aegis-desktop 0.8.14 → 0.8.16

package/lib/local/local.js

@@ -58,6 +58,45 @@ function baseOf(baseURL) {
   return String(baseURL || DEFAULT_BASE).replace(/\/+$/, '');
 }
 
+/**
+ * DeepSeek's chat template (also the one a locally-pulled `deepseek-*` Ollama
+ * model uses) wraps tool calls and turn boundaries in special tokens —
+ * fullwidth pipe (U+FF5C) delimiting an identifier that uses ▁ (U+2581) as its
+ * word separator, e.g. ｜tool▁calls▁begin｜, ｜tool▁call▁end｜, ｜Assistant｜,
+ * ｜begin▁of▁sentence｜. These are chat-template internals, never user-facing
+ * text; when the local daemon's tool-call path leaks them into `delta.content`
+ * they used to reach the screen verbatim — reported as the pasted
+ * "｜｜DSML｜｜" envelope. Returns a per-turn stripper closure with a short
+ * lookback buffer so a token split across two SSE chunks isn't half-rendered
+ * before its closing pipe arrives.
+ */
+const DEEPSEEK_ENVELOPE_RE = /｜[A-Za-z][A-Za-z0-9]*(?:▁[A-Za-z0-9]+)*｜/g;
+function makeDeepSeekEnvelopeStripper() {
+  let buf = '';
+  const strip = (chunk) => {
+    buf += chunk;
+    buf = buf.replace(DEEPSEEK_ENVELOPE_RE, '');
+    const openIdx = buf.lastIndexOf('｜');
+    if (openIdx !== -1) {
+      const tail = buf.slice(openIdx);
+      if (tail.length <= 60 && /^｜[A-Za-z0-9▁]*$/.test(tail)) {
+        const out = buf.slice(0, openIdx);
+        buf = tail;
+        return out;
+      }
+    }
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  strip.flush = () => {
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  return strip;
+}
+
 /**
  * Whether a base URL addresses hardware on this machine (or on this private
  * network) — the gate that decides whether the free lane exists at all.
@@ -369,6 +408,7 @@ async function chat({
   let usage = null;
   const toolCalls = [];
   const byIndex = new Map();
+  const stripEnvelope = makeDeepSeekEnvelopeStripper();
 
   await readSSE(
     res,
@@ -378,8 +418,11 @@ async function chat({
       if (!choice) return;
       const delta = choice.delta || {};
       if (typeof delta.content === 'string' && delta.content) {
-        content += delta.content;
-        if (typeof onDelta === 'function') onDelta({ text: delta.content });
+        const clean = stripEnvelope(delta.content);
+        if (clean) {
+          content += clean;
+          if (typeof onDelta === 'function') onDelta({ text: clean });
+        }
       }
       const frags = delta.tool_calls || [];
       for (const f of frags) {
@@ -399,6 +442,15 @@ async function chat({
     { idleTimeoutMs: SSE_IDLE_TIMEOUT_MS }
   );
 
+  // A trailing '｜…' that never closed (stream ended right after it, or it
+  // was real prose all along) is real content, not an unfinished envelope
+  // token — release it rather than dropping it silently.
+  const strayTail = stripEnvelope.flush();
+  if (strayTail) {
+    content += strayTail;
+    if (typeof onDelta === 'function') onDelta({ text: strayTail });
+  }
+
   for (const [i, acc] of [...byIndex.entries()].sort((a, b) => a[0] - b[0])) {
     if (!acc.function.name && !acc.function.arguments) continue;
     // Ollama does not always mint an id; the engine's tool loop keys results

