@pi-unipi/unipi 2.1.3 → 2.2.0

package/packages/notify/tui/telegram-setup.ts

@@ -0,0 +1,302 @@
+/**
+ * @pi-unipi/notify — Telegram Setup TUI Component
+ *
+ * Interactive overlay for setting up Telegram bot notifications.
+ * Guides user through BotFather flow and auto-detects chat ID.
+ */
+
+import type { Component } from "@earendil-works/pi-tui";
+import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import type { Theme } from "@earendil-works/pi-coding-agent";
+import { pollForChatId } from "../platforms/telegram.js";
+import { updateConfig } from "../settings.js";
+import { boxInnerWidth } from "@pi-unipi/core";
+
+type SetupPhase = "instructions" | "token" | "polling" | "success" | "error" | "timeout";
+
+/** Spinner frames */
+const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+
+/**
+ * Telegram setup overlay component.
+ */
+export class TelegramSetupOverlay implements Component {
+  private phase: SetupPhase = "instructions";
+  private botToken = "";
+  private chatId: string | null = null;
+  private error: string | null = null;
+  private spinnerFrame = 0;
+  private spinnerTimer: ReturnType<typeof setInterval> | null = null;
+  private pollAbort: AbortController | null = null;
+  private pollTimer: ReturnType<typeof setTimeout> | null = null;
+  private startTime = Date.now();
+  private readonly TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+  private isInPaste = false;
+  private pasteBuffer = "";
+  onClose?: () => void;
+  requestRender?: () => void;
+  private theme: Theme | null = null;
+
+  setTheme(theme: Theme): void {
+    this.theme = theme;
+  }
+
+  invalidate(): void {}
+
+  handleInput(data: string): void {
+    switch (this.phase) {
+      case "instructions":
+        if (data === "\r" || data === " ") {
+          this.phase = "token";
+        } else if (data === "\x1b") {
+          this.cleanup();
+          this.onClose?.();
+        }
+        break;
+      case "token":
+        // Handle bracketed paste mode
+        if (this.isInPaste) {
+          this.pasteBuffer += data;
+          const endIndex = this.pasteBuffer.indexOf("\x1b[201~");
+          if (endIndex !== -1) {
+            // Extract pasted content and process it
+            const pasteContent = this.pasteBuffer.substring(0, endIndex);
+            this.processTokenInput(pasteContent);
+            this.isInPaste = false;
+            this.pasteBuffer = "";
+          }
+          return;
+        }
+        // Detect start of bracketed paste
+        if (data.includes("\x1b[200~")) {
+          this.isInPaste = true;
+          this.pasteBuffer = data.replace("\x1b[200~", "");
+          return;
+        }
+        if (data === "\r" && this.botToken.length > 0) {
+          this.startPolling();
+        } else if (data === "\x1b") {
+          this.cleanup();
+          this.onClose?.();
+        } else if (data === "\x7f" || data === "\b") {
+          this.botToken = this.botToken.slice(0, -1);
+        } else {
+          this.processTokenInput(data);
+        }
+        break;
+      case "polling":
+        if (data === "\x1b") {
+          this.cleanup();
+          this.onClose?.();
+        }
+        break;
+      case "success":
+      case "error":
+      case "timeout":
+        if (data === "\r" || data === " " || data === "\x1b") {
+          this.cleanup();
+          this.onClose?.();
+        }
+        break;
+    }
+  }
+
+  private processTokenInput(data: string): void {
+    // Ignore escape sequences (arrow keys, function keys, etc.)
+    if (data.startsWith("\x1b[")) return;
+    // Filter to valid bot token characters only
+    const cleaned = data.replace(/[^0-9:A-Za-z_-]/g, "");
+    if (cleaned.length > 0) {
+      this.botToken += cleaned;
+    }
+  }
+
+  private startPolling(): void {
+    this.phase = "polling";
+    this.startTime = Date.now();
+    this.pollAbort = new AbortController();
+
+    // Start spinner animation
+    this.spinnerTimer = setInterval(() => {
+      this.spinnerFrame = (this.spinnerFrame + 1) % SPINNER_FRAMES.length;
+      this.requestRender?.();
+    }, 80);
+
+    // Start polling
+    this.doPoll();
+  }
+
+  private async doPoll(): Promise<void> {
+    if (this.phase !== "polling" || !this.pollAbort) return;
+
+    try {
+      const chatId = await pollForChatId(
+        this.botToken,
+        this.pollAbort.signal
+      );
+
+      if (chatId) {
+        this.chatId = chatId;
+        this.phase = "success";
+        this.saveConfig();
+        this.cleanup();
+        this.requestRender?.();
+        // Auto-close after brief delay to show success
+        setTimeout(() => this.onClose?.(), 1000);
+        return;
+      }
+
+      // Check timeout
+      if (Date.now() - this.startTime > this.TIMEOUT_MS) {
+        this.phase = "timeout";
+        this.error = "Timed out after 5 minutes";
+        this.cleanup();
+        this.requestRender?.();
+        return;
+      }
+
+      // Schedule next poll
+      this.pollTimer = setTimeout(() => this.doPoll(), 2000);
+    } catch (err) {
+      if (this.pollAbort?.signal.aborted) return;
+      this.phase = "error";
+      this.error = err instanceof Error ? err.message : String(err);
+      this.cleanup();
+      this.requestRender?.();
+    }
+  }
+
+  private saveConfig(): void {
+    if (this.botToken && this.chatId) {
+      updateConfig({
+        telegram: {
+          enabled: true,
+          botToken: this.botToken,
+          chatId: this.chatId,
