@ocis/myagent-cli 0.2.2 → 0.2.3

package/README.md

@@ -42,9 +42,24 @@ npm install -g @ocis/myagent-cli   # global
 
 The CLI runs on **Bun ≥1.0** or **Node.js ≥22.19**. The published bin is a small
 launcher that prefers Bun and falls back to Node, so `bunx` and `npm install -g`
-both work with whichever runtime you have. Configure credentials with
-`myagent config`, or set `MYAGENT_BASE_URL` / `MYAGENT_INTEGRATION_ID` /
-`MYAGENT_API_KEY`.
+both work with whichever runtime you have. Everywhere below, `myagent` means the
+installed binary — with `bunx`, substitute `bunx @ocis/myagent-cli`.
+
+Point it at an integration — the **API Base URL** and **API key** are on the
+Integrations page (the combined URL carries the integration id):
+
+```bash
+# Env vars — handy for bunx and CI:
+MYAGENT_BASE_URL=https://your-host/integrations/<id> \
+MYAGENT_API_KEY=iak_... \
+bunx @ocis/myagent-cli
+
+# Or flags:
+bunx @ocis/myagent-cli --base-url https://your-host/integrations/<id> --api-key iak_...
+
+# Or persist them once (writes ~/.config/myagent/config.json, 0600):
+myagent config
+```
 
 ## Plan / Coding / Cowork modes
 
@@ -111,14 +126,13 @@ you decide, can each need one). Each waiting approval keeps its own deadline
 and its own cancellation, so a release of one call never cancels another and
 `/stop` cancels every one of them.
 
-While you decide, the CLI watches the session's event channel (when the server
-advertises `sessionEvents`) and reports when the channel itself drops and is
-being reconnected. If the server releases the call while you decide (the
-30-minute lease expired, the sandbox restarted, or the run ended), the
-approval is **cancelled** — the tool never runs, and the tool card in the
-transcript says so. Stopping the run (Esc, Ctrl+C, `/stop`) cancels a pending
-approval the same way. If the sandbox was paused while you were away, the next
-request wakes it automatically.
+While you decide, the CLI watches the session's event channel and reports when
+the channel itself drops and is being reconnected. If the server releases the
+call while you decide (the 30-minute lease expired, the sandbox restarted, or
+the run ended), the approval is **cancelled** — the tool never runs, and the
+tool card in the transcript says so. Stopping the run (Esc, Ctrl+C, `/stop`)
+cancels a pending approval the same way. If the sandbox was paused while you
+were away, the next request wakes it automatically.
 
 ## Context files
 

package/dist/agent/turn.d.ts

@@ -74,7 +74,7 @@ export declare class AgentRunner {
      * before an in-flight round resumes, so it cannot be used there).
      */
     private stopped;
-    private followUps;
+    private readonly followUps;
     /**
      * Chain of fire-and-forget follow-up turns (user follow-ups).
      * `waitForIdle()` awaits it so headless runs don't exit before a queued
@@ -88,15 +88,16 @@ export declare class AgentRunner {
      * filter: a replayed CUSTOM_TOOL_CALL for an abandoned call is never
      * executed again.
      */
-    private abandonedToolCalls;
+    private readonly abandonedToolCalls;
     /**
-     * Every CUSTOM_TOOL_CALL id received this session. The replay guard: an id
+     * Every client tool call id this session has taken ownership of — from a
+     * CUSTOM_TOOL_CALL event or a reconcile adoption. The replay guard: an id
      * seen once is never enqueued again, whatever the delivery path (run stream,
      * event-channel replay) — a duplicate would execute a side-effecting tool
      * twice. Cumulative like abandonedToolCalls: ids are unique per call, so
      * there is nothing to reset.
      */
-    private seenToolCallIds;
+    private readonly seenToolCallIds;
     /**
      * Unix ms of a server-reported interruption of the previous run (restart /
      * idle scale-down) — wording only: released calls are explained as an
@@ -108,7 +109,7 @@ export declare class AgentRunner {
      * An id is removed BEFORE its submission request goes out, so the server's
      * echo of our own result can never be misread as a release.
      */
-    private pendingSubmission;
+    private readonly pendingSubmission;
     /**
      * Steers acked but not yet injected into the run, keyed by the persisted
      * message id (from INPUT_ACCEPTED). The ack only means "persisted + queued
@@ -118,13 +119,13 @@ export declare class AgentRunner {
      * as a fresh prompt by the manager, and the message is in the session
      * either way, so the float must not linger.
      */
-    private pendingSteerDeliveries;
+    private readonly pendingSteerDeliveries;
     /**
      * Tool rounds scheduled or executing (debounce included). The turn drains
      * them before it settles, so a round is never raced by the followUps drain.
      */
     private roundsInFlight;
-    private roundsDrained;
+    private readonly roundsDrained;
     /**
      * True once the current run segment ended (RUN_FINISHED/RUN_ERROR) — a
      * stream that closes without this observed a drop, not a settle.
@@ -225,7 +226,7 @@ export declare class AgentRunner {
     waitForIdle(): Promise<void>;
     /**
      * Deliver a round's tool results, reconciling against the server's truth
-     * first when it advertises `toolCallExpiry`:
+     * first (the pending registry is authoritative):
      *
      *  - still pending (exact id) → submit as-is (native tool result, same run);
      *  - the model retried the same action (same name + canonical args) → adopt
@@ -266,7 +267,7 @@ export declare class AgentRunner {
      */
     private markAbandoned;
     private latchThread;
-    /** Open the session event subscription for the recovery window (capability-gated). */
+    /** Open the session event subscription for the recovery window. */
     private startEventSubscription;
     private stopEventSubscription;
     /**

