jeo-code 0.8.36 → 0.8.38

package/CHANGELOG.md

@@ -6,6 +6,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 The README mirrors the latest 5 entries — regenerate with `bun run changelog:sync`.
 
+## [0.8.38] - 2026-07-21
+_Independent architect-subagent review of this whole session's TUI/workflow changes (v0.8.29-v0.8.37), requested explicitly to verify stability before calling the work done. Verdict: WATCH/COMMENT, no P0/P1 — the resize fix, the idle↔mid-turn transition, the new `calc` tool wiring, and the web-search credential gating all held up under independent scrutiny. Found and fixed 3 real, previously-unknown bugs in `width.ts`; 1 architectural observation recorded as tech debt, not fixed._
+
+### Fixed
+- **`wrapTextWithAnsi` could hang the whole TUI forever at `cols<=1` with a leading wide grapheme cluster** (`src/tui/components/width.ts`) — reproduced live (a 5-second `timeout` kill was required to stop it) before fixing: when the very first cluster of the remaining text is wider than the available column budget (e.g. any CJK/emoji character at `cols=1`), `truncateToWidth` returned `""`, so `rest` never shrank and the wrap loop spun forever. This session's own floor-removal fixes (v0.8.33) made `cols=1` a real, reachable value in several call sites, directly increasing exposure to this latent defect. Fixed by forcing forward progress: when nothing fits, the one cluster that doesn't is emitted on its own (deliberately over-width) line instead of hanging — an unavoidable overflow beats a hung process.
+- **Non-Latin combining marks (Hebrew, Arabic, Devanagari, Thai) were not zero-width**, over-counting `visibleWidth` and misaligning box borders/wraps for those scripts (`src/tui/components/width.ts`'s `charWidth`/`isAttachableCombining`) — e.g. Arabic "بَّ" (base + shadda + fatha) counted 3 instead of the 1 a terminal renders. Fixed by extending the zero-width tables with the Hebrew/Arabic/Devanagari/Thai combining-mark ranges, verified against the current `jquast/wcwidth` reference table (github.com/termux/wcwidth, Unicode-aligned as of 2022-12-16) rather than guessed from memory; the Devanagari fix was additionally cross-checked against the `unicode-width` crate's own documented example (`"क्ष".width() == 2`).
+- **Paired regional-indicator flag emoji (e.g. 🇰🇷) were not one atomic cluster** (`nextGraphemeCluster`) — the total width was already coincidentally correct (1+1=2), but a wrap/truncate boundary could land between the two indicators, rendering a lone indicator-letter square instead of a flag. Fixed per UAX #29's RI-pairing rule: a Regional Indicator immediately followed by another Regional Indicator now absorbs into one width-2 cluster; a lone, unpaired indicator is left alone (not force-paired).
+
+### Investigated, not changed (tech debt, not a bug)
+- **Idle-prompt (`launch.ts`) and mid-turn (`tui/app.ts`+`tui/renderer.ts`) run two independent differential-render + resize systems.** The architect traced the actual handoff (`previewArmed` gate, `disarmPreview()`/`armPreview()`, independent `onResize` registration/teardown) and found a clean, correctly-gated transition with no shared row-accounting state to desync — confirmed live too (multiple `--tmux` resize-during-transition reproductions, including an extreme 8-column terminal, all rendered and typed correctly with no corruption). No concrete bug found; flagged only as a maintainability risk (a future renderer-level fix has to be reasoned about twice) worth a future unification, not an urgent fix.
+
+### Verified
+- `test/width.test.ts` — 14 pass (was 11): new tests for the combining-mark fix (Hebrew/Arabic/Devanagari/Thai, cross-checked against the unicode-width crate's own documented example), the flag-emoji atomicity fix (including the "lone indicator is not force-paired" case), and the hang fix (reproducing the exact previously-hanging input, plus a mixed narrow/wide case and a lone emoji case).
+- Live (unmocked) verification beyond the subagent's read-only review: real `jeo --tmux` sessions resized exactly at the idle↔mid-turn transition boundary (including across a real turn error and a real successful reply) showed clean transitions with no corruption; a real 8-column-wide terminal degraded gracefully (no crash, no hang) end to end.
