@nanhara/hara 0.120.0 → 0.121.1

package/dist/tools/patch.js

@@ -1,11 +1,13 @@
 // apply_patch — change MULTIPLE files atomically (all-or-nothing). Everything is validated and
 // computed in memory first; nothing is written unless every change applies cleanly.
-import { readFile, writeFile, mkdir, unlink } from "node:fs/promises";
-import { isAbsolute, resolve, dirname } from "node:path";
+import { lstat, readFile, unlink } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
 import { registerTool } from "./registry.js";
 import { applyEdits } from "./apply-core.js";
 import { emitDiff } from "../diff.js";
 import { recordEdit } from "../undo.js";
+import { atomicWriteText, FileChangedError } from "../fs-write.js";
+import { invalidateFileCandidates } from "../context/mentions.js";
 registerTool({
     name: "apply_patch",
     description: "Change SEVERAL files in one atomic step (all-or-nothing). `changes` is an array of " +
@@ -51,13 +53,29 @@ registerTool({
         const abs = (pth) => (isAbsolute(pth) ? pth : resolve(ctx.cwd, pth));
         // PHASE 1 — validate + compute every change in memory; bail before writing anything.
         const plans = [];
+        const plannedPaths = new Set();
         for (let i = 0; i < changes.length; i++) {
             const ch = changes[i];
             const tag = `change ${i + 1}/${changes.length}`;
             if (typeof ch.path !== "string" || !ch.path)
                 return `Error: ${tag} is missing a path. Nothing written.`;
             const p = abs(ch.path);
-            const type = ch.type ?? (ch.edits ? "update" : "create");
+            if (plannedPaths.has(p))
+                return `Error: ${tag} repeats path ${ch.path}. Combine edits for one file into a single change. Nothing written.`;
+            plannedPaths.add(p);
+            let type = ch.type ?? (ch.edits ? "update" : "create");
+            // Backward-compatible shorthand: {path, content} updates an existing file and creates a missing
+            // one. An EXPLICIT type:create is stricter and never clobbers an existing path.
+            if (!ch.type && !ch.edits) {
+                try {
+                    await lstat(p);
+                    type = "update";
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return `Error: ${tag} cannot inspect ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
+                }
+            }
             if (type === "delete") {
                 let before;
                 try {
@@ -71,16 +89,15 @@ registerTool({
             else if (type === "create") {
                 if (typeof ch.content !== "string")
                     return `Error: ${tag} create ${ch.path} needs \`content\`. Nothing written.`;
-                let before = "";
-                let existed = false;
                 try {
-                    before = await readFile(p, "utf8");
-                    existed = true;
+                    await lstat(p);
+                    return `Error: ${tag} create ${ch.path}: path already exists (use type:update to replace it). Nothing written.`;
                 }
-                catch {
-                    /* new file */
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        return `Error: ${tag} create ${ch.path}: ${error?.message ?? String(error)}. Nothing written.`;
                 }
-                plans.push({ path: ch.path, abs: p, type, before, after: ch.content, existed });
+                plans.push({ path: ch.path, abs: p, type, before: "", after: ch.content, existed: false });
             }
             else {
                 // update
@@ -108,27 +125,39 @@ registerTool({
         try {
             for (const pl of plans) {
                 if (pl.type === "delete") {
+                    let current;
+                    try {
+                        current = await readFile(pl.abs, "utf8");
+                    }
+                    catch {
+                        throw new FileChangedError(pl.path);
+                    }
+                    if (current !== pl.before)
+                        throw new FileChangedError(pl.path);
                     await unlink(pl.abs);
                 }
                 else {
-                    await mkdir(dirname(pl.abs), { recursive: true });
-                    await writeFile(pl.abs, pl.after, "utf8");
+                    await atomicWriteText(pl.abs, pl.after, { expected: pl.existed ? pl.before : null });
                 }
                 applied.push(pl);
             }
         }
         catch (e) {
+            const rollbackFailures = [];
             for (const pl of applied.reverse()) {
                 try {
                     if (pl.type === "create" && !pl.existed)
                         await unlink(pl.abs); // remove a file we created
                     else
-                        await writeFile(pl.abs, pl.before, "utf8"); // restore an updated/deleted file's prior content
+                        await atomicWriteText(pl.abs, pl.before); // restore an updated/deleted file's prior content
                 }
-                catch {
-                    /* best-effort rollback */
+                catch (rollbackError) {
+                    rollbackFailures.push(`${pl.path}: ${rollbackError?.message ?? String(rollbackError)}`);
                 }
             }
+            if (rollbackFailures.length) {
+                return `Error: apply_patch failed (${e instanceof Error ? e.message : String(e)}); rollback was INCOMPLETE: ${rollbackFailures.join("; ")}. Inspect these files before continuing.`;
+            }
             return `Error: apply_patch failed writing a file (${e instanceof Error ? e.message : String(e)}) — rolled back, nothing left changed.`;
         }
         // All writes succeeded → now show diffs + record the undo snapshot.
