jeo-code 0.7.5 → 0.7.7

package/CHANGELOG.md

@@ -6,6 +6,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.7.7] - 2026-06-23
+_Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers._
+
+### Added
+- **Process-group reaper for backgrounded subprocesses (`src/agent/process-reaper.ts`).** `bashTool` now spawns each command as its own process-group leader (`Bun.spawn` `detached:true` on POSIX), so a backgrounded grandchild — `npm run dev &`, `next dev &`, a daemon, `nohup …` — joins that group and the whole subtree is reaped with a single `process.kill(-pgid)` at the turn boundary, **without ever touching jeo's own group**. This closes the leak where a reparented `next-server` survived every turn and the resident set climbed monotonically across a session. Reaping is precise (only groups jeo spawned, never a name-based `pkill`), O(1) (one group signal, no process-table scan), and deterministic (closed at the exact turn that creates it). A `unref`'d periodic sweep is a belt-and-suspenders net for turns that abort before cleanup; opt out with `JEO_KEEP_BACKGROUND=1`, tune the sweep with `JEO_REAP_INTERVAL_MS`.
+- **Recursive fuzzy `@path` mention search (`src/commands/launch/mentions.ts`).** A bare `@frag` now walks the project tree (bounded by depth/scan/result caps, skipping `node_modules`/`.git`/build/VCS dirs) and ranks hits basename-prefix → substring → subsequence, then shallowest/shortest/alphabetical; a `@dir/` prefix lists that single directory. Autocomplete returns the matcher's pool as-is instead of re-filtering by strict prefix.
+
+### Changed
+- **ralplan draft passes route to their per-role configured model.** `runRalplanEngine` now resolves `planner`/`architect`/`critic` subagent models from config and threads each through `callRole`, so the Planner/Architect/Critic drafting + revision calls use their own model; the consensus critic gate continues to resolve its model independently.
+- **OSC 52 clipboard copy exposes a configurable size cap and honest skip signal.** `copyTextToClipboard` reads `JEO_OSC52_MAX` for the base64 payload cap and returns `osc52SkippedTooLarge` when the remote (SSH/tmux) clipboard was skipped for an oversized payload, so the caller can warn instead of silently dropping the remote path; tmux DCS passthrough wrapping is documented.
+
+### Fixed
+- **Salvaged answers and `done` reasons strip leaked reasoning/tool-call markup.** `stripLeakedReasoningTags` (`src/ai/think-tags.ts`) removes `<think>…</think>` blocks, an unmatched `</think>` reasoning prefix, stray `<tool_call>`/`<parameter>`/`antml:*` scaffolding, and Harmony `<|channel|>` markers from a model's final visible text, so API-entered models that emit inline scaffolding no longer surface raw tags in the salvaged prose answer or the `done` reason.
+- **Bracketed paste is ANSI-safe and idle-merged.** Pasted ANSI-colored terminal output is stripped of escape sequences and stray C0 control bytes across every paste path (`stripPasteEscapes`/`pasteEscapeLength`) so it no longer corrupts the input box; a partial paste marker split across stdin chunks is carried (`pasteMarkerTailLength`/`endsInPaste`); and the dropped-end-marker fallback is now **idle-based** (`pasteIdleDecision`, 250ms since the last buffered line) so a large paste streaming in over >250ms is never cut mid-paste.
+
+### Verified
+- `bun run typecheck` clean; touched suites pass — `test/process-reaper.test.ts`, `test/ralplan-draft-model.test.ts`, `test/prompt-key-filter.test.ts`, `test/launch-mentions.test.ts`, `test/clipboard.test.ts`, `test/think-tags.test.ts`, `test/engine-salvage.test.ts` (90 pass / 0 fail) covering group-kill target selection, alive/grace-window reaping, recursive fuzzy mention ranking, escaped-pipe-free paste sanitizing + partial-marker carry + idle merge, the OSC 52 cap/skip signal, per-role ralplan routing, and leaked-tag stripping on salvaged output.
+
+## [0.7.6] - 2026-06-23
+_Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release._
+
+### Added
+- **Cross-target standalone-binary release matrix (incl. Windows `.exe`).** New `scripts/ci-release-build-binaries.ts` compiles `src/cli.ts` for every release target via Bun's `--compile --target bun-<triple>`; since jeo has no native addons/workers, all targets (`darwin-arm64`/`-x64`, `linux-x64`/`-arm64`, `win32-x64`) cross-compile from a single Linux runner. Driven by `bun run build:binaries` / `build:win` (new `package.json` scripts) with `--targets <ids|all>`, `RELEASE_TARGETS` env, and `--dry-run` support. A new `release-binaries` job in `.github/workflows/npm-publish.yml` builds the full matrix, uploads them as a workflow artifact, and on a `release` event runs `gh release upload <tag> dist/jeo-* --clobber` to attach them.
+
+### Changed
+- **The running version's CHANGELOG is embedded into the compiled binary.** `loadBundledChangelog` (in `src/util/whats-new.ts`) now imports `CHANGELOG.md` with `{ type: "text" }`, so the release notes ship inside the `bun build --compile` single binary — where `import.meta.dir` resolves to the bunfs virtual root and the old two-levels-up on-disk path does not exist. The on-disk read remains as a dev fallback only when the embed is empty.
+
+### Fixed
+- **The in-TUI markdown table renderer no longer breaks a cell on an escaped `\|`.** `markdown-table.ts` now distinguishes a real cell separator from a literal pipe: `hasUnescapedPipe` drives row detection, `splitCells` walks the row character-by-character (turning `\|` into a literal `|` inside the cell instead of a column break and never stripping an escaped trailing pipe), and `isDelimiterRow` reuses that same escape-aware split. A table whose cells contain `\|` now renders with the correct column count.
+
+### Verified
+- `bun run typecheck` clean; the touched suites pass — `test/markdown-table.test.ts` and `test/release-binaries.test.ts` (14 pass / 0 fail) cover escaped-pipe cell splitting/delimiter detection, the Windows `.exe` target shape, `--targets`/env/`all` resolution, the per-target compile invocation, and the workflow's build+upload of every target.
+
+
 ## [0.7.5] - 2026-06-23
 _Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs._
 

