@oh-my-pi/pi-tui 16.2.13 → 16.3.2

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## [16.3.0] - 2026-07-02
+
+### Fixed
+
+- Fixed a potential event loop hang when processing oversized, unterminated terminal escape sequences (OSC/DCS/APC).
+- Fixed an issue where large Windows terminal session restores could get truncated mid-frame during ConPTY full-paint resume.
+
 ## [16.2.13] - 2026-07-01
 
 ### Fixed
@@ -591,7 +598,7 @@
 
 ### Changed
 
-- Changed native-scrollback safety defaults to treat unknown POSIX, SSH, and multiplexer-shaped terminals as ED3-risk for passive rendering; checkpoint replay now requires a positive at-tail viewport proof instead of assuming prompt submit makes host scrollback safe ([#1799](https://github.com/can1357/oh-my-pi/issues/1799)).
+- Changed native-scrollback safety defaults to treat unknown POSIX, SSH, and multiplexer-shaped terminals as ED3-risk for passive rendering; checkpoint replay now requires a positive at-tail viewport proof instead of assuming prompt submit makes host scrollback safe.
 - Changed synchronized-output defaults to a conservative opt-in profile: DEC 2026 paint wrappers stay disabled for remote/multiplexer/VTE/unknown terminals unless explicitly forced, while the autowrap guards remain active.
 
 ### Fixed

package/dist/types/bracketed-paste.d.ts

@@ -12,6 +12,22 @@ export type PasteResult = {
  * instead of leaking the printable escape tail into the buffer.
  */
 export declare function decodeReencodedPasteControls(text: string): string;
+/**
+ * Options for {@link BracketedPasteHandler}.
+ */
+export type BracketedPasteHandlerOptions = {
+    /**
+     * Byte cap for buffered paste content (default: 64 MiB). When exceeded,
+     * paste mode is aborted and the accumulated content is delivered as
+     * `pasteContent` on the same `process()` call so a lost/corrupted end
+     * marker cannot consume unbounded memory. Mirrors `StdinBuffer#abortPaste`
+     * — defense in depth for callers that bypass `StdinBuffer` (issue #4073
+     * case B). The normal `ProcessTerminal` path re-wraps `StdinBuffer`'s
+     * bounded paste with both markers, so this cap only fires on alternate
+     * callers.
+     */
+    byteLimit?: number;
+};
 /**
  * Handles bracketed paste mode buffering for terminal input components.
  *
@@ -21,13 +37,15 @@ export declare function decodeReencodedPasteControls(text: string): string;
  */
 export declare class BracketedPasteHandler {
     #private;
+    constructor(options?: BracketedPasteHandlerOptions);
     /**
      * Process incoming terminal data for bracketed paste sequences.
      *
      * @returns `{ handled: false }` if the data contains no paste sequence and
      *          should be processed normally. `{ handled: true }` if the data was
      *          consumed by paste buffering — `pasteContent` is set when a complete
-     *          paste has been assembled; omitted when still buffering.
+     *          paste has been assembled (or the byte cap has aborted a runaway
+     *          buffer); omitted when still buffering.
      */
     process(data: string): PasteResult;
 }

package/dist/types/components/editor.d.ts

@@ -60,8 +60,24 @@ export declare class Editor implements Component, Focusable {
     /**
      * Set custom content for the top border (e.g., status line).
      * Pass undefined to use the default plain border.
+     *
+     * Eager: the passed value is cached and reused every frame. Callers that
+     * mutate status upstream must recompute and call this again. Prefer
+     * {@link setTopBorderProvider} for high-frequency updates — it collapses
+     * per-event rebuilds to one per painted frame.
      */
     setTopBorder(content: EditorTopBorder | undefined): void;
+    /**
+     * Install a lazy provider invoked once per editor render with the current
+     * `availableWidth`. Overrides any eager content set via {@link setTopBorder}
+     * — pass `undefined` to detach and fall back to the eager slot.
+     *
+     * Use this when the top border derives from state that mutates far faster
+     * than the render cadence (session events, streaming, subagent updates).
+     * The TUI already throttles renders, so a provider is invoked at most once
+     * per frame and never does wasted work between paints.
+     */
+    setTopBorderProvider(provider: ((availableWidth: number) => EditorTopBorder | undefined) | undefined): void;
     /**
      * Show or hide the editor border chrome.
      */

