAN_REFUSAL;
       if (configured === "deny" || configured === "allow") return void 0;
-      return current === "plan" ? PLAN_REFUSAL : void 0;
+      return void 0;
     },
     bypass: {
       enable() {
@@ -4555,7 +4599,133 @@ function isFileEdit(tool) {
 }
 
 // src/tools/edit.ts
-import { lstat as lstat3, readFile as readFile8, stat as stat6, writeFile as writeFile6 } from "fs/promises";
+import { readFile as readFile8, stat as stat6 } from "fs/promises";
+
+// src/tools/safe-write.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod5, lstat as lstat3, open, rename as rename5, rm as rm3 } from "fs/promises";
+import { basename as basename2, dirname as dirname2, join } from "path";
+var UnsafeFileChangeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsafeFileChangeError";
+  }
+};
+async function readSafeFileSnapshot(file, maxBytes) {
+  const parent = await lstat3(dirname2(file));
+  if (parent.isSymbolicLink() || !parent.isDirectory()) {
+    throw new UnsafeFileChangeError("the parent path is not a real directory");
+  }
+  const parentIdentity = directoryIdentity(parent);
+  const pathInfo = await lstatMaybe(file);
+  if (!pathInfo) return { exists: false, data: null, mode: 438, parent: parentIdentity };
+  if (pathInfo.isSymbolicLink()) {
+    throw new UnsafeFileChangeError("the path is a symbolic link");
+  }
+  if (!pathInfo.isFile()) throw new UnsafeFileChangeError("the path is not a regular file");
+  if (pathInfo.size > maxBytes) throw new UnsafeFileChangeError("the file is too large");
+  const handle = await open(file, "r");
+  try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || !sameObject(pathInfo, opened)) {
+      throw new UnsafeFileChangeError("the file changed while it was being opened");
+    }
+    const data = await readBounded(handle, maxBytes);
+    const afterRead = await handle.stat();
+    if (!sameVersion(opened, afterRead)) {
+      throw new UnsafeFileChangeError("the file changed while it was being read");
+    }
+    return {
+      exists: true,
+      data,
+      mode: opened.mode & 511,
+      identity: fileIdentity(opened),
+      parent: parentIdentity
+    };
+  } finally {
+    await handle.close();
+  }
+}
+async function atomicWriteSafeFile(file, data, snapshot) {
+  const parent = dirname2(file);
+  await assertSameParent(parent, snapshot.parent);
+  const temp = join(parent, `.${basename2(file)}.${process.pid}.${randomUUID3()}.tmp`);
+  let handle;
+  try {
+    handle = await open(temp, "wx", snapshot.mode);
+    await handle.writeFile(data, typeof data === "string" ? { encoding: "utf8" } : void 0);
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await chmod5(temp, snapshot.mode);
+    await assertSameParent(parent, snapshot.parent);
+    const current = await lstatMaybe(file);
+    if (!matchesSnapshot2(current, snapshot)) {
+      throw new UnsafeFileChangeError("the destination changed before it could be replaced");
+    }
+    await rename5(temp, file);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    await rm3(temp, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function readBounded(handle, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const remaining = maxBytes + 1 - total;
+    if (remaining <= 0) throw new UnsafeFileChangeError("the file is too large");
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+    if (bytesRead === 0) return Buffer.concat(chunks, total);
+    chunks.push(chunk.subarray(0, bytesRead));
+    total += bytesRead;
+  }
+}
+async function assertSameParent(parent, expected) {
+  const current = await lstat3(parent);
+  if (current.isSymbolicLink() || !current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
+    throw new UnsafeFileChangeError("the parent directory changed during the write");
+  }
+}
+function matchesSnapshot2(current, snapshot) {
+  if (!snapshot.exists) return current === null;
+  return Boolean(
+    current && !current.isSymbolicLink() && current.isFile() && sameIdentity(current, snapshot.identity)
+  );
+}
+function sameObject(left, right) {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+function sameVersion(left, right) {
+  return sameObject(left, right) && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function sameIdentity(info, identity2) {
+  return info.dev === identity2.dev && info.ino === identity2.ino && info.size === identity2.size && info.mtimeMs === identity2.mtimeMs && info.ctimeMs === identity2.ctimeMs;
+}
+function fileIdentity(info) {
+  return {
+    dev: info.dev,
+    ino: info.ino,
+    size: info.size,
+    mtimeMs: info.mtimeMs,
+    ctimeMs: info.ctimeMs
+  };
+}
+function directoryIdentity(info) {
+  return { dev: info.dev, ino: info.ino };
+}
+async function lstatMaybe(file) {
+  try {
+    return await lstat3(file);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+// src/tools/edit.ts
 var MAX_FILE_BYTES2 = 5e6;
 function countOccurrences(haystack, needle) {
   if (needle === "") return 0;
@@ -4611,19 +4781,14 @@ var editTool = {
     const { path: path14, oldString, newString, replaceAll = false } = input;
     const safe = resolveInside(ctx.cwd, path14);
     if (!safe.ok) return { content: safe.reason, isError: true };
-    const linkInfo = await lstat3(safe.path).catch(() => null);
-    if (linkInfo?.isSymbolicLink()) {
-      return { content: `Cannot edit ${path14}: the path is a symbolic link. Remove the symlink first.`, isError: true };
-    }
-    const info = await stat6(safe.path).catch(() => null);
-    if (info && info.size > MAX_FILE_BYTES2) {
-      return {
-        content: `Cannot edit ${path14}: the file exceeds the ${MAX_FILE_BYTES2 / 1e6} MB limit.`,
-        isError: true
-      };
+    let snapshot;
+    try {
+      snapshot = await readSafeFileSnapshot(safe.path, MAX_FILE_BYTES2);
+    } catch (error) {
+      return { content: `Cannot edit ${path14}: ${error.message}.`, isError: true };
     }
-    const beforeBuffer = await readFile8(safe.path).catch(() => null);
-    if (beforeBuffer === null) return { content: `Cannot read ${path14}.`, isError: true };
+    if (!snapshot.exists) return { content: `Cannot read ${path14}.`, isError: true };
+    const beforeBuffer = snapshot.data;
     if (beforeBuffer.subarray(0, 8192).includes(0)) {
       return { content: `Cannot edit ${path14}: it is a binary file, not text.`, isError: true };
     }
@@ -4655,7 +4820,7 @@ var editTool = {
       return { content: `Checkpoint capture failed: ${error.message}`, isError: true };
     }
     try {
-      await writeFile6(safe.path, after, "utf8");
+      await atomicWriteSafeFile(safe.path, after, snapshot);
       ctx.checkpoint?.markChanged(safe.path);
     } catch (error) {
       return { content: `Failed to write ${path14}: ${error.message}`, isError: true };
@@ -4675,7 +4840,7 @@ function replacement(before, oldString, newString, replaceAll) {
 }
 
 // src/tools/glob.ts
-import { join } from "path";
+import { join as join2 } from "path";
 import fg from "fast-glob";
 var MAX_RESULTS = 500;
 var IGNORED_DIRECTORIES = ["**/node_modules/**", "**/.git/**", "**/dist/**"];
@@ -4692,6 +4857,7 @@ var globTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   summarize(input) {
     return `glob(${brief(input.pattern)})`;
   },
@@ -4713,7 +4879,7 @@ var globTool = {
     });
     if (entries.length === 0) return { content: `No files matched ${pattern}` };
     entries.sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0));
-    const paths = entries.slice(0, MAX_RESULTS).map((entry) => join(safe.relative, entry.path));
+    const paths = entries.slice(0, MAX_RESULTS).map((entry) => join2(safe.relative, entry.path));
     if (entries.length > MAX_RESULTS) {
       paths.push(`... truncated: ${entries.length - MAX_RESULTS} more files matched.`);
     }
@@ -4723,7 +4889,7 @@ var globTool = {
 
 // src/tools/grep.ts
 import { readFile as readFile9, stat as stat7 } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import fg2 from "fast-glob";
 
 // src/tools/sensitive.ts
@@ -4872,6 +5038,7 @@ var grepTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   permission(input, ctx) {
     const { path: path14, glob } = input ?? {};
     if (isSensitivePath(path14) || mentionsSensitivePattern(glob)) return "ask";
@@ -4910,8 +5077,8 @@ var grepTool = {
       ignore: IGNORED_DIRECTORIES,
       stats: true
     })).sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0)).map((entry) => ({
-      absolute: join2(safe.path, entry.path),
-      relative: join2(safe.relative, entry.path),
+      absolute: join3(safe.path, entry.path),
+      relative: join3(safe.relative, entry.path),
       size: entry.stats?.size ?? 0
     })) : [{ absolute: safe.path, relative: safe.relative, size: target.size }];
     const files = discovered.slice(0, MAX_FILES);
@@ -4979,6 +5146,7 @@ var readTool = {
     additionalProperties: false
   },
   defaultPermission: "allow",
+  readOnly: true,
   permission(input, ctx) {
     const target = input?.path;
     if (isSensitivePath(target)) return "ask";
@@ -5039,8 +5207,8 @@ function toToolSchema(tool) {
 }
 
 // src/tools/write.ts
-import { lstat as lstat4, mkdir as mkdir4, readFile as readFile11, stat as stat9, writeFile as writeFile7 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { mkdir as mkdir4, readFile as readFile11, stat as stat9 } from "fs/promises";
+import { dirname as dirname3 } from "path";
 var MAX_FILE_BYTES5 = 5e6;
 var writeTool = {
   name: "write",
@@ -5090,31 +5258,29 @@ var writeTool = {
     }
     const safe = resolveInside(ctx.cwd, path14);
     if (!safe.ok) return { content: safe.reason, isError: true };