package/main.js

@@ -682,11 +682,28 @@ function providerRouteConfigured(engine) {
  * import to stay unit-testable.
  */
 function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConfigured, avatar) {
-  // One service for the window's lifetime, bound to the app's data dir. It is
-  // created lazily inside its handlers rather than here, so a broken shared
-  // module surfaces as an error in the fingerprint panel instead of preventing
-  // the window from opening at all.
-  const fingerprint = createFingerprintService({ dir });
+  // One service for the window's lifetime, bound to the app's data dir — but
+  // created LAZILY, which is what the comment here always claimed and what the
+  // code did not do. `createFingerprintService({ dir })` throws on a missing
+  // dir, and a test or a call site that has no userData yet (every
+  // `createIpcDispatch(client)` in `test/desktop-shell.mjs`, and any bootstrap
+  // where `resolveUserDataDir` came back empty) died at construction — taking
+  // the whole dispatch surface with it, not just the fingerprint panel. The
+  // proxy defers construction to the first fingerprint call, so a broken shared
+  // module surfaces as an error in that panel instead of preventing the window
+  // from opening at all, exactly as documented below.
+  let fingerprintService = null;
+  const fingerprint = new Proxy({}, {
+    get(_target, prop) {
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      const value = fingerprintService[prop];
+      return typeof value === 'function' ? value.bind(fingerprintService) : value;
+    },
+    has(_target, prop) {
+      if (!fingerprintService) fingerprintService = createFingerprintService({ dir });
+      return prop in fingerprintService;
+    },
+  });
   // `providerConfigured` is an injected thunk (bootstrap() passes one that reads
   // the settings store) so this module keeps its no-Electron, unit-testable
   // shape; absent in tests and older call sites, where it reads as "no".
@@ -716,14 +733,29 @@ function createIpcDispatch(aegis, dir, persistApiKey, openExternal, providerConf
     // In-app API key entry (plan rebuild): replace the live client key and
     // persist it encrypted at rest via the settings store. The renderer only
     // ever sees the masked preview back — never the raw key.
+    // Resolves `{ ok, ... }` / `{ ok: false, error }` rather than throwing —
+    // same reasoning as the fingerprint handlers below: an IPC rejection
+    // reaches the renderer as an opaque "Error invoking remote method" with
+    // the real cause buried in main-process logs, and key entry is the one
+    // flow every user hits on first run.
     setApiKey: (payload) => {
-      const key = payload && payload.key;
-      aegis.setApiKey(key || '');
-      if (persistApiKey) persistApiKey(aegis.apiKey);
-      return { keyConfigured: Boolean(aegis.apiKey), keyMask: maskKey(aegis.apiKey) };
+      try {
+        const key = payload && payload.key;
+        aegis.setApiKey(key || '');
+        if (persistApiKey) persistApiKey(aegis.apiKey);
+        return { ok: true, keyConfigured: Boolean(aegis.apiKey), keyMask: maskKey(aegis.apiKey) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
     },
 
-    verifyApiKey: () => aegis.verifyApiKey(),
+    verifyApiKey: async () => {
+      try {
+        return { ok: true, ...(await aegis.verifyApiKey()) };
+      } catch (e) {
+        return { ok: false, error: (e && e.message) || String(e) };
+      }
+    },
     tokenBankBalance: () => aegis.tokenBankBalance(),
 
     // Billing (plan upgrade + token-bank top-up). aegis1 creates a Stripe

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegis-desktop",
   "productName": "AEGIS Desktop",
-  "version": "0.8.14",
+  "version": "0.8.16",
   "description": "Thin Electron host for AEGIS — a local chat UI over the shared client/aegis.js transport. Ships transport + UI only; engine logic stays server-side.",
   "author": {
     "name": "AEGIS Code",

package/renderer/app.js

@@ -664,6 +664,21 @@ function rafPainter(paint) {
   return transcript ? transcript.paint(paint) : paint;
 }
 
