@prometheus-ai/tui 0.5.4 → 0.5.8

package/src/stdin-buffer.ts

@@ -17,11 +17,32 @@
  * MIT License - Copyright (c) 2025 opentui
  */
 import { EventEmitter } from "events";
+import { isKittyProtocolActive } from "./keys";
 
 const ESC = "\x1b";
 const BRACKETED_PASTE_START = "\x1b[200~";
 const BRACKETED_PASTE_END = "\x1b[201~";
-
+// Paste-mode recovery bounds: a lost/corrupted end marker (ssh/tmux
+// truncation) must not hang input forever or grow memory unboundedly.
+const PASTE_INACTIVITY_TIMEOUT_MS = 1000;
+const PASTE_MAX_BYTES = 64 * 1024 * 1024;
+// A buggy double-report (CSI-u event plus the bare printable for the same
+// keypress) arrives in the same terminal write; a bare char that shows up
+// later than this window is a real keystroke and must not be swallowed.
+const KITTY_PRINTABLE_DEDUP_WINDOW_MS = 25;
+// An SGR mouse report prefix is unambiguous: no keyboard sequence starts with
+// `\x1b[<`, so a buffer still matching this is always the head of a split
+// mouse report. Flushing it on timeout would deliver the tail as literal
+// typed text to whatever component is focused (fullscreen overlays enable
+// any-motion tracking, so report floods plus render stalls make the split
+// routine — see the settings search leaking `[<35;8;16M`).
+const SGR_MOUSE_PARTIAL = /^\x1b\[<[\d;]*$/;
+// Upper bound on how long an unambiguous partial is held past the flush
+// timeout before being delivered raw anyway (terminal died mid-sequence).
+// This is also the worst-case added latency for a partial that never
+// completes (e.g. a bare ESC delivered while the kitty-active flag is
+// stale); keep it small.
+const PARTIAL_HOLD_MAX_MS = 150;
 /**
  * Check if a string is a complete escape sequence or needs more data
  */
@@ -202,41 +223,67 @@ function parseUnmodifiedKittyPrintableCodepoint(sequence: string): number | unde
 
 function extractCompleteSequences(buffer: string): { sequences: string[]; remainder: string } {
 	const sequences: string[] = [];
+	const length = buffer.length;
 	let pos = 0;
 
-	while (pos < buffer.length) {
-		const remaining = buffer.slice(pos);
-
-		// Try to extract a sequence starting at this position
-		if (remaining.startsWith(ESC)) {
-			// Find the end of this escape sequence
-			let seqEnd = 1;
-			while (seqEnd <= remaining.length) {
-				const candidate = remaining.slice(0, seqEnd);
+	// Index-based scanning: this is the input hot path. Slicing the remaining
+	// buffer (or Array.from-ing it) per iteration would make plain-text bursts
+	// O(n²) — a 100KB non-bracketed paste must stay O(n).
+	while (pos < length) {
+		if (buffer.charCodeAt(pos) === 0x1b) {
+			// Find the end of this escape sequence by growing the candidate.
+			let end = pos + 1;
+			let consumed = false;
+			while (end <= length) {
+				const candidate = buffer.slice(pos, end);
 				const status = isCompleteSequence(candidate);
-
-				if (status === "complete") {
-					sequences.push(candidate);
-					pos += seqEnd;
-					break;
-				} else if (status === "incomplete") {
-					seqEnd++;
-				} else {
-					// Should not happen when starting with ESC
-					sequences.push(candidate);
-					pos += seqEnd;
+				if (status === "incomplete") {
+					end++;
+					continue;
+				}
+				// "\x1b\x1b" alone parses as "complete" (legacy alt+esc), but when the
+				// next byte opens a CSI/SS3 ("[" or "O") this is really ESC prefixing
+				// another sequence (meta-CSI, or a held Esc keypress joined by a
+				// follower). Consuming two bytes here would tear the follower and leak
+				// its tail as typed text (settings search filling with "[B" or
+				// "[<35;22;17M"). Keep growing; when the buffer ends here, hold the
+				// partial for the flush window so the disambiguating byte can arrive.
+				if (candidate === `${ESC}${ESC}`) {
+					if (end >= length) {
+						return { sequences, remainder: buffer.slice(pos) };
+					}
+					const next = buffer.charCodeAt(end);
+					if (next === 0x5b || next === 0x4f) {
+						end++;
+						continue;
+					}
+				}
+				// ESC + SGR mouse report is never a meta chord: alt-modified mouse
+				// reports carry the modifier in the button bits, not an ESC prefix.
+				// Deliver the bare ESC (a real Esc keypress) and the report separately.
+				if (candidate.startsWith(`${ESC}${ESC}[<`)) {
+					sequences.push(ESC, candidate.slice(1));
+					pos = end;
+					consumed = true;
 					break;
 				}
+				// "complete" — or "not-escape", which should not happen when
+				// starting with ESC; both consume the candidate.
+				sequences.push(candidate);
+				pos = end;
+				consumed = true;
+				break;
 			}
 