-    const linkInfo = await lstat4(safe.path).catch(() => null);
-    if (linkInfo?.isSymbolicLink()) {
-      return { content: `Cannot write ${path14}: the path is a symbolic link. Remove the symlink first.`, isError: true };
-    }
-    const beforeInfo = await stat9(safe.path).catch(() => null);
-    if (beforeInfo && beforeInfo.size > MAX_FILE_BYTES5) {
-      return {
-        content: `Cannot replace ${path14}: the existing file exceeds the ${MAX_FILE_BYTES5 / 1e6} MB limit.`,
-        isError: true
-      };
-    }
-    const beforeBuffer = await readFile11(safe.path).catch(() => null);
-    if (beforeBuffer instanceof Buffer && beforeBuffer.subarray(0, 8192).includes(0)) {
-      return { content: `Cannot write ${path14}: the existing file is binary, not text.`, isError: true };
-    }
-    let before = "";
-    if (beforeBuffer) before = beforeBuffer.toString("utf8");
+    let target = safe.path;
+    let snapshot;
     try {
-      await mkdir4(dirname2(safe.path), { recursive: true });
-      await ctx.checkpoint?.capture(safe.path);
-      await writeFile7(safe.path, content, "utf8");
-      ctx.checkpoint?.markChanged(safe.path);
+      await mkdir4(dirname3(target), { recursive: true });
+      const rechecked = resolveInside(ctx.cwd, path14);
+      if (!rechecked.ok || rechecked.path !== target) {
+        return {
+          content: `Cannot write ${path14}: the path changed while its parent was created.`,
+          isError: true
+        };
+      }
+      target = rechecked.path;
+      snapshot = await readSafeFileSnapshot(target, MAX_FILE_BYTES5);
+      if (snapshot.exists && snapshot.data.subarray(0, 8192).includes(0)) {
+        return { content: `Cannot write ${path14}: the existing file is binary, not text.`, isError: true };
+      }
+      await ctx.checkpoint?.capture(target);
+      await atomicWriteSafeFile(target, content, snapshot);
+      ctx.checkpoint?.markChanged(target);
     } catch (error) {
       return { content: `Failed to write ${path14}: ${error.message}`, isError: true };
     }
+    const before = snapshot.exists ? snapshot.data.toString("utf8") : "";
     const lines = content === "" ? 0 : content.replace(/\n$/, "").split("\n").length;
     return {
       content: `${before === "" ? "Created" : "Updated"} ${path14} (${lines} ${lines === 1 ? "line" : "lines"})`,
@@ -5147,7 +5313,7 @@ function createToolRegistry(tools) {
 }
 
 // src/prompts/library.ts
-import { chmod as chmod5, readFile as readFile12, readdir as readdir3, unlink as unlink3, writeFile as writeFile8 } from "fs/promises";
+import { chmod as chmod6, readFile as readFile12, readdir as readdir3, unlink as unlink3, writeFile as writeFile6 } from "fs/promises";
 import path10 from "path";
 async function savePrompt(input) {
   const slug = slugify(input.name);
@@ -5161,11 +5327,11 @@ async function savePrompt(input) {
   };
   await ensureDir(promptsDir);
   const file = path10.join(promptsDir, `${slug}.md`);
-  await writeFile8(file, serialize(prompt), {
+  await writeFile6(file, serialize(prompt), {
     encoding: "utf8",
     mode: 384
   });
-  await chmod5(file, 384);
+  await chmod6(file, 384);
   return prompt;
 }
 async function getPrompt(slug) {
@@ -5252,18 +5418,21 @@ function parse(slug, text) {
 }
 
 // src/skills/library.ts
-import { open, readFile as readFile13, readdir as readdir4, stat as stat10 } from "fs/promises";
+import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
 import path11 from "path";
 var SKILL_FILE = "SKILL.md";
 var FRONTMATTER_BYTES = 8192;
 var MAX_SKILL_BYTES = 5e6;
 var MAX_SKILLS_PER_ROOT = 500;
+var guards = /* @__PURE__ */ new WeakMap();
 async function discoverSkills(dirs) {
   const byName = /* @__PURE__ */ new Map();
   for (const root of dirs) {
-    const entries = await readdir4(root).catch(() => []);
+    const rootInfo = await lstat4(root).catch(() => null);
+    if (!rootInfo?.isDirectory() || rootInfo.isSymbolicLink()) continue;
+    const entries = await readdir4(root, { withFileTypes: true }).catch(() => []);
     const found = await Promise.all(
-      entries.slice(0, MAX_SKILLS_PER_ROOT).map((entry) => readMeta(path11.join(root, entry)))
+      entries.filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).slice(0, MAX_SKILLS_PER_ROOT).map((entry) => readMeta(root, rootInfo, path11.join(root, entry.name)))
     );
     for (const meta of found) {
       if (meta && !byName.has(meta.name)) byName.set(meta.name, meta);
@@ -5272,11 +5441,25 @@ async function discoverSkills(dirs) {
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 async function loadSkill(meta) {
-  const info = await stat10(meta.file);
-  if (info.size > MAX_SKILL_BYTES) {
+  const guard = guards.get(meta);
+  if (!guard) throw new Error(`Skill was not discovered through a protected skill root: ${meta.file}`);
+  await assertIdentity(guard.root, guard.rootIdentity, "skill root");
+  await assertIdentity(meta.dir, guard.dirIdentity, "skill directory");
+  const opened = await openVerified(meta.file, guard.fileIdentity);
+  if (opened.info.size > MAX_SKILL_BYTES) {
+    await opened.handle.close();
     throw new Error(`Skill file exceeds the ${MAX_SKILL_BYTES / 1e6} MB limit: ${meta.file}`);
   }
-  const { body } = parseFrontmatter(await readFile13(meta.file, "utf8"));
+  let text;
+  try {
+    text = (await readBounded2(opened.handle, MAX_SKILL_BYTES)).toString("utf8");
+  } finally {
+    await opened.handle.close();
+  }
+  await assertIdentity(guard.root, guard.rootIdentity, "skill root");
+  await assertIdentity(meta.dir, guard.dirIdentity, "skill directory");
+  await assertIdentity(meta.file, guard.fileIdentity, "skill file");
+  const { body } = parseFrontmatter(text);
   return { ...meta, body };
 }
 function formatSkillCatalogue(skills) {
@@ -5286,20 +5469,33 @@ function formatSkillCatalogue(skills) {
     "\n"
   );
 }
-async function readMeta(dir) {
+async function readMeta(root, rootInfo, dir) {
+  const dirInfo = await lstat4(dir).catch(() => null);
+  if (!dirInfo?.isDirectory() || dirInfo.isSymbolicLink()) return null;
   const file = path11.join(dir, SKILL_FILE);
   const head = await readFrontmatterBytes(file);
-  if (head === null) return null;
-  const { fields } = parseFrontmatter(head);
-  return { name: fields.name || path11.basename(dir), description: fields.description ?? "", dir, file };
+  if (!head) return null;
+  const { fields } = parseFrontmatter(head.text);
+  const meta = { name: fields.name || path11.basename(dir), description: fields.description ?? "", dir, file };
+  guards.set(meta, {
+    root,
+    rootIdentity: identity(rootInfo),
+    dirIdentity: identity(dirInfo),
+    fileIdentity: head.identity
+  });
+  return meta;
 }
 async function readFrontmatterBytes(file) {
-  const handle = await open(file, "r").catch(() => null);
+  const before = await lstat4(file).catch(() => null);
+  if (!before?.isFile() || before.isSymbolicLink()) return null;
+  const handle = await open2(file, "r").catch(() => null);
   if (!handle) return null;
   try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || !sameIdentity2(opened, identity(before))) return null;
     const buffer = Buffer.alloc(FRONTMATTER_BYTES);
     const { bytesRead } = await handle.read(buffer, 0, FRONTMATTER_BYTES, 0);
-    return buffer.subarray(0, bytesRead).toString("utf8");
+    return { text: buffer.subarray(0, bytesRead).toString("utf8"), identity: identity(opened) };
   } catch {
     return null;
   } finally {
@@ -5307,6 +5503,44 @@ async function readFrontmatterBytes(file) {
     });
   }
 }
+async function openVerified(file, expected) {
+  const before = await lstat4(file);
+  if (!before.isFile() || before.isSymbolicLink() || !sameIdentity2(before, expected)) {
+    throw new Error(`Refusing changed or symlinked skill file: ${file}`);
+  }
+  const handle = await open2(file, "r");
+  const info = await handle.stat();
+  if (!info.isFile() || !sameIdentity2(info, expected)) {
+    await handle.close();
+    throw new Error(`Refusing skill file changed while opening: ${file}`);
+  }
+  return { handle, info };
+}
+async function assertIdentity(file, expected, label) {
+  const info = await lstat4(file);
+  if (info.isSymbolicLink() || !sameIdentity2(info, expected)) {
+    throw new Error(`Refusing changed or symlinked ${label}: ${file}`);
+  }
+}
+async function readBounded2(handle, maxBytes) {
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const remaining = maxBytes + 1 - total;
+    if (remaining <= 0) throw new Error(`Skill file exceeds the ${maxBytes / 1e6} MB limit`);
+    const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, remaining));
+    const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+    if (bytesRead === 0) return Buffer.concat(chunks, total);
+    chunks.push(chunk.subarray(0, bytesRead));
+    total += bytesRead;
+  }
+}
+function identity(info) {
+  return { dev: info.dev, ino: info.ino };
+}
+function sameIdentity2(info, expected) {
+  return info.dev === expected.dev && info.ino === expected.ino;
+}
 function parseFrontmatter(text) {
   const lines = text.split("\n");
   const fields = {};
@@ -5325,7 +5559,7 @@ function parseFrontmatter(text) {
 }
 
 // src/skills/install.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { execFileSync } from "child_process";
 import {
   existsSync as existsSync2,
@@ -5337,7 +5571,7 @@ import {
   rmSync,
   writeFileSync
 } from "fs";
-import { chmod as chmod6, mkdir as mkdir5 } from "fs/promises";
+import { chmod as chmod7, mkdir as mkdir5 } from "fs/promises";
 import path12 from "path";
 var TMP_DIR = path12.join(skillsDir, ".tmp");