package/dist/agent/turn.js

@@ -148,7 +148,8 @@ export class AgentRunner {
      */
     abandonedToolCalls = new Set();
     /**
-     * Every CUSTOM_TOOL_CALL id received this session. The replay guard: an id
+     * Every client tool call id this session has taken ownership of — from a
+     * CUSTOM_TOOL_CALL event or a reconcile adoption. The replay guard: an id
      * seen once is never enqueued again, whatever the delivery path (run stream,
      * event-channel replay) — a duplicate would execute a side-effecting tool
      * twice. Cumulative like abandonedToolCalls: ids are unique per call, so
@@ -480,6 +481,11 @@ export class AgentRunner {
             batch = [];
             void this.executeAndSubmit(calls, cb, signal)
                 .catch((err) => {
+                // A stop aborts the round mid-flight — "Stopped." is the message;
+                // a "Tool round failed" notice would read as an error the user
+                // didn't cause.
+                if (signal.aborted)
+                    return;
                 cb.onNotice(`Tool round failed: ${err instanceof Error ? err.message : String(err)}`, "error");
             })
                 .finally(() => {
@@ -694,7 +700,7 @@ export class AgentRunner {
     }
     /**
      * Deliver a round's tool results, reconciling against the server's truth
-     * first when it advertises `toolCallExpiry`:
+     * first (the pending registry is authoritative):
      *
      *  - still pending (exact id) → submit as-is (native tool result, same run);
      *  - the model retried the same action (same name + canonical args) → adopt
@@ -855,6 +861,9 @@ export class AgentRunner {
                 // sweep announces a release for a call that was answered.
                 if (call)
                     this.pendingSubmission.delete(call.id);
+                // The retry id is answered by the re-attached result — a replayed
+                // CUSTOM_TOOL_CALL for it must never execute it again.
+                this.seenToolCallIds.add(adopted.id);
                 cb.onNotice(`Re-attached the result of ${call?.name ?? "a tool call"} to the agent's retry.`, "info");
                 continue;
             }
@@ -862,18 +871,27 @@ export class AgentRunner {
         }
         // Pending calls this client never executed (e.g. the model retried with
         // different arguments): execute them through the normal approval path so
-        // the run isn't left waiting on a call nobody will answer.
-        if (unmatched.size > 0) {
-            const extraCalls = [...unmatched.values()].map((p) => ({
-                id: p.id,
-                name: p.name,
-                arguments: p.arguments,
-            }));
+        // the run isn't left waiting on a call nobody will answer. Skip ids
+        // another round already claimed (pendingSubmission) or executed
+        // (seenToolCallIds) — concurrent rounds reconcile against the same server
+        // snapshot, and adopting an id twice would run a side-effecting tool twice.
+        const extraCalls = [...unmatched.values()]
+            .filter((p) => !this.pendingSubmission.has(p.id) && !this.seenToolCallIds.has(p.id))
+            .map((p) => ({
+            id: p.id,
+            name: p.name,
+            arguments: p.arguments,
+        }));
+        if (extraCalls.length > 0) {
             // Register before execution (same as event-driven calls via
             // executeAndSubmit) so a release arriving mid-execution is surfaced by
-            // the release filter instead of only surfacing at submission time.
-            for (const call of extraCalls)
+            // the release filter instead of only surfacing at submission time. The
+            // replay guard too: a replayed CUSTOM_TOOL_CALL for an adopted id must
+            // never execute it again.
+            for (const call of extraCalls) {
                 this.pendingSubmission.add(call.id);
+                this.seenToolCallIds.add(call.id);
+            }
             live.push(...await this.executeToolCalls(extraCalls, signal));
         }
         return { live, released };
@@ -923,7 +941,7 @@ export class AgentRunner {
     // -------------------------------------------------------------------------
     // Fallback event channel (reconcile window only — no run stream attached)
     // -------------------------------------------------------------------------
-    /** Open the session event subscription for the recovery window (capability-gated). */
+    /** Open the session event subscription for the recovery window. */
     startEventSubscription() {
         if (!this.threadId)
             return;
@@ -1198,8 +1216,11 @@ export class AgentRunner {
                 calls.push(call);
                 // Register before execution (same as executeAndSubmit/reconcileRound):
                 // a release arriving while an approval is pending must cancel it via
-                // the release filter, not wait out the approval timeout.
+                // the release filter, not wait out the approval timeout. The replay
+                // guard too — a replayed CUSTOM_TOOL_CALL for this id must never
+                // execute it again.
                 this.pendingSubmission.add(item.id);
+                this.seenToolCallIds.add(item.id);
                 const handler = this.opts.registry.get(item.name);
                 const parsed = this.parseCall(call);
                 if (!isMutatingCall(handler, parsed.args)) {