package/README.ja.md

@@ -193,11 +193,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
+- **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -193,11 +193,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
+- **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -195,11 +195,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
+- **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -193,11 +193,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.7.7]** (2026-06-23) — Long-running-process hygiene & input robustness: backgrounded grandchildren (`next dev &`, daemons) are now reaped at the turn boundary via per-command process groups — closing the climbing `next-server` RSS leak — while the prompt gains recursive fuzzy `@path` search, ANSI-safe and idle-merged bracketed paste, a configurable OSC 52 clipboard cap, per-role ralplan model routing, and leaked-reasoning-tag stripping on salvaged answers.
+- **[0.7.6]** (2026-06-23) — Release & docs plumbing: the running version's release notes now travel inside the `--compile` single binary (so `/whats-new` works offline and from a global install), the in-TUI markdown table renderer stops splitting on escaped `\|` pipes, and the release pipeline gains a cross-compiled standalone-binary matrix — macOS/Linux **plus a first-class Windows x64 `.exe`** — built on one Linux runner and auto-attached to each GitHub release.
 - **[0.7.5]** (2026-06-23) — Startup & loop latency: redundant re-reads that fired on every subagent spawn and every loop step are now memoized behind cheap `stat`-signature caches, so cold paths stay correct (edits/deletes still picked up immediately) while warm paths skip the disk and the re-parse. Targets the per-turn and per-spawn overhead that dominates perceived slowness in team/ralph/autopilot fan-outs.
 - **[0.7.4]** (2026-06-22) — Per-session model isolation + REPL slash-handler testability: a running `jeo` session now pins the model it resolved at start, so a concurrent session running `/model` (which persists the global default) can no longer silently switch a different live session's model mid-run. The read-only code-inspection slashes (`/view`, `/diff`, `/find`, `/search`), the `/undo` git slash, and the `/history` view are extracted into pure, PTY-free handlers so their logic is unit-tested directly instead of buried in the REPL loop.
 - **[0.7.3]** (2026-06-22) — Provider catalog: the Tencent Cloud MaaS (international) `knownModels` list is broadened from a 4-id DeepSeek/MiniMax set to the full live-verified line-up across five families — DeepSeek, MiniMax, Zhipu GLM, Moonshot Kimi, and Hunyuan. Because the host exposes no `/v1/models` route, this hand-maintained list is the model picker's source of truth for the offline fallback.
-- **[0.7.2]** (2026-06-22) — Workflow honesty + prompt-input testability: `ultragoal` acceptance criteria can now carry a trailing `{verify: <command>}` directive that makes a criterion **individually** provable (real PASS/FAIL instead of a blanket UNVERIFIED on a green suite), with a SUCCESS / PARTIAL / SUITE_GREEN / FAILED status taxonomy; the boxed prompt's full stdin→readline keystroke rewriter is extracted into a pure, PTY-free function so the "↓ cuts the lower text" fix and the rest of the wiring are unit-tested directly. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
-- **[0.7.1]** (2026-06-22) — TUI polish + provider breadth: the live forge-card border and forge mark now flow in the **active theme's** own neon palette instead of a fixed brand gradient, the boxed prompt's Up/Down keys no longer wipe a multi-line draft at its top/bottom edge, the Tencent Cloud MaaS catalog gains the live-verified DeepSeek/MiniMax/GLM model families (with catalog backfill for providers that expose no models-list endpoint), and the `jeo --tmux` smoke check drops a false-positive launcher-log grep. Verified leak-free (`mem-probe`, 2000 turns, exit 0) with a fresh `jeo --tmux` boot battery (6/6).
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",
@@ -46,6 +46,8 @@
     "start": "bun src/cli.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "bun build src/cli.ts --compile --outfile dist/jeo",
+    "build:binaries": "bun scripts/ci-release-build-binaries.ts",
+    "build:win": "bun scripts/ci-release-build-binaries.ts --targets win32-x64",
     "pack:check": "npm pack --dry-run",
     "publish:npm": "npm publish --access public --registry https://registry.npmjs.org/",
     "changelog:sync": "bun scripts/sync-changelog.ts",

package/src/agent/AGENTS.md

@@ -25,6 +25,7 @@ The core runtime loop, tool registry, session management, and state persistence
 | `output-minimizer.ts` | Brief description of purpose |
 | `output-util.ts` | Brief description of purpose |
 | `plan.ts` | Subagent planning structures and validation |
+| `process-reaper.ts` | Background-process reaper: spawns bash in its own process group (POSIX detached) so backgrounded grandchildren (`next dev &`, daemons) are reaped by group at turn end instead of orphaning and accumulating (`JEO_KEEP_BACKGROUND=1` opts out, `JEO_REAP_INTERVAL_MS` tunes the periodic safety-net sweep) |
 | `seed.ts` | Brief description of purpose |
 | `session.ts` | Session context building, compaction, and history management |
 | `state.ts` | File-backed state and session persistence (`.jeo/state/`) |

package/src/agent/engine.ts

@@ -24,6 +24,7 @@ import { StepBudget, dynamicStepBudgetConfig, resolveStepBudgetConfig, hashSigna
 import { historyTokens, trimToolResultsInPlace } from "./compaction";
 import { jeoEnv } from "../util/env";
 import { GUARD_LIMITS, isVerificationSignal, repeatHint, classifyDoneGate } from "./loop-guards";
+import { stripLeakedReasoningTags } from "../ai/think-tags";
 
 
 async function invokeCallLlm(history: Message[], options: {
@@ -644,7 +645,9 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
       parseFailures++;
       if (trimmed && (!trimmed.includes("{") || parseFailures > MAX_PARSE_BOUNCES)) {
         pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
-        return finish({ done: true, steps: step, doneReason: trimmed });
+        // Strip leaked <think>/<parameter>/Harmony scaffolding some API-entered
+        // models emit inline so the salvaged answer doesn't surface raw tags.
+        return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags(trimmed) || trimmed });
       }
       pushAssistantTurn(history, responseText, reasonBuf, artifactBuf);
       history.push({
@@ -760,7 +763,7 @@ export async function runAgentLoop(history: Message[], opts: AgentLoopOptions):
           continue;
         }
       }
-      return finish({ done: true, steps: step, doneReason: (toolCalls[0].arguments?.reason as string) ?? "" });
+      return finish({ done: true, steps: step, doneReason: stripLeakedReasoningTags((toolCalls[0].arguments?.reason as string) ?? "") });
     }
 