 var MAX_SKILL_BYTES2 = 5e6;
@@ -5366,7 +5600,7 @@ async function installFromGitHub(url) {
   const { owner, repo, subdir, branch } = parseGitHubUrl(url);
   const name = safeSkillName(subdir ? path12.posix.basename(subdir) : repo);
   const skillDir = safeChildPath(skillsDir, name);
-  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID3()}`);
+  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID4()}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
     const cloneUrl = `https://github.com/${owner}/${repo}.git`;
@@ -5388,7 +5622,7 @@ async function installFromNpm(packageName) {
   if (!parsedName) throw new Error(`Invalid npm package name: ${packageName}`);
   const name = safeSkillName(parsedName);
   const skillDir = safeChildPath(skillsDir, name);
-  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID3()}`);
+  const tmpDir = safeChildPath(TMP_DIR, `${name}-${randomUUID4()}`);
   try {
     mkdirSync(tmpDir, { recursive: true });
     execFileSync("npm", ["pack", packageName, "--prefix", tmpDir], {
@@ -5492,7 +5726,7 @@ async function writeSkillFile(dir, body) {
     throw new Error(`Refusing to replace symlinked skill file: ${file}`);
   }
   writeFileSync(file, body, { encoding: "utf8", mode: 384 });
-  await chmod6(file, 384);
+  await chmod7(file, 384);
 }
 function parseGitHubUrl(url) {
   let parsed;
@@ -5586,6 +5820,7 @@ function createSkillTool(skills) {
       additionalProperties: false
     },
     defaultPermission: "allow",
+    readOnly: true,
     summarize(input) {
       return `skill(${brief(input.name)})`;
     },
@@ -5691,50 +5926,94 @@ function field(input, key) {
 }
 
 // src/core/update.ts
-var UPDATE_URL = `https://api.github.com/repos/${KITCODE_REPOSITORY}/commits/main`;
+var UPDATE_URL = "https://registry.npmjs.org/%40kernelonpanic%2Fkitcode/latest";
+var PACKAGE_URL = "https://www.npmjs.com/package/@kernelonpanic/kitcode";
 var TIMEOUT_MS = 4e3;
 var MAX_RESPONSE_BYTES2 = 128e3;
-async function checkForUpdates(fetcher = fetch, currentCommit = KITCODE_COMMIT) {
-  if (currentCommit === "development") {
-    return { status: "unknown", reason: "development build has no embedded commit" };
+async function checkForUpdates(fetcher = fetch, currentVersion = KITCODE_VERSION) {
+  if (!parseSemver(currentVersion)) {
+    return { status: "unknown", reason: "installed KitCode version is not valid semver" };
   }
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
   try {
     const response = await fetcher(UPDATE_URL, {
       headers: {
-        accept: "application/vnd.github+json",
-        "user-agent": `KitCode/${KITCODE_VERSION}`,
-        "x-github-api-version": "2022-11-28"
+        accept: "application/json",
+        "user-agent": `KitCode/${currentVersion}`
       },
       redirect: "error",
       signal: controller.signal
     });
     if (!response.ok) {
       await response.body?.cancel().catch(() => void 0);
-      return { status: "unknown", reason: `GitHub returned ${response.status}` };
+      return { status: "unknown", reason: `npm registry returned ${response.status}` };
     }
     const payload = await readJsonBounded(response);
-    if (!payload) return { status: "unknown", reason: "GitHub response was too large or invalid" };
-    if (typeof payload.sha !== "string" || !/^[0-9a-f]{40}$/i.test(payload.sha)) {
-      return { status: "unknown", reason: "GitHub response did not contain a commit" };
+    if (!payload) return { status: "unknown", reason: "npm response was too large or invalid" };
+    if (typeof payload.version !== "string" || !parseSemver(payload.version)) {
+      return { status: "unknown", reason: "npm response did not contain a valid version" };
     }
-    const current = currentCommit.toLowerCase();
-    const latest = payload.sha.toLowerCase();
-    if (latest.startsWith(current) || current.startsWith(latest)) {
-      return { status: "current", current, latest };
+    const latest = payload.version;
+    if (compareSemver(latest, currentVersion) <= 0) {
+      return { status: "current", current: currentVersion, latest };
     }
-    const url = typeof payload.html_url === "string" && payload.html_url.startsWith("https://github.com/") ? payload.html_url : `https://github.com/${KITCODE_REPOSITORY}/commits/main`;
-    return { status: "available", current, latest, url };
+    return {
+      status: "available",
+      current: currentVersion,
+      latest,
+      url: `${PACKAGE_URL}/v/${encodeURIComponent(latest)}`
+    };
   } catch (error) {
     return {
       status: "unknown",
-      reason: error instanceof Error && error.name === "AbortError" ? "GitHub check timed out" : "GitHub check failed"
+      reason: error instanceof Error && error.name === "AbortError" ? "npm update check timed out" : "npm update check failed"
     };
   } finally {
     clearTimeout(timer);
   }
 }
+function compareSemver(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) throw new Error("Cannot compare invalid semantic versions");
+  for (let index = 0; index < 3; index += 1) {
+    const x = a.core[index] ?? 0n;
+    const y = b.core[index] ?? 0n;
+    if (x !== y) return x > y ? 1 : -1;
+  }
+  if (a.prerelease.length === 0 || b.prerelease.length === 0) {
+    if (a.prerelease.length === b.prerelease.length) return 0;
+    return a.prerelease.length === 0 ? 1 : -1;
+  }
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const x = a.prerelease[index];
+    const y = b.prerelease[index];
+    if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+    if (x === y) continue;
+    const xNumeric = /^\d+$/.test(x);
+    const yNumeric = /^\d+$/.test(y);
+    if (xNumeric && yNumeric) return BigInt(x) > BigInt(y) ? 1 : -1;
+    if (xNumeric !== yNumeric) return xNumeric ? -1 : 1;
+    return x > y ? 1 : -1;
+  }
+  return 0;
+}
+function parseSemver(value) {
+  const match = value.match(
+    /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/
+  );
+  if (!match) return null;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) {
+    return null;
+  }
+  return {
+    core: [BigInt(match[1]), BigInt(match[2]), BigInt(match[3])],
+    prerelease
+  };
+}
 async function readJsonBounded(response) {
   const declared = Number(response.headers.get("content-length"));
   if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES2) {
@@ -5782,7 +6061,7 @@ async function boot(options) {
   const warnings = [];
   const workspaceRoot2 = await canonicalWorkspace(options.cwd);
   const workspaceTrusted = await isWorkspaceTrusted(options.cwd);
-  const startupUpdate = config.updates.checkOnStart ? checkForUpdates() : null;
+  let startupUpdate;
   if (loadedConfig.ignoredProject) {
     warnings.push(
       `Project config ignored until this workspace is trusted: ${loadedConfig.ignoredProject.path}. Review it, then run: kitcode trust`
@@ -6395,7 +6674,7 @@ ${lines.join("\n")}` : null;
       const states = mcp.states();
       const lines = [
         `KitCode ${KITCODE_VERSION} \xB7 ${KITCODE_COMMIT.slice(0, 12)}`,
-        `updates: ${config.updates.checkOnStart ? "enabled" : "disabled"}`,
+        "updates: npm check runs on every app start",
         `runtime: Node ${process.versions.node} \xB7 ${process.platform}/${process.arch}`,
         `workspace: ${options.cwd}`,
         `config: ${location.path}`,
@@ -6423,7 +6702,8 @@ ${lines.join("\n")}` : null;
       );
       return lines.join("\n");
     },
-    startupUpdateCheck: () => startupUpdate,
+    startupUpdateCheck: () => startupUpdate ??= checkForUpdates(),
+    checkForUpdates: () => checkForUpdates(),
     async run(history, hooks, signal) {
       syncMcpTools();
       const runProviderId = parseModelRef(modelRef)?.provider;
@@ -6561,6 +6841,13 @@ async function ask(text, options = {}) {
     mode: options.mode
   });
   for (const warning of warnings) console.error(sanitizeTerminalText(warning));
+  const update = await runtime.startupUpdateCheck();
+  if (update.status === "available") {
+    console.error(
+      `A newer KitCode version is available (${update.latest}). Update with: npm install -g @kernelonpanic/kitcode@latest
+${update.url}`
+    );
+  }
   const controller = new AbortController();
   const onInterrupt = () => controller.abort();
   process.on("SIGINT", onInterrupt);
@@ -6730,7 +7017,7 @@ function validateKey(value) {
 import { render } from "ink";
 
 // src/ui/App.tsx
-import { Box as Box13, Text as Text12, useApp, useInput as useInput2, useWindowSize as useWindowSize2 } from "ink";
+import { Box as Box13, Text as Text12, useApp, useInput as useInput2, useWindowSize as useWindowSize4 } from "ink";
 import { useCallback, useEffect as useEffect2, useMemo as useMemo4, useRef as useRef4, useState as useState5 } from "react";
 
 // src/mcp/add.ts
@@ -6784,6 +7071,7 @@ var COMMANDS = [
   { name: "mcp", args: "[add|list|delete|enable|disable]" },
   { name: "attach", args: "<path|clipboard|clear>" },
   { name: "compact" },
+  { name: "update" },
   { name: "checker" },
   { name: "sessions", args: "[list|rename|delete [all]|export]" },
   { name: "config" },
@@ -7026,7 +7314,11 @@ var en = {
   sessionActionRename: "rename",
   sessionActionDelete: "delete",
   sessionActionExport: "export Markdown",
-  updateAvailable: (version, url) => `A newer KitCode build is available (${version}): ${url}`,
+  updateAvailable: (version, url) => `A newer KitCode version is available (${version}). Update with:
+npm install -g @kernelonpanic/kitcode@latest
+${url}`,
+  updateCurrent: (version) => `KitCode ${version} is up to date.`,
+  updateFailed: (reason) => `Could not check for updates: ${reason}.`,