+- Full `bun test` — 3123 pass / 0 fail across 307 files.
+- `bun run typecheck` — no errors.
+
+## [0.8.37] - 2026-07-21
+_Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full)._
+
+### Fixed
+- **A dropped/pasted image path with no size limit could read an arbitrarily large file entirely into memory before the format check ever ran** (`src/util/file-attachment.ts`'s `attachImagePaths`) — gjc parity in spirit (#2658's "source size" bound, scoped down for jeo's much simpler single-read attach path — jeo has none of gjc's symlink/hardlink/TOCTOU/remote-`file://`/consent hardening, and doesn't need most of it: unlike gjc's arbitrary bracketed-paste-from-a-possibly-untrusted-clipboard threat model, this reads a path the user directly typed/dropped into their own composer, and the existing magic-byte check already blocks the worst case of exfiltrating an arbitrary non-image file's contents via a misleadingly-named path). The default file reader now `stat()`s the path first and rejects non-files or anything over 25 MiB before ever calling `readFile`, instead of unconditionally reading the whole file into memory first.
+
+### Investigated, confirmed N/A (with direct evidence, not guesses)
+- **#2622** "fail closed on tab worker startup" — gjc's browser tool spawns a separate native-addon-resolving tab-WORKER PROCESS; jeo's `browser-tool.ts` runs Playwright in-process, with no analogous worker-process bootstrap to fail-close on.
+- **#2664** "isolate keybinding configuration arrays" — jeo has no user-configurable keybinding-array system to alias in the first place (confirmed via search: only a static, non-mutable key-hint display in `hints.ts`).
+- **#2665** "share restricted state argv classification" — this hardens gjc's own restricted-role-agent access to a `state` TOOL; jeo's `state.ts` is a human-invoked CLI command only, never a callable agent tool (`DEFAULT_TOOLS` has no `state` entry), so the vulnerability class (a subagent bypassing an argv-based restriction) cannot occur.
+- **#2670** "resource-gc: advance earlier sweep deadlines" — gjc tracks MULTIPLE independently-deadlined cleanup policies behind one shared re-armable timer (the bug: a newly-registered EARLIER deadline didn't preempt it); jeo's `process-reaper.ts` is a single global periodic sweep with no per-policy deadline tracking, so this specific race cannot occur.
+- **#2669** "bound malformed compatible responses" (web-search) — verified live (not just read) that jeo's own `parseOpenAISearchResponse`/`parseGeminiSearchResponse` (added in v0.8.31) already degrade gracefully on a wrong-shaped-but-valid-JSON response body (e.g. `output` being a string instead of an array) via existing `?? []`/`Array.isArray()` guards — fed exactly that shape through both parsers directly; neither threw, both returned an empty-but-valid result. Already correct; no change needed.
+- **#2652** "recover malformed Round 0 intent asks" — specific to gjc's own multi-turn "deep-interview Round 0" AskTool wire-schema/coordinator state machine; jeo's `deep-interview.ts` has no equivalent wire-schema-to-runtime-validation mismatch surface of this shape.
+
+### Verified
+- `test/file-attachment.test.ts` — 18 pass (was 17): new test writes a REAL oversized file (25 MiB + 1 KiB) and a real small PNG to a temp directory and drives them through the REAL (non-injected) filesystem reader — confirms the oversized one is rejected without ever being attached, and the small one still attaches normally through the same code path.
+- Full `bun test` — 3120 pass / 0 fail across 307 files.
+- `bun run typecheck` — no errors.
+
+### Audit status
+- 11 of gjc v0.11.5's ~65 PRs now triaged across this and the prior entry (2 fixed — #2591, #2658's size-cap; 9 confirmed N/A with evidence — #2667, #2749, #2721, #2622, #2664, #2665, #2670, #2669/already-correct, #2652). Tracked as an ongoing goal; remaining PRs continue in subsequent passes.
+
 ## [0.8.36] - 2026-07-21
 _First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase)._
 