     // Anti-spin guard, checked BEFORE execution: a repeated identical step must

package/src/agent/process-reaper.ts

@@ -0,0 +1,200 @@
+/**
+ * Background-process reaper for the bash tool (src/agent/tools.ts:bashTool).
+ *
+ * THE LEAK IT CLOSES
+ * ------------------
+ * When a model command backgrounds a long-lived grandchild — `npm run dev &`,
+ * `next dev &`, a daemon, `nohup …` — the bash SHELL exits immediately but the
+ * grandchild is reparented to init (PID 1) and keeps running. jeo's bash tool
+ * kills the shell, not the subtree, so on Linux that grandchild survives every
+ * turn. Each `next dev` restart that doesn't kill its predecessor leaves another
+ * live `next-server` holding hundreds of MB; across a session the resident set
+ * climbs monotonically — the reported "next-server 메모리 점유율이 점점 높아진다".
+ *
+ * THE FIX (more efficient than name-based periodic `pkill`)
+ * --------------------------------------------------------
+ * bashTool now spawns each command as its OWN process-group leader (Bun.spawn
+ * `detached:true` ⇒ pgid == shell pid on POSIX). A backgrounded grandchild joins
+ * that group, so the whole subtree is reachable by a single `process.kill(-pgid)`
+ * WITHOUT touching jeo (which lives in a different group). Reaping is therefore:
+ *   - PRECISE   — only groups jeo itself spawned, never a `pkill -f next-server`
+ *                 that could nuke a dev server the user runs in another terminal;
+ *   - O(1)      — one group signal, no full process-table scan per sweep;
+ *   - DETERMINISTIC — the leak is closed at the exact turn boundary that creates
+ *                 it, so steady-state cost is zero (the periodic sweep below is a
+ *                 belt-and-suspenders net for turns that abort before cleanup).
+ *
+ * This module is the pure, injectable core: `killSpec` decides the signal target
+ * and `BackgroundReaper` tracks groups + reaps the orphaned ones. All OS effects
+ * (`kill`, the clock) are injected so the selection logic is unit-testable.
+ */
+
+import { jeoEnv } from "../util/env";
+
+export type KillFn = (pid: number, signal?: string | number) => void;
+
+/** A spawned shell tracked for reaping. `grouped` is true when it leads its own
+ *  process group (POSIX detached spawn) and can be signalled as `-pid`. */
+export interface ReapTarget {
+  /** Shell pid; equals the process-group id when `grouped` (detached) is true. */
+  pid: number;
+  /** Spawned as a process-group leader (POSIX detached) — group-killable. */
+  grouped: boolean;
+}
+
+/**
+ * The argument to pass to `process.kill`: the NEGATED pgid to signal the whole
+ * group (reaping backgrounded grandchildren) when the shell leads its own group,
+ * or the bare pid otherwise. A group-kill is only safe when `grouped` — signalling
+ * `-pid` of a non-leader would hit jeo's own group and self-terminate the agent;
+ * Windows has no POSIX process groups, so it always falls back to the bare pid.
+ */
+export function killSpec(target: ReapTarget, platform: NodeJS.Platform = process.platform): number {
+  if (target.grouped && platform !== "win32") return -target.pid;
+  return target.pid;
+}
+
+interface GroupRecord extends ReapTarget {
+  /** Short human label (the command head) for diagnostics. */
+  label: string;
+  registeredAt: number;
+}
+
+export interface ReaperDeps {
+  /** Inject for tests; defaults to process.kill. Signal `0` is a liveness probe. */
+  kill?: KillFn;
+  now?: () => number;
+  platform?: NodeJS.Platform;
+}
+
+/**
+ * Tracks process groups jeo's bash tool spawned and reaps the ones still alive.
+ * Registration happens when a command leaves a lingering background grandchild;
+ * `reap()` SIGKILLs each registered group that is still alive and forgets it.
+ */
+export class BackgroundReaper {
+  private groups = new Map<number, GroupRecord>();
+  private readonly kill: KillFn;
+  private readonly now: () => number;
+  private readonly platform: NodeJS.Platform;
+
+  constructor(deps: ReaperDeps = {}) {
+    this.kill = deps.kill ?? ((pid, signal) => process.kill(pid, signal as NodeJS.Signals));
+    this.now = deps.now ?? Date.now;
+    this.platform = deps.platform ?? process.platform;
+  }
+
+  get size(): number {
+    return this.groups.size;
+  }
+
+  /** Track a spawned shell's group as a reap candidate (idempotent per pid). */
+  register(target: ReapTarget, label = ""): void {
+    if (!Number.isInteger(target.pid) || target.pid <= 1) return; // never 0/-1/1 (init)
+    this.groups.set(target.pid, { ...target, label: label.slice(0, 80), registeredAt: this.now() });
+  }
+
+  /** Forget a group (e.g. the command cleaned itself up). */
+  unregister(pid: number): void {
+    this.groups.delete(pid);
+  }
+
+  /** True if any process in the target's group is still alive (signal-0 probe). */
+  private isAlive(rec: ReapTarget): boolean {
+    try {
+      this.kill(killSpec(rec, this.platform), 0);
+      return true;
+    } catch {
+      return false; // ESRCH ⇒ nothing left in the group
+    }
+  }
+
+  /** Best-effort SIGKILL of one tracked group; returns true if a signal landed. */
+  reapOne(pid: number): boolean {
+    const rec = this.groups.get(pid);
+    if (!rec) return false;
+    this.groups.delete(pid);
+    if (!this.isAlive(rec)) return false;
+    try {
+      this.kill(killSpec(rec, this.platform), "SIGKILL");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Reap tracked groups. Default: only groups still alive (the leaked orphans).
+   * `olderThanMs` limits reaping to groups registered before now-olderThanMs, so a
+   * brand-new turn's background child gets a grace window before the periodic sweep
+   * claims it. Returns the pids that received a kill.
+   */
+  reap(opts: { olderThanMs?: number } = {}): number[] {
+    const reaped: number[] = [];
+    const cutoff = opts.olderThanMs != null ? this.now() - opts.olderThanMs : Infinity;
+    for (const [pid, rec] of [...this.groups]) {
+      if (rec.registeredAt > cutoff) continue;
+      this.groups.delete(pid);
+      if (!this.isAlive(rec)) continue;
+      try {
+        this.kill(killSpec(rec, this.platform), "SIGKILL");
+        reaped.push(pid);
+      } catch {
+        /* group vanished between probe and kill — fine */
+      }
+    }
+    return reaped;
+  }
+
+  /** Drop all tracking without signalling (used when reaping is disabled). */
+  clear(): void {
+    this.groups.clear();
+  }
+}
+
+/** Process-group spawning + background reaping are on unless opted out. */
+export function isBackgroundReapEnabled(env: Record<string, string | undefined> = process.env): boolean {
+  return jeoEnv("KEEP_BACKGROUND", env) !== "1";
+}
+
+/** Periodic-sweep cadence; 0/invalid disables the timer (deterministic reap still runs). */
+export function reapIntervalMs(env: Record<string, string | undefined> = process.env): number {
+  const raw = jeoEnv("REAP_INTERVAL_MS", env);
+  if (raw == null) return 30_000;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : 30_000;
+}
+
+/** Shared session-scoped reaper used by the bash tool. */
+export const backgroundReaper = new BackgroundReaper();
+
+let sweeper: ReturnType<typeof setInterval> | undefined;
+
+/**
+ * Lazily start the periodic safety-net sweep (idempotent). It reaps any tracked
+ * group that outlived a grace window — covering turns that abort before their
+ * deterministic finally-block reap runs. The timer is `unref`'d so it never keeps
+ * the process alive, and a 0 interval (or KEEP_BACKGROUND=1) skips it entirely.
+ */
+export function ensureBackgroundSweeper(
+  reaper: BackgroundReaper = backgroundReaper,
+  env: Record<string, string | undefined> = process.env,
+): void {
+  if (sweeper || !isBackgroundReapEnabled(env)) return;
+  const interval = reapIntervalMs(env);
+  if (interval <= 0) return;
+  sweeper = setInterval(() => {
+    // Grace = one interval: a background child younger than this is left for its
+    // own turn's finally-block to reap, so the sweep only claims true orphans.
+    reaper.reap({ olderThanMs: interval });
+  }, interval);
+  (sweeper as { unref?: () => void }).unref?.();
+}
+
+/** Stop the periodic sweep (tests / shutdown). */
+export function stopBackgroundSweeper(): void {
+  if (sweeper) {
+    clearInterval(sweeper);
+    sweeper = undefined;
+  }
+}

package/src/agent/tools.ts

@@ -4,6 +4,13 @@ import * as path from "node:path";
 import { readWorkflowStateStrict, type WorkflowState } from "./state";
 import { jeoEnv } from "../util/env";
 import { READ_OUTPUT_MAX } from "./tool-output";
+import {
+  backgroundReaper,
+  ensureBackgroundSweeper,
+  isBackgroundReapEnabled,
+  killSpec,
+  type ReapTarget,
+} from "./process-reaper";
 
 /** Read the deep-interview lock; on corrupt state fail CLOSED (treat as active lock). */
 async function readMutationLock(cwd: string): Promise<WorkflowState | null> {
@@ -634,7 +641,13 @@ export async function bashTool(
     const safeEnv = env && !Array.isArray(env)
       ? Object.fromEntries(Object.entries(env).filter(([, v]) => typeof v === "string")) as Record<string, string>
       : undefined;
-    // Run the command using Bun's native spawn
+    // Run the command using Bun's native spawn. When background reaping is on
+    // (default, POSIX), spawn the shell as its OWN process-group leader so a
+    // backgrounded grandchild (`next dev &`, a daemon) joins that group and the
+    // whole subtree is reapable via `process.kill(-pid)` without hitting jeo.
+    const reapBackground = isBackgroundReapEnabled();
+    const grouped = reapBackground && process.platform !== "win32";
+    if (grouped) ensureBackgroundSweeper();
     const proc = Bun.spawn(["bash", "-c", command], {
       cwd: runCwd,
       // Detach stdin (no inherited TTY): a command that reads stdin (`cat`, `read`,
@@ -643,9 +656,21 @@ export async function bashTool(
       stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
+      // Own process group ⇒ group-killable subtree (reaps backgrounded grandchildren).
+      ...(grouped ? { detached: true } : {}),
       // Inherit the parent env; merge caller-supplied (sanitized) vars on top.
       ...(safeEnv && Object.keys(safeEnv).length ? { env: { ...process.env, ...safeEnv } } : {}),
     });
+    const reapTarget: ReapTarget = { pid: proc.pid, grouped };
+    // Signal the whole process group when grouped (so a `cmd &` grandchild dies
+    // too), else fall back to the bare shell pid. `force` ⇒ SIGKILL, else SIGTERM.
+    const killTree = (force: boolean): void => {
+      const sig = force ? "SIGKILL" : "SIGTERM";
+      if (grouped) {
+        try { process.kill(killSpec(reapTarget), sig); return; } catch { /* fall through */ }
+      }
+      try { force ? proc.kill(9) : proc.kill(); } catch {}
+    };
 