package/dist/types/fuzzy.d.ts

@@ -22,3 +22,11 @@ export declare function fuzzyMatch(query: string, text: string): FuzzyMatch;
  */
 export declare function fuzzyRank<T>(items: T[], query: string, getText: (item: T) => string): FuzzyFilterResult<T>[];
 export declare function fuzzyFilter<T>(items: T[], query: string, getText: (item: T) => string): T[];
+/**
+ * Clear the fuzzy search-index cache. Intended for tests/benchmarks so a fresh
+ * cold-start typing session can be measured on demand; not part of the supported
+ * TUI API.
+ *
+ * @internal
+ */
+export declare function resetFuzzyIndexCache(): void;

package/dist/types/terminal-capabilities.d.ts

@@ -40,6 +40,8 @@ export declare class TerminalInfo {
  * the module and so a tmux session attached/detached mid-run is observed.
  */
 export declare function isInsideTmux(env?: NodeJS.ProcessEnv): boolean;
+/** Detect terminal multiplexers where scrollback clearing and height-change redraws are hostile. */
+export declare function isInsideTerminalMultiplexer(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Wrap a control-sequence payload in tmux's DCS passthrough envelope. Each
  * ESC byte inside `payload` is doubled per tmux's escape rules. tmux strips

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-tui",
-	"version": "16.2.13",
+	"version": "16.3.2",
 	"description": "Terminal User Interface library with differential rendering for efficient text-based applications",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -37,8 +37,8 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-natives": "16.2.13",
-		"@oh-my-pi/pi-utils": "16.2.13",
+		"@oh-my-pi/pi-natives": "16.3.2",
+		"@oh-my-pi/pi-utils": "16.3.2",
 		"lru-cache": "11.5.1",
 		"marked": "^18.0.5"
 	},

package/src/bracketed-paste.ts

@@ -40,6 +40,25 @@ export function decodeReencodedPasteControls(text: string): string {
 		.replace(REENCODED_CTRL_XTERM, decodeReencodedCtrlByte);
 }
 
+/**
+ * Options for {@link BracketedPasteHandler}.
+ */
+export type BracketedPasteHandlerOptions = {
+	/**
+	 * Byte cap for buffered paste content (default: 64 MiB). When exceeded,
+	 * paste mode is aborted and the accumulated content is delivered as
+	 * `pasteContent` on the same `process()` call so a lost/corrupted end
+	 * marker cannot consume unbounded memory. Mirrors `StdinBuffer#abortPaste`
+	 * — defense in depth for callers that bypass `StdinBuffer` (issue #4073
+	 * case B). The normal `ProcessTerminal` path re-wraps `StdinBuffer`'s
+	 * bounded paste with both markers, so this cap only fires on alternate
+	 * callers.
+	 */
+	byteLimit?: number;
+};
+
+const DEFAULT_BYTE_LIMIT = 64 * 1024 * 1024;
+
 /**
  * Handles bracketed paste mode buffering for terminal input components.
  *
@@ -50,6 +69,11 @@ export function decodeReencodedPasteControls(text: string): string {
 export class BracketedPasteHandler {
 	#buffer = "";
 	#active = false;
+	readonly #byteLimit: number;
+
+	constructor(options: BracketedPasteHandlerOptions = {}) {
+		this.#byteLimit = options.byteLimit ?? DEFAULT_BYTE_LIMIT;
+	}
 
 	/**
 	 * Process incoming terminal data for bracketed paste sequences.
@@ -57,7 +81,8 @@ export class BracketedPasteHandler {
 	 * @returns `{ handled: false }` if the data contains no paste sequence and
 	 *          should be processed normally. `{ handled: true }` if the data was
 	 *          consumed by paste buffering — `pasteContent` is set when a complete
-	 *          paste has been assembled; omitted when still buffering.
+	 *          paste has been assembled (or the byte cap has aborted a runaway
+	 *          buffer); omitted when still buffering.
 	 */
 	process(data: string): PasteResult {
 		if (data.includes(PASTE_START)) {
@@ -71,14 +96,28 @@ export class BracketedPasteHandler {
 		this.#buffer += data;
 
 		const endIndex = this.#buffer.indexOf(PASTE_END);
-		if (endIndex === -1) return { handled: true, remaining: "" };
+		if (endIndex !== -1) {
+			const pasteContent = this.#buffer.substring(0, endIndex);
+			const remaining = this.#buffer.substring(endIndex + PASTE_END.length);
+
+			this.#buffer = "";
+			this.#active = false;
 
-		const pasteContent = this.#buffer.substring(0, endIndex);
-		const remaining = this.#buffer.substring(endIndex + PASTE_END.length);
+			return { handled: true, pasteContent, remaining };
+		}
 