-			if (seqEnd > remaining.length) {
-				return { sequences, remainder: remaining };
+			if (!consumed) {
+				return { sequences, remainder: buffer.slice(pos) };
 			}
 		} else {
 			// Not an escape sequence - take one Unicode scalar, not a UTF-16 code unit.
-			const char = Array.from(remaining)[0] ?? "";
-			sequences.push(char);
-			pos += char.length;
+			const codePoint = buffer.codePointAt(pos)!;
+			const charLength = codePoint > 0xffff ? 2 : 1;
+			sequences.push(buffer.slice(pos, pos + charLength));
+			pos += charLength;
 		}
 	}
 
@@ -249,6 +296,23 @@ export type StdinBufferOptions = {
 	 * After this time, a genuinely incomplete escape is flushed.
 	 */
 	timeout?: number;
+	/**
+	 * Maximum extra time (default: 150ms) an unambiguous escape partial — an
+	 * SGR mouse prefix, or any dangling escape while the kitty keyboard
+	 * protocol is active — is held past `timeout` waiting for its tail.
+	 */
+	partialHoldTimeout?: number;
+	/**
+	 * Paste-mode inactivity watchdog (default: 1000ms). If no input arrives for
+	 * this long while waiting for the bracketed-paste end marker, the paste is
+	 * assumed truncated: accumulated bytes are delivered and input recovers.
+	 */
+	pasteTimeout?: number;
+	/**
+	 * Paste-mode byte cap (default: 64 MiB). Exceeding it aborts paste mode the
+	 * same way, bounding memory when the end marker never arrives.
+	 */
+	pasteByteLimit?: number;
 };
 
 export type StdinBufferEventMap = {
@@ -263,23 +327,29 @@ export type StdinBufferEventMap = {
 export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 	#buffer: string = "";
 	#timeout?: NodeJS.Timeout;
+	#flushDeferral?: NodeJS.Timeout;
+	#partialHoldStartMs = 0;
 	readonly #timeoutMs: number;
+	readonly #partialHoldMaxMs: number;
+	readonly #pasteTimeoutMs: number;
+	readonly #pasteByteLimit: number;
 	#pasteMode: boolean = false;
-	#pasteBuffer: string = "";
+	#pasteChunks: string[] = [];
+	#pasteOverlap: string = "";
+	#pasteBytes = 0;
+	#pasteWatchdog?: NodeJS.Timeout;
 	#pendingKittyPrintableCodepoint: number | undefined;
+	#pendingKittyPrintableAtMs = 0;
 
 	constructor(options: StdinBufferOptions = {}) {
 		super();
 		this.#timeoutMs = options.timeout ?? 75;
+		this.#partialHoldMaxMs = options.partialHoldTimeout ?? PARTIAL_HOLD_MAX_MS;
+		this.#pasteTimeoutMs = options.pasteTimeout ?? PASTE_INACTIVITY_TIMEOUT_MS;
+		this.#pasteByteLimit = options.pasteByteLimit ?? PASTE_MAX_BYTES;
 	}
 
 	process(data: string | Buffer): void {
-		// Clear any pending timeout
-		if (this.#timeout) {
-			clearTimeout(this.#timeout);
-			this.#timeout = undefined;
-		}
-
 		// Handle high-byte conversion (for compatibility with parseKeypress)
 		// If buffer has single byte > 127, convert to ESC + (byte - 128)
 		let str: string;
@@ -294,6 +364,16 @@ export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 			str = data;
 		}
 