     let timedOut = false;
     let aborted = false;
@@ -674,14 +699,14 @@ export async function bashTool(
       // SIGKILL step ALSO cut the readers: the old code killed the shell but never
       // cancelled the readers, so an orphan-held pipe outlived the deadline and the
       // turn hung forever (the reported freeze).
-      try { proc.kill(); } catch {}
-      killTimer = setTimeout(() => { try { proc.kill(9); } catch {} cancelReaders(); }, 3_000);
+      killTree(false);
+      killTimer = setTimeout(() => { killTree(true); cancelReaders(); }, 3_000);
     }, TIMEOUT_MS);
     // Abort wiring: if the turn is cancelled, SIGKILL the child immediately AND cancel
     // both pipe readers so the drain loops unwind at once.
     const onAbort = () => {
       aborted = true;
-      try { proc.kill(9); } catch {}
+      killTree(true);
       cancelReaders();
     };
     if (signal) {
@@ -728,10 +753,17 @@ export async function bashTool(
       clearTimeout(timer);
       if (killTimer) clearTimeout(killTimer);
       if (signal) signal.removeEventListener("abort", onAbort);
-      // Reap a still-alive child (normal exit, abort, or timeout) so no orphaned
-      // process survives, then force any pipe still held open (backgrounded
-      // grandchild) closed so the awaits below cannot hang.
-      if (proc.exitCode === null && proc.signalCode === null) { try { proc.kill(9); } catch {} }
+      // Reap a still-alive shell (abort/timeout) AND any backgrounded grandchild it
+      // left behind. A `next dev &` / daemon survives the shell's exit by reparenting
+      // to init and would otherwise accumulate every turn (rising next-server RSS);
+      // group-SIGKILL claims the whole subtree. Register first so the periodic sweep
+      // retries if this signal raced the reparent. Skipped when KEEP_BACKGROUND=1.
+      if (proc.exitCode === null && proc.signalCode === null) {
+        killTree(true);
+      } else if (grouped && reapBackground) {
+        backgroundReaper.register(reapTarget, command);
+        backgroundReaper.reapOne(proc.pid);
+      }
       cancelReaders();
     }
     const stdout = await stdoutPromise;

package/src/ai/think-tags.ts

@@ -82,3 +82,33 @@ export function createThinkSplitter(onReasoning?: (delta: string) => void): Thin
 
   return { push, flush };
 }
+
+/**
+ * Strip leaked reasoning / tool-call markup from a model's FINAL visible text
+ * (a salvaged prose answer or a `done` reason). Some API-entered models emit
+ * XML/Harmony-style scaffolding — `<think>…</think>`, `<parameter>…</parameter>`,
+ * `<tool_call>`, `<|channel|>` markers — inside their plain-text reply. The
+ * streaming {@link createThinkSplitter} only removes *matched* think pairs seen
+ * mid-stream; an unmatched `</think>` (a model that begins already "inside" its
+ * reasoning) or stray parameter tags leak through into the answer. This is a
+ * whole-text cleanup, safe to run once on the final string: text with no such
+ * markup is returned trimmed-but-otherwise-unchanged.
+ */
+export function stripLeakedReasoningTags(text: string): string {
+  let s = text;
+  // 1) Drop balanced <think>…</think> blocks.
+  s = s.replace(/<think\b[^>]*>[\s\S]*?<\/think>/gi, "");
+  // 2) An unmatched closing </think> implies an implicit reasoning prefix the
+  //    splitter never saw an opener for: drop everything up to and including the
+  //    LAST such close tag, keeping only the answer that follows it.
+  const lastClose = s.toLowerCase().lastIndexOf("</think>");
+  if (lastClose !== -1) s = s.slice(lastClose + "</think>".length);
+  // 3) Remove stray tool-call / parameter scaffolding tags (keep their inner text).
+  s = s.replace(
+    /<\/?(?:think|tool_call|tool_response|tool_result|parameter|invoke|function|function_call|antml:[a-z_]+)\b[^>]*>/gi,
+    "",
+  );
+  // 4) Remove Harmony channel markers like <|channel|>, <|message|>, <|end|>.
+  s = s.replace(/<\|[^|>]*\|>/g, "");
+  return s.trim();
+}

package/src/cli.ts

@@ -35,5 +35,8 @@ try {
   const code = await dispatch(process.argv.slice(2), { appName: APP_NAME, version: VERSION });
   if (code !== 0) process.exit(code);
 } catch (err) {
-  fatal(err);
+  // Service-readiness: never surface a raw stack trace to users; clean error + non-zero exit.
+  restoreTerminalState();
+  process.stderr.write(`error: ${(err as Error)?.message ?? String(err)}\n`);
+  process.exit(1);
 }

package/src/commands/launch/input.ts

@@ -231,6 +231,51 @@ export function rewriteCursorCombos(plain: string): string {
   return out;
 }
 
+/** Byte length of a terminal ESCAPE SEQUENCE beginning at `s[i]`, else 0 — used to STRIP
+ *  escapes embedded in PASTED text (copied colored terminal output carries `\x1b[31m`-style
+ *  SGR codes; left intact they reach readline as literal escapes that corrupt the input box,
+ *  or as leftover `[31m` garbage text). Covers CSI (`ESC [ … final-byte`), OSC/DCS/PM/APC/SOS
+ *  (`ESC ] | P | ^ | _ | X … ST|BEL`), and the two-byte `ESC <char>` form. A sequence split
+ *  across the end of the segment consumes the remaining tail. */
+export function pasteEscapeLength(s: string, i: number): number {
+  if (s[i] !== "\u001b") return 0;
+  const c = s[i + 1];
+  if (c === undefined) return 1; // lone trailing ESC
+  if (c === "[") { // CSI: params/intermediates until a final byte 0x40–0x7e
+    let j = i + 2;
+    while (j < s.length && !(s[j]! >= "\u0040" && s[j]! <= "\u007e")) j++;
+    return (j < s.length ? j + 1 : s.length) - i;
+  }
+  if (c === "]" || c === "P" || c === "^" || c === "_" || c === "X") { // OSC/DCS/PM/APC/SOS → ST or BEL
+    let j = i + 2;
+    while (j < s.length) {
+      if (s[j] === "\u0007") return j + 1 - i;                         // BEL
+      if (s[j] === "\u001b" && s[j + 1] === "\\") return j + 2 - i;    // ST
+      j++;
+    }
+    return s.length - i;
+  }
+  return 2; // two-byte ESC <char>
+}
+
+/** Remove every terminal escape sequence AND stray C0 control byte (except `\t`/`\n`/`\r`,
+ *  which carry layout meaning the caller handles) from a chunk of PASTED text, so copied
+ *  ANSI-colored output drops to its plain characters instead of corrupting the prompt.
+ *  Shared by every paste path (the idle key-filter, the live-turn drain, mid-turn capture)
+ *  so they sanitize identically. */
+export function stripPasteEscapes(s: string): string {
+  let out = "";
+  let i = 0;
+  while (i < s.length) {
+    const esc = pasteEscapeLength(s, i);
+    if (esc > 0) { i += esc; continue; }
+    const ch = s[i]!;
+    if (ch === "\n" || ch === "\r" || ch === "\t" || ch >= " ") out += ch;
+    i += 1;
+  }
+  return out;
+}
+
 export interface PromptInputQueue {
   pendingLines: string[];
   partial: string;
@@ -267,12 +312,13 @@ function feedTypedSegment(state: PromptInputQueue, segment: string): boolean {
 }
 
 /** Pasted body: pure DATA — newlines split commands into pastedLines, the trailing
- *  partial stays editable, and control bytes (incl. any stray ESC from copied ANSI
- *  text) are dropped instead of being interpreted as keystrokes. */
+ *  partial stays editable, and any ANSI escape sequence from copied terminal output is
+ *  STRIPPED (via `stripPasteEscapes`) instead of being interpreted/leaked as keystrokes.
+ *  Shares the sanitizer with the idle key-filter so every paste path behaves identically. */
 function feedPasteBody(state: PromptInputQueue, body: string): boolean {
   if (!body) return false;
   let accepted = false;
-  const normalized = body.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
   for (const ch of Array.from(normalized)) {
     if (ch === "\n") {
       state.pastedLines.push(state.partial);
@@ -335,7 +381,7 @@ function feedLivePromptSegment(state: PromptInputQueue, segment: string): boolea
 
 function feedLivePromptPasteBody(state: PromptInputQueue, body: string): boolean {
   if (!body) return false;
-  const normalized = body.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  const normalized = stripPasteEscapes(body).replace(/\r\n/g, "\n").replace(/\r/g, "\n");
   const flattened = normalized.split("\n").map(part => part.trim()).filter(Boolean).join(" ");
   if (!flattened) return false;
   state.partial = state.partial ? `${state.partial} ${flattened}` : flattened;
@@ -532,9 +578,46 @@ export interface PromptKeyFilterEnv {
 }
 
