@thegitai/cli 1.0.0-beta.14 → 1.0.0-beta.16

package/dist/bin/ai.js

@@ -4,6 +4,7 @@ import { stdin as input, stdout as output } from 'node:process';
 import readline from 'node:readline/promises';
 import { ServerApi } from '../src/api/index.js';
 import { loginViaBrowser } from '../src/api/browser-login.js';
+import { isTransientNetworkError } from '../src/api/http.js';
 import { formatCliHelpText, formatInteractiveHelpText, } from '../src/help-text.js';
 import { renderMarkdownForTerminal } from '../src/markdown-renderer.js';
 import { createIndex } from '../src/project-index.js';
@@ -36,9 +37,6 @@ function appendPromptHistory(prompt, env = process.env) {
 }
 async function runAuthCommand(command, args) {
     if (command === 'login') {
-        // The public CLI always authenticates against the official TheGitAI host.
-        // There is intentionally no server/website override here — internal dev
-        // uses private tooling, not a customer-visible runtime override path.
         const serverUrl = DEFAULT_SERVER_URL;
         const noBrowser = args.includes('--no-browser');
         console.log(chalk.dim(noBrowser
@@ -314,9 +312,46 @@ export async function main() {
     const rootDir = process.cwd();
     const authConfig = requireCliAuthConfig();
     const serverSessionClient = sessions.createServerSessionClient({ config: authConfig });
-    const cachedModels = models.readCachedServerModels();
-    const serverModels = await models.fetchServerModels({ config: authConfig });
-    const whoami = await auth.fetchWhoamiResponse({ config: authConfig });
+    const cachedModels = models.selectCacheForServer(models.readCachedServerModels(), authConfig.serverUrl);
+    let offlineNotice = null;
+    let serverModels;
+    try {
+        serverModels = await models.fetchServerModels({ config: authConfig });
+    }
+    catch (error) {
+        if (isTransientNetworkError(error) && cachedModels?.models.length) {
+            serverModels = { models: cachedModels.models };
+            offlineNotice = error?.message ? String(error.message) : 'network error';
+        }
+        else {
+            throw error;
+        }
+    }
+    let whoami;
+    try {
+        whoami = await auth.fetchWhoamiResponse({ config: authConfig });
+    }
+    catch (error) {
+        if (isTransientNetworkError(error)) {
+            whoami = {
+                customer: {
+                    id: '',
+                    uuid: '',
+                    email: authConfig.email,
+                    customer_type: authConfig.customerType ?? 'USER',
+                    scopes: [],
+                },
+                debugUi: { showSessionId: false },
+            };
+            offlineNotice ??= error?.message ? String(error.message) : 'network error';
+        }
+        else {
+            throw error;
+        }
+    }
+    if (offlineNotice) {
+        console.error(chalk.yellow(`⚠ Couldn't reach TheGitAI (${offlineNotice}). Starting with cached settings — it will reconnect on your next message.`));
+    }
     if (listSessions) {
         printSessionList(rootDir, listSessionMetadata(rootDir), serverModels);
         return;

package/dist/src/api/auth.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { getClientStateDir } from '../client-state.js';
-import { ServerApiError, authorizedJson, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+import { ServerApiError, authorizedJson, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
 export function getAuthConfigPath(env = process.env) {
     const configured = String(env.THEGITAI_AUTH_CONFIG ?? '').trim();
     if (configured) {
@@ -51,11 +51,11 @@ export async function fetchWhoami({ config, fetchImpl = globalThis.fetch, }) {
     return data.customer;
 }
 export async function fetchWhoamiResponse({ config, fetchImpl = globalThis.fetch, }) {
-    const data = (await authorizedJson({
+    const data = (await retryTransient(() => authorizedJson({
         config,
         path: '/v1/auth/whoami',
         fetchImpl,
-    }));
+    })));
     if (!data?.customer?.email) {
         throw new Error('Server returned an invalid whoami response.');
     }

package/dist/src/api/browser-login.js

@@ -7,15 +7,10 @@ const DEFAULT_WEBSITE_URL = 'https://thegit.ai';
 const DEFAULT_SERVER_URL = 'https://thegit.ai';
 const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
 function shutDownServer(server) {
-    // Drop any lingering (keep-alive) connections so the event loop empties and
-    // the CLI exits instead of hanging after a successful login.
     server.closeAllConnections?.();
     server.close();
 }
 export function resolveWebsiteUrl() {
-    // The public CLI always signs in through the official TheGitAI website. There
-    // is no override path here so the published package cannot be pointed at a
-    // clone host.
     return DEFAULT_WEBSITE_URL.replace(/\/+$/, '');
 }
 function defaultDeviceName() {
@@ -26,7 +21,6 @@ function defaultDeviceName() {
         return os.hostname();
     }
 }
-/** PKCE (RFC 7636, S256): a random verifier and its SHA-256 challenge. */
 export function generatePkce() {
     const verifier = crypto.randomBytes(32).toString('base64url');
     const challenge = crypto
@@ -77,12 +71,6 @@ async function exchangeCodeForToken({ serverUrl, code, codeVerifier, fetchImpl,
         customer,
     };
 }
-/**
- * Browser-based login. Starts a loopback server so the website can redirect the
- * one-time code back automatically; the code is then exchanged for a token
- * using the PKCE verifier. With `noBrowser`, the user pastes the code instead.
- * The CLI never sees the user's credentials.
- */
 export async function loginViaBrowser(options) {
     const serverUrl = normalizeServerUrl(options.serverUrl ?? DEFAULT_SERVER_URL);
     const websiteUrl = resolveWebsiteUrl();
@@ -97,8 +85,6 @@ export async function loginViaBrowser(options) {
             deviceName,
             paste: true,
         });
-        // Headless mode: only print the URL for the user to open on another device.
-        // Never launch a browser here — that is the whole point of --no-browser.
         onUrl(authUrl);
         if (!options.promptCode) {
             throw new Error('No way to read the authorization code in this context.');
@@ -125,8 +111,6 @@ export async function loginViaBrowser(options) {
             }
             const code = requestUrl.searchParams.get('code') ?? '';
             const returnedState = requestUrl.searchParams.get('state') ?? '';
-            // `Connection: close` plus closeAllConnections() ensures the browser's
-            // keep-alive socket is torn down so the process can exit after login.
             if (!code || returnedState !== state) {
                 res.writeHead(400, { 'content-type': 'text/html', connection: 'close' });
                 res.end(RESULT_PAGE('Login failed', 'The request could not be verified. Please run ai login again.'));

