@ocis/myagent-cli 0.2.1 → 0.2.3

package/README.md

@@ -42,9 +42,24 @@ npm install -g @ocis/myagent-cli   # global
 
 The CLI runs on **Bun ≥1.0** or **Node.js ≥22.19**. The published bin is a small
 launcher that prefers Bun and falls back to Node, so `bunx` and `npm install -g`
-both work with whichever runtime you have. Configure credentials with
-`myagent config`, or set `MYAGENT_BASE_URL` / `MYAGENT_INTEGRATION_ID` /
-`MYAGENT_API_KEY`.
+both work with whichever runtime you have. Everywhere below, `myagent` means the
+installed binary — with `bunx`, substitute `bunx @ocis/myagent-cli`.
+
+Point it at an integration — the **API Base URL** and **API key** are on the
+Integrations page (the combined URL carries the integration id):
+
+```bash
+# Env vars — handy for bunx and CI:
+MYAGENT_BASE_URL=https://your-host/integrations/<id> \
+MYAGENT_API_KEY=iak_... \
+bunx @ocis/myagent-cli
+
+# Or flags:
+bunx @ocis/myagent-cli --base-url https://your-host/integrations/<id> --api-key iak_...
+
+# Or persist them once (writes ~/.config/myagent/config.json, 0600):
+myagent config
+```
 
 ## Plan / Coding / Cowork modes
 
@@ -111,14 +126,13 @@ you decide, can each need one). Each waiting approval keeps its own deadline
 and its own cancellation, so a release of one call never cancels another and
 `/stop` cancels every one of them.
 
-While you decide, the CLI watches the session's event channel (when the server
-advertises `sessionEvents`) and reports when the channel itself drops and is
-being reconnected. If the server releases the call while you decide (the
-30-minute lease expired, the sandbox restarted, or the run ended), the
-approval is **cancelled** — the tool never runs, and the tool card in the
-transcript says so. Stopping the run (Esc, Ctrl+C, `/stop`) cancels a pending
-approval the same way. If the sandbox was paused while you were away, the next
-request wakes it automatically.
+While you decide, the CLI watches the session's event channel and reports when
+the channel itself drops and is being reconnected. If the server releases the
+call while you decide (the 30-minute lease expired, the sandbox restarted, or
+the run ended), the approval is **cancelled** — the tool never runs, and the
+tool card in the transcript says so. Stopping the run (Esc, Ctrl+C, `/stop`)
+cancels a pending approval the same way. If the sandbox was paused while you
+were away, the next request wakes it automatically.
 
 ## Context files
 

package/bin/myagent.js

@@ -21,13 +21,18 @@ for (const sig of ["SIGTERM", "SIGHUP"]) {
   process.on(sig, () => { try { child?.kill(sig); } catch { /* already gone */ } });
 }
 
+/** pi-tui's regex needs the `v` flag, which Node only has from 22.19. */
+function nodeTooOld() {
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  return major < 22 || (major === 22 && minor < 19);
+}
+
 function launch(runtime) {
   child = spawn(runtime, [entry, ...args], { stdio: "inherit" });
 
   child.once("error", (err) => {
     if (err.code === "ENOENT" && runtime !== process.execPath) {
-      const [major, minor] = process.versions.node.split(".").map(Number);
-      if (major < 22 || (major === 22 && minor < 19)) {
+      if (nodeTooOld()) {
         console.error(
           `myagent requires Bun or Node.js >= 22.19 (found Node ${process.versions.node}).\n` +
             "Install Bun: https://bun.sh",

package/dist/agent/turn.d.ts

@@ -74,7 +74,7 @@ export declare class AgentRunner {
      * before an in-flight round resumes, so it cannot be used there).
      */
     private stopped;
-    private followUps;
+    private readonly followUps;
     /**
      * Chain of fire-and-forget follow-up turns (user follow-ups).
      * `waitForIdle()` awaits it so headless runs don't exit before a queued
@@ -88,15 +88,16 @@ export declare class AgentRunner {
      * filter: a replayed CUSTOM_TOOL_CALL for an abandoned call is never
      * executed again.
      */
-    private abandonedToolCalls;
+    private readonly abandonedToolCalls;
     /**
-     * Every CUSTOM_TOOL_CALL id received this session. The replay guard: an id
+     * Every client tool call id this session has taken ownership of — from a
+     * CUSTOM_TOOL_CALL event or a reconcile adoption. The replay guard: an id
      * seen once is never enqueued again, whatever the delivery path (run stream,
      * event-channel replay) — a duplicate would execute a side-effecting tool
      * twice. Cumulative like abandonedToolCalls: ids are unique per call, so
      * there is nothing to reset.
      */
-    private seenToolCallIds;
+    private readonly seenToolCallIds;
     /**
      * Unix ms of a server-reported interruption of the previous run (restart /
      * idle scale-down) — wording only: released calls are explained as an
@@ -108,7 +109,7 @@ export declare class AgentRunner {
      * An id is removed BEFORE its submission request goes out, so the server's
      * echo of our own result can never be misread as a release.
      */
-    private pendingSubmission;
+    private readonly pendingSubmission;
     /**
      * Steers acked but not yet injected into the run, keyed by the persisted
      * message id (from INPUT_ACCEPTED). The ack only means "persisted + queued
@@ -118,13 +119,13 @@ export declare class AgentRunner {
      * as a fresh prompt by the manager, and the message is in the session
      * either way, so the float must not linger.
      */
-    private pendingSteerDeliveries;
+    private readonly pendingSteerDeliveries;
     /**
      * Tool rounds scheduled or executing (debounce included). The turn drains
      * them before it settles, so a round is never raced by the followUps drain.
      */
     private roundsInFlight;
-    private roundsDrained;
+    private readonly roundsDrained;
     /**
      * True once the current run segment ended (RUN_FINISHED/RUN_ERROR) — a
      * stream that closes without this observed a drop, not a settle.
@@ -225,7 +226,7 @@ export declare class AgentRunner {
     waitForIdle(): Promise<void>;
     /**
      * Deliver a round's tool results, reconciling against the server's truth
-     * first when it advertises `toolCallExpiry`:
+     * first (the pending registry is authoritative):
      *
      *  - still pending (exact id) → submit as-is (native tool result, same run);
      *  - the model retried the same action (same name + canonical args) → adopt
@@ -266,7 +267,7 @@ export declare class AgentRunner {
      */
     private markAbandoned;
     private latchThread;
-    /** Open the session event subscription for the recovery window (capability-gated). */
+    /** Open the session event subscription for the recovery window. */
     private startEventSubscription;
     private stopEventSubscription;
     /**