 /** Carried across chunks: a bracketed paste can span several stdin chunks, so the
- *  in-paste flag must survive between filter calls. */
+ *  in-paste flag must survive between filter calls. `carry` holds a trailing byte run
+ *  that MIGHT be the start of a split escape sequence — a bracketed-paste marker
+ *  (`\x1b[200~`/`\x1b[201~`) or a `\r` that could be the front of a `\r\n` — sliced off
+ *  the end of one chunk and re-prepended to the next so a marker straddling a stdin read
+ *  boundary is never half-interpreted (the "긴 텍스트 붙여넣으면 `00~`/`[201~` 쓰레기가
+ *  새거나 중간에 제출됨" corruption). Concatenation is always re-parsed, so carrying is
+ *  safe even when the tail turns out NOT to be a marker. */
 export interface PromptKeyFilterState {
   inPaste: boolean;
+  carry?: string;
+}
+
+/** Length of the longest trailing run of `data` that is a PROPER prefix of a
+ *  bracketed-paste marker (so it could be a marker split across a stdin chunk boundary).
+ *  Returns 0 when the tail cannot begin a marker. Both markers share the `\x1b[20` stem,
+ *  so e.g. a trailing `\x1b`, `\x1b[`, `\x1b[2`, `\x1b[20`, `\x1b[200`, or `\x1b[201` is
+ *  held back for the next chunk; a full marker (handled in the main loop) is not. */
+export function pasteMarkerTailLength(data: string): number {
+  const markers = [PASTE_START, PASTE_END] as const;
+  const max = Math.min(Math.max(PASTE_START.length, PASTE_END.length) - 1, data.length);
+  for (let k = max; k >= 1; k--) {
+    const tail = data.slice(data.length - k);
+    for (const m of markers) if (m.length > k && m.startsWith(tail)) return k;
+  }
+  return 0;
+}
+
+/** Whether `data` (already free of any trailing partial marker) leaves the filter INSIDE
+ *  a bracketed paste, given the entry state — by replaying only the paste toggles. Used to
+ *  decide if a trailing lone `\r` is a CRLF/CR split inside paste body (carry it) versus a
+ *  real Enter at the prompt (must NOT be carried). */
+export function endsInPaste(data: string, startInPaste: boolean): boolean {
+  let inPaste = startInPaste;
+  let i = 0;
+  while (i < data.length) {
+    if (!inPaste && data.startsWith(PASTE_START, i)) { inPaste = true; i += PASTE_START.length; continue; }
+    if (inPaste && data.startsWith(PASTE_END, i)) { inPaste = false; i += PASTE_END.length; continue; }
+    i += 1;
+  }
+  return inPaste;
 }
 
 export interface PromptKeyFilterResult {
@@ -561,6 +644,24 @@ export function filterPromptInputChunk(
   env: PromptKeyFilterEnv,
   state: PromptKeyFilterState,
 ): PromptKeyFilterResult {
+  // Re-attach any byte run carried from the previous chunk (a split paste marker or a
+  // dangling `\r`), then hold back a fresh trailing partial so a bracketed-paste marker —
+  // or a `\r\n` straddling this read boundary — is never half-interpreted. Carrying is
+  // safe: the concatenation is re-parsed next call, so a tail that turns out NOT to be a
+  // marker is simply emitted one chunk later.
+  data = (state.carry ?? "") + data;
+  state.carry = "";
+  const markerTail = pasteMarkerTailLength(data);
+  if (markerTail > 0) {
+    state.carry = data.slice(data.length - markerTail);
+    data = data.slice(0, data.length - markerTail);
+  } else if (data.endsWith("\r") && endsInPaste(data, state.inPaste)) {
+    // A lone trailing `\r` INSIDE a paste may be the front of a CRLF split across chunks —
+    // carry it so `\r\n` folds to ONE sentinel instead of two (no spurious blank line).
+    // Outside a paste a trailing `\r` is Enter (submit) and must pass through untouched.
+    state.carry = "\r";
+    data = data.slice(0, data.length - 1);
+  }
   // Empty-line Backspace guard: a standalone Backspace with an empty buffer is a no-op
   // that some Bun readline builds turn into a spurious `close` (hard exit) — drop it
   // before it reaches readline. Forwarded normally inside a paste or with text present.
@@ -575,7 +676,17 @@ export function filterPromptInputChunk(
     if (state.inPaste) {
       if (data.startsWith("\r\n", i)) { out += MULTILINE_SENTINEL; i += 2; continue; }
       if (data[i] === "\n" || data[i] === "\r") { out += MULTILINE_SENTINEL; i += 1; continue; }
-      out += data[i]; i += 1; continue;
+      // Pasted DATA: drop whole ANSI escape sequences (e.g. the `\x1b[31m` color codes in
+      // copied terminal output, which would otherwise reach readline as literal escapes —
+      // or leftover `[31m` text — and corrupt the box), then keep printable text + tabs and
+      // drop any remaining C0 control byte. Shares `pasteEscapeLength`/the same keep rule as
+      // `stripPasteEscapes` so every paste path sanitizes identically. Surrogate halves
+      // (emoji) are >= " " and pass through intact.
+      const esc = pasteEscapeLength(data, i);
+      if (esc > 0) { i += esc; continue; }
+      const ch = data[i]!;
+      if (ch === "\t" || ch >= " ") out += ch;
+      i += 1; continue;
     }
     const mouse = matchMouseReport(data, i);
     if (mouse > 0) { i += mouse; continue; }
@@ -611,4 +722,30 @@ export function filterPromptInputChunk(
     out += data[i]; i += 1;
   }
   return { out, drop: false };
+}
+
+// ── Paste-merge idle gate (large-paste truncation fix) ───────────────────────────
+/** Default idle window for the bracketed-paste merge fallback, in ms. */
+export const PASTE_MERGE_IDLE_MS = 250;
+
+/** Decide the paste-merge fallback when the `201~` end-marker may have been dropped.
+ *
+ *  A multi-line bracketed paste is buffered line-by-line and only flushed as ONE
+ *  message once paste-end arrives. Terminals occasionally drop the end-marker, so
+ *  `launch.ts` also arms an idle fallback. The OLD fallback was a single fixed
+ *  250ms timer measured from the FIRST line — a large paste streaming in over more
+ *  than 250ms tripped it mid-paste and got truncated (the rest leaked as separate
+ *  prompts). This is idle-based instead: `idleMs` is the gap since the LAST buffered
+ *  line, so a steadily-arriving paste keeps resetting the clock and is never cut;
+ *  the fallback fires only after the stream has genuinely gone quiet.
+ *
+ *  Returns `fire: true` when the idle gap has reached the threshold (flush now), else
+ *  `waitMs` = how long to wait before re-checking. Pure, so the timing policy is
+ *  unit-testable without a live readline/PTY. */
+export function pasteIdleDecision(
+  idleMs: number,
+  thresholdMs: number = PASTE_MERGE_IDLE_MS,
+): { fire: boolean; waitMs: number } {
+  if (idleMs >= thresholdMs) return { fire: true, waitMs: 0 };
+  return { fire: false, waitMs: thresholdMs - idleMs };
 }

package/src/commands/launch/mentions.ts

@@ -2,17 +2,103 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { tokenize } from "../../tui/components/autocomplete";
 