@@ -137,6 +166,7 @@ registerTool({
             return pl.type === "delete" ? `deleted ${pl.path}` : `${pl.type === "create" ? "created" : "updated"} ${pl.path}`;
         });
         recordEdit(plans.map((pl) => ({ path: pl.path, absPath: pl.abs, before: pl.existed ? pl.before : null })));
+        invalidateFileCandidates(ctx.cwd);
         return `apply_patch: ${plans.length} file(s) — ${summary.join("; ")}.`;
     },
 });

package/dist/tools/registry.js

@@ -1,3 +1,4 @@
+import { limitToolResult } from "./result-limit.js";
 /** Names of required parameters that are ABSENT (undefined/null) in a tool call's input. Defends
  *  against models that drop parameters outright (observed: qwen3.7-plus losing write_file's
  *  path/content mid-stream) — the loop rejects the call with a precise error instead of executing
@@ -9,8 +10,16 @@ export function missingRequired(tool, input) {
     return req.filter((k) => obj[k] === undefined || obj[k] === null);
 }
 const registry = new Map();
+let specsCache = null;
 export function registerTool(t) {
-    registry.set(t.name, t);
+    const run = t.run;
+    registry.set(t.name, {
+        ...t,
+        // Apply the context boundary at registration so every caller (main loop, tests, embedders) gets
+        // identical behavior instead of relying on one orchestration path to remember the cap.
+        run: async (input, ctx) => limitToolResult(await run(input, ctx)),
+    });
+    specsCache = null;
 }
 export function getTool(name) {
     return registry.get(name);
@@ -20,9 +29,14 @@ export function getTools() {
 }
 /** Provider-neutral tool specs derived from the registry. */
 export function toolSpecs() {
-    return getTools().map((t) => ({
-        name: t.name,
-        description: t.description,
-        input_schema: t.input_schema,
-    }));
+    if (!specsCache) {
+        specsCache = getTools().map((t) => ({
+            name: t.name,
+            description: t.description,
+            input_schema: t.input_schema,
+        }));
+    }
+    // Callers commonly filter the array for a role. Return a shallow copy so that never mutates the
+    // stable cached snapshot shared by subsequent agent rounds.
+    return specsCache.slice();
 }

package/dist/tools/result-limit.js

@@ -0,0 +1,37 @@
+// One invariant for every registered tool: no single result may monopolize the model context. Individual
+// tools can use tighter domain-specific limits, but this final boundary also covers plugins/new tools.
+export const MAX_TOOL_RESULT_CHARS = 24_000;
+function safeHead(value, end) {
+    let at = Math.max(0, Math.min(value.length, end));
+    if (at > 0 && /[\uD800-\uDBFF]/.test(value[at - 1] ?? ""))
+        at--;
+    return value.slice(0, at);
+}
+function safeTail(value, start) {
+    let at = Math.max(0, Math.min(value.length, start));
+    if (at < value.length && /[\uDC00-\uDFFF]/.test(value[at] ?? ""))
+        at++;
+    return value.slice(at);
+}
+/** Keep actionable beginnings and endings while bounding the exact string persisted in history. */
+export function limitToolResult(value, max = MAX_TOOL_RESULT_CHARS) {
+    const text = typeof value === "string" ? value : String(value ?? "");
+    const cap = Math.max(0, Math.floor(max));
+    if (text.length <= cap)
+        return text;
+    if (cap === 0)
+        return "";
+    let omitted = text.length - cap;
+    let fullMarker = "";
+    // The marker consumes part of the budget too. Iterate twice so its count reflects the actual payload
+    // removed rather than understating it by roughly the marker's own length.
