switchroom 0.18.25 → 0.18.26

package/dist/cli/switchroom.js

@@ -2120,7 +2120,7 @@ var init_esm = __esm(() => {
 });
 
 // src/build-info.ts
-var VERSION = "0.18.25", COMMIT_SHA = "01803cff";
+var VERSION = "0.18.26", COMMIT_SHA = "ceb7d1a9";
 
 // src/cli/resolve-version.ts
 import { existsSync, readFileSync } from "node:fs";

package/dist/host-control/main.js

@@ -26605,7 +26605,7 @@ import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:f
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.25";
+var VERSION = "0.18.26";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "switchroom",
   "//version": "NOT the release version — source of truth is the git tag, resolved by scripts/build.mjs:resolveVersion() (see CLAUDE.md > Standard release process). This field is stale by design and only the Layer-4 dev/non-tag fallback for build.mjs + src/cli/resolve-version.ts; do NOT bump it expecting a release to pick it up. npm-pack tarball naming needs a real version — do that as an UNCOMMITTED pack-time bump (see release step 6), never a committed one.",
-  "version": "0.18.25",
+  "version": "0.18.26",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {
@@ -28,7 +28,7 @@
     "test:vitest": "vitest run",
     "test:bun": "bun test src/vault/grants.test.ts src/vault/grants-db.test.ts src/vault/write-grants.test.ts src/vault/broker/server-grants.test.ts src/vault/broker/server-write-grants.test.ts src/vault/broker/server-mint-grant-passphrase-attest.test.ts src/vault/broker/server-passphrase-attest.test.ts src/vault/broker/server-mint-grant-posture-attest.test.ts src/vault/broker/server-admin-only-keys.test.ts src/vault/broker/client-token.test.ts src/vault/broker/server-unlock.test.ts src/vault/broker/auto-unlock.test.ts src/vault/broker/drift-detection.test.ts tests/vault-broker-passphrase.test.ts src/cli/vault-get-broker.test.ts src/vault/resolver-via-broker.test.ts src/vault/broker/scope.test.ts src/vault/broker/server.test.ts src/litellm/provision-apply-e2e.test.ts src/drive/disconnect.test.ts src/drive/grants.test.ts src/drive/oauth.test.ts src/drive/onboarding.test.ts src/drive/reconciler.test.ts src/drive/vault-slots.test.ts src/drive/wrapper.test.ts src/vault/approvals/kernel.test.ts src/vault/approvals/approval-origin.test.ts src/vault/approvals/schema-idempotent.test.ts src/vault/broker/server-approvals.test.ts telegram-plugin/tests/boot-probes.test.ts telegram-plugin/tests/boot-version-string.test.ts telegram-plugin/tests/history.test.ts telegram-plugin/tests/cross-turn-card-gate.test.ts telegram-plugin/tests/emission-authority-open-gate.test.ts telegram-plugin/tests/emission-authority-ping-gate.test.ts telegram-plugin/tests/emission-authority-card-drain-gate.test.ts telegram-plugin/tests/per-topic-current-turn.test.ts telegram-plugin/tests/history-reaper.test.ts telegram-plugin/tests/ipc-server-client.test.ts telegram-plugin/tests/ipc-server-race.test.ts telegram-plugin/tests/ipc-server-query-pending-permission.test.ts telegram-plugin/tests/ipc-server-check-pre-approved.test.ts telegram-plugin/tests/gateway-bridge.test.ts telegram-plugin/tests/gateway-startup-mutex.test.ts telegram-plugin/tests/gateway-clean-shutdown-marker.test.ts telegram-plugin/tests/boot-card-dedupe.test.ts telegram-plugin/tests/boot-card-reason.test.ts telegram-plugin/tests/progress-update.test.ts telegram-plugin/tests/quota-cache.test.ts telegram-plugin/tests/silent-reply-guard.test.ts telegram-plugin/tests/unhandled-rejection-policy.test.ts telegram-plugin/tests/registry-turns.test.ts telegram-plugin/registry/subagents.test.ts telegram-plugin/registry/subagents-bugs.test.ts telegram-plugin/tests/subagent-watcher-parent-turn-key.test.ts telegram-plugin/tests/subagent-nested-dispatch.test.ts telegram-plugin/tests/nested-worker-visibility-harness.test.ts telegram-plugin/tests/turns-writer.test.ts telegram-plugin/tests/resume-inbound-builder.test.ts telegram-plugin/tests/subagent-tracker-hooks.test.ts telegram-plugin/tests/resolve-calling-subagent.test.ts telegram-plugin/tests/gateway-update-placeholder-dispatch.test.ts telegram-plugin/tests/status-query-telemetry.test.ts telegram-plugin/tests/reaction-trigger.test.ts telegram-plugin/tests/reaction-trigger-flow.test.ts telegram-plugin/tests/subagent-watcher-workflow-visibility.test.ts telegram-plugin/uat/load-env.test.ts telegram-plugin/uat/feed-matcher.test.ts telegram-plugin/uat/uat-driver.test.ts telegram-plugin/gateway/webhook-ingest-server.test.ts telegram-plugin/tests/skill-proposal-card.test.ts",
     "test:watch": "vitest",
-    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs",
+    "lint": "tsc --noEmit && node scripts/check-plugin-references.mjs && bash scripts/check-bot-api-wrapping.sh && node scripts/check-bun-test-imports.mjs && node scripts/check-no-pii-secrets.mjs && node scripts/check-vault-test-hermeticity.mjs && node scripts/check-no-broadcast-delivery.mjs && node scripts/check-stale-tool-descriptions.mjs && node scripts/check-web-subscription-honest.mjs && node scripts/check-no-unpinned-npx-playwright.mjs",
     "lint:tsc": "tsc --noEmit",
     "lint:plugin-references": "node scripts/check-plugin-references.mjs",
     "lint:bot-api-wrapping": "bash scripts/check-bot-api-wrapping.sh",