+/** Directories never descended into / surfaced by `@path` recursive search. */
+const IGNORE_DIRS = new Set([
+  "node_modules", ".git", "dist", "build", "out", "coverage",
+  ".next", ".cache", ".turbo", ".svelte-kit", "vendor", "target",
+  ".jeo", ".omc", ".omx", ".gjc",
+]);
+const MAX_RESULTS = 50;
+/** Hard cap on directory entries visited per query (keeps per-keystroke cost bounded). */
+const MAX_SCAN = 8000;
+/** Deepest directory level the recursive walk descends to. */
+const MAX_DEPTH = 10;
+
+/** Fuzzy match tier for `name` against an already-lowercased `frag`.
+ *  0 = prefix, 1 = substring, 2 = subsequence (chars in order), -1 = no match. */
+function fuzzyRank(name: string, fragLower: string): number {
+  if (!fragLower) return 0;
+  const n = name.toLowerCase();
+  if (n.startsWith(fragLower)) return 0;
+  if (n.includes(fragLower)) return 1;
+  let i = 0;
+  for (let j = 0; j < n.length && i < fragLower.length; j++) {
+    if (n[j] === fragLower[i]) i++;
+  }
+  return i === fragLower.length ? 2 : -1;
+}
+
+interface RecursiveHit {
+  rel: string;
+  isDir: boolean;
+  rank: number;
+  depth: number;
+}
+
+/** Recursively search the project tree under `cwd` for entries whose basename
+ *  fuzzy-matches `frag`. Ignores hidden entries and well-known build/VCS dirs,
+ *  bounded by depth / scan / result caps. Pure given the filesystem: never throws
+ *  (unreadable directories are skipped). Returns relative POSIX paths, directories
+ *  keeping a trailing `/`, ranked basename-prefix → substring → subsequence, then
+ *  shallowest / shortest / alphabetical. */
+function searchRecursive(cwd: string, frag: string): string[] {
+  const fragLower = frag.toLowerCase();
+  const hits: RecursiveHit[] = [];
+  let scanned = 0;
+  const stack: { abs: string; rel: string; depth: number }[] = [{ abs: cwd, rel: "", depth: 0 }];
+  while (stack.length > 0) {
+    const { abs, rel, depth } = stack.pop()!;
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (++scanned > MAX_SCAN) break;
+      if (entry.name.startsWith(".")) continue;
+      const isDir = entry.isDirectory();
+      if (isDir && IGNORE_DIRS.has(entry.name)) continue;
+      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+      const rank = fuzzyRank(entry.name, fragLower);
+      if (rank >= 0) hits.push({ rel: childRel, isDir, rank, depth });
+      if (isDir && depth + 1 <= MAX_DEPTH) {
+        stack.push({ abs: path.join(abs, entry.name), rel: childRel, depth: depth + 1 });
+      }
+    }
+    if (scanned > MAX_SCAN) break;
+  }
+  hits.sort((a, b) =>
+    a.rank - b.rank ||
+    a.depth - b.depth ||
+    a.rel.length - b.rel.length ||
+    a.rel.localeCompare(b.rel));
+  return hits.slice(0, MAX_RESULTS).map(h => (h.isDir ? `${h.rel}/` : h.rel));
+}
+
 /** Filesystem completion for an `@path` mention prefix, relative to `cwd`.
- *  Lists the directory the prefix points at, filtering by the basename fragment,
- *  directories first, hidden entries dropped, capped at 50 — directories keep a
- *  trailing `/` so the next Tab descends. Pure given `cwd`: never throws (an
- *  unreadable directory yields no matches). Extracted verbatim from the launch
- *  REPL so it can be unit-tested in isolation. */
+ *
+ *  - A bare fragment with no slash (e.g. `@loop`) triggers a recursive, fuzzy
+ *    project-wide search so nested files surface without typing each directory
+ *    level (`@loop` → `src/agent/loop.ts`).
+ *  - A path containing a slash (or ending in `/`) lists that one directory,
+ *    filtering the basename fragment fuzzily (prefix/substring/subsequence).
+ *
+ *  Directories keep a trailing `/` so the next Tab descends; hidden entries are
+ *  dropped; results are capped at 50. Pure given `cwd`: never throws (an
+ *  unreadable directory yields no matches). */
 export function mentionPaths(cwd: string, prefix: string): string[] {
   const norm = prefix.replace(/\\/g, "/");
   const wantsDirChildren = norm.endsWith("/");
+
+  // Bare non-empty fragment → recursive fuzzy search across the project.
+  if (!wantsDirChildren && norm.length > 0 && !norm.includes("/")) {
+    return searchRecursive(cwd, norm);
+  }
+
   const dirPart = wantsDirChildren ? norm.slice(0, -1) : path.posix.dirname(norm) === "." ? "" : path.posix.dirname(norm);
   const namePart = wantsDirChildren ? "" : path.posix.basename(norm);
+  const fragLower = namePart.toLowerCase();
   const absDir = path.resolve(cwd, dirPart || ".");
   let entries: fs.Dirent[] = [];
   try {
@@ -22,9 +108,12 @@ export function mentionPaths(cwd: string, prefix: string): string[] {
   }
   return entries
     .filter(entry => !entry.name.startsWith("."))
-    .filter(entry => !namePart || entry.name.toLowerCase().startsWith(namePart.toLowerCase()))
+    .filter(entry => fuzzyRank(entry.name, fragLower) >= 0)
     .sort((a, b) => {
       if (a.isDirectory() !== b.isDirectory()) return a.isDirectory() ? -1 : 1;
+      const ra = fuzzyRank(a.name, fragLower);
+      const rb = fuzzyRank(b.name, fragLower);
+      if (ra !== rb) return ra - rb;
       return a.name.localeCompare(b.name);
     })
     .slice(0, 50)

package/src/commands/launch.ts

@@ -149,6 +149,8 @@ import {
   classifyMidTurnLine,
   decideCtrlC,
   filterPromptInputChunk,
+  pasteIdleDecision,
+  PASTE_MERGE_IDLE_MS,
 } from "./launch/input";
 import {
   gatedStdout,
@@ -1556,12 +1558,14 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
   // PASTE-MERGE: a multi-line bracketed paste must arrive as ONE message, not split into
   // one command per line. Lines that fire WHILE a paste is open are buffered here instead
   // of run individually; promptInput joins them with the trailing residual on resolve.
-  // `endWaiters` wake that merge the moment the 201~ paste-end marker arrives.
-  const pasteMerge: { buf: string[]; endWaiters: Array<() => void> } = { buf: [], endWaiters: [] };
+  // `endWaiters` wake that merge the moment the 201~ paste-end marker arrives. `lastActivityAt`
+  // tracks the last buffered line so the dropped-marker fallback is IDLE-based (never cuts a
+  // large paste still streaming in — see pasteIdleDecision).
+  const pasteMerge: { buf: string[]; endWaiters: Array<() => void>; lastActivityAt: number } = { buf: [], endWaiters: [], lastActivityAt: 0 };
   let pasteLineFired = false; // the line that resolved rl.question came from inside a paste
   if (process.stdin.isTTY) {
     const pasteKeypressHandler = (_ch: string, key: { name?: string } | undefined) => {
-      if (key?.name === "paste-start") { promptPasteActive = true; pasteMerge.buf = []; }
+      if (key?.name === "paste-start") { promptPasteActive = true; pasteMerge.buf = []; pasteMerge.lastActivityAt = Date.now(); }
       else if (key?.name === "paste-end") {
         promptPasteActive = false;
         for (const w of pasteMerge.endWaiters.splice(0)) w();
@@ -1578,6 +1582,7 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
     if (promptPasteActive) {
       // Inside a bracketed paste: buffer the line, never run it on its own.
       pasteMerge.buf.push(l);
+      pasteMerge.lastActivityAt = Date.now();
       pasteLineFired = true;
       return;
     }
@@ -1642,10 +1647,24 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
         if (promptPasteActive) {
           await new Promise<void>(resolve => {
             if (!promptPasteActive) { resolve(); return; }
-            pasteMerge.endWaiters.push(resolve);
-            setTimeout(resolve, 250); // safety: never hang if the 201~ marker is dropped
+            let done = false;
+            const finish = () => { if (done) return; done = true; resolve(); };
+            // Woken immediately by the 201~ paste-end marker (endWaiters).
+            pasteMerge.endWaiters.push(finish);
+            // Fallback for a DROPPED end-marker: idle-based, so a large paste still
+            // streaming in keeps resetting the clock and is never truncated. Only a
+            // genuinely quiet stream (no new line for PASTE_MERGE_IDLE_MS) flushes.
+            const tick = () => {
+              if (done) return;
+              if (!promptPasteActive) { finish(); return; }
+              const { fire, waitMs } = pasteIdleDecision(Date.now() - pasteMerge.lastActivityAt);
+              if (fire) { finish(); return; }
+              setTimeout(tick, waitMs);
+            };
+            setTimeout(tick, PASTE_MERGE_IDLE_MS);
           });
         }
+
         const residual = (rl as unknown as { line?: string }).line ?? "";
         // Clear the residual so it does NOT prefill (and re-submit) the next prompt.
         try { rl.write(null, { ctrl: true, name: "u" }); } catch { /* best-effort */ }
@@ -3327,10 +3346,18 @@ export async function runLaunchCommand(args: string[]): Promise<void> {
           if (copied.osc52 || copied.local) {
             const via = [copied.local ? "system tool" : "", copied.osc52 ? "OSC52" : ""].filter(Boolean).join(" + ");
             console.log(`(transcript copied to clipboard via ${via} — ${text.length} chars)`);
+            // OSC52 is the only path that reaches the OUTER terminal over SSH/tmux. If it was
+            // skipped for size, a remote paste won't find the text — say so (and how to lift it).
+            if (copied.osc52SkippedTooLarge) {
+              console.log("(note: too large for the OSC52 remote-clipboard path — copied via the local tool only; over SSH/tmux this won't reach your machine. Set JEO_OSC52_MAX higher if your terminal accepts larger writes.)");
+            }
           } else {
             console.log(text);
-            console.log("(no clipboard path available — transcript printed above)");
+            console.log(copied.osc52SkippedTooLarge
+              ? "(transcript too large for OSC52 and no local clipboard tool — printed above)"
+              : "(no clipboard path available — transcript printed above)");
           }
+
         } catch (err) {
           console.log(`! dump failed: ${(err as Error).message}`);
         }