package/dist/headless.js

@@ -282,6 +282,12 @@ export async function runHeadless(opts) {
         // Same for the best-effort title update latched by onThread above.
         await titleUpdate;
     }
+    catch (err) {
+        // The output contract is "always a parseable object" (json/stream-json):
+        // an escaping exception would leave stdout empty and exit 1 without an
+        // error_code. Record it and fall through to the normal output below.
+        firstError.record(err instanceof Error ? err.message : String(err), "run_failed");
+    }
     finally {
         stop.dispose();
     }

package/dist/index.d.ts

@@ -45,9 +45,12 @@ export declare function assemblePrompt(args: Args, stdinText: string): string;
  * Report a pre-run failure (usage/config/connection) in the requested output
  * format and return the exit code. `json` always emits a parseable object — a
  * CI parser must never see an empty stdout; `stream-json` emits a terminal
- * `done` event; text goes to stderr.
+ * `done` event; text goes to stderr. The default exit code is 2
+ * (usage/config/connection); a failure that is really a failed run (e.g. a
+ * `--timeout` expiry) passes 1 so the same `error_code` always maps to the
+ * same code.
  */
-export declare function fail(format: OutputFormat | undefined, message: string, errorCode?: string): number;
+export declare function fail(format: OutputFormat | undefined, message: string, errorCode?: string, exitCode?: number): number;
 /**
  * Read piped stdin as prompt text. Bounded by the run's `--timeout` when one
  * is set: a non-TTY stdin that never closes (a CI misconfiguration like

package/dist/index.js

@@ -243,9 +243,12 @@ export function assemblePrompt(args, stdinText) {
  * Report a pre-run failure (usage/config/connection) in the requested output
  * format and return the exit code. `json` always emits a parseable object — a
  * CI parser must never see an empty stdout; `stream-json` emits a terminal
- * `done` event; text goes to stderr.
+ * `done` event; text goes to stderr. The default exit code is 2
+ * (usage/config/connection); a failure that is really a failed run (e.g. a
+ * `--timeout` expiry) passes 1 so the same `error_code` always maps to the
+ * same code.
  */
-export function fail(format, message, errorCode) {
+export function fail(format, message, errorCode, exitCode = 2) {
     if (format === "json") {
         process.stdout.write(failureResult(message, errorCode) + "\n");
     }
@@ -255,7 +258,7 @@ export function fail(format, message, errorCode) {
     else {
         process.stderr.write(message + "\n");
     }
-    return 2;
+    return exitCode;
 }
 /**
  * Read piped stdin as prompt text. Bounded by the run's `--timeout` when one
@@ -376,11 +379,15 @@ async function main() {
     if (readsStdin && !process.stdin.isTTY && args.promptParts.length > 0 && !args.flags.timeout) {
         process.stderr.write("Reading additional prompt text from stdin until EOF — pass `< /dev/null` or --timeout <sec> if nothing is piped.\n");
     }
-    const stdinText = readsStdin
-        ? await readStdin(args.flags.timeout ? args.flags.timeout * 1000 : undefined)
-        : "";
+    // The --timeout budget covers the whole invocation, not each phase: the
+    // stdin wait below consumes part of it, and the run gets what is left.
+    const timeoutMs = args.flags.timeout ? args.flags.timeout * 1000 : undefined;
+    const startedAt = Date.now();
+    const stdinText = readsStdin ? await readStdin(timeoutMs) : "";
     if (stdinText === null) {
-        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s waiting for stdin.`, "timeout");
+        // Same `error_code` as a run timeout, so the same exit code: the help
+        // documents 1 = run failed (incl. timeout), 2 = usage/config/connection.
+        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s waiting for stdin.`, "timeout", 1);
     }
     const prompt = assemblePrompt(args, stdinText);
     const registry = new ToolRegistry();
@@ -406,6 +413,14 @@ async function main() {
     if (!prompt) {
         return fail(args.flags.outputFormat, "No prompt provided. Usage: myagent -p \"...\" or pipe text via stdin.", "no_prompt");
     }
+    // What is left of the --timeout budget after the stdin wait and setup. A
+    // non-positive remainder means the budget is already spent — fail as a
+    // timeout instead of handing the run a zero timeout (which would disable
+    // the timer entirely).
+    const remainingTimeoutMs = timeoutMs === undefined ? undefined : timeoutMs - (Date.now() - startedAt);
+    if (remainingTimeoutMs !== undefined && remainingTimeoutMs <= 0) {
+        return fail(args.flags.outputFormat, `Timed out after ${args.flags.timeout}s (the stdin wait consumed the budget).`, "timeout", 1);
+    }
     return await runHeadless({
         client,
         registry,
@@ -423,7 +438,7 @@ async function main() {
         outputFormat: args.flags.outputFormat ?? "text",
         quiet: args.flags.quiet,
         lastMessageOnly: promptMode,
-        timeoutMs: args.flags.timeout ? args.flags.timeout * 1000 : undefined,
+        timeoutMs: remainingTimeoutMs,
     });
 }
 function printSessions(sessions) {