package/dist/src/api/chat.js

@@ -65,7 +65,9 @@ function snapshotForServer(session) {
     return snapshot;
 }
 function imageAttachmentsForServer(attachments) {
-    return (attachments ?? []).map(({ filePath: _filePath, ...attachment }) => attachment);
+    return (attachments ?? []).map(({ filePath, ...attachment }) => attachment.source === 'file' && filePath
+        ? { ...attachment, filePath }
+        : attachment);
 }
 function userHistoryText(entry) {
     return (entry.parts ?? [])
@@ -293,12 +295,6 @@ export async function sendServerUserMessage({ config, projectIndex, session, inp
     const requestImageAttachments = autoAttach.attachments.length > 0
         ? [...imageAttachments, ...autoAttach.attachments]
         : imageAttachments;
-    // requestInput is the server-bound, path-sanitized text ([Image #N] markers in
-    // place of local image paths). Every history-preservation path below (abort,
-    // cancel, failure, mid-stream tool cancel) must persist THIS, never the raw
-    // input — otherwise a cancelled or failed image turn leaks the local
-    // filesystem path into session history and the next snapshot ships it to the
-    // server, defeating the point of sanitizing before the request crosses over.
     const requestInput = autoAttach.attachments.length > 0 ? autoAttach.sanitizedInput : input;
     for (const err of autoAttach.errors) {
         session.onStatus(`Image: ${err}`);
@@ -362,9 +358,6 @@ export async function sendServerUserMessage({ config, projectIndex, session, inp
                 ? error
                 : new TurnCancelledError();
         }
-        // Non-cancel failures (e.g. upstream connection errors) must not leave
-        // speculative cancelled-turn entries in history — otherwise the next
-        // request replays a malformed transcript to the server.
         session.history.length = preTurnHistoryLength;
         preserveFailedTurnInput(session, requestInput, error instanceof ChatTurnFailedError ? error.category : 'unknown_error');
         throw error;

package/dist/src/api/http.js

@@ -26,6 +26,53 @@ export function createTraceContext(traceId = createTraceId()) {
         },
     };
 }
+export const REQUEST_TIMEOUT_MS = 8000;
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'ENOTFOUND',
+    'ENETUNREACH',
+    'EHOSTUNREACH',
+    'EPIPE',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+    'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT',
+]);
+export function isTransientNetworkError(error) {
+    if (error instanceof ServerApiError)
+        return false;
+    if (!error || typeof error !== 'object')
+        return false;
+    const err = error;
+    if (err.name === 'AbortError' || err.name === 'TimeoutError')
+        return true;
+    const code = err.code ?? err.cause?.code;
+    if (code) {
+        return TRANSIENT_NETWORK_CODES.has(code);
+    }
+    if (error instanceof TypeError && /fetch failed/i.test(err.message ?? '')) {
+        return true;
+    }
+    return false;
+}
+export async function retryTransient(run, { retries = 2, baseDelayMs = 400 } = {}) {
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await run();
+        }
+        catch (error) {
+            if (attempt >= retries || !isTransientNetworkError(error))
+                throw error;
+            const delayMs = baseDelayMs * 2 ** attempt;
+            attempt += 1;
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+    }
+}
 export function normalizeServerUrl(serverUrl) {
     const normalized = String(serverUrl || DEFAULT_SERVER_URL)
         .trim()
@@ -53,7 +100,7 @@ export async function readErrorResponse(response, traceId = response.headers.get
     const data = await readJsonResponse(response);
     return new ServerApiError(failureMessage(data, response.status), response.status, traceId);
 }
-export async function authorizedJson({ config, path, method = 'GET', body = null, headers = {}, fetchImpl = globalThis.fetch, }) {
+export async function authorizedJson({ config, path, method = 'GET', body = null, headers = {}, fetchImpl = globalThis.fetch, timeoutMs = REQUEST_TIMEOUT_MS, }) {
     const trace = createTraceContext();
     const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}${path}`, {
         method,
@@ -64,6 +111,7 @@ export async function authorizedJson({ config, path, method = 'GET', body = null
             ...(body === null ? {} : { 'content-type': 'application/json' }),
         },
         body: body === null ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(timeoutMs),
     });
     const data = await readJsonResponse(response);
     if (!response.ok) {

package/dist/src/api/models.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { getClientStateDir } from '../client-state.js';
-import { ServerApiError, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, } from './http.js';
+import { REQUEST_TIMEOUT_MS, ServerApiError, createTraceContext, failureMessage, normalizeServerUrl, readJsonResponse, retryTransient, } from './http.js';
 function sanitizeModelInfo(raw) {
     if (!raw || typeof raw !== 'object') {
         return null;
@@ -45,6 +45,11 @@ export function readCachedServerModels(env = process.env) {
         return null;
     }
 }
+export function selectCacheForServer(cached, serverUrl) {
+    if (!cached)
+        return null;
+    return cached.serverUrl === normalizeServerUrl(serverUrl) ? cached : null;
+}
 export function writeCachedServerModels(cache, env = process.env) {
     const filePath = getModelsCachePath(env);
     mkdirSync(path.dirname(filePath), { recursive: true, mode: 0o700 });
@@ -54,26 +59,27 @@ export function writeCachedServerModels(cache, env = process.env) {
     });
 }
 export async function fetchServerModels({ config, fetchImpl = globalThis.fetch, }) {
-    const trace = createTraceContext();
-    const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/models`, {
-        headers: {
-            authorization: `Bearer ${config.token}`,
-            ...trace.headers,
-        },
+    return retryTransient(async () => {
+        const trace = createTraceContext();
+        const response = await fetchImpl(`${normalizeServerUrl(config.serverUrl)}/v1/models`, {
+            headers: {
+                authorization: `Bearer ${config.token}`,
+                ...trace.headers,
+            },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        const data = (await readJsonResponse(response));
+        if (!response.ok) {
+            throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId);
+        }
+        const models = Array.isArray(data?.models)
+            ? data.models.map(sanitizeModelInfo).filter(Boolean)
+            : [];
+        if (models.length === 0) {
+            throw new Error('Server returned an invalid model list.');
+        }
+        return { models };
     });
-    const data = (await readJsonResponse(response));
-    if (!response.ok) {
-        throw new ServerApiError(failureMessage(data, response.status), response.status, trace.traceId);
-    }
-    const models = Array.isArray(data?.models)
-        ? data.models.map(sanitizeModelInfo).filter(Boolean)
-        : [];
-    if (models.length === 0) {
-        throw new Error('Server returned an invalid model list.');
-    }
-    return {
-        models,
-    };
 }
 export function selectServerModel({ requestedModelId, cached, serverModels, }) {
     const supportedIds = new Set(serverModels.models.map((model) => model.id));

package/dist/src/artifact-policy.js

@@ -148,10 +148,6 @@ export const ARTIFACT_FALLBACK_IGNORE_GLOBS = [
     '**/pnpm-lock.yaml',
     ...ARTIFACT_IGNORE_PATH_PREFIXES.map((prefix) => `${prefix}/**`),
 ];
-// Kept in lockstep with the server's secret-path check: the client repair guard
-// and the server-side secret check must agree on what counts as a secret, or a
-// quoted/curly secret path the client repairs (e.g. service-account.json) slips
-// past the server check, which keys off the original tool-call args.
 const SENSITIVE_BASENAME_PATTERNS = [
     /^\.env(?:\..+)?$/i,
     /^\.?npmrc$/i,