package/src/commands/ralplan.ts

@@ -148,9 +148,21 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
   const ARCHITECT = `You are the ARCHITECT. Review the Planner's draft for technical feasibility, correct file targets, directory structure, and any missing setup/wiring/test steps. Return an improved plan (same shape).\n` + SCHEMA_SPEC;
   const CRITIC = `You are the CRITIC. Finalize the plan: remove vague or redundant steps, make each step actionable and independently verifiable, and ensure the acceptance criteria are covered. Return the final plan (same shape).\n` + SCHEMA_SPEC;
 
+  // Drafting passes honor the SAME per-role model config the rest of jeo uses
+  // (resolveSubagentModel → config.subagents[role].model, else defaultModel).
+  // Previously every pass ran on the default/primary model, ignoring a user's
+  // configured planner/architect tiers; routing each pass to its role's model
+  // lets a cheaper/faster draft tier cut planning latency with NO default change
+  // (unset roles still resolve to defaultModel). The repo-grounded consensus gate
+  // (runConsensusCriticGate) resolves critic's model independently and is untouched.
+  const config = await readGlobalConfig();
+  const PLANNER_MODEL = resolveSubagentModel("planner", config);
+  const ARCHITECT_MODEL = resolveSubagentModel("architect", config);
+  const CRITIC_MODEL = resolveSubagentModel("critic", config);
+
   try {
-    const callRole = async (systemPrompt: string, userContent: string): Promise<string> => {
-      const raw = await callLlm([{ role: "user" as const, content: userContent }], { systemPrompt });
+    const callRole = async (systemPrompt: string, userContent: string, model?: string): Promise<string> => {
+      const raw = await callLlm([{ role: "user" as const, content: userContent }], { systemPrompt, model });
       return raw.replace(/```yaml|```/g, "").trim();
     };
     const isValidPlan = (yaml: string): boolean => {
@@ -175,7 +187,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Planner drafting" });
     }
-    const draft = await callRole(PLANNER, `Crystallized spec (seed.yaml):\n\n${seedContent}`);
+    const draft = await callRole(PLANNER, `Crystallized spec (seed.yaml):\n\n${seedContent}`, PLANNER_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -185,7 +197,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Architect reviewing" });
     }
-    const reviewed = await callRole(ARCHITECT, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nPlanner's draft plan:\n\n${draft}\n\nReturn the improved plan.`);
+    const reviewed = await callRole(ARCHITECT, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nPlanner's draft plan:\n\n${draft}\n\nReturn the improved plan.`, ARCHITECT_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -195,7 +207,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     if (opts.onProgress) {
       opts.onProgress({ skill: "ralplan", phase: "planning", detail: "Critic finalizing" });
     }
-    let cleanPlan = await callRole(CRITIC, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nArchitect's plan:\n\n${reviewed}\n\nReturn the final, critiqued plan.`);
+    let cleanPlan = await callRole(CRITIC, `Crystallized spec (seed.yaml):\n\n${seedContent}\n\nArchitect's plan:\n\n${reviewed}\n\nReturn the final, critiqued plan.`, CRITIC_MODEL);
 
     if (opts.signal?.aborted) {
       return { ok: false, reason: "aborted" };
@@ -209,7 +221,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
     let planValid = true;
     if (!isValidPlan(cleanPlan)) {
       log("[ralplan] Final plan did not match the required shape; requesting a corrected plan…");
-      cleanPlan = await callRole(CRITIC, `Your previous output was not valid for the required schema. Fix it (roles MUST be one of executor|planner|architect|critic).\n\n${SCHEMA_SPEC}\n\nPlan to fix:\n\n${cleanPlan}`);
+      cleanPlan = await callRole(CRITIC, `Your previous output was not valid for the required schema. Fix it (roles MUST be one of executor|planner|architect|critic).\n\n${SCHEMA_SPEC}\n\nPlan to fix:\n\n${cleanPlan}`, CRITIC_MODEL);
       if (!isValidPlan(cleanPlan)) {
         const fallback = [reviewed, draft].find(isValidPlan);
         if (fallback) {
@@ -253,6 +265,7 @@ export async function runRalplanEngine(opts: RalplanEngineOptions = {}): Promise
         CRITIC,
         `The consensus critic returned [ITERATE] on the plan with this justification:\n\n${gate.detail}\n\n` +
         `Revise the plan to address every point.\n\n${SCHEMA_SPEC}\n\nCurrent plan:\n\n${cleanPlan}`,
+        CRITIC_MODEL,
       );
       if (isValidPlan(revised)) {
         cleanPlan = revised;

package/src/tui/clipboard.ts

@@ -27,6 +27,20 @@
  *  this we skip OSC 52 and rely on the local clipboard tool instead. */
 export const OSC52_MAX_BASE64 = 100_000;
 
+/** Resolve the effective OSC 52 base64-payload cap. `JEO_OSC52_MAX` overrides the
+ *  conservative {@link OSC52_MAX_BASE64} default for terminals/tmux configured to
+ *  accept larger clipboard writes (e.g. tmux `set -g set-clipboard on` with a raised
+ *  `buffer-limit`, or a terminal without xterm's ~100KB selection limit). A value
+ *  `<= 0` disables the cap entirely (Infinity); an unparseable value keeps the
+ *  default. Pure (env injected) so it is testable without touching the host. */
+export function osc52MaxBase64(env: Record<string, string | undefined> = process.env): number {
+  const raw = env.JEO_OSC52_MAX;
+  if (raw === undefined || raw.trim() === "") return OSC52_MAX_BASE64;
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return OSC52_MAX_BASE64;
+  return n <= 0 ? Number.POSITIVE_INFINITY : n;
+}
+
 /**
  * Resolve the local system-clipboard WRITE command for a platform, or null when
  * no tool is available. Pure (the `which` probe is injected) so it is testable
@@ -69,18 +83,20 @@ export interface Osc52Options {
   tmux?: boolean;
   /** Clipboard selection: `c` = system clipboard (default), `p` = primary. */
   clipboard?: "c" | "p";
+  /** Max base64 payload to emit (default {@link OSC52_MAX_BASE64}); larger returns "". */
+  maxBase64?: number;
 }
 