package/dist/agent/turn.js

@@ -148,7 +148,8 @@ export class AgentRunner {
      */
     abandonedToolCalls = new Set();
     /**
-     * Every CUSTOM_TOOL_CALL id received this session. The replay guard: an id
+     * Every client tool call id this session has taken ownership of — from a
+     * CUSTOM_TOOL_CALL event or a reconcile adoption. The replay guard: an id
      * seen once is never enqueued again, whatever the delivery path (run stream,
      * event-channel replay) — a duplicate would execute a side-effecting tool
      * twice. Cumulative like abandonedToolCalls: ids are unique per call, so
@@ -480,6 +481,11 @@ export class AgentRunner {
             batch = [];
             void this.executeAndSubmit(calls, cb, signal)
                 .catch((err) => {
+                // A stop aborts the round mid-flight — "Stopped." is the message;
+                // a "Tool round failed" notice would read as an error the user
+                // didn't cause.
+                if (signal.aborted)
+                    return;
                 cb.onNotice(`Tool round failed: ${err instanceof Error ? err.message : String(err)}`, "error");
             })
                 .finally(() => {
@@ -694,7 +700,7 @@ export class AgentRunner {
     }
     /**
      * Deliver a round's tool results, reconciling against the server's truth
-     * first when it advertises `toolCallExpiry`:
+     * first (the pending registry is authoritative):
      *
      *  - still pending (exact id) → submit as-is (native tool result, same run);
      *  - the model retried the same action (same name + canonical args) → adopt
@@ -850,6 +856,14 @@ export class AgentRunner {
             if (adopted) {
                 live.push({ ...output, tool_call_id: adopted.id });
                 unmatched.delete(adopted.id);
+                // The original id is never submitted (its result was re-attached to
+                // the retry), so it must leave the pending set — otherwise the run-end
+                // sweep announces a release for a call that was answered.
+                if (call)
+                    this.pendingSubmission.delete(call.id);
+                // The retry id is answered by the re-attached result — a replayed
+                // CUSTOM_TOOL_CALL for it must never execute it again.
+                this.seenToolCallIds.add(adopted.id);
                 cb.onNotice(`Re-attached the result of ${call?.name ?? "a tool call"} to the agent's retry.`, "info");
                 continue;
             }
@@ -857,18 +871,27 @@ export class AgentRunner {
         }
         // Pending calls this client never executed (e.g. the model retried with
         // different arguments): execute them through the normal approval path so
-        // the run isn't left waiting on a call nobody will answer.
-        if (unmatched.size > 0) {
-            const extraCalls = [...unmatched.values()].map((p) => ({
-                id: p.id,
-                name: p.name,
-                arguments: p.arguments,
-            }));
+        // the run isn't left waiting on a call nobody will answer. Skip ids
+        // another round already claimed (pendingSubmission) or executed
+        // (seenToolCallIds) — concurrent rounds reconcile against the same server
+        // snapshot, and adopting an id twice would run a side-effecting tool twice.
+        const extraCalls = [...unmatched.values()]
+            .filter((p) => !this.pendingSubmission.has(p.id) && !this.seenToolCallIds.has(p.id))
+            .map((p) => ({
+            id: p.id,
+            name: p.name,
+            arguments: p.arguments,
+        }));
+        if (extraCalls.length > 0) {
             // Register before execution (same as event-driven calls via
             // executeAndSubmit) so a release arriving mid-execution is surfaced by
-            // the release filter instead of only surfacing at submission time.
-            for (const call of extraCalls)
+            // the release filter instead of only surfacing at submission time. The
+            // replay guard too: a replayed CUSTOM_TOOL_CALL for an adopted id must
+            // never execute it again.
+            for (const call of extraCalls) {
                 this.pendingSubmission.add(call.id);
+                this.seenToolCallIds.add(call.id);
+            }
             live.push(...await this.executeToolCalls(extraCalls, signal));
         }
         return { live, released };
@@ -918,7 +941,7 @@ export class AgentRunner {
     // -------------------------------------------------------------------------
     // Fallback event channel (reconcile window only — no run stream attached)
     // -------------------------------------------------------------------------
-    /** Open the session event subscription for the recovery window (capability-gated). */
+    /** Open the session event subscription for the recovery window. */
     startEventSubscription() {
         if (!this.threadId)
             return;
@@ -1193,8 +1216,11 @@ export class AgentRunner {
                 calls.push(call);
                 // Register before execution (same as executeAndSubmit/reconcileRound):
                 // a release arriving while an approval is pending must cancel it via
-                // the release filter, not wait out the approval timeout.
+                // the release filter, not wait out the approval timeout. The replay
+                // guard too — a replayed CUSTOM_TOOL_CALL for this id must never
+                // execute it again.
                 this.pendingSubmission.add(item.id);
+                this.seenToolCallIds.add(item.id);
                 const handler = this.opts.registry.get(item.name);
                 const parsed = this.parseCall(call);
                 if (!isMutatingCall(handler, parsed.args)) {

package/dist/approval/policy.js

@@ -142,7 +142,7 @@ export class ApprovalPolicy {
         try {
             // A cancel/timeout while queued settles immediately — no card, no wait.
             if (wait)
-                await Promise.race([previous.catch(() => { }), deadline.promise]);
+                await Promise.race([previous, deadline.promise]);
             if (settled)
                 return await deadline.promise;
             return await Promise.race([this.prompt(request, controller.signal), deadline.promise]);

package/dist/headless.js

@@ -282,6 +282,12 @@ export async function runHeadless(opts) {
         // Same for the best-effort title update latched by onThread above.
         await titleUpdate;
     }
+    catch (err) {
+        // The output contract is "always a parseable object" (json/stream-json):
+        // an escaping exception would leave stdout empty and exit 1 without an
+        // error_code. Record it and fall through to the normal output below.
+        firstError.record(err instanceof Error ? err.message : String(err), "run_failed");
+    }
     finally {
         stop.dispose();
     }