package/telegram-plugin/dist/gateway/gateway.js

@@ -7525,9 +7525,329 @@ var init_approval_card = __esm(() => {
   import_grammy3 = __toESM(require_mod2(), 1);
 });
 
+// render/code-segments.ts
+function findClosingBackticks(text, from, runLen) {
+  let i = from;
+  while (i < text.length) {
+    if (text[i] === "`") {
+      let j = i;
+      while (j < text.length && text[j] === "`")
+        j++;
+      if (j - i === runLen)
+        return j;
+      i = j;
+    } else {
+      i++;
+    }
+  }
+  return -1;
+}
+function splitCodeSegments(text) {
+  const out = [];
+  let i = 0;
+  let plainStart = 0;
+  while (i < text.length) {
+    if (text[i] === "`") {
+      let j = i;
+      while (j < text.length && text[j] === "`")
+        j++;
+      const runLen = j - i;
+      const close = findClosingBackticks(text, j, runLen);
+      if (close !== -1) {
+        if (plainStart < i)
+          out.push({ code: false, text: text.slice(plainStart, i) });
+        out.push({ code: true, text: text.slice(i, close) });
+        i = close;
+        plainStart = close;
+        continue;
+      }
+    }
+    i++;
+  }
+  if (plainStart < text.length)
+    out.push({ code: false, text: text.slice(plainStart) });
+  return out;
+}
+function isTableDelimiterRow(line) {
+  const t = line.trim();
+  return t.length > 0 && /^[\s|:-]+$/.test(t) && t.includes("-") && t.includes("|");
+}
+function isTableCandidateLine(line) {
+  return /^\s*\|/.test(line);
+}
+function findTableRanges(text) {
+  const ranges = [];
+  const lines = text.split(`
+`);
+  let offset = 0;
+  let runStart = -1;
+  let runEnd = -1;
+  let runHasDelim = false;
+  let runLineCount = 0;
+  const flush = () => {
+    if (runStart !== -1 && runLineCount >= 2 && runHasDelim) {
+      ranges.push([runStart, runEnd]);
+    }
+    runStart = -1;
+    runEnd = -1;
+    runHasDelim = false;
+    runLineCount = 0;
+  };
+  for (let k = 0;k < lines.length; k++) {
+    const line = lines[k];
+    const lineLen = line.length + (k < lines.length - 1 ? 1 : 0);
+    if (isTableCandidateLine(line)) {
+      if (runStart === -1)
+        runStart = offset;
+      runEnd = offset + lineLen;
+      runLineCount += 1;
+      if (isTableDelimiterRow(line))
+        runHasDelim = true;
+    } else {
+      flush();
+    }
+    offset += lineLen;
+  }
+  flush();
+  return ranges;
+}
+function splitProseProtected(text) {
+  const out = [];
+  const tables = findTableRanges(text);
+  let tIdx = 0;
+  let i = 0;
+  let plainStart = 0;
+  const pushProtected = (from, to) => {
+    if (plainStart < from)
+      out.push({ code: false, text: text.slice(plainStart, from) });
+    out.push({ code: true, text: text.slice(from, to) });
+    plainStart = to;
+  };
+  while (i < text.length) {
+    while (tIdx < tables.length && tables[tIdx][1] <= i)
+      tIdx++;
+    if (tIdx < tables.length && tables[tIdx][0] === i) {
+      const [, end] = tables[tIdx];
+      pushProtected(i, end);
+      i = end;
+      continue;
+    }
+    const ch = text[i];
+    if (ch === "[") {
+      const close = text.indexOf("]", i + 1);
+      if (close !== -1 && text[close + 1] === "(") {
+        const destClose = text.indexOf(")", close + 2);
+        if (destClose !== -1) {
+          pushProtected(close + 1, destClose + 1);
+          i = destClose + 1;