package/dist/sanitize.js

@@ -10,6 +10,10 @@
 export function sanitizeForTerminal(text) {
     return text
         .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "") // OSC … (BEL / ST)
+        // DCS/APC/PM/SOS … (BEL / ST) — the same string-terminated convention as
+        // OSC. Without this only the 2-byte opener is removed and the payload
+        // (Kitty graphics, Sixel, …) leaks through as literal text.
+        .replace(/\u001b[P_^X][^\u0007\u001b]*(?:\u0007|\u001b\\)?/g, "")
         // CSI: parameter + intermediate bytes then a final byte. SPACE (0x20) is a
         // legal intermediate (`CSI Ps SP q` sets the cursor shape), so it belongs
         // in the class — without it that sequence's tail leaked through as noise.

package/dist/tools/fs.js

@@ -1,7 +1,7 @@
 // ---------------------------------------------------------------------------
 // Filesystem tools: local_read, local_write, local_edit, local_ls.
 // ---------------------------------------------------------------------------
-import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { defineTool, optionalBoolean, optionalNumber, optionalString, requireString } from "./types.js";
 import { displayPath, resolveToolPath } from "./paths.js";
@@ -80,21 +80,21 @@ const writeTool = defineTool({
         const content = args.content;
         const append = optionalBoolean(args, "append") ?? false;
         const absolute = await resolveToolPath(path, ctx);
-        const existed = await stat(absolute).then((s) => s.isFile()).catch(() => false);
+        const info = await stat(absolute).catch(() => null);
+        // Same guard as local_read/local_edit: without it, append reports "does not
+        // exist" for a directory and overwrite leaks a raw EISDIR.
+        if (info?.isDirectory())
+            throw new Error(`"${path}" is a directory — use local_ls.`);
+        const existed = info?.isFile() ?? false;
         if (append && !existed)
             throw new Error(`Cannot append: ${path} does not exist.`);
-        if (append) {
-            // Same cap as local_read/local_edit: appending to a huge existing file
-            // would otherwise read it all into memory before the write.
-            const size = await stat(absolute).then((s) => s.size).catch(() => 0);
-            if (size > MAX_READ_BYTES) {
-                throw new Error(`Cannot append: ${path} is too large (${size} bytes, limit ${MAX_READ_BYTES}).`);
-            }
-        }
         await mkdir(dirname(absolute), { recursive: true });
         if (append) {
-            const previous = await readFile(absolute, "utf-8").catch(() => "");
-            await writeFile(absolute, previous + content, "utf-8");
+            // O_APPEND, not read-modify-write: a failed read used to be swallowed
+            // into "" and the rewrite then truncated the file to just `content`
+            // while reporting success. It also avoids re-encoding a non-UTF-8 file
+            // and the memory cost of reading it (the old size cap guarded that read).
+            await appendFile(absolute, content, "utf-8");
         }
         else {
             await writeFile(absolute, content, "utf-8");