package/dist/index.d.ts

@@ -45,9 +45,12 @@ export declare function assemblePrompt(args: Args, stdinText: string): string;
  * Report a pre-run failure (usage/config/connection) in the requested output
  * format and return the exit code. `json` always emits a parseable object — a
  * CI parser must never see an empty stdout; `stream-json` emits a terminal
- * `done` event; text goes to stderr.
+ * `done` event; text goes to stderr. The default exit code is 2
+ * (usage/config/connection); a failure that is really a failed run (e.g. a
+ * `--timeout` expiry) passes 1 so the same `error_code` always maps to the
+ * same code.
  */
-export declare function fail(format: OutputFormat | undefined, message: string, errorCode?: string): number;
+export declare function fail(format: OutputFormat | undefined, message: string, errorCode?: string, exitCode?: number): number;
 /**
  * Read piped stdin as prompt text. Bounded by the run's `--timeout` when one
  * is set: a non-TTY stdin that never closes (a CI misconfiguration like

package/dist/index.js

@@ -8,8 +8,8 @@
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { homedir } from "node:os";
-import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
+import pkg from "../package.json" with { type: "json" };
 import { IntegrationClient } from "./protocol/client.js";
 import { ToolRegistry } from "./tools/registry.js";
 import { combinedIntegrationUrl, configDir, isConfigured, loadConfig, migrateLegacyConfigDir, resolveConfig, saveConfig, sessionsPath, splitIntegrationUrl, } from "./config.js";
@@ -21,18 +21,11 @@ import { discoverSkills, formatSkillList, resolveSkillDirs } from "./skills/disc
 import { sanitizeForTerminal } from "./sanitize.js";
 import { isMainModule, readStdinText } from "./runtime.js";
 /**
- * Package version, read from package.json so npm releases never drift from
- * `--version`. Resolves to the package root from both src/ (dev) and dist/.
+ * Package version, bundled from package.json so npm releases and the compiled
+ * binary never drift from `--version` (a runtime read cannot resolve inside
+ * `bun build --compile`'s virtual filesystem).
  */
-async function readVersion() {
-    try {
-        const pkg = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
-        return pkg.version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-}
+const VERSION = pkg.version;
 const HELP = `myagent — a coding agent for your local repository, powered by MyAgent
 
 Usage:
@@ -250,9 +243,12 @@ export function assemblePrompt(args, stdinText) {
  * Report a pre-run failure (usage/config/connection) in the requested output
  * format and return the exit code. `json` always emits a parseable object — a
  * CI parser must never see an empty stdout; `stream-json` emits a terminal
- * `done` event; text goes to stderr.
+ * `done` event; text goes to stderr. The default exit code is 2
+ * (usage/config/connection); a failure that is really a failed run (e.g. a
+ * `--timeout` expiry) passes 1 so the same `error_code` always maps to the
+ * same code.
  */
-export function fail(format, message, errorCode) {
+export function fail(format, message, errorCode, exitCode = 2) {
     if (format === "json") {
         process.stdout.write(failureResult(message, errorCode) + "\n");
     }
@@ -262,7 +258,7 @@ export function fail(format, message, errorCode) {
     else {
         process.stderr.write(message + "\n");
     }
-    return 2;
+    return exitCode;
 }
 /**
  * Read piped stdin as prompt text. Bounded by the run's `--timeout` when one
@@ -304,7 +300,7 @@ async function main() {
         return 0;
     }
     if (args.command === "version") {
-        process.stdout.write(`${await readVersion()}\n`);
+        process.stdout.write(`${VERSION}\n`);
         return 0;
     }
     const stored = await loadConfig();
@@ -383,11 +379,15 @@ async function main() {
     if (readsStdin && !process.stdin.isTTY && args.promptParts.length > 0 && !args.flags.timeout) {
         process.stderr.write("Reading additional prompt text from stdin until EOF — pass `< /dev/null` or --timeout <sec> if nothing is piped.\n");
     }
-    const stdinText = readsStdin
-        ? await readStdin(args.flags.timeout ? args.flags.timeout * 1000 : undefined)
-        : "";
+    // The --timeout budget covers the whole invocation, not each phase: the
+    // stdin wait below consumes part of it, and the run gets what is left.
+    const timeoutMs = args.flags.timeout ? args.flags.timeout * 1000 : undefined;
+    const startedAt = Date.now();
+    const stdinText = readsStdin ? await readStdin(timeoutMs) : "";
     if (stdinText === null) {
-        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s waiting for stdin.`, "timeout");
+        // Same `error_code` as a run timeout, so the same exit code: the help
+        // documents 1 = run failed (incl. timeout), 2 = usage/config/connection.
+        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s waiting for stdin.`, "timeout", 1);
     }
     const prompt = assemblePrompt(args, stdinText);
     const registry = new ToolRegistry();
@@ -413,6 +413,14 @@ async function main() {
     if (!prompt) {
         return fail(args.flags.outputFormat, "No prompt provided. Usage: myagent -p \"...\" or pipe text via stdin.", "no_prompt");
     }
+    // What is left of the --timeout budget after the stdin wait and setup. A
+    // non-positive remainder means the budget is already spent — fail as a
+    // timeout instead of handing the run a zero timeout (which would disable
+    // the timer entirely).
+    const remainingTimeoutMs = timeoutMs === undefined ? undefined : timeoutMs - (Date.now() - startedAt);
+    if (remainingTimeoutMs !== undefined && remainingTimeoutMs <= 0) {
+        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s (the stdin wait consumed the budget).`, "timeout", 1);
+    }
     return await runHeadless({
         client,
         registry,
@@ -430,7 +438,7 @@ async function main() {
         outputFormat: args.flags.outputFormat ?? "text",
         quiet: args.flags.quiet,
         lastMessageOnly: promptMode,
-        timeoutMs: args.flags.timeout ? args.flags.timeout * 1000 : undefined,
+        timeoutMs: remainingTimeoutMs,
     });
 }
 function printSessions(sessions) {

package/dist/runtime.d.ts

@@ -1,5 +1,3 @@
-/** Resolve an executable on PATH (Bun.which on Bun, a PATH scan on Node). */
-export declare function which(cmd: string): string | null;
 /** Read all of stdin as UTF-8 text. Callers check `process.stdin.isTTY` first. */
 export declare function readStdinText(): Promise<string>;
 /**
@@ -24,3 +22,10 @@ export interface SpawnOptions {
     detached?: boolean;
 }
 export declare function spawnProcess(args: string[], opts?: SpawnOptions): ProcessHandle;
+/**
+ * Exit code for a child that ended, matching Bun's convention: a signal death
+ * is 128 + signal number (SIGKILL → 137). Node's `close` reports `code: null`
+ * with the signal name, so without this the same kill reads as 0 on Node and
+ * 137 on Bun — abort paths key on the code.
+ */
+export declare function exitCodeFromClose(code: number | null, signal: NodeJS.Signals | null): number;