+          continue;
+        }
+      }
+      i++;
+      continue;
+    }
+    if ((ch === "h" || ch === "w") && (i === 0 || !/[A-Za-z0-9]/.test(text[i - 1]))) {
+      const m = /^(?:https?:\/\/|www\.)[^\s<>()\[\]]+/.exec(text.slice(i));
+      if (m) {
+        const end = i + m[0].length;
+        pushProtected(i, end);
+        i = end;
+        continue;
+      }
+    }
+    i++;
+  }
+  if (plainStart < text.length)
+    out.push({ code: false, text: text.slice(plainStart) });
+  return out;
+}
+function splitProtectedSegments(text) {
+  const out = [];
+  for (const seg of splitCodeSegments(text)) {
+    if (seg.code) {
+      out.push(seg);
+      continue;
+    }
+    for (const sub of splitProseProtected(seg.text))
+      out.push(sub);
+  }
+  return out;
+}
+
+// render/dollar-math-guard.ts
+function guardDollarMath(text) {
+  if (!text.includes("$"))
+    return text;
+  const segments = splitProtectedSegments(text);
+  let total = 0;
+  let hasCurrencySignal = false;
+  for (const seg of segments) {
+    if (seg.code)
+      continue;
+    total += seg.text.match(ANY_DOLLAR)?.length ?? 0;
+    if (!hasCurrencySignal && CURRENCY_SIGNAL.test(seg.text))
+      hasCurrencySignal = true;
+  }
+  if (total < 2 || !hasCurrencySignal)
+    return text;
+  return segments.map((seg) => seg.code ? seg.text : seg.text.replace(UNESCAPED_DOLLAR, () => "\\$")).join("");
+}
+var ANY_DOLLAR, CURRENCY_SIGNAL, UNESCAPED_DOLLAR;
+var init_dollar_math_guard = __esm(() => {
+  ANY_DOLLAR = /\$/g;
+  CURRENCY_SIGNAL = /\$\.?\d|\d\s?\$/;
+  UNESCAPED_DOLLAR = /(?<!\\)\$/g;
+});
+
+// render/emphasis-guard.ts
+function guardAccidentalEmphasis(text) {
+  if (!text.includes("_") && !text.includes("*"))
+    return text;
+  const segments = splitProtectedSegments(text);
+  let hasIntraUnderscore = false;
+  let hasIntraAsterisk = false;
+  let underscoreCount = 0;
+  let asteriskCount = 0;
+  for (const seg of segments) {
+    if (seg.code)
+      continue;
+    if (INTRA_WORD_UNDERSCORE.test(seg.text))
+      hasIntraUnderscore = true;
+    if (INTRA_WORD_ASTERISK.test(seg.text))
+      hasIntraAsterisk = true;
+    underscoreCount += seg.text.match(ANY_UNDERSCORE)?.length ?? 0;
+    asteriskCount += seg.text.match(ANY_ASTERISK)?.length ?? 0;
+  }
+  INTRA_WORD_UNDERSCORE.lastIndex = 0;
+  INTRA_WORD_ASTERISK.lastIndex = 0;
+  const armUnderscore = hasIntraUnderscore && underscoreCount >= 2;
+  const armAsterisk = hasIntraAsterisk && asteriskCount >= 2;
+  if (!armUnderscore && !armAsterisk)
+    return text;
+  return segments.map((seg) => {
+    if (seg.code)
+      return seg.text;
+    let out = seg.text;
+    if (armUnderscore)
+      out = out.replace(INTRA_WORD_UNDERSCORE, "\\_");
+    if (armAsterisk)
+      out = out.replace(INTRA_WORD_ASTERISK, "\\*");
+    return out;
+  }).join("");
+}
+var INTRA_WORD_UNDERSCORE, INTRA_WORD_ASTERISK, ANY_UNDERSCORE, ANY_ASTERISK;
+var init_emphasis_guard = __esm(() => {
+  INTRA_WORD_UNDERSCORE = /(?<=[A-Za-z0-9])_(?=[A-Za-z0-9])/g;
+  INTRA_WORD_ASTERISK = /(?<=[A-Za-z0-9])\*(?=[A-Za-z0-9])/g;
+  ANY_UNDERSCORE = /(?<!\\)_/g;
+  ANY_ASTERISK = /(?<!\\)\*/g;
+});
+
+// render/line-start-guard.ts
+function escapeAccidentalLineStart(line) {
+  const indent = /^ */.exec(line)[0];
+  if (indent.length >= 4)
+    return line;