package/dist/src/cli-args.js

@@ -39,11 +39,6 @@ export function parseArgs(argv) {
             usage = true;
             continue;
         }
-        // An unrecognized dashed token is a mistyped flag, not prompt text. Without
-        // an auth subcommand (whose flags are parsed separately) it would otherwise
-        // be swept into the prompt and silently start a billable session. Flag the
-        // first one so the caller can fail fast instead. Quoted prompts are a single
-        // argv entry with spaces, so they never look like a bare option here.
         if (command === null && unknownOption === null && /^-/.test(arg)) {
             unknownOption = arg;
             continue;

package/dist/src/client-environment.js

@@ -1,6 +1,7 @@
 import { accessSync, constants, readFileSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { ensureSessionScratchDir } from './scratch-dir.js';
 const PACKAGE_MANAGER_CANDIDATES = [
     'apt',
     'apt-get',
@@ -123,5 +124,6 @@ export function collectClientEnvironment(options = {}) {
         shell: detectShell(platform, env),
         ...linuxDistro,
         packageManagers: detectPackageManagers(env, platform, executableExists),
+        scratchDir: options.scratchDir ?? ensureSessionScratchDir(),
     };
 }

package/dist/src/colors.js

@@ -1,10 +1,4 @@
-// Dependency-free ANSI styler with a chalk-compatible surface, imported as
-// `chalk` at call sites. Color gating (NO_COLOR / FORCE_COLOR / non-TTY) lives
-// in colorEnabled() below.
 const STYLE_NAMES = ['bold', 'dim', 'red', 'green', 'yellow', 'cyan'];
-// SGR open/close codes. Bold and dim share the 22 reset; colors share 39, so a
-// nested inner style restores exactly its own attribute without clearing the
-// outer one.
 const OPEN = {
     bold: '\x1b[1m',
     dim: '\x1b[2m',
@@ -33,8 +27,6 @@ function colorEnabled() {
 function applyStyle(name, text) {
     const open = OPEN[name];
     const close = CLOSE[name];
-    // Re-open this style after any inner close of the same code, so a nested
-    // style (e.g. chalk.red(`a ${chalk.bold('b')} c`)) doesn't terminate it early.
     const body = text.includes(close) ? text.split(close).join(close + open) : text;
     return open + body + close;
 }
@@ -43,7 +35,6 @@ function createStyler(styles) {
         const value = String(text);
         if (!colorEnabled() || styles.length === 0)
             return value;
-        // Apply right-to-left so the first style in the chain is outermost.
         return styles.reduceRight((acc, name) => applyStyle(name, acc), value);
     });
     for (const name of STYLE_NAMES) {

package/dist/src/core/image-path-extractor.js

@@ -1,36 +1,64 @@
-import { existsSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { loadImageFromFile } from './clipboard.js';
 const EXT = '(?:png|jpe?g|gif|webp)';
-// Bare-path characters: exclude whitespace, quotes, prose terminators, ':' (so we
-// don't swallow URL schemes or trailing "see foo.png:" prose) and bracket/brace/paren
-// delimiters on both sides (so markdown "![alt](x.png)" / "(x.png)" don't leak in).
 const BARE_CHAR = "[^\\s\"'<>,:;!?()\\[\\]{}]";
-// A bare token may carry backslash-escaped spaces (terminal drag-and-drop) and an
-// optional Windows drive prefix ("C:\\" or "C:/").
 const BARE_PATH = `(?:[A-Za-z]:[\\\\/])?(?:\\\\ |${BARE_CHAR})+\\.${EXT}`;
 const IMAGE_PATH_PATTERN = new RegExp(`"([^"]*\\.${EXT})"` +
     `|'([^']*\\.${EXT})'` +
     `|file://(\\S*\\.${EXT})` +
     `|(${BARE_PATH})`, 'gi');
+const EXTENSION_TOKEN = new RegExp(`^(?:[A-Za-z]:[\\\\/])?(?:\\\\ |${BARE_CHAR})+$`);
+const MAX_EXTENSION_TOKENS = 8;
+function isFile(p) {
+    try {
+        return statSync(p, { throwIfNoEntry: false })?.isFile() ?? false;
+    }
+    catch {
+        return false;
+    }
+}
+function extendBareMatchAcrossSpaces(input, matchStart, raw, cwd) {
+    const baseInner = raw.replace(/\\ /g, ' ');
+    const baseExists = isFile(path.isAbsolute(baseInner) ? baseInner : path.resolve(cwd, baseInner));
+    let best = null;
+    let candidate = raw;
+    let start = matchStart;
+    let addedSeparator = false;
+    for (let hops = 0; hops < MAX_EXTENSION_TOKENS; hops++) {
+        if (start < 2 || input[start - 1] !== ' ' || /\s/.test(input[start - 2]))
+            break;
+        let i = start - 2;
+        while (i >= 0 && !/\s/.test(input[i]))
+            i--;
+        const tokenStart = i + 1;
+        const token = input.slice(tokenStart, start - 1);
+        if (!EXTENSION_TOKEN.test(token))
+            break;
+        candidate = `${token} ${candidate}`;
+        start = tokenStart;
+        addedSeparator = addedSeparator || /[\\/]/.test(token);
+        if (baseExists && !addedSeparator)
+            continue;
+        const inner = candidate.replace(/\\ /g, ' ');
+        const resolved = path.isAbsolute(inner) ? inner : path.resolve(cwd, inner);
+        if (isFile(resolved))
+            best = candidate;
+    }
+    return best ?? raw;
+}
 function detectImagePaths(input, cwd) {
     const regex = new RegExp(IMAGE_PATH_PATTERN.source, IMAGE_PATH_PATTERN.flags);
-    const rawsByPath = new Map();
+    const detected = [];
     let match;
     while ((match = regex.exec(input)) !== null) {
-        const raw = match[0];
-        // A bare match containing "://" is a URL scheme remnant (e.g. the "p://" tail
-        // of "http://…" caught by the drive-letter prefix), never a local file path.
-        // Scope this to the bare branch only — a quoted value may legitimately be a
-        // file:// URL, which the quoted branch below decodes.
+        let raw = match[0];
         if (match[4] != null && raw.includes('://'))
             continue;
         let inner;
         if (match[1] != null || match[2] != null) {
             const quoted = (match[1] ?? match[2]);
-            // A quoted value can itself be a file:// URL ("file:///a/b%20c.png"); it
-            // still needs percent-decoding, so route it through the same decoder.
             if (/^file:\/\//i.test(quoted)) {
                 try {
                     inner = fileURLToPath(quoted);
@@ -44,9 +72,6 @@ function detectImagePaths(input, cwd) {
             }
         }
         else if (match[3] != null) {
-            // file:// URL: decode percent-escapes (e.g. "%20") to the real filesystem
-            // path. A malformed URL (bad %-escape) must be skipped, never thrown:
-            // ordinary prose containing a broken file:// URL should not abort the turn.
             try {
                 inner = fileURLToPath(raw);
             }
@@ -60,10 +85,21 @@ function detectImagePaths(input, cwd) {
             }
         }
         else {
-            // Bare path: unescape "\\ " sequences produced by terminal drag-and-drop.
-            inner = match[4].replace(/\\ /g, ' ');
+            raw = extendBareMatchAcrossSpaces(input, match.index, raw, cwd);
+            inner = raw.replace(/\\ /g, ' ');
         }
         const resolvedPath = path.isAbsolute(inner) ? inner : path.resolve(cwd, inner);
+        const start = match.index - (raw.length - match[0].length);
+        while (detected.length > 0) {
+            const prev = detected[detected.length - 1];
+            if (prev.start + prev.raw.length <= start)
+                break;
+            detected.pop();
+        }
+        detected.push({ resolvedPath, raw, start });
+    }
+    const rawsByPath = new Map();
+    for (const { resolvedPath, raw } of detected) {
         const existing = rawsByPath.get(resolvedPath);
         if (existing) {
             existing.push(raw);
@@ -80,10 +116,6 @@ export function autoAttachImages(input, cwd, existing = []) {
     let sanitizedInput = input;
     const attachments = [];
     const errors = [];
-    // Seed new markers after the highest existing index, not the existing count.
-    // The TUI can submit a sparse attachment set (e.g. [Image #2] kept after
-    // [Image #1] was deleted from the prompt), so counting would reuse an index
-    // still present in the prompt and make the model inspect the wrong image.
     const maxExistingIndex = existing.reduce((highest, a) => Math.max(highest, a.index ?? 0), 0);
     for (const [resolvedPath, rawForms] of rawsByPath) {
         if (existing.length + attachments.length >= max)