+		if (this.#flushDeferral && this.#isFreshEscapeAfterDeferredFlush(str)) {
+			// The buffered partial already hit its flush timeout. A new escape is
+			// a fresh sequence, not a tail; flush the stale partial first so the
+			// new sequence can be parsed from a clean buffer.
+			this.#flushExpired();
+		} else {
+			// Cancel any pending flush — new data may complete the buffered partial.
+			this.#clearFlushTimer();
+		}
+
 		if (str.length === 0 && this.#buffer.length === 0) {
 			this.#emitDataSequence("");
 			return;
@@ -302,24 +382,9 @@ export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 		this.#buffer += str;
 
 		if (this.#pasteMode) {
-			this.#pasteBuffer += this.#buffer;
+			const chunk = this.#buffer;
 			this.#buffer = "";
-
-			const endIndex = this.#pasteBuffer.indexOf(BRACKETED_PASTE_END);
-			if (endIndex !== -1) {
-				const pastedContent = this.#pasteBuffer.slice(0, endIndex);
-				const remaining = this.#pasteBuffer.slice(endIndex + BRACKETED_PASTE_END.length);
-
-				this.#pasteMode = false;
-				this.#pasteBuffer = "";
-				this.#pendingKittyPrintableCodepoint = undefined;
-
-				this.emit("paste", pastedContent);
-
-				if (remaining.length > 0) {
-					this.process(remaining);
-				}
-			}
+			this.#consumePasteChunk(chunk);
 			return;
 		}
 
@@ -335,25 +400,13 @@ export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 
 			this.#pendingKittyPrintableCodepoint = undefined;
 			this.#buffer = this.#buffer.slice(startIndex + BRACKETED_PASTE_START.length);
-			this.#pasteMode = true;
-			this.#pasteBuffer = this.#buffer;
+			const firstChunk = this.#buffer;
 			this.#buffer = "";
-
-			const endIndex = this.#pasteBuffer.indexOf(BRACKETED_PASTE_END);
-			if (endIndex !== -1) {
-				const pastedContent = this.#pasteBuffer.slice(0, endIndex);
-				const remaining = this.#pasteBuffer.slice(endIndex + BRACKETED_PASTE_END.length);
-
-				this.#pasteMode = false;
-				this.#pasteBuffer = "";
-				this.#pendingKittyPrintableCodepoint = undefined;
-
-				this.emit("paste", pastedContent);
-
-				if (remaining.length > 0) {
-					this.process(remaining);
-				}
-			}
+			this.#pasteMode = true;
+			this.#pasteChunks = [];
+			this.#pasteOverlap = "";
+			this.#pasteBytes = 0;
+			this.#consumePasteChunk(firstChunk);
 			return;
 		}
 
@@ -365,32 +418,188 @@ export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 		}
 
 		if (this.#buffer.length > 0) {
-			this.#timeout = setTimeout(() => {
-				const flushed = this.flush();
+			this.#armFlushTimer();
+		} else {
+			this.#partialHoldStartMs = 0;
+		}
+	}
 