+        },
+      });
+    }
+  }
+
+  private cleanup(): void {
+    if (this.spinnerTimer) {
+      clearInterval(this.spinnerTimer);
+      this.spinnerTimer = null;
+    }
+    if (this.pollTimer) {
+      clearTimeout(this.pollTimer);
+      this.pollTimer = null;
+    }
+    if (this.pollAbort) {
+      this.pollAbort.abort();
+      this.pollAbort = null;
+    }
+  }
+
+  // ─── Theme helpers ───────────────────────────────────────────────────
+
+  private fg(color: string, text: string): string {
+    if (this.theme) return this.theme.fg(color as any, text);
+    const c: Record<string, string> = {
+      accent: "\x1b[36m", success: "\x1b[32m", warning: "\x1b[33m",
+      error: "\x1b[31m", dim: "\x1b[2m", borderMuted: "\x1b[90m",
+    };
+    return `${c[color] ?? ""}${text}\x1b[0m`;
+  }
+
+  private bold(text: string): string {
+    return this.theme ? this.theme.bold(text) : `\x1b[1m${text}\x1b[0m`;
+  }
+
+  private frameLine(content: string, innerWidth: number): string {
+    const truncated = truncateToWidth(content, innerWidth, "");
+    const padding = Math.max(0, innerWidth - visibleWidth(truncated));
+    return `${this.fg("borderMuted", "│")}${truncated}${" ".repeat(padding)}${this.fg("borderMuted", "│")}`;
+  }
+
+  private ruleLine(innerWidth: number): string {
+    return this.fg("borderMuted", `├${"─".repeat(innerWidth)}┤`);
+  }
+
+  private borderLine(innerWidth: number, edge: "top" | "bottom"): string {
+    const left = edge === "top" ? "┌" : "└";
+    const right = edge === "top" ? "┐" : "┘";
+    return this.fg("borderMuted", `${left}${"─".repeat(innerWidth)}${right}`);
+  }
+
+  render(width: number): string[] {
+    const innerWidth = boxInnerWidth(width);
+    const lines: string[] = [];
+
+    lines.push(this.borderLine(innerWidth, "top"));
+    lines.push(this.frameLine(this.fg("accent", this.bold("🤖 Telegram Bot Setup")), innerWidth));
+    lines.push(this.ruleLine(innerWidth));
+
+    switch (this.phase) {
+      case "instructions":
+        lines.push(this.frameLine(this.fg("dim", "Set up Telegram notifications in 3 steps:"), innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.bold("1.")} Open Telegram and message ${this.fg("accent", "@BotFather")}`, innerWidth));
+        lines.push(this.frameLine(`     Send /newbot and follow the prompts to create a bot`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.bold("2.")} Copy the bot token from BotFather`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.bold("3.")} Send any message to your new bot`, innerWidth));
+        lines.push(this.frameLine(`     (We'll detect your chat ID automatically)`, innerWidth));
+        lines.push(this.ruleLine(innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Press Enter to continue, Esc to cancel"), innerWidth));
+        break;
+
+      case "token":
+        lines.push(this.frameLine(this.fg("dim", "Paste your bot token from BotFather:"), innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        const display = this.fg("accent", this.bold(this.botToken || " "));
+        lines.push(this.frameLine(`  ${display}${this.fg("dim", "█")}`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Enter to start polling · Esc to cancel"), innerWidth));
+        break;
+
+      case "polling": {
+        const frame = SPINNER_FRAMES[this.spinnerFrame] || "⠋";
+        const elapsed = Math.floor((Date.now() - this.startTime) / 1000);
+        const remaining = Math.max(0, 300 - elapsed);
+        lines.push(this.frameLine(`  ${this.fg("accent", frame)} ${this.bold("Waiting for first message...")}`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", "Send any message to your bot in Telegram")}`, innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", `Timeout: ${Math.floor(remaining / 60)}:${String(remaining % 60).padStart(2, "0")}`)}`, innerWidth));
+        lines.push(this.ruleLine(innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Esc to cancel"), innerWidth));
+        break;
+      }
+
+      case "success":
+        lines.push(this.frameLine(`  ${this.fg("success", "✓ Telegram bot configured!")}`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", `Chat ID: ${this.chatId}`)}`, innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", "Notifications will be sent to this chat")}`, innerWidth));
+        lines.push(this.ruleLine(innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Press Enter to close"), innerWidth));
+        break;
+
+      case "error":
+        lines.push(this.frameLine(`  ${this.fg("error", "✗ Setup failed")}`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", this.error || "Unknown error")}`, innerWidth));
+        lines.push(this.ruleLine(innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Press Enter to close"), innerWidth));
+        break;
+
+      case "timeout":
+        lines.push(this.frameLine(`  ${this.fg("warning", "⏰ Timed out after 5 minutes")}`, innerWidth));
+        lines.push(this.frameLine("", innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", "Make sure you sent a message to your bot in Telegram")}`, innerWidth));
+        lines.push(this.frameLine(`  ${this.fg("dim", "You can try again with /unipi:notify-set-tg")}`, innerWidth));
+        lines.push(this.ruleLine(innerWidth));
+        lines.push(this.frameLine(this.fg("dim", "Press Enter to close"), innerWidth));
+        break;
+    }
+
+    lines.push(this.borderLine(innerWidth, "bottom"));
+    return lines;
+  }
+}

