@oh-my-pi/pi-tui 16.0.6 → 16.0.8

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [16.0.8] - 2026-06-18
+
+### Fixed
+
+- Fixed bracketed paste under kitty+tmux leaking `[27;5;106~` escape tails throughout the pasted text (newlines became visible garbage instead of line breaks). tmux's default `extended-keys-format=xterm` re-encodes paste control bytes as `modifyOtherKeys` sequences (`ESC[27;5;<code>~`), which the paste sanitizer did not decode — only the sibling `csi-u` form (`ESC[<code>;5u`) was handled. Both forms are now decoded back to their literal control byte (Ctrl+J → "\n") before control-character stripping, and the decoder is shared by the multi-line editor and the single-line modal input.
+
 ## [16.0.5] - 2026-06-17
 
 ### Added

package/dist/types/bracketed-paste.d.ts

@@ -5,6 +5,13 @@ export type PasteResult = {
     pasteContent?: string;
     remaining: string;
 };
+/**
+ * Decode tmux's re-encoded control bytes (both `extended-keys-format` variants) inside a
+ * bracketed-paste payload back to their literal byte (e.g. Ctrl+J → "\n"). Leaves the rest of
+ * the text untouched. Call before any control-character stripping so newlines/tabs survive
+ * instead of leaking the printable escape tail into the buffer.
+ */
+export declare function decodeReencodedPasteControls(text: string): string;
 /**
  * Handles bracketed paste mode buffering for terminal input components.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-tui",
-	"version": "16.0.6",
+	"version": "16.0.8",
 	"description": "Terminal User Interface library with differential rendering for efficient text-based applications",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -37,8 +37,8 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "16.0.6",
-		"@oh-my-pi/pi-utils": "16.0.6",
+		"@oh-my-pi/pi-natives": "16.0.8",
+		"@oh-my-pi/pi-utils": "16.0.8",
 		"lru-cache": "11.5.1",
 		"marked": "^18.0.5"
 	},

package/src/bracketed-paste.ts

@@ -3,6 +3,43 @@ const PASTE_END = "\x1b[201~";
 
 export type PasteResult = { handled: false } | { handled: true; pasteContent?: string; remaining: string };
 
+// Some terminals re-encode the control bytes inside a bracketed paste as key-event
+// escape sequences (observed with tmux extended-keys passthrough under kitty). tmux
+// emits one of two formats depending on `extended-keys-format`:
+//   - csi-u:  ESC [ <codepoint> ; 5 u        (Ctrl+J → ESC [ 106 ; 5 u)
+//   - xterm:  ESC [ 27 ; 5 ; <codepoint> ~   (Ctrl+J → ESC [ 27 ; 5 ; 106 ~)
+// Callers must decode these back to the literal control byte (Ctrl+J → "\n") before
+// stripping control chars; otherwise ESC is dropped and the printable tail
+// ("[106;5u" / "[27;5;106~") leaks into the editor.
+//
+// Only Ctrl+<letter> is decoded (codepoint a-z/A-Z → 0x01..0x1A). That is the set tmux
+// actually re-encodes from paste content in practice — TAB (Ctrl+I), LF (Ctrl+J), CR
+// (Ctrl+M), VT (Ctrl+K), FF (Ctrl+L), … Non-letter Ctrl combos (NUL, ESC, FS-US, DEL)
+// never appear as re-encoded paste bytes, so they are left untouched rather than
+// synthesized into raw control bytes. Callers still strip leftover control characters
+// after decoding (the editor keeps "\n"; the single-line input strips all of them).
+const REENCODED_CTRL_CSI_U = /\x1b\[(\d+);5u/g;
+const REENCODED_CTRL_XTERM = /\x1b\[27;5;(\d+)~/g;
+
+function decodeReencodedCtrlByte(match: string, code: string): string {
+	const cp = Number(code);
+	if (cp >= 97 && cp <= 122) return String.fromCharCode(cp - 96); // a-z → Ctrl+A..Ctrl+Z
+	if (cp >= 65 && cp <= 90) return String.fromCharCode(cp - 64); // A-Z → Ctrl+A..Ctrl+Z
+	return match;
+}
+
+/**
+ * Decode tmux's re-encoded control bytes (both `extended-keys-format` variants) inside a
+ * bracketed-paste payload back to their literal byte (e.g. Ctrl+J → "\n"). Leaves the rest of
+ * the text untouched. Call before any control-character stripping so newlines/tabs survive
+ * instead of leaking the printable escape tail into the buffer.
+ */
+export function decodeReencodedPasteControls(text: string): string {
+	return text
+		.replace(REENCODED_CTRL_CSI_U, decodeReencodedCtrlByte)
+		.replace(REENCODED_CTRL_XTERM, decodeReencodedCtrlByte);
+}
+
 /**
  * Handles bracketed paste mode buffering for terminal input components.
  *