+/**
+ * What the last stop attempt actually achieved.
+ *
+ * `models.cancel()` travels over IPC and can be REFUSED — the engine has no
+ * AbortController for that session id (`{ ok: false }`), the channel is not
+ * registered (the promise rejects), or the call throws. The old code wrapped
+ * this in a bare `catch` and ignored the returned promise, so every one of
+ * those became silence: the button said "stopping…", the turn kept streaming,
+ * and the only visible evidence was a salvage bubble that never appeared —
+ * which reads as a salvage bug several layers away from the real one. Recorded
+ * here so the smoke run can fail on it, and the rejection is handled so it
+ * cannot vanish into an unhandled-rejection warning nobody reads.
+ */
+let lastStopOutcome = null;
+
 /**
  * Stop the turn running right now. The transport already honours the abort all
  * the way down (engine.cancel -> AbortController -> the cloud client's fetch),
@@ -682,10 +697,43 @@ function stopPendingTurn() {
   // could be left `true` by an earlier turn and make an unrelated transport
   // failure look like a stop the user asked for.
   stoppedTurn = runningTurn;
+  const stopSessionId = pendingSessionId;
+  lastStopOutcome = { sessionId: stopSessionId, at: Date.now(), state: 'requested' };
   try {
-    models.cancel(pendingSessionId);
-  } catch {
-    /* a dead controller is not an error */
+    const pending = models.cancel(stopSessionId);
+    if (pending && typeof pending.then === 'function') {
+      pending.then(
+        (r) => {
+          lastStopOutcome = {
+            sessionId: stopSessionId,
+            at: Date.now(),
+            state: 'settled',
+            // The engine reports `{ ok: Boolean(controller) }` — a false here
+            // means it had nothing to abort, i.e. the stop was refused. Not an
+            // error, but never a success either.
+            accepted: !r || r.ok !== false,
+            result: r === undefined ? null : r,
+          };
+        },
+        (e) => {
+          lastStopOutcome = {
+            sessionId: stopSessionId,
+            at: Date.now(),
+            state: 'rejected',
+            accepted: false,
+            error: (e && e.message) || String(e),
+          };
+        }
+      );
+    }
+  } catch (e) {
+    lastStopOutcome = {
+      sessionId: stopSessionId,
+      at: Date.now(),
+      state: 'threw',
+      accepted: false,
+      error: (e && e.message) || String(e),
+    };
   }
   // The abort is not instantaneous. Marking the button is all the feedback that
   // survives the trip: `setBusy(false)` deletes the entire pending bubble on
@@ -919,9 +967,11 @@ function renderUpdateBanner(state) {
 async function loadAccountInfo() {
   try {
     const verify = await aegis.verifyApiKey();
-    els.plan.textContent = verify && verify.valid
-      ? (verify.plan || 'active')
-      : 'invalid key';
+    if (!verify || !verify.ok) {
+      els.plan.textContent = 'unavailable';
+    } else {
+      els.plan.textContent = verify.valid ? (verify.plan || 'active') : 'invalid key';
+    }
   } catch {
     els.plan.textContent = 'unavailable';
   }
@@ -1050,11 +1100,14 @@ async function saveApiKey() {
   els.apiKeyHint.textContent = 'saving…';
   try {
     const res = await aegis.setApiKey(key);
+    if (!res || !res.ok) {
+      throw new Error((res && res.error) || 'save failed');
+    }
     // Never retain the raw key in the DOM once saved — show only the masked
     // preview the main process returned.
     els.apiKeyInput.value = '';
     els.apiKeyHint.textContent = key
-      ? `saved (${res && res.keyMask ? res.keyMask : 'configured'})`
+      ? `saved (${res.keyMask ? res.keyMask : 'configured'})`
       : 'key cleared';
     await refreshAfterKeyChange();
   } catch (err) {
@@ -1071,7 +1124,10 @@ async function verifyAegisKey() {
   els.apiKeyHint.textContent = 'verifying…';
   try {
     const verify = await aegis.verifyApiKey();
-    els.apiKeyHint.textContent = verify && verify.valid
+    if (!verify || !verify.ok) {
+      throw new Error((verify && verify.error) || 'verify failed');
+    }
+    els.apiKeyHint.textContent = verify.valid
       ? `valid (${verify.plan || 'active'})`
       : 'invalid key';
   } catch (err) {
@@ -1772,7 +1828,27 @@ const memoryView = {
  *  instead. Confusing the two is how a save would read a hidden textarea. */
 function overlayOpen() {
   if (memoryOverlayOpen()) return true;
-  return !!(window.aegisFingerprint && window.aegisFingerprint.isOpen());
+  // Ask the PANEL, not the module.
+  //
+  // `window.aegisFingerprint` is desktop/renderer/fingerprint.js, whose exports
+  // are `mount` plus pure helpers — it has no `isOpen`. The thing that knows
+  // whether the sheet is up is the handle `mount()` returned, kept in `fpPanel`.
+  // Reaching for `window.aegisFingerprint.isOpen()` threw inside the Escape
+  // listener, and a listener that throws is reported as an uncaught error
+  // rather than propagated to the dispatcher — so `defaultPrevented` stayed
+  // false, Escape stopped interrupting turns, and the visible symptom was a
+  // salvage failure several layers away. A source-shape change must not be able
+  // to do that again: an unusable handle reads as "not open" here, so a broken
+  // φ(α) panel can never disarm the keyboard interrupt (the smoke run fails
+  // loudly instead, on the recorded reason).
+  if (fpPanel && typeof fpPanel.isOpen === 'function') {
+    try {
+      return !!fpPanel.isOpen();
+    } catch (e) {
+      return false;
+    }
+  }
+  return false;
 }
 