package/packages/ralph/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/ralph",
-  "version": "2.1.3",
+  "version": "2.2.0",
   "description": "Long-running iterative development loops for Pi coding agent",
   "type": "module",
   "main": "index.ts",
@@ -27,8 +27,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "2.1.3",
-    "@pi-unipi/info-screen": "2.1.3"
+    "@pi-unipi/core": "2.2.0",
+    "@pi-unipi/info-screen": "2.2.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.80.0",

package/packages/subagents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/subagents",
-  "version": "2.1.3",
+  "version": "2.2.0",
   "description": "Subagents for UniPi — parallel execution, file locking, workflow integration",
   "type": "module",
   "main": "dist/index.js",
@@ -17,9 +17,9 @@
     "test": "npx tsx --test src/__tests__/*.test.ts"
   },
   "dependencies": {
-    "@pi-unipi/core": "2.1.3",
-    "@pi-unipi/workflow": "2.1.3",
-    "@pi-unipi/info-screen": "2.1.3",
+    "@pi-unipi/core": "2.2.0",
+    "@pi-unipi/workflow": "2.2.0",
+    "@pi-unipi/info-screen": "2.2.0",
     "@earendil-works/pi-agent-core": "^0.80.0"
   },
   "devDependencies": {

package/packages/subagents/src/__tests__/shutdown-stale-ctx.test.ts

@@ -0,0 +1,185 @@
+/**
+ * Test: background agents must not touch a stale extension runtime
+ *
+ * BUG — Pi crashed on exit with:
+ *   "This extension ctx is stale after session replacement or reload."
+ *   at pi.sendMessage (loader.js:240)
+ *   at onComplete (packages/subagents/src/index.ts)
+ *
+ * Sequence:
+ *  1. A background agent (e.g. the session-name generator) is still running.
+ *  2. The user quits. Pi emits `session_shutdown`, then immediately calls
+ *     `AgentSession.dispose()`, which invalidates the extension runtime.
+ *  3. Our handler calls `abortAll()`, but aborting only *signals* the
+ *     AbortController — the in-flight promise still settles on a later
+ *     microtask and invokes the completion callback.
+ *  4. That callback called `pi.sendMessage()`, which is `assertActive`-gated,
+ *     so it threw from an async continuation with no catch → process crash.
+ *
+ * FIX — a `sessionEnded` flag set at the top of the `session_shutdown` handler
+ * (before `abortAll()`), checked at the top of the completion callback, plus a
+ * try/catch around `sendMessage` for the session-replacement race.
+ *
+ * The flag is scoped to the extension factory, not the module: `/new`,
+ * `/fork` and `/resume` also emit `session_shutdown` and pi re-invokes the
+ * factory for the replacement session, so a fresh closure resets it.
+ * (Verified against pi 0.80.2: `/new` emits `shutdown reason=new`, then the
+ * factory runs again with `ended=false`.)
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOT = join(import.meta.dirname, "../../../..");
+
+function readSource(relativePath: string): string {
+  const fullPath = join(ROOT, relativePath);
+  if (!existsSync(fullPath)) throw new Error(`File not found: ${fullPath}`);
+  return readFileSync(fullPath, "utf-8");
+}
+
+// ─── Behavioural: reproduce the race ────────────────────────────────
+
+/**
+ * Minimal stand-in for pi's runtime: every `assertActive`-gated method throws
+ * once the session has been disposed.
+ */
+function createFakeRuntime() {
+  let stale = false;
+  return {
+    invalidate() {
+      stale = true;
+    },
+    sendMessage() {
+      if (stale) {
+        throw new Error(
+          "This extension ctx is stale after session replacement or reload.",
+        );
+      }
+      return { delivered: true };
+    },
+    setSessionName() {
+      if (stale) {
+        throw new Error(
+          "This extension ctx is stale after session replacement or reload.",
+        );
+      }
+    },
+    // pi.events is NOT assertActive-gated — it keeps working.
+    events: { emit() {} },
