talon-agent 3.8.1 → 3.9.0

package/src/frontend/native/server.ts

@@ -133,14 +133,17 @@ export type BridgeServerHandlers = {
     | Promise<{ devices: DeviceInfo[]; locations: DeviceLocation[] }>;
   /** A device answered a device_command; true when a call was waiting. */
   completeCommand(body: Record<string, unknown>): boolean;
-  /** A device streams a pull-transfer's file body up (raw request body). */
+  /** A device streams a pull-transfer's file body up (raw request body).
+   *  `fromDeviceId` is the caller's claimed identity, when it sent one. */
   acceptFileUpload(
     token: string,
     body: IncomingMessage,
+    fromDeviceId?: string,
   ): Promise<{ ok: true; bytes: number } | { ok: false; error: string }>;
   /** Resolve a push-transfer token to the file to stream down, or null. */
   openFileDownload(
     token: string,
+    fromDeviceId?: string,
   ): Promise<{ path: string; size: number } | null>;
   /** Resolve a node-provisioning token to its installer script, or null. */
   openNodeInstall(token: string): { script: string; filename: string } | null;
@@ -152,6 +155,12 @@ const SSE_PING_MS = 25_000;
 const MAX_BODY_BYTES = 256 * 1024;
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 const PORT_FALLBACKS = 5;
+/**
+ * Longest device id a client may claim (`?deviceId=…`). Matches the
+ * registry's own id cap — a longer id can never name a real device, and the
+ * claim is held for the life of a connection, so it stays a bounded key.
+ */
+const MAX_DEVICE_ID_CHARS = 128;
 
 // Failed-auth lockout: after this many wrong tokens from one address inside
 // the window, that address gets 429s until the window lapses. The token's
@@ -173,7 +182,13 @@ type AuthState = "ok" | "anonymous" | "bad";
 
 export class BridgeServer {
   private server: Server | null = null;
-  private clients = new Set<ServerResponse>();
+  /**
+   * Live SSE connections → the mesh device id each one claimed on connect
+   * (undefined for clients that didn't claim one: desktop UIs, and companion
+   * builds from before the claim existed). The claim is what makes
+   * `sendToDevice` addressable rather than a shout.
+   */
+  private clients = new Map<ServerResponse, string | undefined>();
   private pingTimer: ReturnType<typeof setInterval> | undefined;
   private port = 0;
   private tlsIdentity: BridgeTlsIdentity | null = null;
@@ -185,6 +200,9 @@ export class BridgeServer {
       host: string;
       port: number;
       token?: string;
+      /** Origins permitted to call the bridge from a browser. Empty by
+       *  default: native clients send no Origin and need no entry here. */
+      allowedOrigins?: readonly string[];
       startedAt: string;
       /**
        * When present, the bridge serves HTTPS with this identity. A provider
@@ -213,8 +231,50 @@ export class BridgeServer {
   /** Push an event to every connected SSE client. */
   broadcast(event: BridgeEvent): void {
     if (this.clients.size === 0) return;
+    this.write(this.clients.keys(), event);
+  }
+
+  /**
+   * Push an event to the client(s) that claimed `deviceId` — the delivery
+   * path for anything addressed to ONE device.
+   *
+   * Device commands are not public: their params carry one-time transfer
+   * tokens, exec command lines, remote paths, and — on the chunked fallback —
+   * whole base64 file bodies. Broadcasting them handed every connected client
+   * another device's secrets and relied on each client discarding what wasn't
+   * addressed to it, which is courtesy, not enforcement.
+   *
+   * A claim is an ADDRESS, not a credential: any client holding the bridge
+   * token could claim any id, and the bridge token is (still) the only trust
+   * boundary here. What this buys is that a device no longer passively
+   * receives traffic meant for its peers.
+   *
+   * Clients that claimed nothing are the fallback audience, and only when the
+   * target claimed nothing either: a companion build that predates the claim
+   * can't be addressed, and dropping its commands would take the mesh offline
+   * for it. So an updated device's traffic never reaches them — the fallback
+   * shrinks to nothing as the fleet updates.
+   */
+  sendToDevice(deviceId: string, event: BridgeEvent): void {
+    if (this.clients.size === 0) return;
+    const claimed: ServerResponse[] = [];
+    const unclaimed: ServerResponse[] = [];
+    for (const [res, id] of this.clients) {
+      if (id === deviceId) claimed.push(res);
+      else if (id === undefined) unclaimed.push(res);
+    }
+    if (claimed.length === 0) {
+      logDebug(
+        "native",
+        `No SSE client claims device ${deviceId} — delivering to ${unclaimed.length} unclaimed client(s)`,
+      );
+    }
+    this.write(claimed.length > 0 ? claimed : unclaimed, event);
+  }
+
+  private write(targets: Iterable<ServerResponse>, event: BridgeEvent): void {
     const payload = `data: ${JSON.stringify(event)}\n\n`;
-    for (const res of this.clients) {
+    for (const res of targets) {
       try {
         res.write(payload);
       } catch {
@@ -245,7 +305,7 @@ export class BridgeServer {
       : createServer(onRequest);
 
     this.pingTimer = setInterval(() => {
-      for (const res of this.clients) {
+      for (const res of this.clients.keys()) {
         try {
           res.write(": ping\n\n");
         } catch {
@@ -301,7 +361,7 @@ export class BridgeServer {
 
   async stop(): Promise<void> {
     clearInterval(this.pingTimer);
-    for (const res of this.clients) {
+    for (const res of this.clients.keys()) {
       try {
         res.end();
       } catch {
@@ -329,6 +389,29 @@ export class BridgeServer {
     const path = url.pathname;
     const method = req.method ?? "GET";
 