   accentSet: (name, hex) => `Accent: ${name} (${hex})`,
   reasoning: (on) => `Reasoning ${on ? "on" : "off"}`,
   effortSet: (value) => `Effort: ${value}`,
@@ -7101,6 +7393,7 @@ var en = {
     "mcp disable": "disconnect without removing an MCP server",
     attach: "attach an image or text file to the next message",
     compact: "summarize older context and keep recent turns",
+    update: "check npm for a newer KitCode version",
     checker: "check local setup without spending model tokens",
     sessions: "search and manage saved sessions",
     "sessions list": "list saved sessions",
@@ -7209,7 +7502,11 @@ var ru = {
   sessionActionRename: "\u043F\u0435\u0440\u0435\u0438\u043C\u0435\u043D\u043E\u0432\u0430\u0442\u044C",
   sessionActionDelete: "\u0443\u0434\u0430\u043B\u0438\u0442\u044C",
   sessionActionExport: "\u044D\u043A\u0441\u043F\u043E\u0440\u0442\u0438\u0440\u043E\u0432\u0430\u0442\u044C Markdown",
-  updateAvailable: (version, url) => `\u0414\u043E\u0441\u0442\u0443\u043F\u043D\u0430 \u043D\u043E\u0432\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode (${version}): ${url}`,
+  updateAvailable: (version, url) => `\u0414\u043E\u0441\u0442\u0443\u043F\u043D\u0430 \u043D\u043E\u0432\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode (${version}). \u041E\u0431\u043D\u043E\u0432\u0438\u0442\u044C:
+npm install -g @kernelonpanic/kitcode@latest
+${url}`,
+  updateCurrent: (version) => `\u0423\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D\u0430 \u0430\u043A\u0442\u0443\u0430\u043B\u044C\u043D\u0430\u044F \u0432\u0435\u0440\u0441\u0438\u044F KitCode ${version}.`,
+  updateFailed: (reason) => `\u041D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C \u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043E\u0431\u043D\u043E\u0432\u043B\u0435\u043D\u0438\u044F: ${reason}.`,
   accentSet: (name, hex) => `\u0426\u0432\u0435\u0442: ${name} (${hex})`,
   reasoning: (on) => `\u0420\u0430\u0437\u043C\u044B\u0448\u043B\u0435\u043D\u0438\u044F ${on ? "\u0432\u043A\u043B\u044E\u0447\u0435\u043D\u044B" : "\u0432\u044B\u043A\u043B\u044E\u0447\u0435\u043D\u044B"}`,
   effortSet: (value) => `\u0413\u043B\u0443\u0431\u0438\u043D\u0430: ${value}`,
@@ -7272,6 +7569,7 @@ var ru = {
     lang: "\u0441\u043C\u0435\u043D\u0438\u0442\u044C \u044F\u0437\u044B\u043A \u0438\u043D\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430",
     prompt: "\u0432\u0441\u0442\u0430\u0432\u0438\u0442\u044C \u0438\u043B\u0438 \u0441\u043E\u0445\u0440\u0430\u043D\u0438\u0442\u044C \u043F\u0440\u043E\u043C\u0442",
     skills: "\u0441\u043F\u0438\u0441\u043E\u043A \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D\u043D\u044B\u0445 \u0441\u043A\u0438\u043B\u043B\u043E\u0432",
+    "prompt delete": "\u0443\u0434\u0430\u043B\u0438\u0442\u044C \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u044B\u0439 \u043F\u0440\u043E\u043C\u0442",
     bypass: "\u043E\u0442\u043A\u043B\u044E\u0447\u0438\u0442\u044C \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043D\u0438\u044F (\u0441\u043F\u0440\u043E\u0441\u0438\u0442 \u0434\u0432\u0430\u0436\u0434\u044B)",
     usage: "\u0442\u043E\u043A\u0435\u043D\u044B \u0438 \u0441\u0442\u043E\u0438\u043C\u043E\u0441\u0442\u044C",
     mcp: "\u043F\u043E\u043A\u0430\u0437\u0430\u0442\u044C \u0438\u043B\u0438 \u0434\u043E\u0431\u0430\u0432\u0438\u0442\u044C MCP-\u0441\u0435\u0440\u0432\u0435\u0440",
@@ -7282,6 +7580,7 @@ var ru = {
     "mcp disable": "\u043E\u0442\u043A\u043B\u044E\u0447\u0438\u0442\u044C MCP \u0431\u0435\u0437 \u0443\u0434\u0430\u043B\u0435\u043D\u0438\u044F",
     attach: "\u043F\u0440\u0438\u043A\u0440\u0435\u043F\u0438\u0442\u044C \u043A\u0430\u0440\u0442\u0438\u043D\u043A\u0443 \u0438\u043B\u0438 \u0442\u0435\u043A\u0441\u0442\u043E\u0432\u044B\u0439 \u0444\u0430\u0439\u043B \u043A \u0441\u043E\u043E\u0431\u0449\u0435\u043D\u0438\u044E",
     compact: "\u0441\u0436\u0430\u0442\u044C \u0441\u0442\u0430\u0440\u044B\u0439 \u043A\u043E\u043D\u0442\u0435\u043A\u0441\u0442, \u0441\u043E\u0445\u0440\u0430\u043D\u0438\u0432 \u043F\u043E\u0441\u043B\u0435\u0434\u043D\u0438\u0435 \u0445\u043E\u0434\u044B",
+    update: "\u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043D\u043E\u0432\u0443\u044E \u0432\u0435\u0440\u0441\u0438\u044E KitCode \u0432 npm",
     checker: "\u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C \u043D\u0430\u0441\u0442\u0440\u043E\u0439\u043A\u0443 \u0431\u0435\u0437 \u0442\u0440\u0430\u0442\u044B \u0442\u043E\u043A\u0435\u043D\u043E\u0432 \u043C\u043E\u0434\u0435\u043B\u0438",
     sessions: "\u043F\u043E\u0438\u0441\u043A \u0438 \u0443\u043F\u0440\u0430\u0432\u043B\u0435\u043D\u0438\u0435 \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u044B\u043C\u0438 \u0441\u0435\u0441\u0441\u0438\u044F\u043C\u0438",
     "sessions list": "\u0441\u043F\u0438\u0441\u043E\u043A \u0441\u043E\u0445\u0440\u0430\u043D\u0451\u043D\u043D\u044B\u0445 \u0441\u0435\u0441\u0441\u0438\u0439",
@@ -7764,7 +8063,7 @@ var PromptInput = memo(function PromptInput2({
   valueRef.current = safeValue;
   cursorRef.current = inputCursor;
   const suggestions = matchCommands(safeValue);
-  const open2 = suggestions.length > 0;
+  const open3 = suggestions.length > 0;
   const active2 = Math.min(selectionCursor, Math.max(0, suggestions.length - 1));
   useEffect(() => {
     setSelectionCursor(0);
@@ -7817,25 +8116,25 @@ var PromptInput = memo(function PromptInput2({
       onPasteImage();
       return;
     }
-    if (open2 && key.upArrow) {
+    if (open3 && key.upArrow) {
       setSelectionCursor(Math.max(0, active2 - 1));
       return;
     }
-    if (open2 && key.downArrow) {
+    if (open3 && key.downArrow) {
       setSelectionCursor(Math.min(suggestions.length - 1, active2 + 1));
       return;
     }
-    if (open2 && key.tab && !key.shift) {
+    if (open3 && key.tab && !key.shift) {
       const chosen = suggestions[active2];
       if (chosen) change(`/${chosen.name} `);
       return;
     }
-    if (open2 && key.return) {
+    if (open3 && key.return) {
       const chosen = suggestions[active2];
       if (chosen) submit(`/${chosen.name}`);
       return;
     }
-    if (!open2 && (key.upArrow || key.downArrow)) {
+    if (!open3 && (key.upArrow || key.downArrow)) {
       const moved = moveInputHistory(
         history,
         historyIndex,
@@ -7887,7 +8186,7 @@ var PromptInput = memo(function PromptInput2({
   });
   const start = Math.max(0, Math.min(active2 - WINDOW2 + 2, suggestions.length - WINDOW2));
   const visible = suggestions.slice(start, start + WINDOW2);
-  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginTop: 1, children: [
+  return /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginTop: 1, flexShrink: 0, children: [
     /* @__PURE__ */ jsxs8(
       Box8,
       {
@@ -7915,7 +8214,7 @@ var PromptInput = memo(function PromptInput2({
       "  ",
       sanitizeTerminalText(hint)
     ] }),
-    open2 && /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginLeft: 2, children: [
+    open3 && /* @__PURE__ */ jsxs8(Box8, { flexDirection: "column", marginLeft: 2, children: [
       visible.map((command, index) => {
         const selected = start + index === active2;
         return /* @__PURE__ */ jsxs8(Text8, { color: selected ? theme.accent : void 0, dimColor: !selected, children: [
@@ -8051,6 +8350,7 @@ function StatusBar({ status }) {
     Box9,
     {
       width: "100%",
+      flexShrink: 0,
       marginTop: 1,
       paddingX: 1,
       borderStyle: "single",
@@ -8182,8 +8482,12 @@ function ContextMeter({
 import { Box as Box10 } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 function interactiveViewportRows(rows) {
-  if (!Number.isFinite(rows)) return 23;
-  return Math.max(1, Math.floor(rows) - 1);
+  if (!Number.isFinite(rows)) return 22;
+  return Math.max(1, Math.floor(rows) - 2);
+}
+var INTERACTIVE_CHROME_ROWS = 14;
+function liveTranscriptRows(rows) {
+  return Math.max(1, interactiveViewportRows(rows) - INTERACTIVE_CHROME_ROWS);
 }
 function TerminalViewport({ children, rows }) {
   return /* @__PURE__ */ jsx10(
@@ -8198,14 +8502,16 @@ function TerminalViewport({ children, rows }) {
 }
 
 // src/ui/components/Transcript.tsx
-import { Box as Box12, Static, Text as Text11 } from "ink";
+import { Box as Box12, Static, Text as Text11, useWindowSize as useWindowSize3 } from "ink";
 import { memo as memo2, useMemo as useMemo3, useRef as useRef3 } from "react";
 import Spinner2 from "ink-spinner";
+import stringWidth2 from "string-width";
 
 // src/ui/markdown.tsx
-import { Box as Box11, Text as Text10 } from "ink";
-import { useMemo as useMemo2 } from "react";
-import { Fragment as Fragment4, jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Box as Box11, Text as Text10, useWindowSize as useWindowSize2 } from "ink";
+import { Fragment as Fragment4, useMemo as useMemo2 } from "react";
+import stringWidth from "string-width";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
 function Markdown({ children }) {
   const blocks = useMemo2(() => extractBlocks(children), [children]);
   return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: blocks.map((block, i) => /* @__PURE__ */ jsx11(BlockView, { block }, i)) });
@@ -8213,45 +8519,43 @@ function Markdown({ children }) {
 function BlockView({ block }) {
   switch (block.type) {
     case "heading": {
-      const sizes = [22, 20, 18, 16, 14, 13];
-      const size = sizes[(block.level ?? 1) - 1] ?? 14;
-      return /* @__PURE__ */ jsx11(Box11, { marginTop: block.level === 1 ? 1 : 0, children: /* @__PURE__ */ jsx11(Text10, { bold: true, children: truncateBySize(block.text ?? "", size) }) });