package/README.ja.md

@@ -283,11 +283,11 @@ CI は `.github/workflows/npm-publish.yml` で公開します — GitHub リリ
 ## 変更履歴 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.38]** (2026-07-21) — Independent architect-subagent review of this whole session's TUI/workflow changes (v0.8.29-v0.8.37), requested explicitly to verify stability before calling the work done. Verdict: WATCH/COMMENT, no P0/P1 — the resize fix, the idle↔mid-turn transition, the new `calc` tool wiring, and the web-search credential gating all held up under independent scrutiny. Found and fixed 3 real, previously-unknown bugs in `width.ts`; 1 architectural observation recorded as tech debt, not fixed.
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
-- **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.ko.md

@@ -284,11 +284,11 @@ CI는 `.github/workflows/npm-publish.yml`로 배포합니다 — GitHub 릴리
 ## 변경 이력 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.38]** (2026-07-21) — Independent architect-subagent review of this whole session's TUI/workflow changes (v0.8.29-v0.8.37), requested explicitly to verify stability before calling the work done. Verdict: WATCH/COMMENT, no P0/P1 — the resize fix, the idle↔mid-turn transition, the new `calc` tool wiring, and the web-search credential gating all held up under independent scrutiny. Found and fixed 3 real, previously-unknown bugs in `width.ts`; 1 architectural observation recorded as tech debt, not fixed.
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
-- **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.md

@@ -291,11 +291,11 @@ Huge thanks to [gajae-code](https://github.com/Yeachan-Heo/gajae-code) for the i
 ## Changelog
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.38]** (2026-07-21) — Independent architect-subagent review of this whole session's TUI/workflow changes (v0.8.29-v0.8.37), requested explicitly to verify stability before calling the work done. Verdict: WATCH/COMMENT, no P0/P1 — the resize fix, the idle↔mid-turn transition, the new `calc` tool wiring, and the web-search credential gating all held up under independent scrutiny. Found and fixed 3 real, previously-unknown bugs in `width.ts`; 1 architectural observation recorded as tech debt, not fixed.
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
-- **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/README.zh.md

@@ -283,11 +283,11 @@ CI 通过 `.github/workflows/npm-publish.yml` 发布 — GitHub 发布 release
 ## 更新日志 (Changelog)
 