package/dist/tools/glob.js

@@ -45,6 +45,14 @@ function splitAlternatives(body) {
     parts.push(body.slice(start));
     return parts;
 }
+/**
+ * Recursion depth cap. Each frame advances one pattern or path character (or
+ * substitutes a shorter pattern for a brace group), so depth grows with the
+ * input — a model-supplied pattern or a very long path could otherwise
+ * overflow the stack with a RangeError. The cap is far above any real glob
+ * and fails with a clear message instead of a crash.
+ */
+const MAX_MATCH_DEPTH = 2000;
 /**
  * Match one pattern against one path with a memoized walk. Brace groups are
  * tried in place (each alternative is matched as `alternative + suffix`), so
@@ -53,66 +61,75 @@ function splitAlternatives(body) {
 function matchPattern(pattern, path) {
     const n = path.length;
     const memos = new Map();
+    let depth = 0;
     function match(pat, pi, si) {
-        let memo = memos.get(pat);
-        if (!memo) {
-            memo = new Map();
-            memos.set(pat, memo);
+        if (++depth > MAX_MATCH_DEPTH) {
+            throw new Error(`Glob pattern is too complex (exceeds ${MAX_MATCH_DEPTH} steps).`);
         }
-        const key = pi * (n + 1) + si;
-        const hit = memo.get(key);
-        if (hit !== undefined)
-            return hit;
-        let result;
-        if (pi >= pat.length) {
-            result = si >= n;
-        }
-        else {
-            const ch = pat[pi];
-            if (ch === "*") {
-                if (pat[pi + 1] === "*") {
-                    if (pat[pi + 2] === "/") {
-                        // `**/`: zero or more directories — stop now, or consume one
-                        // segment (up to and including its `/`) and continue. Consuming a
-                        // whole segment at a time is what keeps the token from stopping
-                        // mid-name (`**` + `/a` must not match "ba").
-                        result = match(pat, pi + 3, si);
-                        if (!result) {
-                            let k = si;
-                            while (k < n && path[k] !== "/")
-                                k++;
-                            result = k < n && match(pat, pi, k + 1);
+        try {
+            let memo = memos.get(pat);
+            if (!memo) {
+                memo = new Map();
+                memos.set(pat, memo);
+            }
+            const key = pi * (n + 1) + si;
+            const hit = memo.get(key);
+            if (hit !== undefined)
+                return hit;
+            let result;
+            if (pi >= pat.length) {
+                result = si >= n;
+            }
+            else {
+                const ch = pat[pi];
+                if (ch === "*") {
+                    if (pat[pi + 1] === "*") {
+                        if (pat[pi + 2] === "/") {
+                            // `**/`: zero or more directories — stop now, or consume one
+                            // segment (up to and including its `/`) and continue. Consuming a
+                            // whole segment at a time is what keeps the token from stopping
+                            // mid-name (`**` + `/a` must not match "ba").
+                            result = match(pat, pi + 3, si);
+                            if (!result) {
+                                let k = si;
+                                while (k < n && path[k] !== "/")
+                                    k++;
+                                result = k < n && match(pat, pi, k + 1);
+                            }
+                        }
+                        else {
+                            // `**`: anything, slashes included.
+                            result = match(pat, pi + 2, si) || (si < n && match(pat, pi, si + 1));
                         }
                     }
                     else {
-                        // `**`: anything, slashes included.
-                        result = match(pat, pi + 2, si) || (si < n && match(pat, pi, si + 1));
+                        // `*`: anything but a slash.
+                        result = match(pat, pi + 1, si) || (si < n && path[si] !== "/" && match(pat, pi, si + 1));
                     }
                 }
-                else {
-                    // `*`: anything but a slash.
-                    result = match(pat, pi + 1, si) || (si < n && path[si] !== "/" && match(pat, pi, si + 1));
+                else if (ch === "?") {
+                    result = si < n && path[si] !== "/" && match(pat, pi + 1, si + 1);
                 }
-            }
-            else if (ch === "?") {
-                result = si < n && path[si] !== "/" && match(pat, pi + 1, si + 1);
-            }
-            else if (ch === "{") {
-                const close = matchingBrace(pat, pi);
-                if (close < 0) {
-                    result = si < n && path[si] === "{" && match(pat, pi + 1, si + 1);
+                else if (ch === "{") {
+                    const close = matchingBrace(pat, pi);
+                    if (close < 0) {
+                        result = si < n && path[si] === "{" && match(pat, pi + 1, si + 1);
+                    }
+                    else {
+                        const suffix = pat.slice(close + 1);
+                        result = splitAlternatives(pat.slice(pi + 1, close)).some((alt) => match(alt + suffix, 0, si));
+                    }
                 }
                 else {
-                    const suffix = pat.slice(close + 1);
-                    result = splitAlternatives(pat.slice(pi + 1, close)).some((alt) => match(alt + suffix, 0, si));
+                    result = si < n && path[si] === ch && match(pat, pi + 1, si + 1);
                 }
             }
-            else {
-                result = si < n && path[si] === ch && match(pat, pi + 1, si + 1);
-            }
+            memo.set(key, result);
+            return result;
+        }
+        finally {
+            depth--;
         }
-        memo.set(key, result);
-        return result;
     }
     return match(pattern, 0, 0);
 }

package/dist/tools/grep.d.ts

@@ -1,3 +1,13 @@
 import type { ToolHandler } from "./types.js";
 export declare const SKIP_DIRS: Set<string>;
+interface Match {
+    path: string;
+    line: number;
+    content: string;
+}
+export declare function searchJs(pattern: RegExp, root: string, signal: AbortSignal | undefined, budgetMs?: number): Promise<{
+    matches: Match[];
+    timedOut: boolean;
+}>;
 export declare const grepToolInstance: ToolHandler;
+export {};