+    // Origin / Host guard runs before everything, including OPTIONS: a
+    // preflight that answers 204 to any origin is itself the permission
+    // slip the browser is asking for.
+    const origin =
+      typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+    const refusal = this.originGuard(req);
+    if (refusal !== undefined) {
+      res.writeHead(403, {
+        ...this.corsHeaders(),
+        "Content-Type": "application/json",
+      });
+      res.end(JSON.stringify({ ok: false, error: refusal }));
+      return;
+    }
+    // Set once here rather than in corsHeaders(): setHeader values survive
+    // every later writeHead(code, {...}) that does not name the same key,
+    // so each of the ~8 response sites keeps the grant without threading
+    // the origin through all of them.
+    if (origin !== undefined && this.isAllowedOrigin(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+    }
+
     if (method === "OPTIONS") {
       res.writeHead(204, this.corsHeaders());
       res.end();
@@ -425,7 +508,10 @@ export class BridgeServer {
     }
 
     try {
-      if (method === "GET" && path === "/events") return this.openStream(res);
+      // A mesh client names itself here so device-addressed events reach it
+      // alone (see sendToDevice); UI clients simply omit it.
+      if (method === "GET" && path === "/events")
+        return this.openStream(res, deviceIdParam(url));
 
       if (method === "GET" && path === "/chats")
         return this.json(res, 200, { chats: this.handlers.listChats() });
@@ -549,12 +635,15 @@ export class BridgeServer {
         const token = url.searchParams.get("transfer") ?? "";
         if (!token)
           return this.json(res, 400, { ok: false, error: "transfer required" });
+        // The caller names itself so the token's device binding can be
+        // checked (see core/mesh/transfers.ts take()).
+        const from = deviceIdParam(url);
         if (method === "POST") {
-          const result = await this.handlers.acceptFileUpload(token, req);
+          const result = await this.handlers.acceptFileUpload(token, req, from);
           return this.json(res, result.ok ? 200 : 409, result);
         }
         if (method === "GET") {
-          const file = await this.handlers.openFileDownload(token);
+          const file = await this.handlers.openFileDownload(token, from);
           if (!file)
             return this.json(res, 404, {
               ok: false,
@@ -725,7 +814,7 @@ export class BridgeServer {
     }
   }
 
-  private openStream(res: ServerResponse): void {
+  private openStream(res: ServerResponse, deviceId?: string): void {
     res.writeHead(200, {
       ...this.corsHeaders(),
       "Content-Type": "text/event-stream",
@@ -752,8 +841,11 @@ export class BridgeServer {
     } catch (err) {
       logError("native", "Failed to replay live turn to new client", err);
     }
-    this.clients.add(res);
-    logDebug("native", `SSE client connected (${this.clients.size} total)`);
+    this.clients.set(res, deviceId);
+    logDebug(
+      "native",
+      `SSE client connected${deviceId ? ` as device ${deviceId}` : ""} (${this.clients.size} total)`,
+    );
     res.on("close", () => {
       this.clients.delete(res);
       logDebug("native", `SSE client left (${this.clients.size} total)`);
@@ -824,9 +916,17 @@ export class BridgeServer {
     );
   }
 
+  /**
+   * CORS headers.
+   *
+   * Deliberately NOT `Access-Control-Allow-Origin: *`. The bridge's clients
+   * are native apps (Electron main process, Flutter, curl, talon-node),
+   * which send no `Origin` at all — a wildcard buys them nothing and hands
+   * every web page on the internet a readable cross-origin channel to the
+   * agent API. Only an explicitly configured origin is echoed back.
+   */
   private corsHeaders(): Record<string, string> {
     return {
-      "Access-Control-Allow-Origin": "*",
       "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
       "Access-Control-Allow-Headers": "Authorization, Content-Type",
       "Access-Control-Max-Age": "86400",
@@ -835,6 +935,55 @@ export class BridgeServer {
     };
   }
 