+    for (let i = 0; i < 2; i++) {
+        fullMarker = `\n…[hara: ${omitted} chars omitted; narrow the query or continue read_file with offset/limit]…\n`;
+        omitted = text.length - Math.max(0, cap - fullMarker.length);
+    }
+    const marker = fullMarker.length < cap ? fullMarker : "…[truncated]…".slice(0, cap);
+    const room = cap - marker.length;
+    const headChars = Math.floor(room * 0.6);
+    const tailChars = room - headChars;
+    return safeHead(text, headChars) + marker + safeTail(text, text.length - tailChars);
+}

package/dist/tools/web.js

@@ -7,6 +7,8 @@ import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { wrapUntrusted } from "../security/external-content.js";
 const MAX = 60_000;
+const SEARCH_ATTEMPT_MS = 8_000;
+const SEARCH_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/124.0 Safari/537.36";
 /** True for loopback / private / link-local / ULA / CGNAT addresses we must not let web_fetch reach. */
 export function isPrivateIp(ip) {
     const host = ip.replace(/^\[|\]$/g, "");
@@ -115,6 +117,146 @@ export function parseSearchResults(html, limit) {
     }
     return out;
 }
+/** Parse Baidu's server-rendered result headings. Baidu result links are redirects, which is fine:
+ *  web_fetch follows redirects while re-running its SSRF check on every hop. This gives mainland users a
+ *  keyless search path that does not depend on an overseas API being reachable. */
+export function parseBaiduSearchResults(html, limit) {
+    const strip = (s) => s
+        .replace(/<script[\s\S]*?<\/script>/gi, " ")
+        .replace(/<style[\s\S]*?<\/style>/gi, " ")
+        .replace(/<[^>]+>/g, " ")
+        .replace(/&nbsp;|&#160;/gi, " ")
+        .replace(/&amp;/gi, "&")
+        .replace(/&lt;/gi, "<")
+        .replace(/&gt;/gi, ">")
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&#x27;/gi, "'")
+        .replace(/\s+/g, " ")
+        .trim();
+    const headings = [];
+    const re = /<h3\b[^>]*>[\s\S]*?<a\b[^>]*href=(?:"([^"]+)"|'([^']+)')[^>]*>([\s\S]*?)<\/a>[\s\S]*?<\/h3>/gi;
+    let m;
+    while ((m = re.exec(html)) && headings.length < limit) {
+        const title = strip(m[3]);
+        const url = (m[1] ?? m[2] ?? "").replace(/&amp;/g, "&");
+        if (title && /^https?:\/\//i.test(url))
+            headings.push({ at: m.index, end: re.lastIndex, title, url });
+    }
+    return headings.map((h, i) => {
+        // The abstract normally sits between this heading and the next result heading. Strip that bounded
+        // slice and cap it; if Baidu changes class names the title/link still survive.
