@pugi/cli 0.1.0-alpha.9 → 0.1.0-beta.10

package/dist/tools/lsp-tools.js

@@ -0,0 +1,189 @@
+import { gateOnCancellation, OperatorAbortedError } from './file-tools.js';
+import { recordToolCall, recordToolResult } from '../core/session.js';
+/** Cap for any single LSP tool's payload size. Keeps model context lean. */
+const LSP_PAYLOAD_CAP_BYTES = 8 * 1024;
+export async function lspHover(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'lsp_hover', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'lsp_hover', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await client.hover(file, { line, character: col }, ctx.cancellation);
+        if (!result.ok)
+            return failure(result);
+        if (!result.value) {
+            return { ok: true, value: { content: '' } };
+        }
+        const content = truncate(result.value.content);
+        return {
+            ok: true,
+            value: {
+                content: content.text,
+                ...(result.value.range ? { range: result.value.range } : {}),
+            },
+            ...(content.truncated ? { truncated: true } : {}),
+        };
+    });
+}
+export async function lspDefinition(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'lsp_definition', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'lsp_definition', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await client.definition(file, { line, character: col }, ctx.cancellation);
+        if (!result.ok)
+            return failure(result);
+        const capped = capLocations(result.value);
+        return {
+            ok: true,
+            value: capped.value,
+            ...(capped.truncated ? { truncated: true } : {}),
+        };
+    });
+}
+export async function lspReferences(ctx, lang, file, line, col) {
+    const toolCallId = recordToolCall(ctx.session, 'lsp_references', `${lang}:${file}:${line}:${col}`);
+    return guard(ctx, 'lsp_references', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await client.references(file, { line, character: col }, ctx.cancellation);
+        if (!result.ok)
+            return failure(result);
+        const capped = capLocations(result.value);
+        return {
+            ok: true,
+            value: capped.value,
+            ...(capped.truncated ? { truncated: true } : {}),
+        };
+    });
+}
+export async function lspDiagnostics(ctx, lang, file) {
+    const toolCallId = recordToolCall(ctx.session, 'lsp_diagnostics', `${lang}:${file}`);
+    return guard(ctx, 'lsp_diagnostics', toolCallId, async () => {
+        const client = ctx.lspClients?.get(lang);
+        if (!client)
+            return unavailable(lang);
+        const result = await client.diagnostics(file, ctx.cancellation);
+        if (!result.ok)
+            return failure(result);
+        const capped = capDiagnostics(result.value);
+        return {
+            ok: true,
+            value: capped.value,
+            ...(capped.truncated ? { truncated: true } : {}),
+        };
+    });
+}
+async function guard(ctx, toolName, toolCallId, op) {
+    try {
+        gateOnCancellation(ctx, toolName);
+    }
+    catch (error) {
+        if (error instanceof OperatorAbortedError) {
+            recordToolResult(ctx.session, toolCallId, 'cancelled', error.message);
+            return { ok: false, reason: 'operator_aborted', detail: error.message };
+        }
+        throw error;
+    }
+    try {
+        const result = await op();
+        if (result.ok) {
+            recordToolResult(ctx.session, toolCallId, 'success', summarize(result.value));
+        }
+        else {
+            recordToolResult(ctx.session, toolCallId, 'error', `${result.reason ?? 'error'}: ${result.detail ?? ''}`);
+        }