+  const rest = line.slice(indent.length);
+  if (ACCIDENTAL_BLOCKQUOTE.test(rest)) {
+    return indent + "\\" + rest;
+  }
+  const ol = ACCIDENTAL_ORDERED_LIST.exec(rest);
+  if (ol) {
+    const digits = ol[1];
+    const delim = ol[2];
+    return indent + digits + "\\" + delim + rest.slice(digits.length + 1);
+  }
+  return line;
+}
+function guardAccidentalBlockConstructs(text) {
+  if (!text.includes(">") && !/\d{4,}[.)]/.test(text))
+    return text;
+  const segments = splitProtectedSegments(text);
+  let out = "";
+  let atLineStart = true;
+  for (const seg of segments) {
+    if (seg.code) {
+      out += seg.text;
+      atLineStart = seg.text.endsWith(`
+`);
+      continue;
+    }
+    const lines = seg.text.split(`
+`);
+    for (let k = 0;k < lines.length; k++) {
+      const lineIsAtStart = k === 0 ? atLineStart : true;
+      const processed = lineIsAtStart ? escapeAccidentalLineStart(lines[k]) : lines[k];
+      out += processed;
+      if (k < lines.length - 1)
+        out += `
+`;
+    }
+    atLineStart = seg.text.endsWith(`
+`);
+  }
+  return out;
+}
+var ACCIDENTAL_BLOCKQUOTE, ACCIDENTAL_ORDERED_LIST;
+var init_line_start_guard = __esm(() => {
+  ACCIDENTAL_BLOCKQUOTE = /^>[0-9=]/;
+  ACCIDENTAL_ORDERED_LIST = /^(\d{4,})([.)])(\s|$)/;
+});
+
+// render/inline-pairs-guard.ts
+function countMatches(text, re) {
+  return text.match(re)?.length ?? 0;
+}
+function guardAccidentalInlinePairs(text) {
+  if (!/[~=|]/.test(text))
+    return text;
+  const segments = splitProtectedSegments(text);
+  let tildes = 0;
+  let marks = 0;
+  let spoilers = 0;
+  for (const seg of segments) {
+    if (seg.code)
+      continue;
+    tildes += countMatches(seg.text, TILDE_APPROX);
+    marks += countMatches(seg.text, MARK_OP);
+    spoilers += countMatches(seg.text, SPOILER_OP);
+  }
+  const armTilde = tildes >= 2;
+  const armMark = marks >= 2;
+  const armSpoiler = spoilers >= 2;
+  if (!armTilde && !armMark && !armSpoiler)
+    return text;
+  return segments.map((seg) => {
+    if (seg.code)
+      return seg.text;
+    let out = seg.text;
+    if (armTilde)
+      out = out.replace(TILDE_APPROX, () => "\\~");
+    if (armMark)
+      out = out.replace(MARK_OP, () => "\\=\\=");
+    if (armSpoiler)
+      out = out.replace(SPOILER_OP, () => "\\|\\|");
+    return out;
+  }).join("");
+}
+var TILDE_APPROX, MARK_OP, SPOILER_OP;
+var init_inline_pairs_guard = __esm(() => {
+  TILDE_APPROX = /(?<!\\)~(?=\$?\.?\d)/g;
+  MARK_OP = /(?<=\w)==(?=\w)/g;
+  SPOILER_OP = /(?<=\w)\|\|(?=\w)/g;
+});
+
 // rich-send.ts
+function guardAccidentalFormatting(markdown) {
+  let out = markdown;
+  out = guardAccidentalEmphasis(out);
+  out = guardAccidentalBlockConstructs(out);
+  out = guardAccidentalInlinePairs(out);
+  out = guardDollarMath(out);
+  return out;
+}
 function richMessage(markdown) {
-  return { markdown };
+  return { markdown: guardAccidentalFormatting(markdown) };
 }
 function isParseEntitiesError(err) {
   if (!(err instanceof import_grammy4.GrammyError) || err.error_code !== 400)
@@ -7545,6 +7865,10 @@ function isLengthError(err) {
 }
 var import_grammy4;
 var init_rich_send = __esm(() => {
+  init_dollar_math_guard();
+  init_emphasis_guard();
+  init_line_start_guard();
+  init_inline_pairs_guard();
   import_grammy4 = __toESM(require_mod2(), 1);
 });
 