+      return /* @__PURE__ */ jsx11(Box11, { marginTop: block.level === 1 ? 1 : 0, children: /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(block.text ?? "") }) });
     }
     case "blockquote":
-      return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", marginLeft: 2, children: (block.text ?? "").split("\n").map((line, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2502 " }),
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: line })
-      ] }, i)) });
+      return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.text ?? "").split("\n").map((line, i) => /* @__PURE__ */ jsx11(Text10, { dimColor: true, italic: true, children: inline(line) }, i)) });
     case "ul":
       return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.items ?? []).map((item, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2022 " }),
-        /* @__PURE__ */ jsx11(Box11, { marginLeft: 2, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
+        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: item.text?.match(/^[☑☐] /) ? "" : "\u2022 " }),
+        /* @__PURE__ */ jsx11(Box11, { flexGrow: 1, flexShrink: 1, minWidth: 0, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
       ] }, i)) });
     case "ol":
       return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: (block.items ?? []).map((item, i) => /* @__PURE__ */ jsxs10(Box11, { children: [
-        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: `${i + 1}. ` }),
-        /* @__PURE__ */ jsx11(Box11, { marginLeft: 2, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
+        /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: `${(block.start ?? 1) + i}. ` }),
+        /* @__PURE__ */ jsx11(Box11, { flexGrow: 1, flexShrink: 1, minWidth: 0, children: /* @__PURE__ */ jsx11(BlockView, { block: item }) })
       ] }, i)) });
     case "paragraph":
-    default:
-      return /* @__PURE__ */ jsx11(Text10, { children: inline(block.text ?? "") });
+    default: {
+      const content = /* @__PURE__ */ jsx11(Text10, { children: inline(block.text ?? "") });
+      if (!block.children?.length) return content;
+      return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", children: [
+        content,
+        /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: block.children.map((child, index) => /* @__PURE__ */ jsx11(BlockView, { block: child }, index)) })
+      ] });
+    }
     case "table":
       return /* @__PURE__ */ jsx11(TableView, { block });
     case "code":
-      return /* @__PURE__ */ jsx11(CodeBlock, { lang: block.lang, code: block.text ?? "" });
+      return /* @__PURE__ */ jsx11(CodeBlock, { code: block.text ?? "" });
     case "hr":
-      return /* @__PURE__ */ jsx11(Box11, { marginTop: 1, marginBottom: 1, children: /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "\u2500".repeat(60) }) });
+      return /* @__PURE__ */ jsx11(Box11, { marginTop: 1, marginBottom: 1, children: /* @__PURE__ */ jsx11(Text10, { dimColor: true, wrap: "truncate-end", children: "\u2500".repeat(60) }) });
   }
 }
-function CodeBlock({ lang, code }) {
-  const theme = useTheme();
+function CodeBlock({ code }) {
   const lines = code.split("\n");
-  return /* @__PURE__ */ jsxs10(Box11, { flexDirection: "column", marginTop: 1, children: [
-    lang && /* @__PURE__ */ jsx11(Text10, { dimColor: true, color: theme.accent, children: lang }),
-    /* @__PURE__ */ jsx11(Box11, { borderColor: "gray", borderStyle: "round", paddingX: 1, children: /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: lines.map((line, i) => /* @__PURE__ */ jsx11(Text10, { color: "cyan", children: line }, i)) }) })
-  ] });
+  return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", marginTop: 1, children: lines.map((line, i) => /* @__PURE__ */ jsx11(Text10, { color: "cyan", children: line }, i)) });
 }
 function TableView({ block }) {
+  const { columns } = useWindowSize2();
   const headers = block.headers ?? [];
   const rows = block.rows ?? [];
   if (headers.length === 0 && rows.length === 0) {
@@ -8261,77 +8565,104 @@ function TableView({ block }) {
   if (colCount === 0) {
     return /* @__PURE__ */ jsx11(Text10, { dimColor: true, children: "(empty table)" });
   }
-  const colWidths = new Array(colCount).fill(0);
-  const allRows = [headers, ...rows];
+  const allRows = [headers, ...rows].map(
+    (row) => Array.from({ length: colCount }, (_, index) => inlineDisplayText(row[index] ?? ""))
+  );
+  const naturalWidths = new Array(colCount).fill(1);
   for (const row of allRows) {
     for (let i = 0; i < colCount; i++) {
       const cell = row[i] ?? "";
-      colWidths[i] = Math.max(colWidths[i], [...cell].length);
+      naturalWidths[i] = Math.max(naturalWidths[i] ?? 1, stringWidth(cell));
     }
   }
-  const separator = colWidths.map((w) => "\u2500".repeat(w)).join("\u253C");
+  const colWidths = fitColumnWidths(naturalWidths, Math.max(1, columns));
+  const separator = colWidths.map((width, index) => {
+    const edge = index === 0 || index === colWidths.length - 1;
+    return "\u2500".repeat(width + (edge ? 1 : 2));
+  }).join("\u253C");
   const lines = [];
   allRows.forEach((row, rowIdx) => {
     const cells = [];
     for (let i = 0; i < colCount; i++) {
       const cell = row[i] ?? "";
       const align = block.colAligns?.[i] ?? "left";
-      const visualWidth = [...cell].length;
-      const padWidth = colWidths[i] + (cell.length - visualWidth);
+      const width = colWidths[i] ?? 1;
+      const fitted = truncateToWidth(cell, width);
+      const visualWidth = stringWidth(fitted);
+      const totalPad = Math.max(0, width - visualWidth);
       let padded;
       if (align === "right") {
-        padded = cell.padStart(padWidth);
+        padded = `${" ".repeat(totalPad)}${fitted}`;
       } else if (align === "center") {
-        const totalPad = padWidth - visualWidth;
         const left = Math.floor(totalPad / 2);
-        padded = " ".repeat(left) + cell + " ".repeat(totalPad - left);
+        padded = `${" ".repeat(left)}${fitted}${" ".repeat(totalPad - left)}`;
       } else {
-        padded = cell.padEnd(padWidth);
+        padded = `${fitted}${" ".repeat(totalPad)}`;
       }
       cells.push(padded);
     }
     lines.push(
-      /* @__PURE__ */ jsx11(Text10, { bold: rowIdx === 0, children: cells.join(" \u2502 ") }, `row-${rowIdx}`)
+      /* @__PURE__ */ jsx11(Text10, { bold: rowIdx === 0, wrap: "truncate-end", children: cells.join(" \u2502 ") }, `row-${rowIdx}`)
     );
     if (rowIdx === 0) {
-      lines.push(/* @__PURE__ */ jsx11(Text10, { dimColor: true, children: separator }, `sep-${rowIdx}`));
+      lines.push(/* @__PURE__ */ jsx11(Text10, { dimColor: true, wrap: "truncate-end", children: separator }, `sep-${rowIdx}`));
     }
   });
   return /* @__PURE__ */ jsx11(Box11, { flexDirection: "column", children: lines });
 }
-var CHARS_PER_FONT_LEVEL = 3;
-function truncateBySize(text, size) {
-  const maxLen = size * CHARS_PER_FONT_LEVEL;
-  return text.length > maxLen ? text.slice(0, maxLen) + "\u2026" : text;
-}
-var HEADING_RE = /^(#{1,6})\s+(.*)$/;
+function fitColumnWidths(natural, maxLineWidth) {
+  const widths = natural.map((width) => Math.max(1, width));
+  const separatorWidth = Math.max(0, widths.length - 1) * 3;
+  const available = Math.max(widths.length, maxLineWidth - separatorWidth);
+  let excess = widths.reduce((sum, width) => sum + width, 0) - available;
+  while (excess > 0) {
+    const shrinkable = widths.map((width, index) => ({ width, index })).filter(({ width }) => width > 1);
+    if (shrinkable.length === 0) break;
+    const share = Math.max(1, Math.ceil(excess / shrinkable.length));
+    for (const { index } of shrinkable) {
+      const current = widths[index] ?? 1;
+      const amount = Math.min(current - 1, share, excess);
+      widths[index] = current - amount;
+      excess -= amount;
+      if (excess === 0) break;
+    }
+  }
+  return widths;
+}
+var graphemeSegmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+function truncateToWidth(text, maxWidth) {
+  if (stringWidth(text) <= maxWidth) return text;
+  if (maxWidth <= 1) return "\u2026";
+  let result = "";
+  for (const { segment } of graphemeSegmenter.segment(text)) {
+    if (stringWidth(result + segment) > maxWidth - 1) break;
+    result += segment;
+  }
+  return `${result}\u2026`;
+}
+function inlineDisplayText(text) {
+  return text.replace(/!\[([^\]]*)\]\(([^)]*)\)/g, "[$1]").replace(/\[([^\]]*)\]\(([^)]*)\)/g, "$1($2)").replace(/(`+)(.*?)\1/g, "$2").replace(/(\*\*|__|~~)(?=\S)(.*?\S)\1/g, "$2").replace(/(?<!\\)(\*|_)(?=\S)(.*?\S)\1/g, "$2").replace(/\\([\\`*_[\]{}()#+\-.!|>])/g, "$1");
+}
+var HEADING_RE = /^ {0,3}(#{1,6})(?:[ \t]+(.*)|[ \t]*)$/;
 var UL_RE = /^([-*+])\s+(.*)$/;
-var OL_RE = /^(\d+)\.\s+(.*)$/;
+var OL_RE = /^(\d{1,9})[.)]\s+(.*)$/;
 var QUOTE_RE = /^>\s?(.*)$/;
-var TASK_RE = /^[-*+]\s+\[([ xX])\]\s+(.*)$/;
-var INDENT_RE = /^(\s*)(.*)$/;
-var HR_RE = /^([-*_])\1{2,}$/;
-var FENCE_RE = /^(`{3,}|~{3,})(\w*)\s*$/;
+var TASK_CONTENT_RE = /^\[([ xX])\]\s+(.*)$/;
+var SETEXT_RE = /^ {0,3}(=+|-+)[ \t]*$/;
+var MAX_TABLE_COLUMNS = 20;
+var MAX_LIST_DEPTH = 20;
 function extractBlocks(src) {
-  const lines = src.replace(/\r\n/g, "\n").split("\n");
+  const lines = src.replace(/\r\n?/g, "\n").split("\n");
   const blocks = [];
   let paragraph = [];
-  let list = null;
   let quote = [];
   let code = null;
-  let table = null;
   const flushParagraph = () => {
     if (paragraph.length) {
-      blocks.push({ type: "paragraph", text: paragraph.join(" ").trim() });