package/dist/src/executor.js

@@ -6,12 +6,9 @@ import os from 'os';
 import path from 'path';
 import { ARTIFACT_INSPECT_BLOCK_DIRS, getBlockedArtifactInspectDir, relativeProjectPath, } from './artifact-policy.js';
 import { emitCommandOutput, isTuiMode } from './runtime-mode.js';
+import { ensureSessionScratchDir, isInsideTheGitAiScratch, sessionScratchDir, } from './scratch-dir.js';
 const requireFromHere = createRequire(import.meta.url);
 let nodePtyCache;
-// @lydell/node-pty ships its native binding as platform-specific optional
-// packages. If none is installed for this OS/arch the require throws; we cache
-// the failure and fall back to the non-interactive child_process path. A pty is
-// only needed to answer interactive sudo prompts.
 function loadNodePty() {
     if (nodePtyCache !== undefined)
         return nodePtyCache;
@@ -221,6 +218,7 @@ function isExistingDirectory(absPath) {
         return false;
     }
 }
+const OS_TEMP_BLOCK_MARKER = 'os-temp:';
 function getBlockedOsTempInspection(rawToken, rootDir) {
     const token = normalizeToken(rawToken);
     if (!token || !path.isAbsolute(token))
@@ -228,6 +226,8 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     const resolved = path.resolve(token);
     if (!isInsideOsTemp(resolved))
         return null;
+    if (isInsideTheGitAiScratch(resolved))
+        return null;
     if (rootDir) {
         const resolvedRoot = path.resolve(rootDir);
         if (resolved === resolvedRoot ||
@@ -238,7 +238,7 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     if (resolved === path.resolve(os.tmpdir()) ||
         hasPathGlob(token) ||
         isExistingDirectory(resolved)) {
-        return path.basename(os.tmpdir()) || os.tmpdir();
+        return `${OS_TEMP_BLOCK_MARKER}${path.basename(os.tmpdir()) || os.tmpdir()}`;
     }
     return null;
 }
@@ -254,6 +254,9 @@ function findBlockedDirForToken(rawToken, rootDir, baseDir, allowBareDirMatch =
         const resolved = path.isAbsolute(token)
             ? path.resolve(token)
             : path.resolve(baseDir ?? rootDir, token);
+        const osTempResolved = getBlockedOsTempInspection(resolved, rootDir);
+        if (osTempResolved)
+            return osTempResolved;
         return getBlockedProjectPathDir(resolved, rootDir);
     }
     if (!allowBareDirMatch || !BLOCKED_PATH_INSPECT_DIRS.has(token)) {
@@ -390,11 +393,16 @@ function findBlockedDirInCommandTokens(command, rootDir, baseDir) {
     }
     return null;
 }
+function expandTempEnvRefs(command) {
+    return command
+        .replace(/\$\{THEGITAI_SCRATCH_DIR[^}]*\}|\$THEGITAI_SCRATCH_DIR\b/g, sessionScratchDir())
+        .replace(/\$\{TMPDIR[^}]*\}|\$TMPDIR\b/g, process.env.TMPDIR || os.tmpdir());
+}
 function findIgnoredPathInspection(command, rootDir) {
     if (!FILE_INSPECTION_COMMAND_PATTERN.test(command)) {
         return null;
     }
-    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(command));
+    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(expandTempEnvRefs(command)));
     const baseDir = getCommandBaseDir(haystack, rootDir);
     const blockedDir = findBlockedDirInCommandTokens(haystack, rootDir, baseDir);
     if (blockedDir) {
@@ -554,10 +562,17 @@ function terminateChild(child, signal) {
     }
 }
 export function getBlockedPathInspectDir(command, rootDir) {
-    return findIgnoredPathInspection(command, rootDir);
+    const blocked = findIgnoredPathInspection(command, rootDir);
+    return blocked?.startsWith(OS_TEMP_BLOCK_MARKER)
+        ? blocked.slice(OS_TEMP_BLOCK_MARKER.length)
+        : blocked;
 }
 export function getBlockedCommandReason(command, hasTimeout, rootDir) {
     const ignoredDir = findIgnoredPathInspection(command, rootDir);
+    if (ignoredDir?.startsWith(OS_TEMP_BLOCK_MARKER)) {
+        const tempName = ignoredDir.slice(OS_TEMP_BLOCK_MARKER.length);
+        return `Listing or scanning the shared OS temp directory (${tempName}) is blocked because it can contain other users' and processes' files. Use the session scratch directory ${ensureSessionScratchDir()} for temporary scripts and files — creating, running, and listing are all allowed there — or reference an exact file path.`;
+    }
     if (ignoredDir) {
         return `Command inspects an off-limits generated or dependency directory (${ignoredDir}). Avoid that path.`;
     }
@@ -619,6 +634,7 @@ function buildCommandEnv(cwd) {
         npm_config_fund: 'false',
         npm_config_audit: 'false',
         NUXI_INIT_SKIP_PROMPT: 'true',
+        THEGITAI_SCRATCH_DIR: ensureSessionScratchDir(),
     };
 }
 function sanitizePtyOutput(command, output, cwd, secrets) {
@@ -797,9 +813,6 @@ export async function runCommand(command, cwd, { requestSudoPassword, timeout, }
         if (nodePty) {
             return runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword, nodePty);
         }
-        // No pty binding installed for this platform — fall through to the
-        // non-interactive spawn path. The command still runs; an interactive sudo
-        // prompt simply can't be answered here.
     }
     return new Promise((resolve) => {
         let stdout = '';