+  };
+}
+
+/**
+ * Reproduces the extension's shutdown wiring.
+ *
+ * @param guard - whether to apply the `sessionEnded` fix
+ */
+function simulateShutdownRace(guard: boolean) {
+  const pi = createFakeRuntime();
+  let sessionEnded = false;
+  const errors: Error[] = [];
+
+  // The completion callback registered with AgentManager.
+  const onComplete = () => {
+    if (guard && sessionEnded) return;
+    pi.sendMessage();
+  };
+
+  // A background agent whose promise is still pending at shutdown.
+  let settle!: () => void;
+  const inFlight = new Promise<void>((resolve) => {
+    settle = resolve;
+  }).then(() => {
+    try {
+      onComplete();
+    } catch (error) {
+      // In production this is an unhandled rejection that kills the process.
+      errors.push(error as Error);
+    }
+  });
+
+  // --- session_shutdown handler ---
+  if (guard) sessionEnded = true; // must be set BEFORE abortAll()
+  settle(); // abortAll(): signals abort; the promise settles a tick later
+  // --- pi disposes the session right after handlers resolve ---
+  pi.invalidate();
+
+  return { done: inFlight, errors };
+}
+
+describe("shutdown race — background agent completing after dispose", () => {
+  it("reproduces the stale-ctx crash without the guard", async () => {
+    const { done, errors } = simulateShutdownRace(false);
+    await done;
+
+    assert.equal(errors.length, 1, "expected the unguarded path to throw");
+    assert.match(errors[0].message, /stale after session replacement/);
+  });
+
+  it("does not touch the stale runtime with the guard", async () => {
+    const { done, errors } = simulateShutdownRace(true);
+    await done;
+
+    assert.deepEqual(errors, [], "guarded path must not throw");
+  });
+});
+
+// ─── Source contract: the wiring must stay correct ──────────────────
+
+describe("subagents shutdown wiring", () => {
+  const src = readSource("packages/subagents/src/index.ts");
+
+  it("declares the sessionEnded guard", () => {
+    assert.match(
+      src,
+      /let sessionEnded = false;/,
+      "expected a `sessionEnded` guard flag",
+    );
+  });
+
+  it("sets the guard before aborting, inside session_shutdown", () => {
+    const handler = src.match(
+      /pi\.on\(\s*"session_shutdown"[\s\S]*?\}\s*\);/,
+    )?.[0];
+    assert.ok(handler, "session_shutdown handler not found");
+
+    const guardIdx = handler.indexOf("sessionEnded = true");
+    const abortIdx = handler.indexOf("abortAll()");
+
+    assert.notEqual(guardIdx, -1, "handler must set sessionEnded = true");
+    assert.notEqual(abortIdx, -1, "handler must still call abortAll()");
+    assert.ok(
+      guardIdx < abortIdx,
+      "sessionEnded must be set BEFORE abortAll(), which settles in-flight promises",
+    );
+  });
+
+  it("checks the guard before any pi call in the completion callback", () => {
+    const guardIdx = src.indexOf("if (sessionEnded) return;");
+    assert.notEqual(guardIdx, -1, "completion callback must bail when sessionEnded");
+
+    const sendIdx = src.indexOf("pi.sendMessage");
+    assert.notEqual(sendIdx, -1, "expected a pi.sendMessage call");
+    assert.ok(
+      guardIdx < sendIdx,
+      "the guard must be checked before pi.sendMessage is reached",
+    );
+  });
+
+  it("wraps sendMessage in try/catch for the session-replacement race", () => {
+    const block = src.match(/try\s*\{\s*pi\.sendMessage[\s\S]*?\}\s*catch\s*\{[\s\S]*?\}/);
+    assert.ok(
+      block,
+      "pi.sendMessage must be wrapped in try/catch — a notification is best-effort",
+    );
+  });
+
+  it("keeps setSessionName defensively wrapped", () => {
+    // Badge generation also runs on a background agent.
+    const block = src.match(/try\s*\{\s*pi\.setSessionName[\s\S]*?\}\s*catch/);
+    assert.ok(block, "pi.setSessionName must stay wrapped in try/catch");
+  });
+});