@@ -67710,9 +68034,21 @@ function backOffOpenInline2(text4, cut) {
 }
 
 // rich-send.ts
+init_dollar_math_guard();
+init_emphasis_guard();
+init_line_start_guard();
+init_inline_pairs_guard();
 var import_grammy8 = __toESM(require_mod2(), 1);
+function guardAccidentalFormatting2(markdown) {
+  let out = markdown;
+  out = guardAccidentalEmphasis(out);
+  out = guardAccidentalBlockConstructs(out);
+  out = guardAccidentalInlinePairs(out);
+  out = guardDollarMath(out);
+  return out;
+}
 function richMessage2(markdown) {
-  return { markdown };
+  return { markdown: guardAccidentalFormatting2(markdown) };
 }
 
 // gateway/redelivery-decision.ts
@@ -83460,10 +83796,10 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.18.25";
-var COMMIT_SHA = "01803cff";
-var COMMIT_DATE = "2026-07-15T16:26:26+10:00";
-var LATEST_PR = 3254;
+var VERSION = "0.18.26";
+var COMMIT_SHA = "ceb7d1a9";
+var COMMIT_DATE = "2026-07-15T11:05:52Z";
+var LATEST_PR = 3258;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts

package/telegram-plugin/render/code-segments.ts

@@ -0,0 +1,210 @@
+// Shared CommonMark-correct code-span / fenced-block splitter for the outbound
+// formatting guards (#3252). Every guard that neutralises accidental Telegram
+// markdown typesetting (dollar-math, emphasis, line-start block constructs,
+// inline pairs) must skip content inside code spans and fenced code blocks
+// verbatim. Rather than each guard forking its own copy of the splitter (the
+// dollar guard shipped one, the emphasis + line-start guards each duplicated
+// it), this is the ONE source of truth they all import.
+
+/** A contiguous slice of rendered markdown, tagged as code (verbatim, never
+ *  transformed) or prose (eligible for a guard's rewrite). */
+export interface Segment {
+  code: boolean;
+  text: string;
+}
+
+/** From index `from` (just past an opening run of `runLen` backticks), find the
+ *  index immediately AFTER the matching closing run of exactly `runLen`
+ *  backticks. Returns -1 when there is no matching close (a stray backtick), in
+ *  which case the opener is treated as literal prose. Equal-length matching is
+ *  the CommonMark rule for code spans and matches the balanced fences the
+ *  renderer emits for code blocks. */
+export function findClosingBackticks(text: string, from: number, runLen: number): number {
+  let i = from;
+  while (i < text.length) {
+    if (text[i] === "`") {
+      let j = i;
+      while (j < text.length && text[j] === "`") j++;
+      if (j - i === runLen) return j;
+      i = j;
+    } else {
+      i++;
+    }
+  }
+  return -1;
+}
+
+/** Split rendered markdown into alternating prose / code segments so a guard can
+ *  skip code spans and fenced code blocks entirely. */
+export function splitCodeSegments(text: string): Segment[] {
+  const out: Segment[] = [];
+  let i = 0;
+  let plainStart = 0;
+  while (i < text.length) {
+    if (text[i] === "`") {
+      let j = i;
+      while (j < text.length && text[j] === "`") j++;
+      const runLen = j - i;
+      const close = findClosingBackticks(text, j, runLen);
+      if (close !== -1) {