+      blocks.push({ type: "paragraph", text: joinParagraphLines(paragraph) });
       paragraph = [];
     }
   };
-  const flushList = () => {
-    if (list && list.items.length) {
-      blocks.push({ type: list.ordered ? "ol" : "ul", items: list.items });
-      list = null;
-    }
-  };
   const flushQuote = () => {
     if (quote.length) {
       blocks.push({ type: "blockquote", text: quote.join("\n") });
@@ -8346,238 +8677,360 @@ function extractBlocks(src) {
   };
   const flushAll = () => {
     flushParagraph();
-    flushList();
     flushQuote();
     flushCode();
   };
-  const flushTable = () => {
-    if (table && table.headers.length > 0) {
-      blocks.push({
-        type: "table",
-        headers: table.headers,
-        rows: table.rows,
-        colAligns: table.colAligns
-      });
-    }
-    table = null;
-  };
-  const parseListItem = (text, indent) => {
-    const task = text.match(TASK_RE);
-    if (task) {
-      const done = task[1].toLowerCase() === "x";
-      return {
-        type: "paragraph",
-        text: `${done ? "\u2611" : "\u2610"} ${task[2]}`
-      };
-    }
-    return { type: "paragraph", text };
-  };
   for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
+    const line = lines[i] ?? "";
     const trimmed = line.trim();
     if (code) {
-      const endMatch = trimmed.match(FENCE_RE);
-      if (endMatch && endMatch[1][0] === code.fence[0] && endMatch[1].length >= code.fence.length) {
+      if (isClosingFence(line, code.fence)) {
         flushCode();
         continue;
       }
       code.lines.push(line);
       continue;
     }
-    const fenceMatch = trimmed.match(FENCE_RE);
-    if (fenceMatch) {
+    const fence = parseOpeningFence(line);
+    if (fence) {
       flushAll();
-      flushTable();
-      code = { fence: fenceMatch[1], lang: fenceMatch[2], lines: [] };
+      code = { fence: fence.fence, lang: fence.lang, lines: [] };
       continue;
     }
     if (trimmed === "") {
-      flushTable();
       flushAll();
       continue;
     }
-    const hrMatch = trimmed.match(HR_RE);
-    if (hrMatch) {
-      flushTable();
+    const heading = line.match(HEADING_RE);
+    if (heading) {
       flushAll();
-      blocks.push({ type: "hr" });
+      const text = (heading[2] ?? "").replace(/[ \t]+#+[ \t]*$/, "").trim();
+      blocks.push({ type: "heading", level: heading[1].length, text });
       continue;
     }
-    const heading = trimmed.match(HEADING_RE);
-    if (heading) {
-      flushTable();
+    const setext = lines[i + 1]?.match(SETEXT_RE);
+    if (setext && isSetextHeadingText(line)) {
+      flushAll();
+      blocks.push({ type: "heading", level: setext[1][0] === "=" ? 1 : 2, text: trimmed });
+      i += 1;
+      continue;
+    }
+    if (isHorizontalRule(trimmed)) {
       flushAll();
-      blocks.push({ type: "heading", level: heading[1].length, text: heading[2].trim() });
+      blocks.push({ type: "hr" });
       continue;
     }
     const quoteMatch = trimmed.match(QUOTE_RE);
     if (quoteMatch) {
-      flushTable();
       flushParagraph();
-      flushList();
       flushCode();
       quote.push(quoteMatch[1]);
       continue;
     }
-    const indentMatch = line.match(INDENT_RE);
-    const indent = indentMatch?.[1].length ?? 0;
-    const taskMatch = trimmed.match(TASK_RE);
-    if (taskMatch) {
-      flushTable();
+    const parsedList = parseListBlock(lines, i);
+    if (parsedList) {
       flushParagraph();
       flushQuote();
       flushCode();
-      if (!list || list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: false, items: [], indent };
-      }
-      list.items.push(parseListItem(trimmed, indent));
+      blocks.push(parsedList.block);
+      i = parsedList.nextIndex - 1;
       continue;
     }
-    const ulMatch = trimmed.match(UL_RE);
-    if (ulMatch) {
-      flushTable();
-      flushParagraph();
-      flushQuote();
-      flushCode();
-      if (!list || list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: false, items: [], indent };
-      }
-      list.items.push(parseListItem(ulMatch[2], indent));
+    const markdownTable = parseMarkdownTable(lines, i);
+    if (markdownTable) {
+      flushAll();
+      blocks.push(markdownTable.block);
+      i = markdownTable.nextIndex - 1;
       continue;
     }
-    const olMatch = trimmed.match(OL_RE);
-    if (olMatch) {
-      flushTable();
-      flushParagraph();
-      flushQuote();
-      flushCode();
-      if (!list || !list.ordered || indent !== list.indent) {
-        flushList();
-        list = { ordered: true, items: [], indent };
-      }
-      list.items.push(parseListItem(olMatch[2], indent));
+    const asciiTable = parseAsciiTable(lines, i);
+    if (asciiTable) {
+      flushAll();
+      blocks.push(asciiTable.block);
+      i = asciiTable.nextIndex - 1;
       continue;
     }
-    const sepMatch = trimmed.match(/^\|?\s*(\s*:?-+:?\s*\|)+\s*:?-+:?\s*\|?$/);
-    if (sepMatch) {
-      const cells = trimmed.split("|").map((c) => c.trim()).filter((c) => c.length > 0);
-      if (cells.length >= 2 && cells.every((c) => /^:?-+:?$/.test(c))) {
-        if (table) {
-          table.colAligns = cells.map((c) => {
-            if (c.startsWith(":") && c.endsWith(":")) return "center";
-            if (c.endsWith(":")) return "right";
-            return "left";
-          });
-          continue;
-        }
-      }
+    if (quote.length > 0) {
+      quote.push(trimmed);
+      continue;
     }
-    const rowMatch = trimmed.match(/^\|?.+\|.+\|?$/);
-    if (rowMatch) {
-      const cells = trimmed.split("|").map((c) => c.trim()).filter((c, idx, arr) => {
-        if (idx === 0 && c === "") return false;
-        if (idx === arr.length - 1 && c === "") return false;
-        return true;
-      });
-      const isWindowsPath = cells.length === 2 && (/^[A-Za-z]:\\/.test(cells[0]) || /^\\\\/.test(cells[0]));
-      if (cells.length >= 2 && cells.every((c) => c.length > 0) && !isWindowsPath) {
-        if (table) {
-          table.rows.push(cells);
-        } else {
-          flushAll();
-          table = { headers: cells, rows: [], colAligns: [] };
+    flushQuote();
+    flushCode();
+    paragraph.push(paragraphLine(line));
+  }
+  flushAll();
+  return blocks;
+}
+function paragraphLine(line) {
+  const hardBreak = /(?: {2,}|\\)$/.test(line);
+  const text = line.trim().replace(/\\$/, "");
+  return hardBreak ? `${text}
+` : text;
+}
+function joinParagraphLines(lines) {
+  let result = "";
+  for (const line of lines) {
+    if (result && !result.endsWith("\n")) result += " ";
+    result += line;
+  }
+  return result.trim();
+}
+function parseListMarker(line) {
+  const match = line.match(/^(\s*)(?:(\d{1,9})[.)]|([-+*]))\s+(.*)$/);
+  if (!match) return null;
+  return {
+    indent: match[1].replace(/\t/g, "    ").length,
+    ordered: Boolean(match[2]),
+    start: match[2] ? Number.parseInt(match[2], 10) : 1,
+    text: match[4]
+  };
+}
+function parseListItem(text) {
+  const task = text.match(TASK_CONTENT_RE);
+  return {
+    type: "paragraph",
+    text: task ? `${task[1].toLowerCase() === "x" ? "\u2611" : "\u2610"} ${task[2]}` : text
+  };
+}
+function parseListBlock(lines, start, depth = 0) {
+  const first2 = parseListMarker(lines[start] ?? "");
+  if (!first2) return null;
+  const items = [];
+  let nextIndex = start;
+  while (nextIndex < lines.length) {
+    const marker = parseListMarker(lines[nextIndex] ?? "");
+    if (!marker || marker.indent !== first2.indent || marker.ordered !== first2.ordered) break;
+    const item = parseListItem(marker.text);
+    nextIndex += 1;
+    while (nextIndex < lines.length) {
+      if ((lines[nextIndex] ?? "").trim() === "") {
+        let afterBlank = nextIndex;
+        while (afterBlank < lines.length && (lines[afterBlank] ?? "").trim() === "") {
+          afterBlank += 1;
         }
-        continue;
-      }
-    }
-    const asciiSepMatch = trimmed.match(/^[\s\-─┄┈━┅]{3,}$/);
-    if (asciiSepMatch) {
-      if (table && table.headers.length > 0 && table.colAligns.length === 0) {
-        table.colAligns = table.headers.map(() => "left");
-        continue;
-      }
-      if (paragraph.length === 1) {
-        const prevLine = paragraph[0].trim();
-        const tokens3 = prevLine.split(/\s{2,}/).map((c) => c.trim()).filter((c) => c.length > 0);
-        if (tokens3.length >= 2 && tokens3.length <= 10) {
-          paragraph = [];
-          flushList();
-          flushQuote();
-          flushCode();
-          table = { headers: tokens3, rows: [], colAligns: tokens3.map(() => "left") };
-          continue;
+        const followingMarker2 = parseListMarker(lines[afterBlank] ?? "");
+        if (!followingMarker2 || followingMarker2.indent < first2.indent) {
+          nextIndex = afterBlank;
+          break;
         }
+        nextIndex = afterBlank;
+        if (followingMarker2.indent === first2.indent) break;
       }
-    }
-    if (table && table.headers.length > 0 && !trimmed.includes("|")) {
-      const tokens3 = trimmed.split(/\s{2,}/).map((c) => c.trim()).filter((c) => c.length > 0);
-      if (tokens3.length >= 2 && tokens3.length <= table.headers.length + 2) {
-        const looksLikeCode = tokens3.some((t) => t.startsWith("//") || t.startsWith("#") || t.startsWith("/*"));
-        const looksLikePath = tokens3.length === 2 && (/^[A-Za-z]:\\/.test(tokens3[0]) || /^\\\\/.test(tokens3[0]));
-        if (!looksLikeCode && !looksLikePath) {
-          table.rows.push(tokens3);
+      const followingMarker = parseListMarker(lines[nextIndex] ?? "");
+      if (followingMarker) {