+        return result;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        recordToolResult(ctx.session, toolCallId, 'error', message);
+        return { ok: false, reason: 'lsp_error', detail: message };
+    }
+}
+function unavailable(lang) {
+    return {
+        ok: false,
+        reason: 'lsp_unavailable',
+        detail: `no LSP server started for ${lang}. Install the server and re-run ` +
+            `with --lsp ${lang}, or fall back to grep.`,
+    };
+}
+function failure(result) {
+    if (result.ok) {
+        // Shouldn't be hit — caller checks first.
+        return { ok: true, value: result.value };
+    }
+    return { ok: false, reason: result.reason, detail: result.detail };
+}
+function summarize(value) {
+    if (value === null || value === undefined)
+        return 'no result';
+    if (Array.isArray(value))
+        return `${value.length} items`;
+    if (typeof value === 'object')
+        return Object.keys(value).join(',');
+    return String(value);
+}
+function truncate(text) {
+    const bytes = Buffer.byteLength(text, 'utf8');
+    if (bytes <= LSP_PAYLOAD_CAP_BYTES)
+        return { text, truncated: false };
+    // Truncate to the cap byte boundary. We don't try to honor codepoint
+    // alignment — UTF-8 surrogate splits show up as a single ? at the
+    // boundary, which is acceptable for a debug surface; the dispatcher
+    // is the trust boundary for "this is what the model will see".
+    const buf = Buffer.from(text, 'utf8').subarray(0, LSP_PAYLOAD_CAP_BYTES);
+    return { text: `${buf.toString('utf8')}\n... [truncated]`, truncated: true };
+}
+function capLocations(locations) {
+    // Cap at 200 locations OR the byte cap, whichever hits first. The
+    // 200 number is the operator-facing "this is a hot symbol" threshold —
+    // a richer surface (paginated `pugi lsp references --offset N`) is
+    // open backlog.
+    const COUNT_CAP = 200;
+    if (locations.length === 0)
+        return { value: locations, truncated: false };
+    const trimmed = locations.slice(0, COUNT_CAP);
+    const serialized = JSON.stringify(trimmed);
+    if (Buffer.byteLength(serialized, 'utf8') <= LSP_PAYLOAD_CAP_BYTES && trimmed.length === locations.length) {
+        return { value: trimmed, truncated: false };
+    }
+    // Trim by halves until we fit the byte cap. Worst case ~10 iterations
+    // for the 200 max, fine for an interactive tool.
+    let upper = trimmed.length;
+    while (upper > 1) {
+        const half = Math.floor(upper / 2);
+        const sub = trimmed.slice(0, half);
+        if (Buffer.byteLength(JSON.stringify(sub), 'utf8') <= LSP_PAYLOAD_CAP_BYTES) {
+            return { value: sub, truncated: true };
+        }
+        upper = half;
+    }
+    return { value: trimmed.slice(0, 1), truncated: true };
+}
+function capDiagnostics(items) {
+    if (items.length === 0)
+        return { value: items, truncated: false };
+    const serialized = JSON.stringify(items);
+    if (Buffer.byteLength(serialized, 'utf8') <= LSP_PAYLOAD_CAP_BYTES) {
+        return { value: items, truncated: false };
+    }
+    // Diagnostics are sorted error-first in LSP convention; trim from the
+    // tail so we keep the highest-severity items.
+    let upper = items.length;
+    while (upper > 1) {
+        const half = Math.floor(upper / 2);
+        const sub = items.slice(0, half);
+        if (Buffer.byteLength(JSON.stringify(sub), 'utf8') <= LSP_PAYLOAD_CAP_BYTES) {
+            return { value: sub, truncated: true };
+        }
+        upper = half;
+    }
+    return { value: items.slice(0, 1), truncated: true };
+}
+/** Test-only surface so specs can poke truncation directly. */
+export const __test__ = { truncate, capLocations, capDiagnostics, LSP_PAYLOAD_CAP_BYTES };
+//# sourceMappingURL=lsp-tools.js.map