package/dist/src/help-text.js

@@ -1,9 +1,5 @@
 import chalk from './colors.js';
 import { getCliVersion, getPlatformTag } from './version.js';
-// The bound keys (Enter/Esc/Ctrl+C/Tab/arrows) are identical across platforms in
-// a terminal. The one thing that genuinely differs is the terminal's paste
-// shortcut, so surface the one for the host OS (right-click paste works
-// everywhere regardless).
 function pasteShortcutForPlatform() {
     switch (process.platform) {
         case 'darwin':
@@ -104,7 +100,6 @@ const HELP_MARKDOWN = [
     '  message — there is no client-side debug mode by design.',
 ].join('\n');
 export function formatAboutCard() {
-    // Fenced so the column alignment survives terminal markdown rendering.
     return [
         '```',
         'TheGitAI',

package/dist/src/patcher.js

@@ -162,7 +162,6 @@ export function writeProjectFile(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
     mkdirSync(path.dirname(absPath), { recursive: true });
@@ -179,7 +178,6 @@ export function writeProjectFileBuffer(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
     mkdirSync(path.dirname(absPath), { recursive: true });

package/dist/src/scanner.js

@@ -42,12 +42,6 @@ function isFallbackIgnoredFile(relPath, fileName) {
         return true;
     return FALLBACK_LOCKFILES.has(fileName);
 }
-// Local stand-in for the previous glob('**/*', { nodir: true, dot: false,
-// ignore: FALLBACK_IGNORE }) call, used only when `git ls-files` fails (e.g. a
-// non-git directory). Walks the tree depth-first, skips dotfiles and
-// dot-directories (glob's dot: false), prunes ignored artifact dirs, and drops
-// lockfiles plus sensitive/ignored paths — reproducing the old fallback without
-// the glob dependency.
 function walkProjectFilesFallback(rootDir, limit) {
     const results = [];
     const visit = (relDir) => {
@@ -70,9 +64,6 @@ function walkProjectFilesFallback(rootDir, limit) {
                 continue;
             const relPath = relDir ? `${relDir}/${name}` : name;
             if (entry.isDirectory()) {
-                // Only the prefix-based artifact rule is safe to prune a directory by;
-                // the sensitive-basename check must stay at the file level so a dir
-                // merely named e.g. `secret` doesn't hide non-sensitive files under it.
                 if (ALWAYS_IGNORE_DIRS.has(name) || shouldIgnoreArtifactPath(relPath)) {
                     continue;
                 }

package/dist/src/scratch-dir.js

@@ -0,0 +1,57 @@
+import { chmodSync, lstatSync, mkdirSync, mkdtempSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+let cachedScratchDir = null;
+export function sessionScratchDir() {
+    if (!cachedScratchDir) {
+        cachedScratchDir = path.join(os.tmpdir(), `thegitai-${process.pid}`);
+    }
+    return cachedScratchDir;
+}
+function isSquattedScratchRoot(dir) {
+    try {
+        const st = lstatSync(dir);
+        if (st.isSymbolicLink() || !st.isDirectory())
+            return true;
+        if (process.platform !== 'win32' &&
+            typeof process.getuid === 'function' &&
+            st.uid !== process.getuid()) {
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+export function ensureSessionScratchDir() {
+    const dir = sessionScratchDir();
+    try {
+        if (isSquattedScratchRoot(dir)) {
+            cachedScratchDir = mkdtempSync(path.join(os.tmpdir(), 'thegitai-'));
+            return cachedScratchDir;
+        }
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32') {
+            chmodSync(dir, 0o700);
+        }
+    }
+    catch {
+    }
+    return sessionScratchDir();
+}
+export function isInsideTheGitAiScratch(absPath) {
+    const tempRoot = path.resolve(os.tmpdir());
+    const relPath = path.relative(tempRoot, path.resolve(absPath));
+    if (!relPath || relPath.startsWith('..') || path.isAbsolute(relPath)) {
+        return false;
+    }
+    const first = relPath.split(/[\\/]/, 1)[0] ?? '';
+    if (!/^thegitai(?:$|[-.])/i.test(first)) {
+        return false;
+    }
+    if (/[*?[\]{}]/.test(first)) {
+        return false;
+    }
+    return !isSquattedScratchRoot(path.join(tempRoot, first));
+}

package/dist/src/secret-preview.js

@@ -6,11 +6,7 @@ const PRIVATE_KEY_REDACTION = '[REDACTED: private key]';
 const SENSITIVE_JSON_KEY_PATTERN = /^(?:private[_-]?key|secret|api[_-]?key|password|client_secret|refresh_token|access_token|id_token|auth_provider_x509_cert_url)$/i;
 const PEM_BLOCK_PATTERN = /-----BEGIN [^-]*(?:PRIVATE KEY|SECRET KEY|OPENSSH PRIVATE KEY)[\s\S]*?-----END [^-]*(?:PRIVATE KEY|SECRET KEY|OPENSSH PRIVATE KEY)-----/gi;
 const PEM_SECRET_PATH_PATTERN = /\.(?:pem|key)$/i;
-// Password embedded in a connection-string URL, e.g.
-// `postgresql://user:PASS@host`. Redacted from shell output so secrets in
-// commands like `cat .env` do not leak into history or telemetry.
 const URL_CREDENTIALS_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s/@]+)(@)/gi;
-/** Redact only userinfo passwords in connection-string URLs (zero false positives). */
 export function redactConnectionStringCredentials(text) {
     return text.replace(URL_CREDENTIALS_PATTERN, (_match, prefix, _password, at) => `${prefix}${VALUE_REDACTION}${at}`);
 }
@@ -72,12 +68,6 @@ export function isDotenvLikePath(value) {
     const base = path.posix.basename(text.replace(/\\/g, '/'));
     return DOTENV_BASENAME_PATTERN.test(base);
 }
-/**
- * True only for a clean dotenv file we can safely show with keys visible and
- * values tokenized: no PEM block, not JSON, and every non-blank/non-comment line
- * is a `KEY=VALUE` assignment. Anything ambiguous (a stray line that might be a
- * raw secret) returns false so the caller keeps the opaque blackout instead.
- */
 export function looksLikeEditableDotenv(content) {
     PEM_BLOCK_PATTERN.lastIndex = 0;
     if (PEM_BLOCK_PATTERN.test(content))