-				for (const sequence of flushed) {
-					this.#emitDataSequence(sequence);
-				}
-			}, this.#timeoutMs);
+	/**
+	 * Consume one chunk of paste-mode input. Chunks are accumulated in an array
+	 * and only joined once the end marker arrives, so a large paste delivered in
+	 * many small terminal reads stays O(total) instead of the O(total^2) cost of
+	 * re-concatenating and rescanning the whole buffer on every chunk. A short
+	 * overlap tail (end-marker length - 1) is carried across chunk boundaries so
+	 * a marker split between two reads is still detected without rescanning.
+	 */
+	#consumePasteChunk(chunk: string): void {
+		const probe = this.#pasteOverlap + chunk;
+		if (probe.indexOf(BRACKETED_PASTE_END) === -1) {
+			this.#pasteChunks.push(chunk);
+			this.#pasteBytes += chunk.length;
+			const keep = BRACKETED_PASTE_END.length - 1;
+			this.#pasteOverlap = probe.length > keep ? probe.slice(probe.length - keep) : probe;
+			if (this.#pasteBytes > this.#pasteByteLimit) {
+				this.#abortPaste();
+				return;
+			}
+			this.#armPasteWatchdog();
+			return;
+		}
+
+		// End marker arrived: join once and split at its first occurrence,
+		// matching the prior indexOf-from-start semantics exactly.
+		const flat = this.#pasteChunks.length > 0 ? `${this.#pasteChunks.join("")}${chunk}` : chunk;
+		const endIndex = flat.indexOf(BRACKETED_PASTE_END);
+		const pastedContent = flat.slice(0, endIndex);
+		const remaining = flat.slice(endIndex + BRACKETED_PASTE_END.length);
+
+		this.#clearPasteWatchdog();
+		this.#pasteMode = false;
+		this.#pasteChunks = [];
+		this.#pasteOverlap = "";
+		this.#pasteBytes = 0;
+		this.#pendingKittyPrintableCodepoint = undefined;
+
+		this.emit("paste", pastedContent);
+
+		if (remaining.length > 0) {
+			this.process(remaining);
+		}
+	}
+
+	/** Re-arm the paste-mode inactivity watchdog after each chunk. */
+	#armPasteWatchdog(): void {
+		if (this.#pasteWatchdog) clearTimeout(this.#pasteWatchdog);
+		this.#pasteWatchdog = setTimeout(() => {
+			this.#pasteWatchdog = undefined;
+			this.#abortPaste();
+		}, this.#pasteTimeoutMs);
+	}
+
+	#clearPasteWatchdog(): void {
+		if (this.#pasteWatchdog) {
+			clearTimeout(this.#pasteWatchdog);
+			this.#pasteWatchdog = undefined;
 		}
 	}
 
+	/**
+	 * Recover from a paste whose end marker never arrived (dropped or corrupted
+	 * in transit, or past the byte cap): exit paste mode and deliver the
+	 * accumulated bytes as a paste, so they are neither lost, replayed as
+	 * keystrokes, nor accumulated forever while input appears dead.
+	 */
+	#abortPaste(): void {
+		this.#clearPasteWatchdog();
+		const content = this.#pasteChunks.join("");
+		this.#pasteMode = false;
+		this.#pasteChunks = [];
+		this.#pasteOverlap = "";
+		this.#pasteBytes = 0;
+		this.emit("paste", content);
+	}
+
 	#emitDataSequence(sequence: string): void {
 		const rawCodepoint = sequence.length === 1 ? sequence.codePointAt(0) : undefined;
-		if (rawCodepoint !== undefined && rawCodepoint === this.#pendingKittyPrintableCodepoint) {
+		if (
+			rawCodepoint !== undefined &&
+			rawCodepoint === this.#pendingKittyPrintableCodepoint &&
+			Date.now() - this.#pendingKittyPrintableAtMs <= KITTY_PRINTABLE_DEDUP_WINDOW_MS
+		) {
 			this.#pendingKittyPrintableCodepoint = undefined;
 			return;
 		}
 
 		this.#pendingKittyPrintableCodepoint = parseUnmodifiedKittyPrintableCodepoint(sequence);
+		if (this.#pendingKittyPrintableCodepoint !== undefined) {
+			this.#pendingKittyPrintableAtMs = Date.now();
+		}
 		this.emit("data", sequence);
 	}
 