package/dist/tools/grep.js

@@ -6,17 +6,19 @@
 // ---------------------------------------------------------------------------
 import { readdir, readFile, stat } from "node:fs/promises";
 import { join, relative } from "node:path";
+import { createContext, runInContext } from "node:vm";
 import { defineTool, optionalString, requireString } from "./types.js";
 import { resolveToolPath } from "./paths.js";
+import { isBinaryBuffer } from "./binary.js";
 import { spawnProcess } from "../runtime.js";
 const MAX_MATCHES = 100;
 /**
  * Wall-clock budget for the JS fallback walk. The pattern is LLM-authored and
  * compiled with `new RegExp` — a catastrophic-backtracking pattern would
- * otherwise pin the single-threaded process inside `pattern.test()` with
- * no abort able to interrupt it. The budget bounds the aggregate; a single
- * pathological match on one huge line can still overshoot, but the window
- * shrinks from unbounded to one line.
+ * otherwise pin the single-threaded process inside `pattern.test()` with no
+ * abort able to interrupt it. The per-line loop runs inside `node:vm` with a
+ * timeout (see `testLines`), so even a single pathological match is
+ * interruptible; the budget bounds the aggregate.
  */
 const JS_SEARCH_BUDGET_MS = 10_000;
 export const SKIP_DIRS = new Set([
@@ -120,9 +122,43 @@ async function searchWithRipgrep(pattern, searchPath, include, signal) {
         return null; // fall back to the JS walk
     }
 }
-async function searchJs(pattern, root, signal) {
+/** One reusable context — creating one per file would dominate the walk.
+ * Safe under the parallel read-only batches executeToolCalls runs: testLines
+ * is synchronous end-to-end, so concurrent searches can never interleave
+ * inside it (an async refactor would need per-call state). */
+const regexSandbox = { pattern: null, lines: [], out: [], signal: null, deadline: 0, max: 0 };
+const regexContext = createContext(regexSandbox);
+/**
+ * Test one file's lines inside the sandbox. The vm timeout is the remaining
+ * search budget, so a single pathological `test()` call can never outlive the
+ * budget. A timeout loses the file's partial matches — the search is reported
+ * as budget-exceeded either way.
+ */
+function testLines(pattern, lines, signal, deadline, max) {
+    const timeout = deadline - Date.now();
+    if (timeout <= 0)
+        return { matches: [], timedOut: true };
+    regexSandbox.pattern = pattern;
+    regexSandbox.lines = lines;
+    regexSandbox.out = [];
+    regexSandbox.signal = signal ?? null;
+    regexSandbox.deadline = deadline;
+    regexSandbox.max = max;
+    try {
+        runInContext("for (let i = 0; i < lines.length; i++) {" +
+            " if (out.length >= max || (signal && signal.aborted) || Date.now() > deadline) break;" +
+            " if (pattern.test(lines[i])) out.push(i);" +
+            " pattern.lastIndex = 0;" +
+            "}", regexContext, { timeout });
+        return { matches: regexSandbox.out, timedOut: false };
+    }
+    catch {
+        return { matches: [], timedOut: true };
+    }
+}
+export async function searchJs(pattern, root, signal, budgetMs = JS_SEARCH_BUDGET_MS) {
     const matches = [];
-    const deadline = Date.now() + JS_SEARCH_BUDGET_MS;
+    const deadline = Date.now() + budgetMs;
     let timedOut = false;
     const overBudget = () => {
         if (Date.now() > deadline)
@@ -154,27 +190,31 @@ async function searchJs(pattern, root, signal) {
             const info = await stat(full).catch(() => null);
             if (!info || info.size > 2 * 1024 * 1024)
                 continue;
-            let text;
+            let buffer;
             try {
-                text = await readFile(full, "utf-8");
+                buffer = await readFile(full);
             }
             catch {
                 continue;
             }
-            if (text.includes("\0"))
+            // Shared sniffer (NUL byte or invalid UTF-8) — a NUL-only check would
+            // search binary content that happens to decode into U+FFFD.
+            if (isBinaryBuffer(buffer))
                 continue;
-            const lines = text.split("\n");
-            for (let i = 0; i < lines.length && matches.length < MAX_MATCHES; i++) {
-                // Abort and the budget must hold inside the per-line loop too — a
-                // large file must not run to its last line after the user pressed
-                // stop or the budget expired.
-                if ((i & 31) === 0 && (signal?.aborted || overBudget()))
-                    return;
-                if (pattern.test(lines[i])) {
-                    matches.push({ path: full, line: i + 1, content: lines[i] });
-                }
-                pattern.lastIndex = 0;
+            const lines = buffer.toString("utf-8").split("\n");
+            const { matches: lineMatches, timedOut: fileTimedOut } = testLines(pattern, lines, signal, deadline, MAX_MATCHES - matches.length);
+            for (const i of lineMatches) {
+                matches.push({ path: full, line: i + 1, content: lines[i] });
             }
+            // A single test() call outlived the remaining budget — the pattern is
+            // pathological; stop the walk and report the budget as exceeded.
+            if (fileTimedOut) {
+                timedOut = true;
+                return;
+            }
+            // The loop may also have stopped on the deadline or an abort.
+            if (overBudget() || signal?.aborted)
+                return;
         }
     }
     await walk(root, 0);