+        const boundary = headings[i + 1]?.at ?? Math.min(html.length, h.end + 1800);
+        const snippet = strip(html.slice(h.end, boundary)).slice(0, 240);
+        return { title: h.title, url: h.url, snippet };
+    });
+}
+/** Parse Bing's stable server-rendered result list (`cn.bing.com` is reachable in the mainland network
+ *  where overseas agent-search APIs commonly fail). */
+export function parseBingSearchResults(html, limit) {
+    const strip = (s) => s
+        .replace(/<[^>]+>/g, " ")
+        .replace(/&nbsp;|&#160;/gi, " ")
+        .replace(/&ensp;|&#8194;/gi, " ")
+        .replace(/&emsp;|&#8195;/gi, " ")
+        .replace(/&amp;/gi, "&")
+        .replace(/&lt;/gi, "<")
+        .replace(/&gt;/gi, ">")
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&#x27;/gi, "'")
+        .replace(/\s+/g, " ")
+        .trim();
+    const out = [];
+    const blockRe = /<li\b[^>]*class=(?:"[^"]*\bb_algo\b[^"]*"|'[^']*\bb_algo\b[^']*')[^>]*>([\s\S]*?)<\/li>/gi;
+    let block;
+    while ((block = blockRe.exec(html)) && out.length < limit) {
+        const link = /<h2\b[^>]*>[\s\S]*?<a\b[^>]*href=(?:"([^"]+)"|'([^']+)')[^>]*>([\s\S]*?)<\/a>[\s\S]*?<\/h2>/i.exec(block[1]);
+        if (!link)
+            continue;
+        const url = (link[1] ?? link[2] ?? "").replace(/&amp;/g, "&");
+        const title = strip(link[3]);
+        if (!title || !/^https?:\/\//i.test(url))
+            continue;
+        const paragraph = /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block[1]);
+        out.push({ title, url, snippet: strip(paragraph?.[1] ?? "").slice(0, 240) });
+    }
+    return out;
+}
+/** Best-effort parser for Google's classic HTML result shape. Google often serves a redirect/challenge
+ *  shell in mainland environments, so this is a fallback, not the sole search path. */
+export function parseGoogleSearchResults(html, limit) {
+    const strip = (s) => s
+        .replace(/<[^>]+>/g, " ")
+        .replace(/&amp;/gi, "&")
+        .replace(/&lt;/gi, "<")
+        .replace(/&gt;/gi, ">")
+        .replace(/&quot;/gi, '"')
+        .replace(/&#39;|&#x27;/gi, "'")
+        .replace(/\s+/g, " ")
+        .trim();
+    const out = [];
+    const linkRe = /<a\b[^>]*href=(?:"([^"]+)"|'([^']+)')[^>]*>[\s\S]{0,1600}?<h3\b[^>]*>([\s\S]*?)<\/h3>[\s\S]*?<\/a>/gi;
+    let m;
+    while ((m = linkRe.exec(html)) && out.length < limit) {
+        let url = (m[1] ?? m[2] ?? "").replace(/&amp;/g, "&");
+        if (url.startsWith("/url?")) {
+            try {
+                url = new URL(url, "https://www.google.com").searchParams.get("q") ?? "";
+            }
+            catch {
+                url = "";
+            }
+        }
+        const title = strip(m[3]);
+        if (!title || !/^https?:\/\//i.test(url) || /(?:^|\.)google\.[^/]+\//i.test(url))
+            continue;
+        out.push({ title, url, snippet: "" });
+    }
+    return out;
+}
+/** Detect the common HTML shell returned by SPAs (root element + scripts/loading text, no readable body).
+ *  web_fetch intentionally does not execute arbitrary page JavaScript, so surfacing the limitation is
+ *  better than returning a misleading successful "(empty body)". */
+export function looksLikeJsRenderedShell(html, readable) {
+    if (readable.trim().length >= 180)
+        return false;
+    const hasRoot = /<(?:div|main)\b[^>]*(?:id=["'](?:root|app|__next)["']|data-reactroot)/i.test(html);
+    const scripts = (html.match(/<script\b/gi) ?? []).length;
+    const shellText = /(?:enable javascript|javascript is required|loading[.…]*|正在加载|请启用\s*javascript)/i.test(readable || html);
+    return (hasRoot && scripts > 0) || (scripts >= 2 && readable.trim().length < 40) || shellText;
+}
+async function searchFetch(url, init) {
+    return fetch(url, { ...init, signal: AbortSignal.timeout(SEARCH_ATTEMPT_MS) });
+}
+async function firstSuccessfulSearch(attempts, failures) {
+    if (!attempts.length)
+        return null;
+    return new Promise((resolve) => {
+        let remaining = attempts.length;
+        let settled = false;
+        for (const attempt of attempts) {
+            void attempt
+                .run()
+                .then((results) => {
+                if (results.length && !settled) {
+                    settled = true;
+                    resolve(results);
+                }
+                else if (!results.length) {
+                    failures.push(`${attempt.name} no results`);
+                }
+            })
+                .catch((e) => {
+                const reason = e?.name === "TimeoutError" || e?.name === "AbortError" ? "timeout" : (e?.message ?? String(e));
+                failures.push(`${attempt.name} ${reason}`);
+            })
+                .finally(() => {
+                remaining--;
+                if (remaining === 0 && !settled)
+                    resolve(null);
+            });
+        }
+    });
+}
 registerTool({
     name: "web_search",
     description: "Search the web and return the top results (title, URL, snippet). Use it to FIND information or pages you " +
@@ -135,51 +277,90 @@ registerTool({
             return "(empty query)";
         const limit = Math.min(Math.max(1, Number(input.limit) || 6), 10);
         const fmt = (rs) => rs.map((r, n) => `${n + 1}. ${r.title}\n   ${r.url}${r.snippet ? `\n   ${r.snippet}` : ""}`).join("\n\n");
-        const ctrl = new AbortController();
-        const timer = setTimeout(() => ctrl.abort(), 20_000);
-        try {
-            // Reliable path: Tavily (designed for agents, free tier) when a key is configured.