package/dist/src/session-safety.js

@@ -454,17 +454,6 @@ export function resolveRedactionTokens(state, text, filePath, hash) {
 }
 const DOTENV_ASSIGNMENT_PATTERN = /^(\s*(?:export\s+)?[A-Za-z_][A-Za-z0-9_]*\s*=)(.*)$/;
 const DOTENV_COMMENT_PATTERN = /^(\s*#\s*)(\S.*)$/;
-/**
- * Redact a dotenv file's values while leaving keys visible. Every assignment's
- * value is replaced with a stable, reversible token so the agent can see the
- * file's structure and edit it (remove or replace lines) without ever seeing a
- * secret value; `resolveRedactionTokens` swaps the real values back on write.
- * Comment bodies are tokenized too, because developers routinely leave
- * commented-out credentials in dotenv files and those must not leak where the
- * opaque preview would have hidden them. Callers must confirm the content is
- * clean dotenv (`looksLikeEditableDotenv`) first so the only non-assignment
- * lines reaching here are blanks and comments.
- */
 export function redactDotenvWithStableTokens(state, content, filePath, hash) {
     const tokens = [];
     const redactedLines = content.split('\n').map((line) => {
@@ -490,14 +479,6 @@ export function redactDotenvWithStableTokens(state, content, filePath, hash) {
     });
     return { content: redactedLines.join('\n'), tokens };
 }
-/**
- * The redaction-token registry is capped at `MAX_REDACTION_TOKENS`; a read that
- * emits more tokens than that would evict its own oldest tokens, leaving
- * `[REDACTED:n]` markers in the preview that `write_file`/`str_replace` can no
- * longer resolve (silently writing the literal token back). So a dotenv file
- * with more tokenizable lines than the budget must not use the editable preview
- * — the caller falls back to the opaque blackout instead.
- */
 export function dotenvFitsRedactionBudget(content) {
     let count = 0;
     for (const line of content.split('\n')) {

package/dist/src/session-store.js

@@ -122,7 +122,6 @@ function loadAllSnapshots(rootDir, env = process.env) {
             snapshots.push(loadSnapshotFile(filePath, rootDir));
         }
         catch {
-            // Skip corrupted snapshots silently — customers have no actionable debug path here.
         }
     }
     return snapshots.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));

package/dist/src/tool-executor.js

@@ -46,10 +46,6 @@ function getEditToolFilePath(call) {
     }
     return '';
 }
-// replace_document_text repairs its source filePath but writes a separate
-// outputPath verbatim (a write target must not be fold-matched onto a different
-// existing file). When an outputPath is given, the snapshot path it returns is
-// that raw output, so it must not be repaired.
 function editToolWritesSeparateOutput(call) {
     if (call.name !== 'replace_document_text')
         return false;
@@ -131,13 +127,6 @@ export async function executeLocalToolCall(toolContext, session, call) {
             session.onToolEvent?.({ call, result });
             return result;
         }
-        // Snapshot the real file the edit tool will touch. Tools that repair their
-        // path internally (str_replace/patch_file/replace_document_text) must be
-        // snapshotted against the repaired path, or the pre-edit snapshot targets
-        // the unrepaired path and the edit is journaled as a `create` and undone by
-        // deleting the user's file. write_file/delete_file consume the raw path, so
-        // repairing their snapshot would instead journal a phantom edit of a
-        // different file — keep them on the raw path.
         const rawEditFilePath = isEditToolName(call.name)
             ? getEditToolFilePath(call)
             : '';

package/dist/src/tools/path-suggest.js

@@ -1,9 +1,6 @@
 import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 import { isSensitiveProjectPath, shouldIgnoreArtifactPath, } from '../artifact-policy.js';
-// "File not found" recovery hint: when a model mistypes a filename (most
-// often Unicode punctuation — a straight ' for a curly ’ — or a small typo),
-// suggest the closest real file from the same directory.
 function foldName(name) {
     return name
         .normalize('NFC')
@@ -46,9 +43,6 @@ export function suggestClosestPath(rootDir, missingPath) {
     let best = null;
     let bestDistance = Number.POSITIVE_INFINITY;
     for (const candidate of candidates) {
-        // Never suggest a file the caller would refuse to read/write directly:
-        // probing a near-miss like `.enx` or `credential.docx` must not leak the
-        // existence of `.env`/credentials through the recovery hint.
         const candidateRelative = path.relative(rootDir, path.join(directory, candidate));
         if (isSensitiveProjectPath(candidateRelative))
             continue;
@@ -64,10 +58,6 @@ export function suggestClosestPath(rootDir, missingPath) {
     const relative = path.relative(rootDir, suggested);
     return relative && !relative.startsWith('..') ? relative : suggested;
 }
-// Fold only the punctuation/whitespace a model routinely alters when it echoes
-// a filename — a curly apostrophe ’ flattened to a straight ', smart double
-// quotes, and a non-breaking space — WITHOUT touching case, so a path is only
-// auto-corrected when nothing but this punctuation differs from a real file.
 function foldPunctuation(name) {
     return name
         .normalize('NFC')
@@ -75,9 +65,6 @@ function foldPunctuation(name) {
         .replace(/[“”]/g, '"')
         .replace(/ /g, ' ');
 }
-// Strip ONE matched pair of surrounding quotes. A path pasted from a file
-// manager's "Copy as path" or dragged into a terminal arrives wrapped in
-// '…' / "…", and that wrapping is captured verbatim as part of the filename.
 function stripSurroundingQuotes(p) {
     if (p.length >= 2) {
         const first = p[0];
@@ -88,9 +75,6 @@ function stripSurroundingQuotes(p) {
     }
     return p;
 }
-// A single backslash is a legal filename byte on POSIX, but models routinely
-// double it (it is JSON's escape character) when echoing a name, turning
-// `back\slash.js` into `back\\slash.js`. Collapse doubled backslashes to one.
 function collapseDoubledBackslashes(p) {
     return p.replace(/\\\\/g, '\\');
 }
@@ -105,36 +89,17 @@ function existsAgainst(rootDir, p) {
         return false;
     }
 }
-// Repair must never resolve a protected file (a secret like `.env`/credentials).
-// Repair only runs when the literal path is missing, so without this a quoted or
-// curly-flattened secret path — which used to fail as not-found — would be
-// silently resolved to the real secret, bypassing the redaction that keys off
-// the original tool-call args (e.g. read_document, str_replace, patch_file).
 function isProtectedRepairTarget(rootDir, candidate) {
     const rel = path.relative(rootDir, resolveAgainst(rootDir, candidate));
     const projectPath = rel && !rel.startsWith('..') ? rel : candidate;
     return (isSensitiveProjectPath(projectPath) ||
         (rel !== '' && !rel.startsWith('..') && shouldIgnoreArtifactPath(rel)));
 }
-// Edit tools that call repairFilePath on their path argument internally. The
-// executor repairs the pre-edit snapshot path only for these, so its snapshot
-// targets the same file the tool writes; write_file/delete_file consume the raw
-// path, so their snapshot must too.
 export const PATH_REPAIRING_EDIT_TOOLS = new Set([
     'str_replace',
     'patch_file',
     'replace_document_text',
 ]);
-// Repair a model/user-supplied path to a real on-disk file WITHOUT changing
-// intent, for tools that act on a file expected to already exist. Literal
-// first: any path that already resolves — including one that legitimately
-// contains quotes or backslashes — is returned untouched. Only when the path
-// does not resolve do we try safe de-manglings: strip surrounding quotes,
-// collapse doubled backslashes, and finally match a directory entry that
-// differs only by foldable punctuation (the "model flattened a curly ’ to a
-// straight '" case, which no transform of the input can reproduce). Returns the
-// input unchanged when nothing better exists, so the caller's normal not-found
-// handling (and its recovery hint) still fires.
 export function repairFilePath(rootDir, raw) {
     if (!raw || existsAgainst(rootDir, raw))
         return raw;
@@ -164,12 +129,10 @@ export function repairFilePath(rootDir, raw) {
     }
     const matches = entries.filter((entry) => foldPunctuation(entry) === wanted);
     if (matches.length !== 1)
-        return raw; // none, or ambiguous — never guess
+        return raw;
     const matchedAbs = path.join(directory, matches[0]);
     const matchedRel = path.relative(rootDir, matchedAbs);
     const matched = path.isAbsolute(dequoted) ? matchedAbs : matchedRel || matchedAbs;
-    // Never auto-resolve into a protected file: a fold-match that lands on `.env`
-    // would confirm its existence to the model and bypass redaction.
     if (isProtectedRepairTarget(rootDir, matched))
         return raw;
     return matched;