-		this.#buffer = "";
-		this.#active = false;
+		// Byte cap: a lost/corrupted end marker (ssh/tmux truncation) must not
+		// consume unbounded memory. Deliver the accumulated bytes so they are
+		// neither lost nor held forever, and reset paste mode so subsequent
+		// input recovers. See `StdinBuffer#abortPaste` for the sibling recovery
+		// semantics inside `StdinBuffer`.
+		if (this.#buffer.length > this.#byteLimit) {
+			const pasteContent = this.#buffer;
+			this.#buffer = "";
+			this.#active = false;
+			return { handled: true, pasteContent, remaining: "" };
+		}
 
-		return { handled: true, pasteContent, remaining };
+		return { handled: true, remaining: "" };
 	}
 }

package/src/components/editor.ts

@@ -467,8 +467,12 @@ export class Editor implements Component, Focusable {
 	onAutocompleteCancel?: () => void;
 	disableSubmit: boolean = false;
 
-	// Custom top border (for status line integration)
+	// Custom top border (for status line integration). Either an eager `content`
+	// (set once, reused every frame) or a `provider` that recomputes lazily just
+	// before the editor paints — the second form lets the host coalesce
+	// per-event rebuilds down to one per rendered frame (see #4145).
 	#topBorderContent?: EditorTopBorder;
+	#topBorderProvider?: (availableWidth: number) => EditorTopBorder | undefined;
 	#borderVisible = true;
 
 	constructor(theme: EditorTheme) {
@@ -483,11 +487,30 @@ export class Editor implements Component, Focusable {
 	/**
 	 * Set custom content for the top border (e.g., status line).
 	 * Pass undefined to use the default plain border.
+	 *
+	 * Eager: the passed value is cached and reused every frame. Callers that
+	 * mutate status upstream must recompute and call this again. Prefer
+	 * {@link setTopBorderProvider} for high-frequency updates — it collapses
+	 * per-event rebuilds to one per painted frame.
 	 */
 	setTopBorder(content: EditorTopBorder | undefined): void {
 		this.#topBorderContent = content;
 	}
 
+	/**
+	 * Install a lazy provider invoked once per editor render with the current
+	 * `availableWidth`. Overrides any eager content set via {@link setTopBorder}
+	 * — pass `undefined` to detach and fall back to the eager slot.
+	 *
+	 * Use this when the top border derives from state that mutates far faster
+	 * than the render cadence (session events, streaming, subagent updates).
+	 * The TUI already throttles renders, so a provider is invoked at most once
+	 * per frame and never does wasted work between paints.
+	 */
+	setTopBorderProvider(provider: ((availableWidth: number) => EditorTopBorder | undefined) | undefined): void {
+		this.#topBorderProvider = provider;
+	}
+
 	/**
 	 * Show or hide the editor border chrome.
 	 */
@@ -806,8 +829,12 @@ export class Editor implements Component, Focusable {
 		if (borderVisible) {
 			// Render top border: ╭─ [status content] ────────────────╮
 			const topFillWidth = Math.max(0, width - borderWidth * 2);
-			if (this.#topBorderContent) {
-				const { content, width: statusWidth } = this.#topBorderContent;
+			// Provider (lazy) wins over eager content — a host that installs both
+			// wants the coalesced path; falling back to eager keeps existing
+			// setTopBorder callers working unchanged.
+			const topBorder = this.#topBorderProvider ? this.#topBorderProvider(topFillWidth) : this.#topBorderContent;
+			if (topBorder) {
+				const { content, width: statusWidth } = topBorder;
 				if (statusWidth <= topFillWidth) {
 					// Status fits - add fill after it
 					const fillWidth = topFillWidth - statusWidth;

package/src/fuzzy.ts

@@ -52,7 +52,37 @@ function normalizeForSearch(value: string): string {
 		.replace(/\s+/g, " ");
 }
 
+// Module-level memo of the per-text search index. `buildSearchIndex` is a pure
+// function of `text`, but selectors call it once per candidate per keystroke —
+// the same stable candidate list is re-filtered as the user types. Caching the
+// index across keystrokes eliminates the redundant normalize + word-split + Set
+// build on every character. Consumers only read the result, so sharing is safe.
+//
+// Admission is conservative so the cache helps the repeated-filter hot path
+// without paying for one-off text: only short texts are cached (long inputs —
+// pasted prompts, transcripts searched via the message selector — would bloat
+// memory), and admission stops at the cap instead of evicting, so a stream of
+// unique texts (message/session search) can't churn the map.
+const INDEX_CACHE_MAX = 4096;
+const MAX_CACHED_TEXT_LEN = 4096;
+const indexCache = new Map<string, SearchIndex>();
+
 function buildSearchIndex(text: string): SearchIndex {
+	// Long inputs (pasted prompts, transcripts) are never cached; bypass the Map
+	// entirely so they don't pay a hash lookup on every search.
+	if (text.length > MAX_CACHED_TEXT_LEN) return buildUncachedSearchIndex(text);
+
+	const cached = indexCache.get(text);
+	if (cached !== undefined) return cached;
+
+	const result = buildUncachedSearchIndex(text);
+	if (indexCache.size < INDEX_CACHE_MAX) {
+		indexCache.set(text, result);
+	}
+	return result;
+}
+
+function buildUncachedSearchIndex(text: string): SearchIndex {
 	const normalized = normalizeForSearch(text);
 	if (normalized.length === 0) {
 		return { normalized, compact: "", compactWordStarts: new Set(), words: [] };
@@ -236,9 +266,22 @@ function scoreToken(token: string, index: SearchIndex): FuzzyMatch {
 	return best;
 }
 