 <!-- CHANGELOG:START (auto-generated from CHANGELOG.md — run `bun run changelog:sync`) -->
+- **[0.8.38]** (2026-07-21) — Independent architect-subagent review of this whole session's TUI/workflow changes (v0.8.29-v0.8.37), requested explicitly to verify stability before calling the work done. Verdict: WATCH/COMMENT, no P0/P1 — the resize fix, the idle↔mid-turn transition, the new `calc` tool wiring, and the web-search credential gating all held up under independent scrutiny. Found and fixed 3 real, previously-unknown bugs in `width.ts`; 1 architectural observation recorded as tech debt, not fixed.
+- **[0.8.37]** (2026-07-21) — Long-term goal opened to triage every remaining PR in gjc v0.11.5's ~65-entry list, one batch at a time. This entry covers the first batch (10 PRs read in full).
 - **[0.8.36]** (2026-07-21) — First full audit of gjc v0.11.5's actual ~65-PR "What's Changed" list (prior passes had used release-note prose or direct-source structural diffs — this is the first time every individual PR was read and triaged against jeo's own codebase).
 - **[0.8.35]** (2026-07-21) — Deeper gjc-parity pass: re-cloned the real, public `Yeachan-Heo/gajae-code` source and, this time, structurally compared its actual tool implementations (`packages/coding-agent/src/tools/`) against jeo's own tool surface, not just the provider catalog.
 - **[0.8.34]** (2026-07-21) — Provider/model-catalog sync against gjc's actual current source (a shallow clone of the real, public `Yeachan-Heo/gajae-code` repo at v0.11.5 — direct `packages/ai/src/models.json` comparison, not inference from release notes). The system prompt's philosophy, the `/route` command, and the `tencent` provider were explicitly out of scope and are unchanged.
-- **[0.8.33]** (2026-07-20) — Real terminal-resize testing (repeated tmux resize-window + keystroke reproductions, byte-for-byte ANSI replay outside jeo/tmux to isolate root causes deterministically) uncovered and closed a progressive screen-corruption bug: resizing down to a narrow terminal (e.g. a ~20-column tmux pane) produced a growing stack of duplicate status-bar lines on every subsequent keystroke, and a separate, independently-reproducible scroll bug in the mid-turn live renderer.
-- **[0.8.32]** (2026-07-20) — gjc parity: TUI display-width/wrapping is now grapheme-cluster-aware for emoji sequences (VS16 presentation, skin-tone modifiers, keycaps, ZWJ-joined emoji like family/profession glyphs), fixing box-border and wrap misalignment ("깨짐") that the old per-code-point width summation produced whenever such a sequence appeared in a message — Korean/CJK-only text was already correctly handled and is unaffected.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full history.
 <!-- CHANGELOG:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jeo-code",
-  "version": "0.8.36",
+  "version": "0.8.38",
   "description": "Clean, highly optimized AI coding agent using spec-first loop",
   "type": "module",
   "main": "src/cli.ts",

package/src/tui/components/width.ts

@@ -26,6 +26,11 @@ export function charWidth(cp: number): number {
   // C0/C1 control characters have no width here (callers strip/By handle them).
   if (cp < 32 || (cp >= 0x7f && cp < 0xa0)) return 0;
   // Zero-width: combining marks, ZWSP/ZWNJ/ZWJ, variation selectors, BOM.
+  // Non-Latin combining-mark ranges (Hebrew points/cantillation, Arabic vowel signs,
+  // Devanagari matras/virama, Thai vowels/tone marks) verified against the current
+  // jquast/wcwidth zero-width table (github.com/termux/wcwidth, table_zero.py,
+  // Unicode-aligned as of 2022-12-16) — a real, reproduced gap: e.g. Arabic "بّّ"َ
+  // (base + shadda + fatha) previously counted visibleWidth 3 instead of 1.
   if (
     (cp >= 0x0300 && cp <= 0x036f) || // combining diacritical marks
     (cp >= 0x200b && cp <= 0x200f) || // zero-width space..RLM
@@ -33,6 +38,14 @@ export function charWidth(cp: number): number {
     (cp >= 0x1ab0 && cp <= 0x1aff) || // combining diacritical marks extended
     (cp >= 0x1dc0 && cp <= 0x1dff) || // combining diacritical marks supplement
     (cp >= 0x20d0 && cp <= 0x20ff) || // combining marks for symbols
+    (cp >= 0x0591 && cp <= 0x05bd) || // Hebrew accents/points (Etnahta..Meteg)
+    cp === 0x05bf || (cp >= 0x05c1 && cp <= 0x05c2) || (cp >= 0x05c4 && cp <= 0x05c5) || cp === 0x05c7 || // Hebrew points (Rafe, Shin/Sin Dot, upper/lower dot, Qamats Qatan)
+    (cp >= 0x0610 && cp <= 0x061a) || // Arabic honorific/small signs
+    (cp >= 0x064b && cp <= 0x065f) || cp === 0x0670 || // Arabic vowel signs/tanwin, superscript alef
+    (cp >= 0x06d6 && cp <= 0x06dc) || (cp >= 0x06df && cp <= 0x06e4) || (cp >= 0x06e7 && cp <= 0x06e8) || (cp >= 0x06ea && cp <= 0x06ed) || // Arabic Quranic annotation signs
+    (cp >= 0x0900 && cp <= 0x0902) || cp === 0x093a || cp === 0x093c || // Devanagari candrabindu/anusvara/vowel-sign-oe/nukta
+    (cp >= 0x0941 && cp <= 0x0948) || cp === 0x094d || (cp >= 0x0951 && cp <= 0x0957) || (cp >= 0x0962 && cp <= 0x0963) || // Devanagari vowel signs/virama/stress/vocalic
+    cp === 0x0e31 || (cp >= 0x0e34 && cp <= 0x0e3a) || (cp >= 0x0e47 && cp <= 0x0e4e) || // Thai vowels/tone marks
     cp === 0xfeff
   ) {
     return 0;
@@ -64,6 +77,12 @@ const VS16 = 0xfe0f; // variation selector: force EMOJI (wide) presentation
 const FITZPATRICK_MIN = 0x1f3fb; // Emoji Modifier Fitzpatrick Type-1-2 .. Type-6
 const FITZPATRICK_MAX = 0x1f3ff;
 const KEYCAP_COMBINING = 0x20e3; // combining enclosing keycap (1️⃣, #️⃣, *️⃣)
+const RI_MIN = 0x1f1e6; // Regional Indicator Symbol Letter A
+const RI_MAX = 0x1f1ff; // Regional Indicator Symbol Letter Z
+
+function isRegionalIndicator(cp: number): boolean {
+  return cp >= RI_MIN && cp <= RI_MAX;
+}
 