package/dist/tools/registry.js

@@ -1,8 +1,19 @@
 const registry = [
+    // α7.7: unified-diff patch apply. Routes through the same security
+    // gate as Layer A/B/C, so the risk class matches `edit`/`write`
+    // (medium — writes inside the workspace, never to protected files).
+    { name: 'apply_patch', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
     { name: 'bash', permission: 'bash', risk: 'high', concurrencySafe: false, m1: true },
     { name: 'edit', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
     { name: 'glob', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'grep', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    // α7.7: LSP read-only surface. Server runs locally, no Anvil
+    // round-trip. Concurrency-safe because every operation reads
+    // server state without mutating workspace files.
+    { name: 'lsp_definition', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    { name: 'lsp_diagnostics', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    { name: 'lsp_hover', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
+    { name: 'lsp_references', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'question', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'read', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'skill', permission: 'read', risk: 'low', concurrencySafe: true, m1: true },
@@ -11,6 +22,21 @@ const registry = [
     { name: 'task_list', permission: 'none', risk: 'low', concurrencySafe: true, m1: true },
     { name: 'task_update', permission: 'none', risk: 'low', concurrencySafe: false, m1: true },
     { name: 'web_fetch', permission: 'network', risk: 'medium', concurrencySafe: true, m1: true },
+    // α7.7: scratch worktree management. `worktree_create` writes nothing
+    // dangerous (a clone under `.pugi/worktrees/`); `worktree_promote`
+    // applies a diff back to the main tree, so it shares the `edit`
+    // risk class. `worktree_drop` is the cleanup primitive.
+    //
+    // R1 fix (2026-05-26, PR #413 r1, Fix 9): raised `worktree_create`
+    // and `worktree_drop` from `low` to `medium`. `worktree_drop` runs
+    // `rmSync` on its target — even with the new path-containment gate
+    // in `core/edits/worktree.ts::dropWorktree`, a destructive primitive
+    // belongs in `medium` so the permission FSM prompts on every call.
+    // `worktree_create` is raised for disk-pressure parity (a runaway
+    // agent loop could fill the disk with abandoned scratch worktrees).
+    { name: 'worktree_create', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
+    { name: 'worktree_drop', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
+    { name: 'worktree_promote', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
     { name: 'write', permission: 'edit', risk: 'medium', concurrencySafe: false, m1: true },
 ];
 export const toolRegistry = registry.sort((a, b) => a.name.localeCompare(b.name));

package/dist/tools/web-fetch.js

@@ -240,7 +240,7 @@ function ipv4IsBlocked(ip) {
  * a literal IP (with brackets stripped). We honor that fast-path and
  * skip DNS.
  */
-async function validateHostnameForFetch(hostname) {
+export async function validateHostnameForFetch(hostname) {
     // URL.hostname keeps the brackets off IPv6 literals already.
     if (!hostname)
         return 'empty hostname';

package/dist/tui/agent-tree-pane.js

@@ -0,0 +1,9 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Text } from 'ink';
+import { AgentTree } from './agent-tree.js';
+export function AgentTreePane(props) {
+    const onWatch = props.agents.filter((a) => a.status === 'queued' || a.status === 'thinking').length;
+    const total = props.agents.length;
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, dimColor: true, children: '─ agents ' }), _jsx(Text, { dimColor: true, children: `(${total} total, ${onWatch} on watch)` })] }), _jsx(AgentTree, { agents: props.agents, nowEpochMs: props.nowEpochMs })] }));
+}
+//# sourceMappingURL=agent-tree-pane.js.map

package/dist/tui/ask-cli.js

@@ -0,0 +1,52 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { render, useApp } from 'ink';
+import { AskModal, PlanReviewModal } from './ask-modal.js';
+export async function renderAskCli(options) {
+    let resolveOuter;
+    const outerPromise = new Promise((resolve) => {
+        resolveOuter = resolve;
+    });
+    function App() {
+        const { exit } = useApp();
+        return (_jsx(AskModal, { tag: options.tag, onResolve: (verdict) => {
+                resolveOuter(verdict);
+                // Slight delay so Ink flushes the unmount before the parent
+                // CLI prints the verdict line. Otherwise the modal frame and
+                // the verdict line can interleave on slow terminals.
+                setTimeout(() => exit(), 16);
+            } }));
+    }
+    const instance = render(_jsx(App, {}));
+    const verdict = await outerPromise;
+    try {
+        await instance.waitUntilExit();
+    }
+    catch {
+        // Ink may throw if exit() races with a re-render; the verdict is
+        // already captured so we ignore.
+    }
+    return verdict;
+}
+export async function renderPlanReviewCli(options) {
+    let resolveOuter;
+    const outerPromise = new Promise((resolve) => {
+        resolveOuter = resolve;
+    });
+    function App() {
+        const { exit } = useApp();
+        return (_jsx(PlanReviewModal, { tag: options.tag, onResolve: (result) => {
+                resolveOuter(result);
+                setTimeout(() => exit(), 16);
+            } }));
+    }
+    const instance = render(_jsx(App, {}));
+    const result = await outerPromise;
+    try {
+        await instance.waitUntilExit();
+    }
+    catch {
+        // See renderAskCli — captured verdict supersedes a late Ink throw.
+    }
+    return result;
+}
+//# sourceMappingURL=ask-cli.js.map