 /** The memory inspector alone. Split out of overlayOpen() when the authorship
@@ -4483,11 +4559,20 @@ async function init() {
   // which made its veto assertion unfalsifiable. Exposes state only: no
   // setters, nothing that can drive the UI. Frozen so a stray write in a test
   // cannot fake a passing run.
+  // Bound below, read by the diagnostic just above. `defaultPrevented === false`
+  // on its own cannot say whether Escape was declined by policy or never
+  // handled at all, and that ambiguity is what makes an unwired interrupt look
+  // like a renderer regression.
+  let escapeBind = null;
   window.__aegisSmoke = Object.freeze({
     isScrolledUp: () => transcript.isScrolledUp(),
     metrics: () => transcript.metrics(),
+    escapeDecision: () => (escapeBind && typeof escapeBind.lastDecision === 'function'
+      ? escapeBind.lastDecision()
+      : null),
+    stopOutcome: () => lastStopOutcome,
   });
-  bindEscapeInterrupt({
+  escapeBind = bindEscapeInterrupt({
     doc: document,
     // The memory overlay wins: while it is open, Escape closes it rather than
     // reaching past it to cancel a turn the user may not be looking at.
@@ -4499,9 +4584,18 @@ async function init() {
     // both are somehow up.
     isOverlayOpen: overlayOpen,
     onOverlayEscape: () => {
-      if (window.aegisFingerprint && window.aegisFingerprint.isOpen()) {
-        window.aegisFingerprint.close();
-        return;
+      // Same handle, same reason as overlayOpen(): the module has no `close`,
+      // the mounted panel does. Guessed at the module here too, which threw for
+      // the same reason — and an overlay can only be closed by its own sheet's
+      // handle, so there is nothing to fall back to but the memory overlay.
+      if (fpPanel && typeof fpPanel.close === 'function') {
+        try {
+          fpPanel.close();
+          return;
+        } catch (e) {
+          // fall through to the memory overlay rather than rethrowing inside a
+          // keydown listener
+        }
       }
       closeMemoryOverlay();
     },

package/renderer/transcript-view.js

@@ -218,21 +218,85 @@ function attachScrollLift(deps) {
 function bindEscapeInterrupt(deps) {
   const d = deps || {};
 