 function isFitzpatrick(cp: number): boolean {
   return cp >= FITZPATRICK_MIN && cp <= FITZPATRICK_MAX;
@@ -78,6 +97,10 @@ function isAttachableCombining(cp: number): boolean {
     || (cp >= 0x1ab0 && cp <= 0x1aff)
     || (cp >= 0x1dc0 && cp <= 0x1dff)
     || (cp >= 0x20d0 && cp <= 0x20ff)
+    || (cp >= 0x0591 && cp <= 0x05bd) || cp === 0x05bf || (cp >= 0x05c1 && cp <= 0x05c2) || (cp >= 0x05c4 && cp <= 0x05c5) || cp === 0x05c7 // Hebrew
+    || (cp >= 0x0610 && cp <= 0x061a) || (cp >= 0x064b && cp <= 0x065f) || cp === 0x0670 || (cp >= 0x06d6 && cp <= 0x06dc) || (cp >= 0x06df && cp <= 0x06e4) || (cp >= 0x06e7 && cp <= 0x06e8) || (cp >= 0x06ea && cp <= 0x06ed) // Arabic
+    || (cp >= 0x0900 && cp <= 0x0902) || cp === 0x093a || cp === 0x093c || (cp >= 0x0941 && cp <= 0x0948) || cp === 0x094d || (cp >= 0x0951 && cp <= 0x0957) || (cp >= 0x0962 && cp <= 0x0963) // Devanagari
+    || cp === 0x0e31 || (cp >= 0x0e34 && cp <= 0x0e3a) || (cp >= 0x0e47 && cp <= 0x0e4e) // Thai
     || cp === 0xfeff;
 }
 
@@ -110,6 +133,17 @@ export function nextGraphemeCluster(s: string, i: number): { length: number; wid
   let len = base.length;
   let j = i + base.length;
   const peek = (): number => s.codePointAt(j) ?? -1;
+  // A pair of adjacent Regional Indicators forms ONE flag-emoji cluster (UAX #29's
+  // RI-pairing rule) — e.g. 🇰🇷 = REGIONAL INDICATOR K + REGIONAL INDICATOR R. Each
+  // RI alone is already width 1 (no dedicated charWidth range; falls through to the
+  // default), so an unpaired scan already SUMS to the right total (2) even without
+  // this — but without pairing, a wrap/truncate boundary can land BETWEEN the two,
+  // rendering a lone indicator-letter square instead of a flag. No further
+  // modifiers (VS16/ZWJ/Fitzpatrick) are defined for a flag pair, so return early.
+  if (isRegionalIndicator(base.cp) && isRegionalIndicator(peek())) {
+    const second = codePointAndLength(s, j);
+    return { length: len + second.length, width: 2 };
+  }
 