package/dist/tui/ask-modal.js

@@ -0,0 +1,211 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Office-hours forcing questions + plan-review modals - Sprint α6.3.
+ *
+ * Two Ink components feed by the parsed `<pugi-ask>` / `<pugi-plan-review>`
+ * tag records the session module extracts from persona output.
+ *
+ *   - <AskModal />: numbered options (1-4) + optional "Other" custom-input
+ *     fallback. Operator types `1`, `2`, `3`, `4`, or `o <free text>`.
+ *
+ *   - <PlanReviewModal />: numbered steps + optional risk callout +
+ *     three-way verdict `[a] approve · [m] modify · [c] cancel`.
+ *     Operator types `a`, `m`, or `c`. `m` opens a free-text editor;
+ *     the operator's edited text is returned verbatim to the session.
+ *
+ * Both components are PURE in the Ink sense — they read props + own
+ * useState for the input buffer, and emit one final `onResolve` callback
+ * when the operator submits. The REPL root handles wiring the verdict
+ * back into the session as the next user turn (prefixed with
+ * `[ASK-RESPONSE:<value>]` / `[PLAN-VERDICT:approve|modify|cancel] ...`)
+ * so the persona transcript stays linear.
+ *
+ * Brand voice gate: ASCII glyphs only, no em-dashes, no banned brand
+ * words (journey, explore, delight, magical, friendly, AI-powered,
+ * pug-tastic). The modal copy is power-word neutral so a localized
+ * variant lands cleanly later.
+ */
+import { useState } from 'react';
+import { Box, Text, useInput } from 'ink';
+export function AskModal(props) {
+    const [mode, setMode] = useState('pick');
+    const [buffer, setBuffer] = useState('');
+    useInput((input, key) => {
+        // Esc cancels the modal in either mode.
+        if (key.escape) {
+            props.onResolve({ value: '', cancelled: true });
+            return;
+        }
+        if (mode === 'pick') {
+            // Numeric keys 1..N select the matching option, capped at the
+            // total option count. Out-of-range keys are ignored.
+            const numeric = Number.parseInt(input, 10);
+            if (!Number.isNaN(numeric) && numeric >= 1 && numeric <= props.tag.options.length) {
+                const opt = props.tag.options[numeric - 1];
+                if (opt) {
+                    props.onResolve({ value: opt.value, cancelled: false });
+                    return;
+                }
+            }
+            // The "Other" sentinel is the index = options.length + 1. We
+            // also accept `o` (lowercase) as a hotkey since the cursor key
+            // for "Other" is always one-past-the-last numeric.
+            const otherIndex = props.tag.options.length + 1;
+            if ((!Number.isNaN(numeric) && numeric === otherIndex)
+                || input === 'o'
+                || input === 'O') {
+                setMode('custom');
+                setBuffer('');
+                return;
+            }
+            // Any other keystroke: ignored. The hint footer tells the
+            // operator the legal keys.
+            return;
+        }
+        // Custom-input mode: line editor.
+        if (key.return) {
+            // Empty buffer + Enter = cancel custom (return to pick).
+            if (buffer.trim().length === 0) {
+                setMode('pick');
+                setBuffer('');
+                return;
+            }
+            props.onResolve({
+                value: '',
+                customInput: buffer.trim(),
+                cancelled: false,
+            });
+            return;
+        }
+        if (key.backspace || key.delete) {
+            setBuffer((prev) => prev.slice(0, -1));
+            return;
+        }
+        if (input && !key.meta && !key.ctrl) {
+            setBuffer((prev) => prev + input);