+        if (followingMarker.indent <= first2.indent) break;
+        if (depth >= MAX_LIST_DEPTH) {
+          item.text = `${item.text ?? ""} ${followingMarker.text}`.trim();
+          nextIndex += 1;
           continue;
         }
+        const nested = parseListBlock(lines, nextIndex, depth + 1);
+        if (!nested) break;
+        item.children ??= [];
+        item.children.push(nested.block);
+        nextIndex = nested.nextIndex;
+        continue;
       }
-    }
-    flushTable();
-    flushList();
-    flushQuote();
-    flushCode();
-    paragraph.push(trimmed);
+      if (interruptsList(lines, nextIndex)) break;
+      const continuation = (lines[nextIndex] ?? "").trim();
+      item.text = `${item.text ?? ""} ${continuation}`.trim();
+      nextIndex += 1;
+    }
+    items.push(item);
+  }
+  const block = { type: first2.ordered ? "ol" : "ul", items };
+  if (first2.ordered && first2.start !== 1) block.start = first2.start;
+  return { block, nextIndex };
+}
+function interruptsList(lines, index) {
+  const line = lines[index] ?? "";
+  const trimmed = line.trim();
+  return Boolean(
+    line.match(HEADING_RE) || trimmed.match(QUOTE_RE) || parseOpeningFence(line) || isHorizontalRule(trimmed) || parseMarkdownTable(lines, index) || parseAsciiTable(lines, index)
+  );
+}
+function parseOpeningFence(line) {
+  const match = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+  if (!match) return null;
+  const info = match[2].trim();
+  if (match[1][0] === "`" && info.includes("`")) return null;
+  return { fence: match[1], lang: info.split(/\s+/, 1)[0] ?? "" };
+}
+function isClosingFence(line, opening) {
+  const match = line.match(/^ {0,3}(`+|~+)[ \t]*$/);
+  return Boolean(
+    match && match[1][0] === opening[0] && match[1].length >= opening.length
+  );
+}
+function isHorizontalRule(line) {
+  return /^(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/.test(line);
+}
+function isSetextHeadingText(line) {
+  const trimmed = line.trim();
+  return trimmed !== "" && !HEADING_RE.test(line) && !QUOTE_RE.test(trimmed) && !UL_RE.test(trimmed) && !OL_RE.test(trimmed) && !parseOpeningFence(line);
+}
+function parseMarkdownTable(lines, start) {
+  const headers = splitTableRow(lines[start] ?? "");
+  const delimiter = splitTableRow(lines[start + 1] ?? "");
+  if (!headers || !delimiter || headers.length < 2 || headers.length > MAX_TABLE_COLUMNS || delimiter.length !== headers.length || !delimiter.every((cell) => /^:?-{3,}:?$/.test(cell))) {
+    return null;
   }
-  flushTable();
-  flushAll();
-  return blocks;
+  const colAligns = delimiter.map((cell) => {
+    if (cell.startsWith(":") && cell.endsWith(":")) return "center";
+    if (cell.endsWith(":")) return "right";
+    return "left";
+  });
+  const rows = [];
+  let nextIndex = start + 2;
+  while (nextIndex < lines.length) {
+    const cells = splitTableRow(lines[nextIndex] ?? "");
+    if (!cells) break;
+    rows.push(headers.map((_, index) => cells[index] ?? ""));
+    nextIndex += 1;
+  }
+  return {
+    block: { type: "table", headers, rows, colAligns },
+    nextIndex
+  };
+}
+function splitTableRow(line) {
+  const source = line.trim();
+  if (!source.includes("|")) return null;
+  const cells = [];
+  let cell = "";
+  let codeFenceLength = 0;
+  let foundSeparator = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const character = source[index] ?? "";
+    if (character === "\\" && source[index + 1] === "|") {
+      cell += "|";
+      index += 1;
+      continue;
+    }
+    if (character === "`") {
+      let end = index + 1;
+      while (source[end] === "`") end += 1;
+      const runLength = end - index;
+      if (codeFenceLength === 0) codeFenceLength = runLength;
+      else if (codeFenceLength === runLength) codeFenceLength = 0;
+      cell += source.slice(index, end);
+      index = end - 1;
+      continue;
+    }
+    if (character === "|" && codeFenceLength === 0) {
+      foundSeparator = true;
+      cells.push(cell.trim());
+      cell = "";
+      continue;
+    }
+    cell += character;
+  }
+  cells.push(cell.trim());
+  if (!foundSeparator) return null;
+  if (cells[0] === "") cells.shift();
+  if (cells[cells.length - 1] === "") cells.pop();
+  return cells.length >= 2 ? cells : null;
+}
+function parseAsciiTable(lines, start) {
+  const headers = splitAsciiCells(lines[start] ?? "");
+  if (headers.length < 2 || headers.length > MAX_TABLE_COLUMNS) return null;
+  const separator = (lines[start + 1] ?? "").trim();
+  const separatorCells = splitAsciiCells(separator);
+  const validSeparator = /^[─┄┈━┅-]{3,}$/.test(separator) || separatorCells.length === headers.length && separatorCells.every((cell) => /^[─┄┈━┅-]{3,}$/.test(cell));
+  if (!validSeparator) return null;
+  const rows = [];
+  let nextIndex = start + 2;
+  while (nextIndex < lines.length) {
+    const cells = splitAsciiCells(lines[nextIndex] ?? "");
+    if (cells.length !== headers.length) break;
+    rows.push(cells);
+    nextIndex += 1;
+  }
+  if (rows.length === 0) return null;
+  return {
+    block: {
+      type: "table",
+      headers,
+      rows,
+      colAligns: headers.map(() => "left")
+    },
+    nextIndex
+  };
+}
+function splitAsciiCells(line) {
+  return line.trim().split(/\s{2,}/).map((cell) => cell.trim()).filter(Boolean);
 }
 var MAX_INLINE_DEPTH = 10;
+var INLINE_ESCAPE_BASE = 57344;
+var ESCAPABLE_MARKDOWN = ["\\", "`", "*", "_", "[", "]", "{", "}", "(", ")", "#", "+", "-", ".", "!", "|", ">"];
+function protectInlineEscapes(text) {
+  return text.replace(/\\([\\`*_[\]{}()#+\-.!|>])/g, (_match, character) => {
+    const index = ESCAPABLE_MARKDOWN.indexOf(character);
+    return String.fromCodePoint(INLINE_ESCAPE_BASE + index);
+  });
+}
+function restoreInlineEscapes(text) {
+  return [...text].map((character) => {
+    const index = character.codePointAt(0) - INLINE_ESCAPE_BASE;
+    return index >= 0 && index < ESCAPABLE_MARKDOWN.length ? ESCAPABLE_MARKDOWN[index] : character;
+  }).join("");
+}
 function inline(text, depth = 0) {
   if (depth > MAX_INLINE_DEPTH) {
-    return text;
+    return restoreInlineEscapes(text);
   }
   const nodes = [];
-  let rest = text;
+  let rest = protectInlineEscapes(text);
   let key = 0;
   const matchers = [
     {
-      re: /(!\[)([^\]]*)\]\(([^)]+)\)/,
+      re: /(!\[)([^\]]*)\]\(((?:[^()\\]|\\.|\([^()]*\))+?)\)/,
       handler: (m) => /* @__PURE__ */ jsxs10(Text10, { color: "cyan", bold: true, children: [
         "[img: ",
-        m[2],
+        restoreInlineEscapes(m[2]),
         "]"
       ] }, key++)
     },
     {
-      re: /(\[)([^\]]*)\]\(([^)]+)\)/,
-      handler: (m) => /* @__PURE__ */ jsxs10(Fragment4, { children: [
-        /* @__PURE__ */ jsx11(Text10, { color: "cyan", underline: true, children: inline(m[2], depth + 1) }, key++),
-        /* @__PURE__ */ jsxs10(Text10, { dimColor: true, color: "gray", children: [
-          "(",
-          m[3],
-          ")"
-        ] }, key++)
-      ] })
+      re: /(\[)([^\]]*)\]\(((?:[^()\\]|\\.|\([^()]*\))+?)\)/,
+      handler: (m) => {
+        const fragmentKey = key++;
+        return /* @__PURE__ */ jsxs10(Fragment4, { children: [
+          /* @__PURE__ */ jsx11(Text10, { color: "cyan", underline: true, children: inline(m[2], depth + 1) }),
+          /* @__PURE__ */ jsxs10(Text10, { dimColor: true, color: "gray", children: [
+            "(",
+            restoreInlineEscapes(m[3]),
+            ")"
+          ] })
+        ] }, fragmentKey);
+      }
     },
     {
       re: /(`+)([^`]+?)\1/,
-      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, color: "cyan", children: m[2] }, key++)
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, color: "cyan", children: restoreInlineEscapes(m[2]) }, key++)
     },
     {
-      re: /(\*\*)(.+?)\1/,
+      re: /(\*\*\*|___)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, italic: true, children: inline(m[2], depth + 1) }, key++)
+    },
+    {
+      re: /(\*\*)(?=\S)(.*?\S)\1/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(__)(.+?)\1/,
+      re: /(__)(?=\S)(.*?\S)\1/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { bold: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(~~)(.+?)\1/,
-      handler: (m) => /* @__PURE__ */ jsx11(Text10, { strikethrough: true, children: m[2] }, key++)
+      re: /(~~)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { strikethrough: true, children: inline(m[2], depth + 1) }, key++)
+    },
+    {
+      re: /(\*)(?=\S)(.*?\S)\1/,
+      handler: (m) => /* @__PURE__ */ jsx11(Text10, { italic: true, children: inline(m[2], depth + 1) }, key++)
     },
     {
-      re: /(\*)(.+?)\1/,
+      re: /(?<!\w)(_)(?=\S)(.*?\S)\1(?!\w)/,
       handler: (m) => /* @__PURE__ */ jsx11(Text10, { italic: true, children: inline(m[2], depth + 1) }, key++)
     }
   ];
@@ -8590,11 +9043,11 @@ function inline(text, depth = 0) {
       }
     }
     if (!best) {
-      nodes.push(rest);
+      nodes.push(restoreInlineEscapes(rest));
       break;
     }
     const idx = best.match.index ?? 0;
-    if (idx > 0) nodes.push(rest.slice(0, idx));
+    if (idx > 0) nodes.push(restoreInlineEscapes(rest.slice(0, idx)));
     nodes.push(best.handler(best.match));
     rest = rest.slice(idx + best.match[0].length);
   }
@@ -8604,12 +9057,19 @@ function inline(text, depth = 0) {
 // src/ui/components/Transcript.tsx
 import { Fragment as Fragment5, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
 var HEADER = { kind: "header" };
+function assistantThinkingForFrame(bubble, frozenThinking) {
+  return bubble.streaming && bubble.text !== "" ? frozenThinking ?? bubble.thinking : bubble.thinking;