 /**
  * Build the OSC 52 clipboard-SET escape for `text`, or "" when the base64 payload
- * exceeds {@link OSC52_MAX_BASE64} (caller falls back to a local tool). When
- * `tmux` is set the whole sequence is wrapped in DCS passthrough (`ESC P tmux ; …
- * ESC \`) with every inner ESC doubled, the tmux contract for forwarding an
- * escape to the terminal underneath it.
+ * exceeds the cap (default {@link OSC52_MAX_BASE64}, overridable via `maxBase64`; the
+ * caller falls back to a local tool). When `tmux` is set the whole sequence is wrapped
+ * in DCS passthrough (`ESC P tmux ; … ESC \`) with every inner ESC doubled, the tmux
+ * contract for forwarding an escape to the terminal underneath it.
  */
 export function osc52Sequence(text: string, opts: Osc52Options = {}): string {
   const b64 = Buffer.from(text, "utf8").toString("base64");
-  if (b64.length > OSC52_MAX_BASE64) return "";
+  if (b64.length > (opts.maxBase64 ?? OSC52_MAX_BASE64)) return "";
   const target = opts.clipboard ?? "c";
   const inner = `\x1b]52;${target};${b64}\x07`;
   if (!opts.tmux) return inner;
@@ -100,6 +116,8 @@ export interface CopyToClipboardDeps {
   platform?: NodeJS.Platform;
   /** True when running inside tmux (defaults to !!process.env.TMUX). */
   insideTmux?: boolean;
+  /** Environment for resolving the OSC 52 cap (`JEO_OSC52_MAX`); defaults to process.env. */
+  env?: Record<string, string | undefined>;
 }
 
 export interface CopyResult {
@@ -107,6 +125,10 @@ export interface CopyResult {
   osc52: boolean;
   /** A local clipboard subprocess accepted the text. */
   local: boolean;
+  /** OSC 52 was SKIPPED because the base64 payload exceeded the cap — the remote
+   *  (SSH/tmux) clipboard was NOT updated; only a local tool, if any, ran. Lets the
+   *  caller warn the user instead of silently dropping the remote path. */
+  osc52SkippedTooLarge: boolean;
 }
 
 /**
@@ -121,13 +143,17 @@ export async function copyTextToClipboard(text: string, deps: CopyToClipboardDep
   const insideTmux = deps.insideTmux ?? !!process.env.TMUX;
   const write = deps.write ?? ((s: string) => { try { process.stdout.write(s); } catch { /* terminal gone */ } });
   const spawn = deps.spawn ?? ((cmd, opts) => Bun.spawn(cmd, opts) as ReturnType<NonNullable<CopyToClipboardDeps["spawn"]>>);
+  const maxBase64 = osc52MaxBase64(deps.env ?? process.env);
 
-  const result: CopyResult = { osc52: false, local: false };
+  const result: CopyResult = { osc52: false, local: false, osc52SkippedTooLarge: false };
 
-  const seq = osc52Sequence(text, { tmux: insideTmux });
+  const seq = osc52Sequence(text, { tmux: insideTmux, maxBase64 });
   if (seq) {
     write(seq);
     result.osc52 = true;
+  } else {
+    // osc52Sequence only returns "" when the payload is over the cap.
+    result.osc52SkippedTooLarge = true;
   }
 
   const cmd = systemClipboardCopyCommand(platform, which);

package/src/tui/components/autocomplete.ts

@@ -114,8 +114,11 @@ export function complete(line: string, ctx: CompletionContext): CompletionResult
     const token = trailingSpace ? "" : tokens[tokens.length - 1] ?? "";
     if (token.startsWith("@")) {
       const prefix = token.slice(1);
+      // `mentionPaths` already does the matching (recursive fuzzy for a bare
+      // fragment, single-dir listing when the prefix has a slash), so the pool
+      // is returned as-is rather than re-filtered by strict prefix.
       const pool = (ctx.mentionPaths?.(prefix) ?? []).map(p => (p.startsWith("@") ? p : `@${p}`));
-      return { completions: dedupeCap(prefixHits(pool, token)), token, kind: "path" };
+      return { completions: dedupeCap(pool), token, kind: "path" };
     }
     // `$skill` mention completion at ANY position in the line (mention-style;
     // a leading `$name` is additionally the direct-invocation entrypoint).

package/src/tui/components/markdown-table.ts

@@ -12,25 +12,47 @@ export interface TableRenderOptions {
   maxColWidth?: number;
 }
 
-/** A line is a table row when it has at least one unescaped `|` and trims to start/contain cells. */
-function isTableRow(line: string): boolean {
-  const t = line.trim();
-  return t.includes("|") && /\|/.test(t);
+/** A line carries an *unescaped* `|` — a real cell separator, not a literal `\|`. */
+function hasUnescapedPipe(line: string): boolean {
+  return /(?:^|[^\\])\|/.test(line);
 }
 
-/** A line is the GFM delimiter row, e.g. `| --- | :--: | ---: |`. */
-function isDelimiterRow(line: string): boolean {
-  const t = line.trim().replace(/^\||\|$/g, "");
-  if (!t.includes("-")) return false;
-  return t.split("|").every(cell => /^\s*:?-{1,}:?\s*$/.test(cell));
+/** A line is a table row when it has at least one unescaped `|`. */
+function isTableRow(line: string): boolean {
+  return hasUnescapedPipe(line.trim());
 }
 
-/** Split a markdown table row into trimmed cell strings (drop the outer pipes). */
+/** Split a markdown table row into trimmed cell strings, honoring escaped `\|`. */
 function splitCells(line: string): string[] {
-  let t = line.trim();
-  if (t.startsWith("|")) t = t.slice(1);
-  if (t.endsWith("|")) t = t.slice(0, -1);
-  return t.split("|").map(c => c.trim());
+  let s = line.trim();
+  if (s.startsWith("|")) s = s.slice(1);
+  // Only strip a trailing pipe that actually closes the row (not an escaped `\|`).
+  if (s.endsWith("|") && !s.endsWith("\\|")) s = s.slice(0, -1);
+  const cells: string[] = [];
+  let cur = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i]!;
+    if (ch === "\\" && s[i + 1] === "|") {
+      cur += "|";
+      i++;
+      continue;
+    }
+    if (ch === "|") {
+      cells.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  cells.push(cur);
+  return cells.map(c => c.trim());
+}
+
+/** A line is the GFM delimiter row, e.g. `| --- | :--: | ---: |`. */
+function isDelimiterRow(line: string): boolean {
+  if (!isTableRow(line)) return false;
+  const cells = splitCells(line);
+  return cells.length > 0 && cells.every(cell => /^:?-{1,}:?$/.test(cell));
 }
 
 type Align = "left" | "center" | "right";

package/src/util/whats-new.ts

@@ -1,4 +1,5 @@
 import pkg from "../../package.json";
+import changelogText from "../../CHANGELOG.md" with { type: "text" };
 import { compareVersions } from "../commands/update";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -198,9 +199,12 @@ export function renderWhatsNew(sections: ChangelogSection[], opts?: WhatsNewRend
 
 /** Read the CHANGELOG.md that ships next to this package (running version's notes). */
 export async function loadBundledChangelog(): Promise<string | null> {
-  // This module lives at src/util/whats-new.ts; CHANGELOG.md sits at the package
-  // root, i.e. two levels up. Resolve against the module dir so it works from a
-  // global install path just as from the repo.
+  // CHANGELOG.md is embedded at build time via the text import above, so the
+  // running version's notes are available offline AND inside the `--compile`
+  // single binary — where `import.meta.dir` resolves to the bunfs virtual root
+  // and the on-disk path below does not exist.
+  if (changelogText && changelogText.trim().length > 0) return changelogText;
+  // Dev fallback: read from the package root two levels up if the embed is empty.
   const candidate = path.join(import.meta.dir, "..", "..", "CHANGELOG.md");
   try {
     return await readFile(candidate, "utf-8");