+        }
+    }, { isActive: props.inert !== true });
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "yellow", paddingX: 1, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "yellow", children: '? ' }), _jsx(Text, { bold: true, children: 'Need your call before I continue' })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { children: props.tag.question }) }), _jsxs(Box, { flexDirection: "column", marginTop: 1, children: [props.tag.options.map((opt, idx) => (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: "cyan", bold: true, children: `  ${idx + 1}. ` }), _jsx(Text, { children: opt.label })] }), opt.desc ? (_jsx(Box, { marginLeft: 5, children: _jsx(Text, { dimColor: true, children: opt.desc }) })) : null] }, opt.value))), _jsxs(Box, { children: [_jsx(Text, { color: "cyan", bold: true, children: `  ${props.tag.options.length + 1}. ` }), _jsx(Text, { dimColor: true, children: 'Other (type a custom answer)' })] })] }), mode === 'pick' ? (_jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: `Press 1-${props.tag.options.length + 1} to choose. Esc cancels.` }) })) : (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Box, { children: [_jsx(Text, { color: "cyan", children: '> ' }), _jsx(Text, { children: buffer }), _jsx(Text, { inverse: true, children: ' ' })] }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: 'Type your custom answer. Enter submits. Esc cancels.' }) })] }))] }));
+}
+export function PlanReviewModal(props) {
+    const [mode, setMode] = useState('pick');
+    const [buffer, setBuffer] = useState('');
+    useInput((input, key) => {
+        if (key.escape) {
+            // Escape from EITHER mode means cancel — symmetric with AskModal.
+            props.onResolve({ verdict: 'cancel' });
+            return;
+        }
+        if (mode === 'pick') {
+            if (input === 'a' || input === 'A') {
+                props.onResolve({ verdict: 'approve' });
+                return;
+            }
+            if (input === 'c' || input === 'C') {
+                props.onResolve({ verdict: 'cancel' });
+                return;
+            }
+            if (input === 'm' || input === 'M') {
+                setMode('modify');
+                setBuffer('');
+                return;
+            }
+            return;
+        }
+        // Modify-mode line editor.
+        if (key.return) {
+            if (buffer.trim().length === 0) {
+                setMode('pick');
+                setBuffer('');
+                return;
+            }
+            props.onResolve({ verdict: 'modify', modifyText: buffer.trim() });
+            return;
+        }
+        if (key.backspace || key.delete) {
+            setBuffer((prev) => prev.slice(0, -1));
+            return;
+        }
+        if (input && !key.meta && !key.ctrl) {
+            setBuffer((prev) => prev + input);
+        }
+    }, { isActive: props.inert !== true });
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "magenta", paddingX: 1, children: [_jsxs(Box, { children: [_jsx(Text, { bold: true, color: "magenta", children: '? ' }), _jsx(Text, { bold: true, children: 'Plan review - approve before I execute' })] }), _jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Text, { dimColor: true, children: 'Steps:' }), props.tag.steps.map((step, idx) => (_jsxs(Box, { children: [_jsx(Text, { color: "cyan", bold: true, children: `  ${idx + 1}. ` }), _jsx(Text, { children: step.text })] }, `step-${idx}`)))] }), props.tag.risk ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, color: "red", children: 'Risk:' }), _jsx(Box, { marginLeft: 2, children: _jsx(Text, { children: props.tag.risk }) })] })) : null, mode === 