package/dist/ui/app.d.ts

@@ -1,5 +1,5 @@
 import type { IntegrationClient } from "../protocol/client.js";
-import type { AgentUsage } from "../protocol/types.js";
+import type { AgentUsage, SessionSummary } from "../protocol/types.js";
 import type { ToolRegistry } from "../tools/registry.js";
 import type { StoredConfig } from "../config.js";
 import { type AgentMode } from "../agent/modes.js";
@@ -32,6 +32,12 @@ export interface TuiOptions {
  */
 export declare function sidebarWidth(columns: number): number;
 export declare function runTui(opts: TuiOptions): Promise<number>;
+/**
+ * One `/session` picker row label. The title is remote free text (the model
+ * sets it via update_topic) — sanitize it like the sidebar does, or an escape
+ * sequence in it would reach the real terminal.
+ */
+export declare function sessionItemLabel(s: SessionSummary, current: string | null, folderTag: string): string;
 /**
  * Footer usage: `current` minus the pre-run `baseline`, so the status bar
  * reports the current/last run instead of the session total.

package/dist/ui/app.js

@@ -15,6 +15,7 @@ import { deriveTitle } from "../agent/sessions.js";
 import { TodoStore } from "../agent/todo.js";
 import { ApprovalPolicy } from "../approval/policy.js";
 import { collectFileDiff, collectGitStatus, EMPTY_GIT_STATUS } from "../git/status.js";
+import { sanitizeForTerminal } from "../sanitize.js";
 import { bgRgb, isColorEnabled, modeBorder, overlayBackgroundRgb, panelBackgroundRgb, style, userMessageBackgroundRgb } from "./colors.js";
 import { helpLines } from "./help.js";
 import { buildModelItems, currentModelId } from "./model-list.js";
@@ -723,7 +724,7 @@ export async function runTui(opts) {
                 : "";
             return {
                 value: s.thread_id,
-                label: `${s.thread_id === current ? "● " : "  "}${folderTag}${s.title || s.thread_id}`,
+                label: sessionItemLabel(s, current, folderTag),
                 description: `${s.status} · ${s.message_count} msgs · ${new Date(s.updated_at).toLocaleString()}${s.thread_id === current ? " · current" : ""}`,
             };
         });
@@ -1011,6 +1012,14 @@ export async function runTui(opts) {
 // ---------------------------------------------------------------------------
 // Small helpers
 // ---------------------------------------------------------------------------
+/**
+ * One `/session` picker row label. The title is remote free text (the model
+ * sets it via update_topic) — sanitize it like the sidebar does, or an escape
+ * sequence in it would reach the real terminal.
+ */
+export function sessionItemLabel(s, current, folderTag) {
+    return `${s.thread_id === current ? "● " : "  "}${folderTag}${sanitizeForTerminal(s.title || s.thread_id)}`;
+}
 /**
  * Footer usage: `current` minus the pre-run `baseline`, so the status bar
  * reports the current/last run instead of the session total.

package/dist/ui/components.js

@@ -337,8 +337,11 @@ export class SidebarComponent {
         // The session title is the panel's headline — brighter than the section
         // headers below it. The "New session" placeholder stays at section-header
         // level so it doesn't read as a real title.
+        // The session title is remote free text (the model sets it via
+        // update_topic; a resumed thread's title comes from the server) — same
+        // sanitizing rule as the todo content below.
         push(this.state.title
-            ? ` ${style.bold(SESSION_TITLE_COLOR(this.state.title))}`
+            ? ` ${style.bold(SESSION_TITLE_COLOR(sanitizeForTerminal(this.state.title)))}`
             : ` ${style.bold(TITLE_COLOR("New session"))}`);
         blank();
         const usage = this.state.usage;
@@ -355,7 +358,10 @@ export class SidebarComponent {
         if (todoItems.length > 0) {
             section("todo", `TODO (${this.opts.todos.doneCount}/${todoItems.length})`);
             for (const item of todoItems) {
-                const content = item.content.replace(/\s+/g, " ");
+                // Todo content is model-authored (the update_todo args) and reaches
+                // the real terminal on every sidebar repaint — same sanitizing rule as
+                // every other transcript component.
+                const content = sanitizeForTerminal(item.content.replace(/\s+/g, " "));
                 value(`${todoGlyph(item.status)} ${item.status === "completed" ? GRAY_DIM_COLOR(content) : GRAY_COLOR(content)}`);
             }
             blank();
@@ -436,8 +442,11 @@ export class PromptEditor extends Editor {
     }
     renderBottomBorder(width, hiddenLineCount) {
         const label = ` ${MODES[this.mode].label} `;
-        const modelText = this.model ?? "no model";
-        const thinkingText = this.thinking ?? "default";
+        // Both are remote text (session detail, model list, thinking levels) and
+        // this border is redrawn every frame — sanitize before measuring so the
+        // chip hit-test ranges match what is actually rendered.
+        const modelText = sanitizeForTerminal(this.model ?? "no model");
+        const thinkingText = sanitizeForTerminal(this.thinking ?? "default");
         const info = `· ${modelText} · ${thinkingText} `;
         const suffix = hiddenLineCount > 0 ? `↓ ${hiddenLineCount} more ` : "";
         const fill = width - visibleWidth(label) - visibleWidth(info) - visibleWidth(suffix) - 1;