+}
 function firstMutableBubbleIndex(bubbles) {
   return bubbles.findIndex(
     (bubble) => bubble.kind === "assistant" && bubble.streaming || bubble.kind === "tool" && bubble.state === "running" || bubble.kind === "subagent" && bubble.state === "running"
   );
 }
-var Transcript = memo2(function Transcript2({ bubbles, workspace }) {
+var Transcript = memo2(function Transcript2({
+  bubbles,
+  workspace,
+  maxLiveRows = 12
+}) {
   const liveAt = firstMutableBubbleIndex(bubbles);
   const stableCount = liveAt === -1 ? bubbles.length : liveAt;
   const stableRef = useRef3([]);
@@ -8623,21 +9083,36 @@ var Transcript = memo2(function Transcript2({ bubbles, workspace }) {
   }
   const live = liveAt === -1 ? [] : bubbles.slice(liveAt);
   const staticItems = [HEADER, ...stableRef.current];
-  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginBottom: 1, flexShrink: 1, overflowY: "hidden", children: [
-    /* @__PURE__ */ jsx12(Static, { items: staticItems, children: (item) => item.kind === "header" ? /* @__PURE__ */ jsx12(Logo, { workspace }, "kitcode-header") : /* @__PURE__ */ jsx12(BubbleView, { bubble: item }, item.id) }),
-    /* @__PURE__ */ jsx12(
-      Box12,
-      {
-        flexDirection: "column",
-        flexShrink: 1,
-        overflowY: "hidden",
-        justifyContent: "flex-end",
-        children: live.map((bubble) => /* @__PURE__ */ jsx12(BubbleView, { bubble }, bubble.id))
-      }
-    )
-  ] });
+  return /* @__PURE__ */ jsxs11(
+    Box12,
+    {
+      flexDirection: "column",
+      marginBottom: 1,
+      flexShrink: 1,
+      minHeight: 0,
+      overflowY: "hidden",
+      children: [
+        /* @__PURE__ */ jsx12(Static, { items: staticItems, children: (item) => item.kind === "header" ? /* @__PURE__ */ jsx12(Logo, { workspace }, "kitcode-header") : /* @__PURE__ */ jsx12(BubbleView, { bubble: item }, item.id) }),
+        /* @__PURE__ */ jsx12(
+          Box12,
+          {
+            flexDirection: "column",
+            flexShrink: 1,
+            minHeight: 0,
+            maxHeight: maxLiveRows,
+            overflowY: "hidden",
+            justifyContent: "flex-end",
+            children: live.map((bubble) => /* @__PURE__ */ jsx12(BubbleView, { bubble, maxRows: maxLiveRows }, bubble.id))
+          }
+        )
+      ]
+    }
+  );
 });
-var BubbleView = memo2(function BubbleView2({ bubble }) {
+var BubbleView = memo2(function BubbleView2({
+  bubble,
+  maxRows
+}) {
   const theme = useTheme();
   if (bubble.kind === "user") {
     return /* @__PURE__ */ jsx12(Box12, { marginTop: 1, children: /* @__PURE__ */ jsxs11(Text11, { color: theme.accent, bold: true, children: [
@@ -8650,20 +9125,62 @@ var BubbleView = memo2(function BubbleView2({ bubble }) {
     return /* @__PURE__ */ jsx12(Box12, { marginTop: 1, children: /* @__PURE__ */ jsx12(Text11, { color, children: bubble.text }) });
   }
   if (bubble.kind === "assistant") {
-    return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginTop: 1, children: [
-      bubble.thinking.trim() !== "" && /* @__PURE__ */ jsx12(Text11, { dimColor: true, italic: true, children: bubble.thinking.trim() }),
-      bubble.streaming ? /* @__PURE__ */ jsx12(Text11, { children: bubble.text }) : /* @__PURE__ */ jsx12(Markdown, { children: bubble.text }),
-      bubble.streaming && bubble.text === "" && /* @__PURE__ */ jsxs11(Text11, { dimColor: true, children: [
-        /* @__PURE__ */ jsx12(Spinner2, { type: "dots" }),
-        " thinking"
-      ] })
-    ] });
+    return /* @__PURE__ */ jsx12(AssistantView, { bubble, maxRows });
   }
   if (bubble.kind === "subagent") {
     return /* @__PURE__ */ jsx12(SubagentView, { bubble });
   }
   return /* @__PURE__ */ jsx12(ToolView, { bubble });
 });
+function AssistantView({ bubble, maxRows }) {
+  const { columns } = useWindowSize3();
+  const frozenThinking = useRef3(void 0);
+  const answering = bubble.streaming && bubble.text !== "";
+  if (!answering) frozenThinking.current = void 0;
+  if (answering && frozenThinking.current === void 0) {
+    frozenThinking.current = bubble.thinking;
+  }
+  const visibleThinking = assistantThinkingForFrame(bubble, frozenThinking.current);
+  const liveBudget = bubble.streaming && maxRows !== void 0 ? Math.max(1, maxRows - 1) : void 0;
+  const thinkingBudget = liveBudget === void 0 ? void 0 : bubble.text !== "" ? Math.min(3, Math.max(0, liveBudget - 1)) : Math.max(0, liveBudget - 1);
+  const frameThinking = thinkingBudget === void 0 ? visibleThinking.trim() : clipTextToRows(visibleThinking.trim(), thinkingBudget, columns);
+  const usedThinkingRows = frameThinking === "" ? 0 : frameThinking.split("\n").length;
+  const frameText = liveBudget === void 0 ? bubble.text : clipTextToRows(bubble.text, Math.max(1, liveBudget - usedThinkingRows), columns);
+  return /* @__PURE__ */ jsxs11(Box12, { flexDirection: "column", marginTop: 1, children: [
+    frameThinking !== "" && /* @__PURE__ */ jsx12(Text11, { dimColor: true, italic: true, children: frameThinking }),
+    bubble.streaming ? /* @__PURE__ */ jsx12(Text11, { children: frameText }) : /* @__PURE__ */ jsx12(Markdown, { children: bubble.text }),
+    bubble.streaming && bubble.text === "" && /* @__PURE__ */ jsxs11(Text11, { dimColor: true, children: [
+      /* @__PURE__ */ jsx12(Spinner2, { type: "dots" }),
+      " thinking"
+    ] })
+  ] });
+}
+function clipTextToRows(text, maxRows, columns) {
+  if (text === "" || maxRows <= 0) return "";
+  const width = Number.isFinite(columns) ? Math.max(1, Math.floor(columns)) : 80;
+  const rows = text.replace(/\r\n?/g, "\n").split("\n").flatMap((line) => wrapVisualLine(line, width));
+  if (rows.length <= maxRows) return rows.join("\n");
+  const tail2 = rows.slice(-Math.max(1, maxRows - 1));
+  return maxRows === 1 ? tail2.at(-1) ?? "" : ["\u2026", ...tail2].join("\n");
+}
+function wrapVisualLine(line, columns) {
+  if (line === "") return [""];
+  const rows = [];
+  let current = "";
+  let currentWidth = 0;
+  for (const character of line) {
+    const width = Math.max(1, stringWidth2(character));
+    if (current !== "" && currentWidth + width > columns) {
+      rows.push(current);
+      current = "";
+      currentWidth = 0;
+    }
+    current += character;
+    currentWidth += width;
+  }
+  if (current !== "" || rows.length === 0) rows.push(current);
+  return rows;
+}
 function ToolView({ bubble }) {
   const theme = useTheme();
   const mark = bubble.state === "running" ? "\u25CC" : bubble.state === "ok" ? "\u25CF" : "\u2717";
@@ -8971,7 +9488,7 @@ function App({
   warnings = []
 }) {
   const { exit } = useApp();
-  const { rows } = useWindowSize2();
+  const { rows } = useWindowSize4();
   const [transcript, setTranscript] = useState5(
     () => warnings.reduce((state, text) => pushNotice(state, "warn", text), fromHistory(initialHistory))
   );
@@ -9064,11 +9581,10 @@ function App({
   );
   useEffect2(() => {
     const check = runtime.startupUpdateCheck();
-    if (!check) return;
     let active2 = true;
     void check.then((result) => {
       if (active2 && result.status === "available") {
-        notice("info", strings.updateAvailable(result.latest.slice(0, 12), result.url));
+        notice("info", strings.updateAvailable(result.latest, result.url));
       }
     });
     return () => {
@@ -9364,6 +9880,17 @@ function App({
         case "config":
           notice("info", strings.configAt(runtime.configPath()));
           return;
+        case "update": {
+          const result = await runtime.checkForUpdates();
+          if (result.status === "available") {
+            notice("info", strings.updateAvailable(result.latest, result.url));
+          } else if (result.status === "current") {
+            notice("info", strings.updateCurrent(result.current));
+          } else {
+            notice("warn", strings.updateFailed(result.reason));
+          }
+          return;
+        }
         case "login":
           setSetup(true);
           return;
@@ -10091,6 +10618,10 @@ Rename the file if you want a different name.`);
       return;
     }
     if (!key.escape) return;
+    if (input !== "") {
+      setInput("");
+      return;
+    }
     if (busy && abort.current) {
       abort.current.abort();
       queueRef.current = [];
@@ -10151,7 +10682,8 @@ ${strings.configAt(runtime.configPath())}`);
         Transcript,
         {
           bubbles: transcript.bubbles,
-          workspace: runtime.cwd
+          workspace: runtime.cwd,
+          maxLiveRows: liveTranscriptRows(rows)
         },
         transcriptRevision
       ),
@@ -10349,6 +10881,12 @@ import { jsx as jsx14 } from "react/jsx-runtime";
 function clearTerminal() {
   if (process.stdout.isTTY) process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
 }
+var TUI_RENDER_OPTIONS = {
+  // Keep unchanged streamed lines in place instead of clearing and redrawing
+  // the whole live region on every frame.
+  incrementalRendering: true,
+  maxFps: 30
+};
 async function startTui(options) {
   const { runtime, history, warnings, shutdown } = await boot({
     cwd: options.cwd ?? process.cwd(),
@@ -10358,10 +10896,10 @@ async function startTui(options) {
     mode: options.mode
   });
   clearTerminal();
-  const instance = render(/* @__PURE__ */ jsx14(App, { runtime, initialHistory: history, warnings }), {
-    incrementalRendering: true,
-    maxFps: 30
-  });
+  const instance = render(
+    /* @__PURE__ */ jsx14(App, { runtime, initialHistory: history, warnings }),
+    TUI_RENDER_OPTIONS
+  );
   try {
     await instance.waitUntilExit();
   } finally {