-export function fuzzyMatch(query: string, text: string): FuzzyMatch {
-	const normalizedQuery = normalizeForSearch(query);
-	if (normalizedQuery.length === 0) {
+/** A query normalized and split once, so `fuzzyRank` doesn't re-normalize the
+ * same query for every candidate in the list. */
+interface PreparedQuery {
+	normalized: string;
+	tokens: string[];
+	compact: string;
+}
+
+function prepareQuery(query: string): PreparedQuery | null {
+	const normalized = normalizeForSearch(query);
+	if (normalized.length === 0) return null;
+	return { normalized, tokens: normalized.split(" "), compact: normalized.replaceAll(" ", "") };
+}
+
+function fuzzyMatchCore(pq: PreparedQuery | null, text: string): FuzzyMatch {
+	if (pq === null) {
 		return { matches: true, score: 0 };
 	}
 
@@ -248,20 +291,19 @@ export function fuzzyMatch(query: string, text: string): FuzzyMatch {
 	}
 
 	let totalScore = 0;
-	const phraseIndex = index.normalized.indexOf(normalizedQuery);
-	if (phraseIndex >= 0 && isWordBoundaryPhrase(index.normalized, phraseIndex, normalizedQuery.length)) {
+	const phraseIndex = index.normalized.indexOf(pq.normalized);
+	if (phraseIndex >= 0 && isWordBoundaryPhrase(index.normalized, phraseIndex, pq.normalized.length)) {
 		totalScore -= PHRASE_BONUS;
 		totalScore += phraseIndex * 0.01;
 	}
 
-	const compactQuery = normalizedQuery.replaceAll(" ", "");
-	const compactPhraseIndex = index.compact.indexOf(compactQuery);
+	const compactPhraseIndex = index.compact.indexOf(pq.compact);
 	if (compactPhraseIndex >= 0 && index.compactWordStarts.has(compactPhraseIndex)) {
 		totalScore -= COMPACT_PHRASE_BONUS;
 		totalScore += compactPhraseIndex * 0.01;
 	}
 
-	for (const token of normalizedQuery.split(" ")) {
+	for (const token of pq.tokens) {
 		const match = scoreToken(token, index);
 		if (!match.matches) {
 			return { matches: false, score: 0 };
@@ -272,6 +314,10 @@ export function fuzzyMatch(query: string, text: string): FuzzyMatch {
 	return { matches: true, score: totalScore };
 }
 
+export function fuzzyMatch(query: string, text: string): FuzzyMatch {
+	return fuzzyMatchCore(prepareQuery(query), text);
+}
+
 /**
  * Filter and sort items by fuzzy match quality (best matches first).
  * Supports space-separated tokens: all tokens must match.
@@ -281,9 +327,10 @@ export function fuzzyRank<T>(items: T[], query: string, getText: (item: T) => st
 		return items.map(item => ({ item, score: 0 }));
 	}
 
+	const pq = prepareQuery(query);
 	const results: FuzzyFilterResult<T>[] = [];
 	for (const item of items) {
-		const match = fuzzyMatch(query, getText(item));
+		const match = fuzzyMatchCore(pq, getText(item));
 		if (match.matches) {
 			results.push({ item, score: match.score });
 		}
@@ -296,3 +343,14 @@ export function fuzzyRank<T>(items: T[], query: string, getText: (item: T) => st
 export function fuzzyFilter<T>(items: T[], query: string, getText: (item: T) => string): T[] {
 	return fuzzyRank(items, query, getText).map(result => result.item);
 }
+
+/**
+ * Clear the fuzzy search-index cache. Intended for tests/benchmarks so a fresh
+ * cold-start typing session can be measured on demand; not part of the supported
+ * TUI API.
+ *
+ * @internal
+ */
+export function resetFuzzyIndexCache(): void {
+	indexCache.clear();
+}