+        if (plainStart < i) out.push({ code: false, text: text.slice(plainStart, i) });
+        out.push({ code: true, text: text.slice(i, close) });
+        i = close;
+        plainStart = close;
+        continue;
+      }
+    }
+    i++;
+  }
+  if (plainStart < text.length) out.push({ code: false, text: text.slice(plainStart) });
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// Link / autolink / table protection (#3252 — link-aware guards)
+// ---------------------------------------------------------------------------
+//
+// The four accidental-formatting guards must NOT escape inside content where
+// the trigger chars (`_ * ~ = | $`) are STRUCTURAL rather than prose:
+//   • markdown link destinations — the `(url)` (and `(url "title")`) target of
+//     a `[label](url)` link. Underscores / tildes / `==` in a URL path or query
+//     are part of the address; a backslash there can 404 the link. The link
+//     LABEL (`[...]`) is rendered prose and stays guarded.
+//   • bare autolinked URLs — `http(s)://…` and `www.…` runs Telegram auto-links.
+//   • GFM table rows — a table's structural pipes / empty cells (`|a||b|`) must
+//     survive; escaping inside a real table row corrupts the table.
+// Everything else is prose and stays fully guarded. This is the sibling of the
+// code-span skip: a PROTECTED segment (`code: true`) is emitted verbatim.
+//
+// Deterministic and linear-time: one left-to-right char scan per prose chunk
+// plus one line pre-pass for tables; no backtracking regexes.
+
+/** A GFM table delimiter row: only pipes / colons / dashes / spaces, with at
+ *  least one dash AND at least one pipe (a bare `---` is a thematic break, not a
+ *  table). This is what distinguishes a real table from prose that merely starts
+ *  with `|`. */
+function isTableDelimiterRow(line: string): boolean {
+  const t = line.trim();
+  return t.length > 0 && /^[\s|:-]+$/.test(t) && t.includes("-") && t.includes("|");
+}
+
+/** A candidate table line: after optional leading spaces it begins with `|`. */
+function isTableCandidateLine(line: string): boolean {
+  return /^\s*\|/.test(line);
+}
+
+/** Find the [start, end) char ranges (relative to `text`) of GFM table blocks —
+ *  maximal runs of 2+ consecutive `|`-leading lines that contain a delimiter
+ *  row. Each returned range spans whole lines INCLUDING their trailing newline,
+ *  so a table becomes ONE protected segment. A lone `|a||b|` line with no
+ *  delimiter row is NOT a real table → not protected → still guarded. */
+function findTableRanges(text: string): Array<[number, number]> {
+  const ranges: Array<[number, number]> = [];
+  const lines = text.split("\n");
+  let offset = 0;
+  let runStart = -1;
+  let runEnd = -1;
+  let runHasDelim = false;
+  let runLineCount = 0;
+  const flush = () => {
+    if (runStart !== -1 && runLineCount >= 2 && runHasDelim) {
+      ranges.push([runStart, runEnd]);
+    }
+    runStart = -1;
+    runEnd = -1;
+    runHasDelim = false;
+    runLineCount = 0;
+  };
+  for (let k = 0; k < lines.length; k++) {
+    const line = lines[k];
+    // char length of this line including its trailing newline (except the last).