package/dist/runtime.js

@@ -2,40 +2,18 @@
 // Runtime shims: the few places where Bun and Node genuinely differ.
 //
 // Everything else uses node: builtins, which Bun implements natively — only
-// subprocess spawning (Bun.spawn vs node:child_process), PATH lookup
-// (Bun.which), stdin (Bun.stdin) and entry-point detection (import.meta.main)
-// need a runtime branch. The Bun branches are guarded by `typeof Bun`, so the
-// emitted JS never touches the `Bun` global on Node.
+// subprocess spawning (Bun.spawn vs node:child_process), stdin (Bun.stdin) and
+// entry-point detection (import.meta.main) need a runtime branch. The Bun
+// branches are guarded by `typeof Bun`, so the emitted JS never touches the
+// `Bun` global on Node.
 // ---------------------------------------------------------------------------
 import { spawn } from "node:child_process";
-import { realpathSync, statSync } from "node:fs";
+import { realpathSync } from "node:fs";
 import { Buffer } from "node:buffer";
-import { delimiter, join } from "node:path";
+import { constants as osConstants } from "node:os";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 const isBun = typeof Bun !== "undefined";
-// --- which -----------------------------------------------------------------
-/** Resolve an executable on PATH (Bun.which on Bun, a PATH scan on Node). */
-export function which(cmd) {
-    if (isBun && Bun.which)
-        return Bun.which(cmd);
-    const exts = process.platform === "win32"
-        ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean)
-        : [""];
-    for (const dir of (process.env.PATH ?? "").split(delimiter)) {
-        for (const ext of exts) {
-            const candidate = join(dir, cmd + ext);
-            try {
-                if (statSync(candidate).isFile())
-                    return candidate;
-            }
-            catch {
-                /* keep looking */
-            }
-        }
-    }
-    return null;
-}
 // --- stdin -----------------------------------------------------------------
 /** Read all of stdin as UTF-8 text. Callers check `process.stdin.isTTY` first. */
 export async function readStdinText() {
@@ -70,18 +48,51 @@ export function isMainModule(meta) {
 export function spawnProcess(args, opts) {
     return isBun ? spawnBun(args, opts) : spawnNode(args, opts);
 }
+/** An already-ended stream, for pipes that were not requested. */
+function emptyStream() {
+    return new ReadableStream();
+}
+/**
+ * Exit code for a child that ended, matching Bun's convention: a signal death
+ * is 128 + signal number (SIGKILL → 137). Node's `close` reports `code: null`
+ * with the signal name, so without this the same kill reads as 0 on Node and
+ * 137 on Bun — abort paths key on the code.
+ */
+export function exitCodeFromClose(code, signal) {
+    if (code !== null)
+        return code;
+    if (!signal)
+        return 0;
+    return 128 + (osConstants.signals[signal] ?? 0);
+}
 function spawnBun(args, opts) {
-    const proc = Bun.spawn(args, {
-        cwd: opts?.cwd,
-        stdin: "ignore",
-        stdout: opts?.stdout === "pipe" ? "pipe" : "ignore",
-        stderr: opts?.stderr === "pipe" ? "pipe" : "ignore",
-        detached: opts?.detached,
-    });
+    let proc;
+    try {
+        proc = Bun.spawn(args, {
+            cwd: opts?.cwd,
+            stdin: "ignore",
+            stdout: opts?.stdout === "pipe" ? "pipe" : "ignore",
+            stderr: opts?.stderr === "pipe" ? "pipe" : "ignore",
+            detached: opts?.detached,
+        });
+    }
+    catch (err) {
+        // Bun throws synchronously for a missing binary; Node reports it through
+        // `exited` = -1. Normalize so callers see one contract on both runtimes.
+        if (err?.code !== "ENOENT")
+            throw err;
+        return {
+            pid: 0,
+            stdout: emptyStream(),
+            stderr: emptyStream(),
+            exited: Promise.resolve(-1),
+            kill: () => { },
+        };
+    }
     return {
         pid: proc.pid,
-        stdout: proc.stdout,
-        stderr: proc.stderr,
+        stdout: opts?.stdout === "pipe" ? proc.stdout : emptyStream(),
+        stderr: opts?.stderr === "pipe" ? proc.stderr : emptyStream(),
         exited: proc.exited,
         kill: (signal) => { try {
             proc.kill(signal);
@@ -101,17 +112,17 @@ function spawnNode(args, opts) {
     });
     // First of close/error wins: a spawn failure (ENOENT) may emit only `error`.
     const exited = new Promise((resolve) => {
-        child.once("close", (code) => resolve(code ?? 0));
+        child.once("close", (code, signal) => resolve(exitCodeFromClose(code, signal)));
         child.once("error", () => resolve(-1));
     });
     return {
         pid: child.pid ?? 0,
         stdout: child.stdout
             ? Readable.toWeb(child.stdout)
-            : new ReadableStream(),
+            : emptyStream(),
         stderr: child.stderr
             ? Readable.toWeb(child.stderr)
-            : new ReadableStream(),
+            : emptyStream(),
         exited,
         kill: (signal) => { try {
             child.kill(signal);

package/dist/sanitize.js

@@ -10,6 +10,10 @@
 export function sanitizeForTerminal(text) {
     return text
         .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "") // OSC … (BEL / ST)
+        // DCS/APC/PM/SOS … (BEL / ST) — the same string-terminated convention as
+        // OSC. Without this only the 2-byte opener is removed and the payload
+        // (Kitty graphics, Sixel, …) leaks through as literal text.
+        .replace(/\u001b[P_^X][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "")
         // CSI: parameter + intermediate bytes then a final byte. SPACE (0x20) is a
         // legal intermediate (`CSI Ps SP q` sets the cursor shape), so it belongs
         // in the class — without it that sequence's tail leaked through as noise.