-            const key = process.env.HARA_SEARCH_API_KEY || process.env.TAVILY_API_KEY;
-            if (key) {
-                const res = await fetch("https://api.tavily.com/search", {
-                    method: "POST",
-                    signal: ctrl.signal,
-                    headers: { "content-type": "application/json" },
-                    body: JSON.stringify({ api_key: key, query: q, max_results: limit }),
-                });
-                if (res.ok) {
+        const failures = [];
+        // Race the configured agent-search API against a mainland-accessible HTML source. A blocked Tavily
+        // endpoint no longer adds an 8-second penalty before Hara starts the domestic fallback.
+        const key = process.env.HARA_SEARCH_API_KEY || process.env.TAVILY_API_KEY;
+        const primaryAttempts = [];
+        if (key) {
+            primaryAttempts.push({
+                name: "Tavily",
+                run: async () => {
+                    const res = await searchFetch("https://api.tavily.com/search", {
+                        method: "POST",
+                        headers: { "content-type": "application/json" },
+                        body: JSON.stringify({ api_key: key, query: q, max_results: limit }),
+                    });
+                    if (!res.ok)
+                        throw new Error(`HTTP ${res.status}`);
                     const j = (await res.json());
-                    const rs = (j.results ?? []).map((x) => ({ title: String(x.title ?? x.url ?? ""), url: String(x.url ?? ""), snippet: String(x.content ?? "").slice(0, 200) }));
-                    if (rs.length)
-                        return wrapUntrusted(fmt(rs), `web_search: ${q}`);
-                }
-                // Tavily failed → fall through to the keyless best-effort path.
-            }
-            // Keyless fallback: DuckDuckGo HTML (POST — GET returns a 202 challenge). May be rate-limited.
-            const res = await fetch("https://html.duckduckgo.com/html/", {
-                method: "POST",
-                signal: ctrl.signal,
-                redirect: "follow",
-                headers: {
-                    "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",
-                    "content-type": "application/x-www-form-urlencoded",
-                    accept: "text/html",
+                    return (j.results ?? []).map((x) => ({ title: String(x.title ?? x.url ?? ""), url: String(x.url ?? ""), snippet: String(x.content ?? "").slice(0, 200) }));
                 },
-                body: `q=${encodeURIComponent(q)}`,
             });
-            if (!res.ok)
-                return `Search failed: HTTP ${res.status}. Keyless search is rate-limited — set HARA_SEARCH_API_KEY (Tavily) for reliable search, or web_fetch a known URL.`;
-            const results = parseSearchResults(await res.text(), limit);
-            if (!results.length)
-                return "(no results — the keyless endpoint is rate-limited or changed. Set HARA_SEARCH_API_KEY (Tavily) for reliable search, or web_fetch a known URL.)";
-            return wrapUntrusted(fmt(results), `web_search: ${q}`);
-        }
-        catch (e) {
-            return `Search failed: ${e?.name === "AbortError" ? "timed out (20s)" : (e?.message ?? e)}`;
-        }
-        finally {
-            clearTimeout(timer);
         }
+        primaryAttempts.push({
+            name: "Bing CN",
+            run: async () => {
+                const res = await searchFetch(`https://cn.bing.com/search?q=${encodeURIComponent(q)}&count=${limit}&setlang=zh-Hans`, {
+                    method: "GET",
+                    redirect: "follow",
+                    headers: { "user-agent": SEARCH_UA, accept: "text/html" },
+                });
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                return parseBingSearchResults(await res.text(), limit);
+            },
+        });
+        const primary = await firstSuccessfulSearch(primaryAttempts, failures);
+        if (primary)
+            return wrapUntrusted(fmt(primary), `web_search: ${q}`);
+        // Secondary sources run concurrently, keeping total failure latency bounded. Google is included as a
+        // user-friendly fallback where it is reachable, but is never the sole path (mainland often gets a shell).