+    const lineLen = line.length + (k < lines.length - 1 ? 1 : 0);
+    if (isTableCandidateLine(line)) {
+      if (runStart === -1) runStart = offset;
+      runEnd = offset + lineLen;
+      runLineCount += 1;
+      if (isTableDelimiterRow(line)) runHasDelim = true;
+    } else {
+      flush();
+    }
+    offset += lineLen;
+  }
+  flush();
+  return ranges;
+}
+
+/** Protect links / autolinks / table rows within a single PROSE chunk, returning
+ *  alternating prose / protected segments. */
+function splitProseProtected(text: string): Segment[] {
+  const out: Segment[] = [];
+  const tables = findTableRanges(text);
+  let tIdx = 0;
+  let i = 0;
+  let plainStart = 0;
+  const pushProtected = (from: number, to: number) => {
+    if (plainStart < from) out.push({ code: false, text: text.slice(plainStart, from) });
+    out.push({ code: true, text: text.slice(from, to) });
+    plainStart = to;
+  };
+  while (i < text.length) {
+    // Advance the table pointer past any range we've already scanned past.
+    while (tIdx < tables.length && tables[tIdx][1] <= i) tIdx++;
+    // 1. Table block — protect whole lines verbatim.
+    if (tIdx < tables.length && tables[tIdx][0] === i) {
+      const [, end] = tables[tIdx];
+      pushProtected(i, end);
+      i = end;
+      continue;
+    }
+    const ch = text[i];
+    // 2. Markdown link destination: `[label](dest)` — protect only `(dest)`.
+    if (ch === "[") {
+      const close = text.indexOf("]", i + 1);
+      if (close !== -1 && text[close + 1] === "(") {
+        const destClose = text.indexOf(")", close + 2);
+        if (destClose !== -1) {
+          // Protect the `(dest)` span; the `[label]` before it stays prose.
+          pushProtected(close + 1, destClose + 1);
+          i = destClose + 1;
+          continue;
+        }
+      }
+      i++;
+      continue;
+    }
+    // 3. Bare autolink: `http(s)://…` or `www.…`, left-flanked by a boundary.
+    if (
+      (ch === "h" || ch === "w") &&
+      (i === 0 || !/[A-Za-z0-9]/.test(text[i - 1]))
+    ) {
+      const m = /^(?:https?:\/\/|www\.)[^\s<>()\[\]]+/.exec(text.slice(i));
+      if (m) {
+        const end = i + m[0].length;
+        pushProtected(i, end);
+        i = end;
+        continue;
+      }
+    }
+    i++;
+  }
+  if (plainStart < text.length) out.push({ code: false, text: text.slice(plainStart) });
+  return out;
+}
+
+/** Split rendered markdown into prose / protected segments where a PROTECTED
+ *  (`code: true`) segment is any content a guard must emit verbatim: code spans,
+ *  fenced code blocks, markdown link destinations, bare autolinks, and GFM
+ *  table rows. This is the link/table-aware superset of `splitCodeSegments` that
+ *  all four #3252 guards route through. Prose segments (`code: false`) remain
+ *  guardable (including a link's `[label]` text). Deterministic, linear-time. */
+export function splitProtectedSegments(text: string): Segment[] {
+  const out: Segment[] = [];
+  for (const seg of splitCodeSegments(text)) {
+    if (seg.code) {
+      out.push(seg);
+      continue;
+    }
+    for (const sub of splitProseProtected(seg.text)) out.push(sub);
+  }
+  return out;
+}