+  // Why the last Escape did what it did.
+  //
+  // This exists because the only externally visible signal an ignored Escape
+  // leaves behind is `defaultPrevented === false`, and that single bit cannot
+  // tell four legitimate refusals (overlay open, no pending turn, no stopTurn,
+  // auto-repeat) apart from the one genuinely broken case: a dependency threw
+  // inside the listener, and `dispatchEvent` reported the listener error as
+  // uncaught instead of propagating it to the caller. Both look identical from
+  // outside — the turn keeps running and `defaultPrevented` is false — so a
+  // wiring fault is indistinguishable from a policy decision without this.
+  let lastDecision = null;
+
   function handle(e) {
+    const decision = {
+      at: Date.now(),
+      key: e && e.key,
+      repeat: Boolean(e && e.repeat),
+      overlayOpen: null,
+      hasPendingTurn: null,
+      consumed: false,
+      threw: null,
+    };
+    lastDecision = decision;
+
     if (!e || e.key !== 'Escape') return false;
     // A held key is one intent, not one per repeat. Without this the auto-repeat
     // events keep arriving after the interrupted turn has already ended, and
     // the ones that land once the user has sent the next message stop that turn
     // instead — the keyboard twin of a stuck cancel button.
     if (e.repeat) return false;
-    if (typeof d.isOverlayOpen === 'function' && d.isOverlayOpen()) {
-      if (typeof d.onOverlayEscape === 'function') d.onOverlayEscape();
-      return false;
+    if (typeof d.isOverlayOpen === 'function') {
+      try {
+        decision.overlayOpen = Boolean(d.isOverlayOpen());
+      } catch (err) {
+        // A probe that breaks must not disarm the interrupt: the user's only
+        // keyboard route to stopping a runaway turn is this handler, and
+        // "unknown" is not "open". The reason is recorded rather than raised,
+        // so the smoke run fails on it while the user still gets their Escape.
+        decision.threw = 'isOverlayOpen: ' + ((err && err.message) || err);
+        decision.overlayOpen = false;
+      }
+      if (decision.overlayOpen) {
+        if (typeof d.onOverlayEscape === 'function') {
+          try {
+            d.onOverlayEscape();
+          } catch (err) {
+            decision.threw = 'onOverlayEscape: ' + ((err && err.message) || err);
+          }
+        }
+        return false;
+      }
+    }
+    if (typeof d.hasPendingTurn === 'function') {
+      try {
+        decision.hasPendingTurn = Boolean(d.hasPendingTurn());
+      } catch (err) {
+        decision.threw = 'hasPendingTurn: ' + ((err && err.message) || err);
+        return false;
+      }
+      if (!decision.hasPendingTurn) return false;
     }
-    if (typeof d.hasPendingTurn === 'function' && !d.hasPendingTurn()) return false;
     if (typeof d.stopTurn !== 'function') return false;
     if (typeof e.preventDefault === 'function') e.preventDefault();
-    d.stopTurn();
+    decision.consumed = true;
+    // The key is consumed either way — the interrupt has been asked for and the
+    // turn must not survive a throw from the stop itself. What the stop
+    // ANSWERED is recorded, because a consumed key with a refused stop is the
+    // one combination that looks like success from outside while nothing has
+    // happened: `defaultPrevented` is true, the bubble never appears, and the
+    // turn runs to completion.
+    let stopResult = null;
+    try {
+      const r = d.stopTurn();
+      stopResult = r === undefined ? null : Boolean(r);
+    } catch (err) {
+      stopResult = false;
+      decision.threw = 'stopTurn: ' + ((err && err.message) || err);
+    }
+    decision.stopAccepted = stopResult;
     return true;
   }
 
@@ -242,6 +306,7 @@ function bindEscapeInterrupt(deps) {
 
   return {
     handle: handle,
+    lastDecision: () => lastDecision,
     unbind: () => {
       if (d.doc && typeof d.doc.removeEventListener === 'function') {
         d.doc.removeEventListener('keydown', handle);

package/vendor/aegis.js

@@ -65,6 +65,50 @@ function envIdleMs(name) {
   return Number.isFinite(n) && n > 0 ? n : 0;
 }
 