+        const secondary = await firstSuccessfulSearch([
+            {
+                name: "Baidu",
+                run: async () => {
+                    const res = await searchFetch(`https://www.baidu.com/s?wd=${encodeURIComponent(q)}&rn=${limit}`, {
+                        method: "GET",
+                        redirect: "follow",
+                        headers: { "user-agent": SEARCH_UA, accept: "text/html" },
+                    });
+                    if (!res.ok)
+                        throw new Error(`HTTP ${res.status}`);
+                    return parseBaiduSearchResults(await res.text(), limit);
+                },
+            },
+            {
+                name: "Google",
+                run: async () => {
+                    const res = await searchFetch(`https://www.google.com/search?q=${encodeURIComponent(q)}&num=${limit}&hl=zh-CN`, {
+                        method: "GET",
+                        redirect: "follow",
+                        headers: { "user-agent": SEARCH_UA, accept: "text/html" },
+                    });
+                    if (!res.ok)
+                        throw new Error(`HTTP ${res.status}`);
+                    return parseGoogleSearchResults(await res.text(), limit);
+                },
+            },
+            {
+                name: "DuckDuckGo",
+                run: async () => {
+                    const res = await searchFetch("https://html.duckduckgo.com/html/", {
+                        method: "POST",
+                        redirect: "follow",
+                        headers: { "user-agent": SEARCH_UA, "content-type": "application/x-www-form-urlencoded", accept: "text/html" },
+                        body: `q=${encodeURIComponent(q)}`,
+                    });
+                    if (!res.ok)
+                        throw new Error(`HTTP ${res.status}`);
+                    return parseSearchResults(await res.text(), limit);
+                },
+            },
+        ], failures);
+        if (secondary)
+            return wrapUntrusted(fmt(secondary), `web_search: ${q}`);
+        return `Search failed across available providers (${failures.join("; ")}). Check connectivity/proxy, configure HARA_SEARCH_API_KEY, or web_fetch a known URL.`;
     },
 });
 registerTool({
@@ -232,6 +413,11 @@ registerTool({
             let text = /html/i.test(ct) ? htmlToText(raw) : raw;
             if (text.length > cap)
                 text = text.slice(0, cap) + `\n…[truncated ${text.length - cap} chars]`;
+            if (/html/i.test(ct) && looksLikeJsRenderedShell(raw, text)) {
+                const hint = "This page appears to be JavaScript-rendered; web_fetch received only the SPA shell and does not execute page scripts. " +
+                    "Use an available browser/web skill for the rendered page, or the site's authenticated API/connector (for example the Feishu Docs API).";
+                return `# ${current.href} (HTTP ${res.status})\n\n${wrapUntrusted(`${text || "(empty shell)"}\n\n${hint}`, current.href)}`;
+            }
             return `# ${current.href} (HTTP ${res.status})\n\n${wrapUntrusted(text || "(empty body)", current.href)}`;
         }
         catch (e) {

package/dist/tui/App.js

@@ -516,7 +516,7 @@ export function App({ initialStatus, model, cwd, header, onSubmit, cycleApproval
         const askTextFn = (title) => new Promise((resolve) => setAskText({ title, resolve }));
         // ask_user: when options are given, offer them as a select + a "type my own" escape hatch; otherwise (or
         // when the user chooses to type their own) capture a free-text line. Returns the chosen/typed answer.
-        const OTHER = "__ask_other__"; // sentinel value for the "type my own" option
+        const OTHER = "\\0__ask_other__"; // escaped sentinel keeps this TypeScript file text-only
         const askFn = async (question, options) => {
             if (options && options.length) {
                 const choice = await openPrompt(question, [