   if (peek() === VS15) { width = 1; len += 1; j += 1; }
   else if (peek() === VS16) { width = 2; len += 1; j += 1; }
@@ -322,6 +356,28 @@ export function wrapTextWithAnsi(text: string, cols: number): string[] {
         : head.endsWith(RESET) && rest.startsWith(head.slice(0, -RESET.length))
           ? head.slice(0, -RESET.length)
           : head;
+      if (consumed.length === 0) {
+        // `truncateToWidth` couldn't fit even ONE whole cluster in `width` — a wide
+        // grapheme cluster (CJK/emoji/ZWJ sequence) wider than the available column
+        // budget, e.g. a 2-wide cluster at cols=1. Left alone, `rest` never shrinks
+        // and this loop spins forever — a REAL, reproduced infinite loop (hangs the
+        // whole TUI; confirmed live via a 5s timeout kill before this fix). Force
+        // forward progress: emit that one cluster on its own, deliberately
+        // over-width, line — an unavoidable overflow beats a hung process. `rest[0]`
+        // is guaranteed to be real content here, never an escape sequence (those are
+        // always consumed into `head` regardless of the width budget, so an empty
+        // `head` can only mean the first REAL cluster itself didn't fit).
+        const forced = nextGraphemeCluster(rest, 0);
+        const forcedText = rest.slice(0, forced.length);
+        let forcedLine = active + forcedText;
+        const forcedActive = sgrStateAfter(active, forcedText);
+        if (forcedActive && !forcedLine.endsWith(RESET)) forcedLine += RESET;
+        out.push(forcedLine);
+        active = forcedActive;
+        rest = rest.slice(forced.length);
+        if (rest.length === 0) break;
+        continue;
+      }
       if (consumed.length === rest.length) {
         let line = active + rest;
         if (active && !line.endsWith(RESET)) line += RESET;

package/src/util/file-attachment.ts

@@ -13,11 +13,23 @@
  * Only paths with a known image extension are considered, so ordinary prose is
  * never mistaken for a file. Non-image / unreadable paths are left untouched.
  */
-import { readFile } from "node:fs/promises";
+import { readFile, stat } from "node:fs/promises";
 import type { ImageAttachment } from "../ai/types";
 
 const IMAGE_EXT_RE = /\.(?:png|jpe?g|gif|webp|bmp)$/i;
 
+/** Reject a dropped/pasted image path bigger than this before reading it fully into
+ *  memory (gjc parity, #2658's "source size" bound in spirit — a scoped-down version
+ *  for jeo's simpler single-read attach path, not the full symlink/TOCTOU/consent
+ *  hardening that PR added for a materially different threat model: gjc validates
+ *  arbitrary bracketed-paste text that may originate from an untrusted clipboard
+ *  source, while this reads a path the user directly typed/dropped into their own
+ *  composer). Without a cap, a stray path to a multi-GB file — a typo, or a dropped
+ *  huge video misidentified by extension — would be read ENTIRELY into memory before
+ *  the magic-byte check below ever gets to reject it. 25 MiB comfortably covers any
+ *  real photo/screenshot while bounding the worst case. */
+export const MAX_ATTACH_IMAGE_BYTES = 25 * 1024 * 1024;
+
 
 /**
  * Normalize the whitespace around every `[image #N]` tag to a single space:
@@ -150,6 +162,8 @@ export type FileReader = (path: string) => Promise<Uint8Array | null>;
 
 const defaultReader: FileReader = async (p) => {
   try {
+    const st = await stat(p);
+    if (!st.isFile() || st.size > MAX_ATTACH_IMAGE_BYTES) return null;
     return new Uint8Array(await readFile(p));
   } catch {
     return null;