package/dist/tools/fs.js

@@ -1,7 +1,7 @@
 // ---------------------------------------------------------------------------
 // Filesystem tools: local_read, local_write, local_edit, local_ls.
 // ---------------------------------------------------------------------------
-import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { defineTool, optionalBoolean, optionalNumber, optionalString, requireString } from "./types.js";
 import { displayPath, resolveToolPath } from "./paths.js";
@@ -80,21 +80,21 @@ const writeTool = defineTool({
         const content = args.content;
         const append = optionalBoolean(args, "append") ?? false;
         const absolute = await resolveToolPath(path, ctx);
-        const existed = await stat(absolute).then((s) => s.isFile()).catch(() => false);
+        const info = await stat(absolute).catch(() => null);
+        // Same guard as local_read/local_edit: without it, append reports "does not
+        // exist" for a directory and overwrite leaks a raw EISDIR.
+        if (info?.isDirectory())
+            throw new Error(`"${path}" is a directory — use local_ls.`);
+        const existed = info?.isFile() ?? false;
         if (append && !existed)
             throw new Error(`Cannot append: ${path} does not exist.`);
-        if (append) {
-            // Same cap as local_read/local_edit: appending to a huge existing file
-            // would otherwise read it all into memory before the write.
-            const size = await stat(absolute).then((s) => s.size).catch(() => 0);
-            if (size > MAX_READ_BYTES) {
-                throw new Error(`Cannot append: ${path} is too large (${size} bytes, limit ${MAX_READ_BYTES}).`);
-            }
-        }
         await mkdir(dirname(absolute), { recursive: true });
         if (append) {
-            const previous = await readFile(absolute, "utf-8").catch(() => "");
-            await writeFile(absolute, previous + content, "utf-8");
+            // O_APPEND, not read-modify-write: a failed read used to be swallowed
+            // into "" and the rewrite then truncated the file to just `content`
+            // while reporting success. It also avoids re-encoding a non-UTF-8 file
+            // and the memory cost of reading it (the old size cap guarded that read).
+            await appendFile(absolute, content, "utf-8");
         }
         else {
             await writeFile(absolute, content, "utf-8");

package/dist/tools/glob.js

@@ -45,6 +45,14 @@ function splitAlternatives(body) {
     parts.push(body.slice(start));
     return parts;
 }
+/**
+ * Recursion depth cap. Each frame advances one pattern or path character (or
+ * substitutes a shorter pattern for a brace group), so depth grows with the
+ * input — a model-supplied pattern or a very long path could otherwise
+ * overflow the stack with a RangeError. The cap is far above any real glob
+ * and fails with a clear message instead of a crash.
+ */
+const MAX_MATCH_DEPTH = 2000;
 /**
  * Match one pattern against one path with a memoized walk. Brace groups are
  * tried in place (each alternative is matched as `alternative + suffix`), so
@@ -53,66 +61,75 @@ function splitAlternatives(body) {
 function matchPattern(pattern, path) {
     const n = path.length;
     const memos = new Map();
+    let depth = 0;
     function match(pat, pi, si) {
-        let memo = memos.get(pat);
-        if (!memo) {
-            memo = new Map();
-            memos.set(pat, memo);
+        if (++depth > MAX_MATCH_DEPTH) {
+            throw new Error(`Glob pattern is too complex (exceeds ${MAX_MATCH_DEPTH} steps).`);
         }
-        const key = pi * (n + 1) + si;
-        const hit = memo.get(key);
-        if (hit !== undefined)
-            return hit;
-        let result;
-        if (pi >= pat.length) {
-            result = si >= n;
-        }
-        else {
-            const ch = pat[pi];
-            if (ch === "*") {
-                if (pat[pi + 1] === "*") {
-                    if (pat[pi + 2] === "/") {
-                        // `**/`: zero or more directories — stop now, or consume one
-                        // segment (up to and including its `/`) and continue. Consuming a
-                        // whole segment at a time is what keeps the token from stopping
-                        // mid-name (`**` + `/a` must not match "ba").
-                        result = match(pat, pi + 3, si);
-                        if (!result) {
-                            let k = si;
-                            while (k < n && path[k] !== "/")
-                                k++;
-                            result = k < n && match(pat, pi, k + 1);
+        try {
+            let memo = memos.get(pat);
+            if (!memo) {
+                memo = new Map();
+                memos.set(pat, memo);
+            }
+            const key = pi * (n + 1) + si;
+            const hit = memo.get(key);
+            if (hit !== undefined)
+                return hit;
+            let result;
+            if (pi >= pat.length) {
+                result = si >= n;
+            }
+            else {
+                const ch = pat[pi];
+                if (ch === "*") {
+                    if (pat[pi + 1] === "*") {
+                        if (pat[pi + 2] === "/") {
+                            // `**/`: zero or more directories — stop now, or consume one
+                            // segment (up to and including its `/`) and continue. Consuming a
+                            // whole segment at a time is what keeps the token from stopping
+                            // mid-name (`**` + `/a` must not match "ba").
+                            result = match(pat, pi + 3, si);
+                            if (!result) {
+                                let k = si;
+                                while (k < n && path[k] !== "/")
+                                    k++;
+                                result = k < n && match(pat, pi, k + 1);
+                            }
+                        }
+                        else {
+                            // `**`: anything, slashes included.
+                            result = match(pat, pi + 2, si) || (si < n && match(pat, pi, si + 1));
                         }
                     }
                     else {
-                        // `**`: anything, slashes included.
-                        result = match(pat, pi + 2, si) || (si < n && match(pat, pi, si + 1));
+                        // `*`: anything but a slash.
+                        result = match(pat, pi + 1, si) || (si < n && path[si] !== "/" && match(pat, pi, si + 1));
                     }
                 }
-                else {
-                    // `*`: anything but a slash.
-                    result = match(pat, pi + 1, si) || (si < n && path[si] !== "/" && match(pat, pi, si + 1));
+                else if (ch === "?") {
+                    result = si < n && path[si] !== "/" && match(pat, pi + 1, si + 1);
                 }
-            }
-            else if (ch === "?") {
-                result = si < n && path[si] !== "/" && match(pat, pi + 1, si + 1);
-            }
-            else if (ch === "{") {
-                const close = matchingBrace(pat, pi);
-                if (close < 0) {
-                    result = si < n && path[si] === "{" && match(pat, pi + 1, si + 1);
+                else if (ch === "{") {
+                    const close = matchingBrace(pat, pi);
+                    if (close < 0) {
+                        result = si < n && path[si] === "{" && match(pat, pi + 1, si + 1);
+                    }
+                    else {
+                        const suffix = pat.slice(close + 1);
+                        result = splitAlternatives(pat.slice(pi + 1, close)).some((alt) => match(alt + suffix, 0, si));
+                    }
                 }
                 else {
-                    const suffix = pat.slice(close + 1);
-                    result = splitAlternatives(pat.slice(pi + 1, close)).some((alt) => match(alt + suffix, 0, si));
+                    result = si < n && path[si] === ch && match(pat, pi + 1, si + 1);
                 }
             }
-            else {
-                result = si < n && path[si] === ch && match(pat, pi + 1, si + 1);
-            }
+            memo.set(key, result);
+            return result;
+        }
+        finally {
+            depth--;
         }
-        memo.set(key, result);
-        return result;
     }
     return match(pattern, 0, 0);
 }