package/dist/src/tools/read-file.js

@@ -68,10 +68,6 @@ export async function readFile(context, args) {
         }
     }
     const previewPath = projectPath ?? filePath;
-    // A clean dotenv file is shown with keys visible and values tokenized so the
-    // agent can still edit it (str_replace/write_file round-trip the tokens) and
-    // read coverage is recorded. Any other secret file — PEM, JSON credentials,
-    // or a dotenv with a stray non-assignment line — keeps the opaque blackout.
     const editableDotenv = Boolean(projectPath) &&
         Boolean(safety) &&
         isDotenvLikePath(previewPath) &&

package/dist/src/tools/replace-document-text.js

@@ -95,10 +95,6 @@ export async function replaceDocumentText(context, args) {
             failureCategory: 'invalid_argument',
         };
     }
-    // outputPath is a write target, not an existing input, so it must NOT be
-    // path-repaired: fold-match could redirect a "create Review '24.docx" onto an
-    // existing Review ’24.docx and overwrite it. The executor mirrors this by not
-    // repairing the snapshot path when an outputPath is present.
     const outputRaw = String(args.outputPath ?? args.output_path ?? '').trim();
     const targetPath = outputRaw
         ? relativeEditablePath(context.rootDir, outputRaw)
@@ -153,9 +149,6 @@ export async function replaceDocumentText(context, args) {
             failureCategory: serverResult.failureCategory ?? 'external_service',
         };
     }
-    // Validate-only: report per-replacement match info without touching the file.
-    // changed:false marks it non-mutating so the agent loop does not count a
-    // dry-run as an applied edit.
     if (validateOnly) {
         return {
             ok: true,
@@ -166,8 +159,6 @@ export async function replaceDocumentText(context, args) {
             results: serverResult.results,
         };
     }
-    // No replacement matched: nothing was written. Surface per-item reasons so
-    // the model can correct and resend only the failing entries.
     const replacementCount = Number(serverResult.replacementCount ?? 0);
     if (replacementCount === 0) {
         const failures = Array.isArray(serverResult.replacements)
@@ -224,9 +215,6 @@ export async function replaceDocumentText(context, args) {
         failedCount: serverResult.failedCount,
         replacements: serverResult.replacements,
         bytesWritten: nextData.length,
-        // A partial batch still wrote the matched entries (changed:true above), but
-        // the loop must reflect and repair the missed entries — needsRepair forces
-        // that without losing credit for the applied edits.
         ...(failedCount > 0
             ? {
                 needsRepair: true,

package/dist/src/tools/run-command.js

@@ -45,7 +45,7 @@ export async function runShellCommand(context, args) {
                 ok: false,
                 skipped: true,
                 command,
-                error: 'User declined command execution',
+                error: 'User declined command execution. Do not rerun this command or try a broader variant of it; either continue without it or ask the user one specific question about how to proceed.',
             };
         }
     }
@@ -67,8 +67,6 @@ export async function runShellCommand(context, args) {
     if (repoSync.added || repoSync.modified || repoSync.removed) {
         onStatus(`Synced repo state after command (${repoSync.added} added, ${repoSync.modified} modified, ${repoSync.removed} removed).`);
     }
-    // Redact connection-string passwords so shell output (e.g. `cat .env`,
-    // `printenv`) cannot leak them into history or telemetry.
     let output = typeof result.output === 'string'
         ? redactConnectionStringCredentials(result.output)
         : result.output;

package/dist/src/tools/run-node-script.js

@@ -3,6 +3,7 @@ import { execFileSync, spawn } from 'node:child_process';
 import { syncIndexFromDisk } from '../project-index.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { buildDeferredShellDiagnostics, invalidateShellDiagnosticsCache, } from './shell-diagnostics.js';
+import { ensureSessionScratchDir } from '../scratch-dir.js';
 const DEFAULT_TIMEOUT = 5 * 60 * 1000;
 const MAX_OUTPUT_CHARS = 4000;
 const MAX_CAPTURE_CHARS = 1024 * 1024;
@@ -99,6 +100,7 @@ function executeNodeScript(rootDir, script, timeout) {
                 npm_config_progress: 'false',
                 npm_config_fund: 'false',
                 npm_config_audit: 'false',
+                THEGITAI_SCRATCH_DIR: ensureSessionScratchDir(),
             },
             stdio: ['pipe', 'pipe', 'pipe'],
         });

package/dist/src/tree-sitter-runtime.js

@@ -6,12 +6,6 @@ import { addSignatureForNode } from './extractors/index.js';
 import { getRepoMapLanguageForFile, } from './repo-map-languages.js';
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// web-tree-sitter is vendored (see vendor/web-tree-sitter/NOTICE) so the
-// published package has zero runtime dependencies. Resolve the vendored CommonJS
-// runtime relative to this compiled file: dist/src/ -> dist/vendor in the
-// published layout, with the source tree as a dev fallback. The .cjs locates its
-// own web-tree-sitter.wasm next to itself via __dirname, so no locateFile
-// override is needed.
 function resolveVendoredTreeSitter() {
     const candidates = [
         path.resolve(__dirname, '..', 'vendor', 'web-tree-sitter', 'web-tree-sitter.cjs'),