+/**
+ * DeepSeek's chat template wraps tool calls and turn boundaries in special
+ * tokens — fullwidth pipe (U+FF5C) delimiting an identifier that uses ▁
+ * (U+2581) as its word separator, e.g. ｜tool▁calls▁begin｜, ｜tool▁call▁end｜,
+ * ｜Assistant｜, ｜begin▁of▁sentence｜. These are chat-template internals, never
+ * user-facing text; when the provider's streaming tool-call path leaks them
+ * into `delta.content` they used to reach the screen verbatim — reported as
+ * the pasted "｜｜DSML｜｜" envelope on Windows/macOS. Returns a per-stream
+ * stripper closure with a short lookback buffer so a token split across two
+ * SSE chunks isn't half-rendered before its closing pipe arrives.
+ */
+const DEEPSEEK_ENVELOPE_RE = /｜[A-Za-z][A-Za-z0-9]*(?:▁[A-Za-z0-9]+)*｜/g;
+function makeDeepSeekEnvelopeStripper() {
+  let buf = '';
+  const strip = (chunk) => {
+    buf += chunk;
+    buf = buf.replace(DEEPSEEK_ENVELOPE_RE, '');
+    const openIdx = buf.lastIndexOf('｜');
+    if (openIdx !== -1) {
+      const tail = buf.slice(openIdx);
+      // Held back only while the tail still looks like an in-progress token
+      // (no closing pipe yet); a bare '｜' or genuine prose flushes normally.
+      if (tail.length <= 60 && /^｜[A-Za-z0-9▁]*$/.test(tail)) {
+        const out = buf.slice(0, openIdx);
+        buf = tail;
+        return out;
+      }
+    }
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  // Unconditional release of whatever is left buffered — called once the
+  // stream is fully drained, when a held-back '｜…' is known to never close
+  // (dropped connection, or it was real prose all along) rather than an
+  // in-progress token.
+  strip.flush = () => {
+    const out = buf;
+    buf = '';
+    return out;
+  };
+  return strip;
+}
+
 /**
  * UUID v4 that works everywhere: Web Crypto first (browsers, Node ≥ 19),
  * then Node's CJS crypto module (Node < 19), then a Math.random fallback for
@@ -221,10 +265,26 @@ function createClient(opts = {}) {
       }
       throw err;
     } finally {
+      // The timeout is time-to-*headers* only, so it is cleared the moment the
+      // response resolves: a long generation must never be cut off by it.
       if (timer) clearTimeout(timer);
-      if (controller && callerSignal && typeof callerSignal.removeEventListener === 'function') {
-        callerSignal.removeEventListener('abort', onAbort);
-      }
+      // …but the caller's abort bridge is deliberately NOT removed here.
+      //
+      // `fetch` resolves at the status line, while the RESPONSE BODY is still
+      // bound to `controller.signal` and keeps being read long after this
+      // function has returned. Unhooking the caller's signal at that point
+      // detached Stop/Escape from the stream it was supposed to stop: the
+      // engine's own controller really did abort — `engine.cancel()` answered
+      // `{ ok: true }`, so the right controller was found and `abort()` was
+      // really called — and nothing happened, because the only thing wired to
+      // the live body had already been told to stop listening. The turn then
+      // streamed to completion while the UI sat on "stopping…", never settled,
+      // and never produced the salvaged bubble, because no error ever reached
+      // the caller's catch.
+      //
+      // `once: true` plus one signal per turn bounds the cost of leaving it
+      // attached to a single listener per turn — a far smaller price than a
+      // cancel button that does nothing.
     }
   }
 