package/packages/subagents/src/index.ts

@@ -137,10 +137,40 @@ export default function (pi: ExtensionAPI) {
   // Activity tracking for widget
   const agentActivity = new Map<string, AgentActivity>();
 
+  /**
+   * Set once `session_shutdown` fires — after which `pi` must not be touched.
+   *
+   * Pi disposes the session as soon as the shutdown handlers resolve, and
+   * `AgentSession.dispose()` invalidates the extension runtime. Every
+   * `assertActive`-gated method (`sendMessage`, `setSessionName`,
+   * `appendEntry`, `setModel`, …) then throws "This extension ctx is stale
+   * after session replacement or reload".
+   *
+   * Background agents outlive that moment: `abortAll()` only signals their
+   * AbortController, so the in-flight promise settles a microtask *later* and
+   * fires this completion callback against a dead runtime — an unhandled
+   * throw that crashed the process on exit.
+   *
+   * Scoped to the extension factory rather than module scope on purpose:
+   * `session_shutdown` also fires for `/new`, `/fork` and `/resume` (reasons
+   * "new" / "fork" / "resume"), and pi re-invokes the extension factory for
+   * the replacement session. A fresh closure therefore starts with
+   * `sessionEnded = false`, so the guard can never latch permanently.
+   * Verified: `/new` emits `shutdown reason=new` then re-runs the factory.
+   *
+   * `pi.events` is NOT gated, so cross-module events still fire.
+   */
+  let sessionEnded = false;
+
   // Create manager with completion callback
   const manager = new AgentManager(
     (record) => {
       agentActivity.delete(record.id);
+
+      // After shutdown the UI is gone and the runtime is stale — nothing here
+      // is deliverable, and touching `pi` would throw.
+      if (sessionEnded) return;
+
       widget.markFinished(record.id);
       widget.update();
 