-	flush(): string[] {
+	/**
+	 * setTimeout(0): when the event loop stalls past the timeout (heavy render)
+	 * while the tail of a split escape is already queued on stdin, expired
+	 * timers run before the poll phase that delivers the tail — flushing
+	 * straight from the timer would tear the sequence apart and leak the tail
+	 * as typed text. The zero-delay deferral runs on the next timers pass,
+	 * after poll has had a chance to deliver the pending chunk to process()
+	 * and cancel the deferral.
+	 */
+	#armFlushTimer(): void {
+		this.#timeout = setTimeout(() => {
+			this.#timeout = undefined;
+			this.#flushDeferral = setTimeout(() => {
+				this.#flushDeferral = undefined;
+				this.#flushExpired();
+			});
+		}, this.#timeoutMs);
+	}
+
+	#clearFlushTimer(): void {
 		if (this.#timeout) {
 			clearTimeout(this.#timeout);
 			this.#timeout = undefined;
 		}
+		if (this.#flushDeferral) {
+			clearTimeout(this.#flushDeferral);
+			this.#flushDeferral = undefined;
+		}
+	}
+
+	/**
+	 * A deferred flush means the current buffer already waited for the
+	 * incomplete-sequence timeout. If the next chunk starts a fresh escape, do
+	 * not merge it into the stale partial. Keep ESC-backslash as a continuation
+	 * for OSC/DCS/APC string terminators (`ST`).
+	 */
+	#isFreshEscapeAfterDeferredFlush(str: string): boolean {
+		if (!str.startsWith(ESC) || this.#buffer.length === 0) return false;
+		if (
+			str.startsWith(`${ESC}\\`) &&
+			(this.#buffer.startsWith(`${ESC}]`) ||
+				this.#buffer.startsWith(`${ESC}P`) ||
+				this.#buffer.startsWith(`${ESC}_`))
+		) {
+			return false;
+		}
+		return true;
+	}
+
+	/**
+	 * Whether the dangling partial cannot be a finished keypress and is worth
+	 * holding for its tail instead of flushing:
+	 * - SGR mouse prefixes (`\x1b[<…`) — no keyboard sequence uses them.
+	 * - Any partial while the kitty keyboard protocol is active — the ESC key
+	 *   arrives as `\x1b[27u` and alt-chords as CSI-u, so a bare `\x1b` (or
+	 *   any unterminated escape) is always a split sequence, never a key.
+	 */
+	#shouldHoldPartial(): boolean {
+		return SGR_MOUSE_PARTIAL.test(this.#buffer) || isKittyProtocolActive();
+	}
+
+	/** Timeout-driven flush: hold unambiguous partials (bounded), else deliver. */
+	#flushExpired(): void {
+		if (this.#buffer.length === 0) {
+			this.#partialHoldStartMs = 0;
+			return;
+		}
+		if (this.#shouldHoldPartial()) {
+			if (this.#partialHoldStartMs === 0) this.#partialHoldStartMs = Date.now();
+			if (Date.now() - this.#partialHoldStartMs < this.#partialHoldMaxMs) {
+				this.#armFlushTimer();
+				return;
+			}
+		}
+		this.#partialHoldStartMs = 0;
+		for (const sequence of this.flush()) {
+			this.#emitDataSequence(sequence);
+		}
+	}
+
+	flush(): string[] {
+		this.#clearFlushTimer();
 
 		if (this.#buffer.length === 0) {
 			return [];
@@ -403,14 +612,15 @@ export class StdinBuffer extends EventEmitter<StdinBufferEventMap> {
 	}
 
 	clear(): void {
-		if (this.#timeout) {
-			clearTimeout(this.#timeout);
-			this.#timeout = undefined;
-		}
+		this.#clearFlushTimer();
+		this.#clearPasteWatchdog();
 		this.#buffer = "";
 		this.#pasteMode = false;
-		this.#pasteBuffer = "";
+		this.#pasteChunks = [];
+		this.#pasteOverlap = "";
+		this.#pasteBytes = 0;
 		this.#pendingKittyPrintableCodepoint = undefined;
+		this.#partialHoldStartMs = 0;
 	}
 
 	getBuffer(): string {