'pick' ? (_jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: "green", bold: true, children: '  [a] approve  ' }), _jsx(Text, { color: "yellow", bold: true, children: '[m] modify  ' }), _jsx(Text, { color: "red", bold: true, children: '[c] cancel' })] }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: 'Press a, m, or c. Esc cancels.' }) })] })) : (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Box, { children: [_jsx(Text, { color: "yellow", children: 'modify > ' }), _jsx(Text, { children: buffer }), _jsx(Text, { inverse: true, children: ' ' })] }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: 'Type the revision. Enter submits. Esc cancels.' }) })] }))] }));
+}
+/* ------------------------------------------------------------------ */
+/* Verdict serialisation                                              */
+/* ------------------------------------------------------------------ */
+/**
+ * Encode an ask-modal verdict into the literal string the session
+ * injects as the next operator turn. The persona's prompt teaches it
+ * to recognise this prefix, so the conversation stays coherent without
+ * a side channel.
+ *
+ * Examples:
+ *   { value: 'vercel' }              -> "[ASK-RESPONSE:vercel]"
+ *   { value: '', customInput: 'gcp'} -> "[ASK-RESPONSE:other] gcp"
+ *   { cancelled: true }              -> "[ASK-RESPONSE:cancelled]"
+ *
+ * customInput is stripped of any leading `[ASK-RESPONSE:...]` /
+ * `[PLAN-VERDICT:...]` pattern so a forged operator prefix cannot be
+ * read as a different verdict by a prefix-greedy persona (Claude
+ * triple-review P1, PR #375).
+ */
+export function encodeAskVerdict(verdict) {
+    if (verdict.cancelled)
+        return '[ASK-RESPONSE:cancelled]';
+    if (verdict.value.length > 0)
+        return `[ASK-RESPONSE:${verdict.value}]`;
+    const customInput = verdict.customInput
+        ? sanitiseVerdictText(verdict.customInput)
+        : '';
+    if (customInput.length > 0) {
+        return `[ASK-RESPONSE:other] ${customInput}`;
+    }
+    return '[ASK-RESPONSE:cancelled]';
+}
+/**
+ * Encode a plan-review verdict into the next operator turn. Mirrors
+ * the ask encoding so the persona sees a single grammar.
+ *
+ * modifyText is sanitised against verdict-header forgery the same way
+ * customInput is in encodeAskVerdict (Claude triple-review P1).
+ */
+export function encodePlanReviewVerdict(result) {
+    switch (result.verdict) {
+        case 'approve':
+            return '[PLAN-VERDICT:approve]';
+        case 'cancel':
+            return '[PLAN-VERDICT:cancel]';
+        case 'modify': {
+            const modifyText = result.modifyText
+                ? sanitiseVerdictText(result.modifyText)
+                : '';
+            if (modifyText.length > 0) {
+                return `[PLAN-VERDICT:modify] ${modifyText}`;
+            }
+            return '[PLAN-VERDICT:cancel]';
+        }
+    }
+}
+/**
+ * Strip any leading `[ASK-RESPONSE:...]` or `[PLAN-VERDICT:...]`
+ * pattern from free-text operator input so a malicious or accidental
+ * operator string cannot forge a verdict header. Iterates because the
+ * operator could prepend several forged headers in a row.
+ *
+ * Mirrors the same-named helper in core/repl/session.ts. Kept in both
+ * modules so the test surfaces of ask-modal and session are
+ * independently exercisable without circular imports.
+ */
+function sanitiseVerdictText(raw) {
+    let cleaned = raw;
+    for (let i = 0; i < raw.length + 4; i += 1) {
+        const stripped = cleaned.replace(/^\s*\[(?:ASK-RESPONSE|PLAN-VERDICT):[^\]]*\]\s*/u, '');
+        if (stripped === cleaned)
+            break;
+        cleaned = stripped;
+    }
+    return cleaned.trim();
+}
+//# sourceMappingURL=ask-modal.js.map