package/dist/tools/grep.d.ts

@@ -1,3 +1,13 @@
 import type { ToolHandler } from "./types.js";
 export declare const SKIP_DIRS: Set<string>;
+interface Match {
+    path: string;
+    line: number;
+    content: string;
+}
+export declare function searchJs(pattern: RegExp, root: string, signal: AbortSignal | undefined, budgetMs?: number): Promise<{
+    matches: Match[];
+    timedOut: boolean;
+}>;
 export declare const grepToolInstance: ToolHandler;
+export {};

package/dist/tools/grep.js

@@ -6,17 +6,19 @@
 // ---------------------------------------------------------------------------
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, relative } from "node:path";
+import { createContext, runInContext } from "node:vm";
 import { defineTool, optionalString, requireString } from "./types.js";
 import { resolveToolPath } from "./paths.js";
-import { spawnProcess, which } from "../runtime.js";
+import { isBinaryBuffer } from "./binary.js";
+import { spawnProcess } from "../runtime.js";
 const MAX_MATCHES = 100;
 /**
  * Wall-clock budget for the JS fallback walk. The pattern is LLM-authored and
  * compiled with `new RegExp` — a catastrophic-backtracking pattern would
- * otherwise pin the single-threaded process inside `pattern.test()` with
- * no abort able to interrupt it. The budget bounds the aggregate; a single
- * pathological match on one huge line can still overshoot, but the window
- * shrinks from unbounded to one line.
+ * otherwise pin the single-threaded process inside `pattern.test()` with no
+ * abort able to interrupt it. The per-line loop runs inside `node:vm` with a
+ * timeout (see `testLines`), so even a single pathological match is
+ * interruptible; the budget bounds the aggregate.
  */
 const JS_SEARCH_BUDGET_MS = 10_000;
 export const SKIP_DIRS = new Set([
@@ -31,7 +33,9 @@ function formatMatches(matches, workspace) {
     return lines.join("\n") + (truncated ? `\n… (results capped at ${MAX_MATCHES} matches)` : "");
 }
 /**
- * Search with ripgrep when available. Returns null when rg is unavailable.
+ * Search with ripgrep when available. Returns null when rg is unavailable
+ * (missing binary, rejected pattern, spawn failure) so the caller falls back
+ * to the JS walk.
  *
  * The cap is enforced HERE, on the parse: rg's `--max-count` is per FILE, so
  * on a large tree it can still produce a huge JSON stream. The output is read
@@ -39,9 +43,6 @@ function formatMatches(matches, workspace) {
  * buffer nor the child outlives the cap.
  */
 async function searchWithRipgrep(pattern, searchPath, include, signal) {
-    const rg = which("rg");
-    if (!rg)
-        return null;
     // --max-count bounds the per-file work rg does; the global cap is ours.
     const args = ["--json", "--max-count", String(MAX_MATCHES), "--no-ignore", "-e", pattern];
     if (include)
@@ -50,7 +51,7 @@ async function searchWithRipgrep(pattern, searchPath, include, signal) {
         args.push("--glob", `!**/${dir}/**`);
     args.push(searchPath);
     try {
-        const proc = spawnProcess([rg, ...args], { stdout: "pipe", stderr: "ignore" });
+        const proc = spawnProcess(["rg", ...args], { stdout: "pipe", stderr: "ignore" });
         const onAbort = () => { try {
             proc.kill();
         }
@@ -121,9 +122,43 @@ async function searchWithRipgrep(pattern, searchPath, include, signal) {
         return null; // fall back to the JS walk
     }
 }
-async function searchJs(pattern, root, signal) {
+/** One reusable context — creating one per file would dominate the walk.
+ * Safe under the parallel read-only batches executeToolCalls runs: testLines
+ * is synchronous end-to-end, so concurrent searches can never interleave
+ * inside it (an async refactor would need per-call state). */
+const regexSandbox = { pattern: null, lines: [], out: [], signal: null, deadline: 0, max: 0 };
+const regexContext = createContext(regexSandbox);
+/**
+ * Test one file's lines inside the sandbox. The vm timeout is the remaining
+ * search budget, so a single pathological `test()` call can never outlive the
+ * budget. A timeout loses the file's partial matches — the search is reported
+ * as budget-exceeded either way.
+ */
+function testLines(pattern, lines, signal, deadline, max) {
+    const timeout = deadline - Date.now();
+    if (timeout <= 0)
+        return { matches: [], timedOut: true };
+    regexSandbox.pattern = pattern;
+    regexSandbox.lines = lines;
+    regexSandbox.out = [];
+    regexSandbox.signal = signal ?? null;
+    regexSandbox.deadline = deadline;
+    regexSandbox.max = max;
+    try {
+        runInContext("for (let i = 0; i < lines.length; i++) {" +
+            " if (out.length >= max || (signal && signal.aborted) || Date.now() > deadline) break;" +
+            " if (pattern.test(lines[i])) out.push(i);" +
+            " pattern.lastIndex = 0;" +
+            "}", regexContext, { timeout });
+        return { matches: regexSandbox.out, timedOut: false };
+    }
+    catch {
+        return { matches: [], timedOut: true };
+    }
+}
+export async function searchJs(pattern, root, signal, budgetMs = JS_SEARCH_BUDGET_MS) {
     const matches = [];
-    const deadline = Date.now() + JS_SEARCH_BUDGET_MS;
+    const deadline = Date.now() + budgetMs;
     let timedOut = false;
     const overBudget = () => {
         if (Date.now() > deadline)
@@ -155,27 +190,31 @@ async function searchJs(pattern, root, signal) {
             const info = await stat(full).catch(() => null);
             if (!info || info.size > 2 * 1024 * 1024)
                 continue;
-            let text;
+            let buffer;
             try {
-                text = await readFile(full, "utf-8");
+                buffer = await readFile(full);
             }
             catch {
                 continue;
             }
-            if (text.includes("\0"))
+            // Shared sniffer (NUL byte or invalid UTF-8) — a NUL-only check would
+            // search binary content that happens to decode into U+FFFD.
+            if (isBinaryBuffer(buffer))
                 continue;
-            const lines = text.split("\n");
-            for (let i = 0; i < lines.length && matches.length < MAX_MATCHES; i++) {
-                // Abort and the budget must hold inside the per-line loop too — a
-                // large file must not run to its last line after the user pressed
-                // stop or the budget expired.
-                if ((i & 31) === 0 && (signal?.aborted || overBudget()))
-                    return;
-                if (pattern.test(lines[i])) {
-                    matches.push({ path: full, line: i + 1, content: lines[i] });
-                }
-                pattern.lastIndex = 0;
+            const lines = buffer.toString("utf-8").split("\n");
+            const { matches: lineMatches, timedOut: fileTimedOut } = testLines(pattern, lines, signal, deadline, MAX_MATCHES - matches.length);
+            for (const i of lineMatches) {
+                matches.push({ path: full, line: i + 1, content: lines[i] });
             }
+            // A single test() call outlived the remaining budget — the pattern is
+            // pathological; stop the walk and report the budget as exceeded.
+            if (fileTimedOut) {
+                timedOut = true;
+                return;
+            }
+            // The loop may also have stopped on the deadline or an abort.
+            if (overBudget() || signal?.aborted)
+                return;
         }
     }
     await walk(root, 0);