@@ -160,6 +190,7 @@ export default function (pi: ExtensionAPI) {
         record.resultConsumed = true;
       }
 
+
       // Send styled notification via message renderer
       const status = getStatusLabel(record.status, record.error);
       const durationMs = record.completedAt ? record.completedAt - record.startedAt : 0;
@@ -180,15 +211,22 @@ export default function (pi: ExtensionAPI) {
       ].join("\n");
 
       if (!record.resultConsumed) {
-        pi.sendMessage<NotificationDetails>(
-          {
-            customType: "subagent-notification",
-            content: notificationXml,
-            display: true,
-            details,
-          },
-          { deliverAs: "followUp", triggerTurn: true },
-        );
+        // Defence in depth: `sessionEnded` covers the ordinary shutdown path,
+        // but a session can also be replaced mid-flight. Delivering a
+        // notification is best-effort — it must never take the process down.
+        try {
+          pi.sendMessage<NotificationDetails>(
+            {
+              customType: "subagent-notification",
+              content: notificationXml,
+              display: true,
+              details,
+            },
+            { deliverAs: "followUp", triggerTurn: true },
+          );
+        } catch {
+          // Runtime went stale between the guard and here — nothing to notify.
+        }
       }
 
       pi.events.emit("subagents:completed", {
@@ -394,8 +432,12 @@ export default function (pi: ExtensionAPI) {
     });
   });
 
-  // ESC propagation: abort all agents on session shutdown
+  // ESC propagation: abort all agents on session shutdown.
+  // Set the guard FIRST: abortAll() settles in-flight promises, whose
+  // completion callbacks would otherwise reach a runtime that pi is about to
+  // invalidate.
   pi.on("session_shutdown", async () => {
+    sessionEnded = true;
     manager.abortAll();
     manager.dispose();
   });

package/packages/unipi/index.ts

@@ -30,6 +30,7 @@ import footer from "@pi-unipi/footer";
 import updater from "@pi-unipi/updater";
 import inputShortcuts from "@pi-unipi/input-shortcuts";
 import cocoindex from "@pi-unipi/cocoindex";
+import image from "../image/src/index.js";
 
 export default function (pi: ExtensionAPI) {
   workflow(pi);
@@ -51,4 +52,5 @@ export default function (pi: ExtensionAPI) {
   updater(pi);
   inputShortcuts(pi);
   cocoindex(pi);
+  image(pi);
 }

package/packages/updater/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/updater",
-  "version": "2.1.3",
+  "version": "2.2.0",
   "description": "Auto-updater, changelog browser, and readme browser for Unipi — checks npm registry, renders CHANGELOG.md and README.md files in TUI overlays",
   "type": "module",
   "main": "src/index.ts",
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "2.1.3"
+    "@pi-unipi/core": "2.2.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.80.0",

package/packages/updater/src/tui/changelog-overlay.ts

@@ -11,7 +11,7 @@ import { Key, matchesKey, truncateToWidth, visibleWidth } from "@earendil-works/
 import type { Theme } from "@earendil-works/pi-coding-agent";
 import { parseChangelog } from "../changelog.js";
 import { renderMarkdown } from "../markdown.js";
-import { getInstalledPackageVersion } from "@pi-unipi/core";
+import { getInstalledPackageVersion, boxInnerWidth } from "@pi-unipi/core";
 import type { ChangelogEntry } from "../../types.js";
 
 type View = "list" | "detail";
@@ -72,7 +72,7 @@ export function renderChangelogOverlay() {
     const render = (width: number): string[] => {
       ensureLoaded();
 
-      const innerWidth = Math.max(22, width - 2);
+      const innerWidth = boxInnerWidth(width);
       const lines: string[] = [];
 
       // ── Header ──────────────────────────────────────────────────────