@@ -838,6 +898,15 @@ function createClient(opts = {}) {
     // resolve with text only and the caller could never see the calls.
     const toolCallsByIndex = new Map();
     let finishReason = null;
+    // `fullText` above stays RAW (it is also the `seen` cursor the snapshot
+    // reconciliation below compares against the provider's own un-stripped
+    // snapshots); `cleanText` is what the caller actually receives — the same
+    // stream, with DeepSeek's chat-template envelope removed — and is what the
+    // final `message.content` below is built from, so a non-streaming caller
+    // reading the resolved result sees the same clean text a streaming caller
+    // already saw via `onStream`.
+    let cleanText = '';
+    const stripEnvelope = makeDeepSeekEnvelopeStripper();
 
     // Idle watchdog: if the server holds the connection open without ever
     // sending another byte (a stuck upstream call, a proxy that swallows the
@@ -863,6 +932,7 @@ function createClient(opts = {}) {
     let keepAlives = 0;
     async function readWithIdleTimeout() {
       let timer;
+      let onAbort = null;
       const remaining = Math.max(0, idleMs - (Date.now() - lastPayloadAt));
       const timeout = new Promise((_, reject) => {
         timer = setTimeout(() => {
@@ -873,10 +943,37 @@ function createClient(opts = {}) {
           ));
         }, remaining);
       });
+      // The caller's abort, raced against the read directly rather than trusted
+      // to propagate through the body stream.
+      //
+      // Whether an abort of the caller's signal reaches a response body that is
+      // already being read is a property of `boundedFetch`, not of this loop —
+      // and it is not a property this loop can observe. Racing here makes "the
+      // caller stopped" a fact the read loop establishes for itself, so Stop
+      // and Escape end the turn at the next chunk boundary regardless of how
+      // the request's signal was assembled. Without it an aborted turn kept
+      // consuming a stream nobody wanted and `chat()` never settled at all.
+      const aborted = signal && typeof signal.addEventListener === 'function'
+        ? new Promise((_, reject) => {
+            onAbort = () => {
+              const e = new Error('The turn was stopped.');
+              e.name = 'AbortError';
+              e.code = 'ABORT_ERR';
+              reject(e);
+            };
+            if (signal.aborted) onAbort();
+            else signal.addEventListener('abort', onAbort, { once: true });
+          })
+        : null;
       try {
-        return await Promise.race([reader.read(), timeout]);
+        return await (aborted
+          ? Promise.race([reader.read(), timeout, aborted])
+          : Promise.race([reader.read(), timeout]));
       } finally {
         clearTimeout(timer);
+        if (signal && onAbort && typeof signal.removeEventListener === 'function') {
+          signal.removeEventListener('abort', onAbort);
+        }
       }
     }
 
@@ -969,7 +1066,13 @@ function createClient(opts = {}) {
           choice && choice.delta && choice.delta.content,
           choice && choice.message && choice.message.content,
           fullText,
-          (chunk) => onStream({ delta: chunk })
+          (chunk) => {
+            const clean = stripEnvelope(chunk);
+            if (clean) {
+              cleanText += clean;
+              onStream({ delta: clean });
+            }
+          }
         );
         const fragments =
           (choice && choice.delta && choice.delta.tool_calls) ||
@@ -999,13 +1102,22 @@ function createClient(opts = {}) {
       throw err;
     }
 
+    // A trailing '｜…' that never closed (stream ended right after it, or it
+    // was real prose all along) is real content, not an unfinished envelope
+    // token — release it rather than dropping it silently.
+    const strayTail = stripEnvelope.flush();
+    if (strayTail) {
+      cleanText += strayTail;
+      onStream({ delta: strayTail });
+    }
+
     // An id-less fragment stream still yields usable calls, but the caller
     // needs *an* id to pair results back, so synthesize one.
     const toolCalls = [...toolCallsByIndex.entries()]
       .sort((a, b) => a[0] - b[0])
       .map(([idx, c]) => ({ ...c, id: c.id || `call_${idx}` }));
 
-    const message = { content: fullText };
+    const message = { content: cleanText };
     if (toolCalls.length) message.tool_calls = toolCalls;
     const result = {
       model: resultModel,