package/dist/ui/app.d.ts

@@ -1,5 +1,5 @@
 import type { IntegrationClient } from "../protocol/client.js";
-import type { AgentUsage } from "../protocol/types.js";
+import type { AgentUsage, SessionSummary } from "../protocol/types.js";
 import type { ToolRegistry } from "../tools/registry.js";
 import type { StoredConfig } from "../config.js";
 import { type AgentMode } from "../agent/modes.js";
@@ -32,6 +32,12 @@ export interface TuiOptions {
  */
 export declare function sidebarWidth(columns: number): number;
 export declare function runTui(opts: TuiOptions): Promise<number>;
+/**
+ * One `/session` picker row label. The title is remote free text (the model
+ * sets it via update_topic) — sanitize it like the sidebar does, or an escape
+ * sequence in it would reach the real terminal.
+ */
+export declare function sessionItemLabel(s: SessionSummary, current: string | null, folderTag: string): string;
 /**
  * Footer usage: `current` minus the pre-run `baseline`, so the status bar
  * reports the current/last run instead of the session total.

package/dist/ui/app.js

@@ -15,6 +15,7 @@ import { deriveTitle } from "../agent/sessions.js";
 import { TodoStore } from "../agent/todo.js";
 import { ApprovalPolicy } from "../approval/policy.js";
 import { collectFileDiff, collectGitStatus, EMPTY_GIT_STATUS } from "../git/status.js";
+import { sanitizeForTerminal } from "../sanitize.js";
 import { bgRgb, isColorEnabled, modeBorder, overlayBackgroundRgb, panelBackgroundRgb, style, userMessageBackgroundRgb } from "./colors.js";
 import { helpLines } from "./help.js";
 import { buildModelItems, currentModelId } from "./model-list.js";
@@ -723,7 +724,7 @@ export async function runTui(opts) {
                 : "";
             return {
                 value: s.thread_id,
-                label: `${s.thread_id === current ? "● " : "  "}${folderTag}${s.title || s.thread_id}`,
+                label: sessionItemLabel(s, current, folderTag),
                 description: `${s.status} · ${s.message_count} msgs · ${new Date(s.updated_at).toLocaleString()}${s.thread_id === current ? " · current" : ""}`,
             };
         });
@@ -1011,6 +1012,14 @@ export async function runTui(opts) {
 // ---------------------------------------------------------------------------
 // Small helpers
 // ---------------------------------------------------------------------------
+/**
+ * One `/session` picker row label. The title is remote free text (the model
+ * sets it via update_topic) — sanitize it like the sidebar does, or an escape
+ * sequence in it would reach the real terminal.
+ */
+export function sessionItemLabel(s, current, folderTag) {
+    return `${s.thread_id === current ? "● " : "  "}${folderTag}${sanitizeForTerminal(s.title || s.thread_id)}`;
+}
 /**
  * Footer usage: `current` minus the pre-run `baseline`, so the status bar
  * reports the current/last run instead of the session total.

package/dist/ui/components.d.ts

@@ -42,6 +42,9 @@ export declare class AssistantMessageComponent implements Component {
     /** Raw stream (unsanitized) — the sanitizing pass needs the whole text. */
     private raw;
     private text;
+    /** Set once any delta carried a control char: from then on the accumulated
+     *  text must be re-sanitized (a sequence can span deltas). */
+    private dirty;
     constructor();
     append(delta: string): void;
     get content(): string;
@@ -51,6 +54,7 @@ export declare class AssistantMessageComponent implements Component {
 export declare class ReasoningBlockComponent implements Component {
     private raw;
     private text;
+    private dirty;
     expanded: boolean;
     append(delta: string): void;
     toggle(): void;