package/src/components/editor.ts

@@ -1,6 +1,6 @@
 import { getProjectDir, logger } from "@oh-my-pi/pi-utils";
 import type { AutocompleteProvider, CombinedAutocompleteProvider } from "../autocomplete";
-import { BracketedPasteHandler } from "../bracketed-paste";
+import { BracketedPasteHandler, decodeReencodedPasteControls } from "../bracketed-paste";
 import { getKeybindings, type KeybindingsManager } from "../keybindings";
 import { extractPrintableText, matchesKey } from "../keys";
 import { KillRing } from "../kill-ring";
@@ -1843,20 +1843,14 @@ export class Editor implements Component, Focusable {
 		});
 	}
 
-	/** Normalize raw pasted text: decode tmux CSI-u re-encoded control bytes, normalize CRLF and
+	/** Normalize raw pasted text: decode tmux re-encoded control bytes (both extended-keys formats),
+	 *  normalize CRLF and
 	 *  NFC (macOS NFD filename drag-drops), expand tabs, and strip control characters except newline. */
 	#sanitizePastedText(pastedText: string): string {
-		// Some terminals (e.g. tmux popups with extended-keys-format=csi-u) re-encode
-		// control bytes inside bracketed paste as CSI-u Ctrl+<letter> sequences
-		// (ESC [ <codepoint> ; 5 u). Decode those back to their literal byte so the
-		// per-char filter below preserves newlines instead of stripping ESC and
-		// leaking the printable tail (e.g. "[106;5u") into the editor.
-		const decodedText = pastedText.replace(/\x1b\[(\d+);5u/g, (match, code) => {
-			const cp = Number(code);
-			if (cp >= 97 && cp <= 122) return String.fromCharCode(cp - 96);
-			if (cp >= 65 && cp <= 90) return String.fromCharCode(cp - 64);
-			return match;
-		});
+		// Decode tmux's re-encoded control bytes (both extended-keys formats) back to
+		// their literal byte so the per-char filter below preserves newlines instead of
+		// stripping ESC and leaking the printable tail into the editor. See the decoder.
+		const decodedText = decodeReencodedPasteControls(pastedText);
 
 		// Clean the pasted text. NFC-normalize so macOS Finder drag-drops of
 		// Korean filenames (which arrive as NFD: e.g. `ᄒ`+`ᅪ` instead of `화`)

package/src/components/input.ts

@@ -1,4 +1,4 @@
-import { BracketedPasteHandler } from "../bracketed-paste";
+import { BracketedPasteHandler, decodeReencodedPasteControls } from "../bracketed-paste";
 import { getKeybindings } from "../keybindings";
 import { extractPrintableText } from "../keys";
 import { KillRing } from "../kill-ring";
@@ -375,8 +375,12 @@ export class Input implements Component, Focusable {
 		this.#lastAction = null;
 		this.#pushUndo();
 
-		// Clean the pasted text — remove newlines and carriage returns, normalize
-		// tabs, AND normalize Unicode to NFC.
+		// Clean the pasted text — decode tmux's re-encoded control bytes (both
+		// extended-keys formats, e.g. Ctrl+J → "\n") back to literal bytes so the escape
+		// tail does not leak in, remove newlines/carriage returns, expand tabs, NFC-normalize,
+		// then strip any remaining control bytes. The decoder can synthesize Ctrl+A..Ctrl+Z
+		// (0x01..0x1A) from a paste, and a single-line value must hold none of them — newlines
+		// are already gone and tabs are already spaces by the time the C0/DEL strip runs.
 		//
 		// NFC normalization rationale: macOS Finder drag-drops file paths in NFD
 		// (Conjoining Jamo, U+1100..U+11FF). `Bun.stringWidth` counts each
@@ -387,9 +391,11 @@ export class Input implements Component, Focusable {
 		// as cursor drift past the visible filename — N×~1.5 cells for a path
 		// with N Korean syllables. NFC normalization at paste time stores the
 		// value in the same form everything else in the codebase assumes.
-		const cleanText = replaceTabs(pastedText.replace(/\r\n/g, "").replace(/\r/g, "").replace(/\n/g, "")).normalize(
-			"NFC",
-		);
+		const cleanText = replaceTabs(
+			decodeReencodedPasteControls(pastedText).replace(/\r\n/g, "").replace(/\r/g, "").replace(/\n/g, ""),
+		)
+			.normalize("NFC")
+			.replace(/[\x00-\x1F\x7F]/g, "");
 
 		// Insert at cursor position
 		this.#value = this.#value.slice(0, this.#cursor) + cleanText + this.#value.slice(this.#cursor);