package/dist/tui/conversation-pane.js

@@ -1,5 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Box, Text } from 'ink';
+import { MarkdownRender } from './markdown-render.js';
 const HUE_COLOR_BY_SLUG = {
     // Mira (Pug) - coordinator
     main: 'cyan',
@@ -23,10 +24,14 @@ const HUE_COLOR_BY_SLUG = {
     analyst: 'gray',
 };
 export function ConversationPane(props) {
+    const showHeader = props.showHeader !== false;
     if (props.rows.length === 0) {
-        return (_jsx(Box, { children: _jsx(Text, { dimColor: true, children: "Brief the workforce to begin. Try a short sentence or /help." }) }));
+        return (_jsxs(Box, { flexDirection: "column", children: [showHeader ? _jsx(PaneHeader, { count: 0 }) : null, _jsx(Text, { dimColor: true, children: "Brief the workforce to begin. Try a short sentence or /help." })] }));
     }
-    return (_jsx(Box, { flexDirection: "column", children: props.rows.map((row) => (_jsx(ConversationRow, { row: row, personaNames: props.personaNames }, row.id))) }));
+    return (_jsxs(Box, { flexDirection: "column", children: [showHeader ? _jsx(PaneHeader, { count: props.rows.length }) : null, props.rows.map((row) => (_jsx(ConversationRow, { row: row, personaNames: props.personaNames }, row.id)))] }));
+}
+function PaneHeader({ count }) {
+    return (_jsxs(Box, { children: [_jsx(Text, { bold: true, dimColor: true, children: '─ conversation ' }), _jsx(Text, { dimColor: true, children: `(${count} row${count === 1 ? '' : 's'})` })] }));
 }
 function ConversationRow({ row, personaNames, }) {
     switch (row.source) {
@@ -38,8 +43,48 @@ function ConversationRow({ row, personaNames, }) {
             const slug = row.personaSlug ?? '';
             const color = HUE_COLOR_BY_SLUG[slug] ?? 'white';
             const displayName = personaNames?.get(slug) ?? slug;
-            return (_jsxs(Box, { children: [_jsx(Text, { color: color, bold: true, children: `▸ ${displayName} ` }), _jsx(Text, { children: row.text })] }));
+            // α6.12: persona bodies travel through MarkdownRender so code
+            // fences, headings, and inline accents land correctly. A row that
+            // carries no Markdown syntax renders as plain text under the same
+            // path (the parser falls through to a single paragraph span), so
+            // there is no regression for the simple "Mira shipped." baseline.
+            const containsMarkdown = looksLikeMarkdown(row.text);
+            return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { children: [_jsx(Text, { color: color, bold: true, children: `▸ ${displayName} ` }), containsMarkdown ? null : _jsx(Text, { children: row.text })] }), containsMarkdown ? (_jsx(Box, { marginLeft: 2, children: _jsx(MarkdownRender, { source: row.text }) })) : null] }));
         }
     }
 }
+/**
+ * Cheap heuristic for "this transcript row will benefit from Markdown
+ * rendering". We only pay the parser cost when the row plausibly
+ * contains a code fence, heading, list item, or inline accent. A bare
+ * "Mira shipped." line takes the legacy fast path.
+ *
+ * The probe is intentionally generous - false positives just route
+ * through the parser, which renders plain text identically.
+ */
+function looksLikeMarkdown(text) {
+    if (text.length === 0)
+        return false;
+    if (text.includes('```'))
+        return true;
+    // Codex P2 PR #369: intro-plus-list shape ("Summary:\n- bullet")
+    // must route through renderer. Scan EVERY line, not just the first.
+    const lines = text.split('\n');
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (/^#{1,6}\s/.test(line))
+            return true;
+        if (/^[-*+]\s/.test(line))
+            return true;
+        if (/^\d+\.\s/.test(line))
+            return true;
+    }
+    if (/\*\*[^*]+\*\*/.test(text))
+        return true;
+    if (/`[^`]+`/.test(text))
+        return true;
+    if (/\[[^\]]+\]\([^)]+\)/.test(text))
+        return true;
+    return false;
+}
 //# sourceMappingURL=conversation-pane.js.map