package/dist/ui/components.js

@@ -84,11 +84,21 @@ export class UserMessageComponent {
         ];
     }
 }
+/**
+ * Characters `sanitizeForTerminal` would change (ESC and C0/C1 controls; tab
+ * and newline are kept). While a stream has never contained one, the sanitizer
+ * is the identity — re-running it over the whole accumulated text on every
+ * delta is O(n²) for no effect.
+ */
+const CONTROL_CHARS = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/;
 export class AssistantMessageComponent {
     md;
     /** Raw stream (unsanitized) — the sanitizing pass needs the whole text. */
     raw = "";
     text = "";
+    /** Set once any delta carried a control char: from then on the accumulated
+     *  text must be re-sanitized (a sequence can span deltas). */
+    dirty = false;
     constructor() {
         this.md = new Markdown("", 0, 0, markdownTheme, { color: assistantColor });
     }
@@ -97,9 +107,16 @@ export class AssistantMessageComponent {
         // material (file bodies, fetched pages) verbatim — strip terminal
         // sequences, like tool output and headless deltas do. Sanitizing the
         // ACCUMULATED text, not the delta: a sequence split across two deltas
-        // would slip through a per-delta pass.
+        // would slip through a per-delta pass. The clean fast path is exact: with
+        // no control char anywhere, the sanitizer returns the input unchanged.
         this.raw += delta;
-        this.text = sanitizeForTerminal(this.raw);
+        if (!this.dirty && !CONTROL_CHARS.test(delta)) {
+            this.text = this.raw;
+        }
+        else {
+            this.dirty = true;
+            this.text = sanitizeForTerminal(this.raw);
+        }
         this.md.setText(this.text);
     }
     get content() {
@@ -164,12 +181,19 @@ export class AssistantMessageComponent {
 export class ReasoningBlockComponent {
     raw = "";
     text = "";
+    dirty = false;
     expanded = false;
     append(delta) {
         // Same rule as assistant text: reasoning is model output rendered to the
         // real terminal, and it quotes tool output freely.
         this.raw += delta;
-        this.text = sanitizeForTerminal(this.raw);
+        if (!this.dirty && !CONTROL_CHARS.test(delta)) {
+            this.text = this.raw;
+        }
+        else {
+            this.dirty = true;
+            this.text = sanitizeForTerminal(this.raw);
+        }
     }
     toggle() {
         this.expanded = !this.expanded;
@@ -313,8 +337,11 @@ export class SidebarComponent {
         // The session title is the panel's headline — brighter than the section
         // headers below it. The "New session" placeholder stays at section-header
         // level so it doesn't read as a real title.
+        // The session title is remote free text (the model sets it via
+        // update_topic; a resumed thread's title comes from the server) — same
+        // sanitizing rule as the todo content below.
         push(this.state.title
-            ? ` ${style.bold(SESSION_TITLE_COLOR(this.state.title))}`
+            ? ` ${style.bold(SESSION_TITLE_COLOR(sanitizeForTerminal(this.state.title)))}`
             : ` ${style.bold(TITLE_COLOR("New session"))}`);
         blank();
         const usage = this.state.usage;
@@ -331,7 +358,10 @@ export class SidebarComponent {
         if (todoItems.length > 0) {
             section("todo", `TODO (${this.opts.todos.doneCount}/${todoItems.length})`);
             for (const item of todoItems) {
-                const content = item.content.replace(/\s+/g, " ");
+                // Todo content is model-authored (the update_todo args) and reaches
+                // the real terminal on every sidebar repaint — same sanitizing rule as
+                // every other transcript component.
+                const content = sanitizeForTerminal(item.content.replace(/\s+/g, " "));
                 value(`${todoGlyph(item.status)} ${item.status === "completed" ? GRAY_DIM_COLOR(content) : GRAY_COLOR(content)}`);
             }
             blank();
@@ -412,8 +442,11 @@ export class PromptEditor extends Editor {
     }
     renderBottomBorder(width, hiddenLineCount) {
         const label = ` ${MODES[this.mode].label} `;
-        const modelText = this.model ?? "no model";
-        const thinkingText = this.thinking ?? "default";
+        // Both are remote text (session detail, model list, thinking levels) and
+        // this border is redrawn every frame — sanitize before measuring so the
+        // chip hit-test ranges match what is actually rendered.
+        const modelText = sanitizeForTerminal(this.model ?? "no model");
+        const thinkingText = sanitizeForTerminal(this.thinking ?? "default");
         const info = `· ${modelText} · ${thinkingText} `;
         const suffix = hiddenLineCount > 0 ? `↓ ${hiddenLineCount} more ` : "";
         const fill = width - visibleWidth(label) - visibleWidth(info) - visibleWidth(suffix) - 1;

package/dist/ui/format.d.ts

@@ -24,5 +24,10 @@ export declare function todoMark(status: TodoStatus): string;
  * Render a `local_update_todo` request's args as display lines — the task
  * list lives in the tool request, not in the system prompt. Empty for
  * malformed args (the tool call itself surfaces the validation error).
+ *
+ * The content is model-authored and rendered to the real terminal, so it is
+ * sanitized here: this custom renderer bypasses `paramValueLines`' stringify
+ * pass (and `sanitizeArgs` only covers top-level strings — `todos` is an
+ * array).
  */
 export declare function formatTodoArgs(args: Record<string, unknown>): string[];

package/dist/ui/format.js

@@ -3,6 +3,7 @@
 // ---------------------------------------------------------------------------
 import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { parseTodoItems } from "../agent/todo.js";
+import { sanitizeForTerminal } from "../sanitize.js";
 /** 999 → "999", 12345 → "12.3k", 1234567 → "1.2M". */
 export function formatTokens(n) {
     if (!Number.isFinite(n))
@@ -63,6 +64,11 @@ export function todoMark(status) {
  * Render a `local_update_todo` request's args as display lines — the task
  * list lives in the tool request, not in the system prompt. Empty for
  * malformed args (the tool call itself surfaces the validation error).
+ *
+ * The content is model-authored and rendered to the real terminal, so it is
+ * sanitized here: this custom renderer bypasses `paramValueLines`' stringify
+ * pass (and `sanitizeArgs` only covers top-level strings — `todos` is an
+ * array).
  */
 export function formatTodoArgs(args) {
     let items;
@@ -72,5 +78,5 @@ export function formatTodoArgs(args) {
     catch {
         return [];
     }
-    return items.map((t) => `${todoMark(t.status)} ${t.content}`);
+    return items.map((t) => `${todoMark(t.status)} ${sanitizeForTerminal(t.content)}`);
 }

package/dist/ui/model-list.js

@@ -5,6 +5,7 @@
 // "default". Current wins when both apply, so the row the user is actually
 // running carries exactly one marker.
 // ---------------------------------------------------------------------------
+import { sanitizeForTerminal } from "../sanitize.js";
 /**
  * The id the picker marks as current: the model in use (a thread's model or a
  * fresh selection), otherwise the user's pending selection, otherwise the
@@ -26,7 +27,9 @@ export function buildModelItems(models, currentId) {
         const isDefault = m.default === true || (!hasDefaultFlag && index === 0);
         return {
             value: m.id,
-            label: m.label ? `${m.label} (${m.id})` : m.id,
+            // Both fields are remote text (the server's model list) — sanitize them
+            // like every other remote string the UI renders.
+            label: sanitizeForTerminal(m.label ? `${m.label} (${m.id})` : m.id),
             description: isCurrent ? "current" : isDefault ? "default" : "",
         };
     });

package/dist/ui/tool-view.js

@@ -88,11 +88,13 @@ function toolSummaryRaw(name, args) {
     switch (displayToolName(name)) {
         case "read": {
             const path = stringArg(args.path) ?? "";
+            // Mirror the tool's clamp (fs.ts) so a limit/offset of 0 or a negative
+            // number can't render a nonsense range like "lines 1–0".
             const offset = numberArg(args.offset);
             const limit = numberArg(args.limit);
-            const start = offset ?? 1;
+            const start = Math.max(1, Math.floor(offset ?? 1));
             const range = limit !== undefined
-                ? `lines ${start}–${start + limit - 1}`
+                ? `lines ${start}–${start + Math.max(1, Math.floor(limit)) - 1}`
                 : offset !== undefined ? `from line ${start}` : "";
             return [path, range].filter(Boolean).join(" · ");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ocis/myagent-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Terminal coding agent for your local repository, powered by a remote MyAgent server",
   "type": "module",
   "bin": {