package/dist/src/ui/repl.js

@@ -998,8 +998,6 @@ export function getInputCommandToken(input) {
         return '';
     const firstSpaceIndex = trimmed.indexOf(' ');
     const token = firstSpaceIndex === -1 ? trimmed : trimmed.slice(0, firstSpaceIndex);
-    // A token with a second '/' is a filesystem path (e.g. /home/user/repo),
-    // not a slash command — no command contains a slash, so don't treat it as one.
     if (token.indexOf('/', 1) !== -1)
         return '';
     return token;
@@ -1012,9 +1010,6 @@ function shouldShowCommandPalette(state) {
         !state.resumePickerOpen &&
         trimmed.startsWith('/') &&
         !trimmed.includes(' ') &&
-        // A '/'-prefixed token with a second '/' is a filesystem path, not a
-        // command — getInputCommandToken returns '' for it, so the palette stays
-        // closed when a folder path is pasted.
         getInputCommandToken(trimmed) !== '');
 }
 export function shouldRemountLiveFrameForComposerInputChange(current, nextInput) {
@@ -1405,9 +1400,6 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
             activeTurnAbort?.abort();
             activeTurnAbort = null;
             cancelActiveCommand();
-            // Ctrl+C with a queued message: recall it into the composer for editing
-            // rather than auto-submitting it against the cancelled turn. (Esc with a
-            // queued message clears the slot in shell-input without cancelling.)
             const queued = store.getState().queuedMessage;
             const cancelledEntries = [
                 ...takePendingTurnEntries(),
@@ -1811,8 +1803,6 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
             if (!queued || store.getState().busy || exiting) {
                 return;
             }
-            // Rehydrate attachments/chunks before submit: handleSubmit expands
-            // pastedChunks from the store and the turn picks up imageAttachments.
             store.update((current) => ({
                 ...current,
                 imageAttachments: queued.imageAttachments,
@@ -1839,9 +1829,6 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
                     });
                     return;
                 }
-                // Snapshot the raw (placeholder) body plus chunks/images so recall and
-                // flush round-trip the collapsed paste + attachments. Hold at most one;
-                // a second enqueue replaces the slot.
                 const pending = store.getState();
                 const snapshot = {
                     body: String(rawInput ?? ''),
@@ -2094,8 +2081,6 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
                     appendError(error.message);
                 }
                 await remountTui();
-                // A cancelled turn never auto-submits the queue (Ctrl+C recalls it via
-                // cancelActiveTurn); only a genuine error flushes a pending message.
                 if (!cancelled && turnGeneration === activeTurnGeneration) {
                     await flushQueuedMessage();
                 }

package/dist/src/ui/tui/bridge.js

@@ -91,14 +91,11 @@ function normalizeChildMessage(raw) {
 export function resolveTuiBinaryPath() {
     const binaryName = process.platform === 'win32' ? 'thegitai-tui.exe' : 'thegitai-tui';
     const platformPackage = `@thegitai/tui-${process.platform}-${process.arch}`;
-    // 1) Published per-platform optional dependency (the installed-from-npm path).
     try {
         return requireFromHere.resolve(`${platformPackage}/${binaryName}`);
     }
     catch {
-        // Not installed (unsupported platform yet, or local dev) — fall through.
     }
-    // 2) Local dev build: `npm run build:tui` populates the workspace bin/.
     const moduleDir = path.dirname(fileURLToPath(import.meta.url));
     const devCandidates = [
         path.join(moduleDir, '../../../bin', binaryName),
@@ -137,7 +134,6 @@ export function createRatatuiBridge() {
             }
         }
         catch {
-            // ignore malformed protocol lines
         }
     });
     child.on('exit', () => {

package/dist/src/ui/tui/build-frame.js

@@ -131,9 +131,6 @@ function diffLinePrefix(kind) {
             return ' ';
     }
 }
-// Fit a single diff line to the available terminal width with a clean ellipsis.
-// Unlike the general-purpose truncate(), this never appends a word like
-// "(truncated)" — that wording belongs on tool output, not on-screen diff rows.
 function fitDiffLine(content, maxWidth) {
     if (maxWidth <= 0)
         return '';
@@ -178,8 +175,6 @@ function getInputCommandToken(input) {
     const trimmed = String(input ?? '').trimStart();
     const match = trimmed.match(/^\/[^\s]*/);
     const token = match?.[0] ?? '';
-    // A token with a second '/' is a filesystem path (e.g. /home/user/repo),
-    // not a slash command — no command contains a slash, so don't treat it as one.
     if (token.indexOf('/', 1) !== -1)
         return '';
     return token;
@@ -689,9 +684,6 @@ export function buildTuiFrame(state, cols, rows, spinnerFrame, elapsedSeconds) {
         sections.push({ kind: 'live', lines: liveLines });
     }
     const overlayActive = Boolean(state.approvalPrompt || state.sudoPrompt);
-    // Composer stays visible while busy unless a blocking overlay is active. When
-    // one message is already queued, the queued chip is shown here in place of the
-    // input box (only one message is ever held) so there is no empty prompt.
     if (!state.resumePickerOpen && !state.modelPickerOpen && !overlayActive) {
         const composerLines = [];
         if (state.queuedMessage) {

package/dist/src/ui/tui/shell-input.js

@@ -275,8 +275,6 @@ export function handleShellKeyEvent(store, handlers, event) {
     }
     if (key.escape) {
         if (state.busy) {
-            // With a queued message, Esc clears the queue only (turn keeps running).
-            // With nothing queued, Esc cancels the turn (Ctrl+C also cancels).
             if (state.queuedMessage) {
                 handlers.onLiveFrameShapeChange();
                 store.update((current) => ({ ...current, queuedMessage: null }));
@@ -317,8 +315,6 @@ export function handleShellKeyEvent(store, handlers, event) {
         return;
     }
     if (key.upArrow) {
-        // While busy with an empty composer, Up recalls and dequeues the queued
-        // message for editing; otherwise it walks prompt history as usual.
         if (state.busy && state.input.trim() === '' && state.queuedMessage) {
             handlers.onLiveFrameShapeChange();
             store.update((current) => {

package/dist/src/version.js

@@ -3,11 +3,6 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const PACKAGE_NAME = '@thegitai/cli';
 const UNKNOWN_VERSION = '0.0.0';
-// Resolve the package version at runtime by walking up from this module to the
-// nearest package.json named @thegitai/cli. This works in both layouts: the
-// compiled binary (dist/bin/ai.js → ../../package.json) and the source tree run
-// under tsx in tests (src/version.ts → ../package.json). The name guard avoids
-// picking up an unrelated manifest if the file is ever nested elsewhere.
 export function getCliVersion() {
     let dir = path.dirname(fileURLToPath(import.meta.url));
     for (let depth = 0; depth < 6; depth++) {
@@ -18,7 +13,6 @@ export function getCliVersion() {
             }
         }
         catch {
-            // No package.json at this level (or unreadable); keep walking up.
         }
         const parent = path.dirname(dir);
         if (parent === dir)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thegitai/cli",
-  "version": "1.0.0-beta.14",
+  "version": "1.0.0-beta.16",
   "description": "TheGitAI CLI client (source-visible, proprietary)",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://thegit.ai",
@@ -25,10 +25,10 @@
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
-    "@thegitai/tui-darwin-arm64": "1.0.0-beta.14",
-    "@thegitai/tui-darwin-x64": "1.0.0-beta.14",
-    "@thegitai/tui-linux-x64": "1.0.0-beta.14",
-    "@thegitai/tui-win32-x64": "1.0.0-beta.14",
+    "@thegitai/tui-darwin-arm64": "1.0.0-beta.16",
+    "@thegitai/tui-darwin-x64": "1.0.0-beta.16",
+    "@thegitai/tui-linux-x64": "1.0.0-beta.16",
+    "@thegitai/tui-win32-x64": "1.0.0-beta.16",
     "@vscode/ripgrep": "1.18.0"
   },
   "publishConfig": {