package/dist/ui/format.d.ts

@@ -24,5 +24,10 @@ export declare function todoMark(status: TodoStatus): string;
  * Render a `local_update_todo` request's args as display lines — the task
  * list lives in the tool request, not in the system prompt. Empty for
  * malformed args (the tool call itself surfaces the validation error).
+ *
+ * The content is model-authored and rendered to the real terminal, so it is
+ * sanitized here: this custom renderer bypasses `paramValueLines`' stringify
+ * pass (and `sanitizeArgs` only covers top-level strings — `todos` is an
+ * array).
  */
 export declare function formatTodoArgs(args: Record<string, unknown>): string[];

package/dist/ui/format.js

@@ -3,6 +3,7 @@
 // ---------------------------------------------------------------------------
 import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import { parseTodoItems } from "../agent/todo.js";
+import { sanitizeForTerminal } from "../sanitize.js";
 /** 999 → "999", 12345 → "12.3k", 1234567 → "1.2M". */
 export function formatTokens(n) {
     if (!Number.isFinite(n))
@@ -63,6 +64,11 @@ export function todoMark(status) {
  * Render a `local_update_todo` request's args as display lines — the task
  * list lives in the tool request, not in the system prompt. Empty for
  * malformed args (the tool call itself surfaces the validation error).
+ *
+ * The content is model-authored and rendered to the real terminal, so it is
+ * sanitized here: this custom renderer bypasses `paramValueLines`' stringify
+ * pass (and `sanitizeArgs` only covers top-level strings — `todos` is an
+ * array).
  */
 export function formatTodoArgs(args) {
     let items;
@@ -72,5 +78,5 @@ export function formatTodoArgs(args) {
     catch {
         return [];
     }
-    return items.map((t) => `${todoMark(t.status)} ${t.content}`);
+    return items.map((t) => `${todoMark(t.status)} ${sanitizeForTerminal(t.content)}`);
 }

package/dist/ui/model-list.js

@@ -5,6 +5,7 @@
 // "default". Current wins when both apply, so the row the user is actually
 // running carries exactly one marker.
 // ---------------------------------------------------------------------------
+import { sanitizeForTerminal } from "../sanitize.js";
 /**
  * The id the picker marks as current: the model in use (a thread's model or a
  * fresh selection), otherwise the user's pending selection, otherwise the
@@ -26,7 +27,9 @@ export function buildModelItems(models, currentId) {
         const isDefault = m.default === true || (!hasDefaultFlag && index === 0);
         return {
             value: m.id,
-            label: m.label ? `${m.label} (${m.id})` : m.id,
+            // Both fields are remote text (the server's model list) — sanitize them
+            // like every other remote string the UI renders.
+            label: sanitizeForTerminal(m.label ? `${m.label} (${m.id})` : m.id),
             description: isCurrent ? "current" : isDefault ? "default" : "",
         };
     });

package/dist/ui/tool-view.js

@@ -88,11 +88,13 @@ function toolSummaryRaw(name, args) {
     switch (displayToolName(name)) {
         case "read": {
             const path = stringArg(args.path) ?? "";
+            // Mirror the tool's clamp (fs.ts) so a limit/offset of 0 or a negative
+            // number can't render a nonsense range like "lines 1–0".
             const offset = numberArg(args.offset);
             const limit = numberArg(args.limit);
-            const start = offset ?? 1;
+            const start = Math.max(1, Math.floor(offset ?? 1));
             const range = limit !== undefined
-                ? `lines ${start}–${start + limit - 1}`
+                ? `lines ${start}–${start + Math.max(1, Math.floor(limit)) - 1}`
                 : offset !== undefined ? `from line ${start}` : "";
             return [path, range].filter(Boolean).join(" · ");
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ocis/myagent-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Terminal coding agent for your local repository, powered by a remote MyAgent server",
   "type": "module",
   "bin": {