+  /** True when `origin` is on the operator's `native.allowedOrigins` list. */
+  private isAllowedOrigin(origin: string): boolean {
+    return this.opts.allowedOrigins?.includes(origin) ?? false;
+  }
+
+  /**
+   * Reject browser-driven cross-origin requests and DNS-rebinding.
+   *
+   * Two independent checks, because they stop different attacks:
+   *
+   *   - `Origin`: browsers attach it to every cross-origin request and
+   *     scripts cannot forge it. Native clients omit it entirely. So "an
+   *     Origin we did not allow" means "a web page is driving us" — which,
+   *     on the default unauthenticated loopback bind, would let any site
+   *     the user visits POST /send and run tools on this machine.
+   *   - `Host`: a name that resolves to 127.0.0.1 makes the request
+   *     SAME-origin, so no Origin header is sent and the check above never
+   *     fires. Pinning Host to loopback/the configured bind closes that.
+   *
+   * Returns an error string when the request must be refused.
+   */
+  private originGuard(req: IncomingMessage): string | undefined {
+    const origin = req.headers.origin;
+    if (typeof origin === "string" && origin !== "" && origin !== "null") {
+      if (!this.isAllowedOrigin(origin)) {
+        return `Origin ${origin} is not allowed. Add it to native.allowedOrigins to permit browser clients.`;
+      }
+    }
+
+    const host = req.headers.host;
+    if (typeof host === "string" && host !== "") {
+      // Strip the port; bracketed IPv6 keeps its brackets off.
+      const name = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
+      const allowed =
+        name === "127.0.0.1" ||
+        name === "localhost" ||
+        name === "::1" ||
+        name === this.opts.host ||
+        // A wildcard bind is reachable under every local name; the bearer
+        // token is the control there, not the Host header.
+        this.opts.host === "0.0.0.0" ||
+        this.opts.host === "::";
+      if (!allowed) {
+        return `Host ${host} is not recognised for this bridge (DNS-rebinding guard).`;
+      }
+    }
+    return undefined;
+  }
+
   private jsonHeaders(): Record<string, string> {
     return { ...this.corsHeaders(), "Content-Type": "application/json" };
   }
@@ -880,6 +1029,16 @@ function asString(v: unknown): string | undefined {
   return typeof v === "string" ? v : undefined;
 }
 
+/**
+ * The `deviceId` a mesh client claims on `/events` and `/devices/file`.
+ * Undefined when absent or blank — every consumer treats "no claim" as the
+ * legacy case, so an empty string must never look like a claimed id.
+ */
+function deviceIdParam(url: URL): string | undefined {
+  const raw = (url.searchParams.get("deviceId") ?? "").trim();
+  return raw ? raw.slice(0, MAX_DEVICE_ID_CHARS) : undefined;
+}
+
 /** Parse a positive-integer query param; undefined when absent/invalid. */
 function asPositiveInt(v: string | null): number | undefined {
   if (!v) return undefined;

package/src/frontend/shared/format.ts

@@ -38,6 +38,12 @@ export function formatTokenCount(n: number): string {
   return String(n);
 }
 
+/** Keep small model costs legible without making larger totals noisy. */
+export function formatUsd(cost: number): string {
+  const safeCost = Number.isFinite(cost) && cost > 0 ? cost : 0;
+  return `$${safeCost > 0.5 ? safeCost.toFixed(2) : safeCost.toFixed(4)}`;
+}
+
 export function formatBytes(bytes: number): string {
   if (bytes >= 1_073_741_824) return `${(bytes / 1_073_741_824).toFixed(1)} GB`;
   if (bytes >= 1_048_576) return `${(bytes / 1_048_576).toFixed(1)} MB`;

package/src/frontend/telegram/actions/messaging.ts

@@ -18,6 +18,99 @@ import {
 import { sendText, toPositiveId } from "./shared.js";
 import { TELEGRAM_MAX_TEXT, type TelegramActionHandlers } from "./types.js";
 
+// ── Inline keyboards ─────────────────────────────────────────────────────────
+
+/**
+ * Telegram caps `callback_data` at 64 BYTES, not characters
+ * (https://core.telegram.org/bots/api#inlinekeyboardbutton). Exceeding it
+ * fails the whole sendMessage with BUTTON_DATA_INVALID — the message never
+ * arrives, buttons and all.
+ *
+ * Bytes rather than chars matters: a 21-character Japanese label is already
+ * over budget, so non-Latin keyboards break far sooner than English ones.
+ */
+const CALLBACK_DATA_MAX_BYTES = 64;
+
+type ButtonSpec = { text: string; url?: string; callback_data?: string };
+
+/** The two inline-button shapes this module emits. */
+type BuiltButton =
+  { text: string; url: string } | { text: string; callback_data: string };
+
+/** Byte length of `text` when UTF-8 encoded. */
+function utf8Bytes(text: string): number {
+  return Buffer.byteLength(text, "utf8");
+}
+
+/** Longest prefix of `text` that fits `maxBytes`, never splitting a code point. */
+function truncateUtf8(text: string, maxBytes: number): string {
+  if (utf8Bytes(text) <= maxBytes) return text;
+  let out = "";
+  let used = 0;
+  for (const char of text) {
+    const size = utf8Bytes(char);
+    if (used + size > maxBytes) break;
+    out += char;
+    used += size;
+  }
+  return out;
+}
+
+/**
+ * Resolve one button's callback data.
+ *
+ * An EXPLICIT `callback_data` is semantic — the model dispatches on the exact
+ * value it chose — so an over-long one is reported rather than truncated;
+ * handing the callback handler a different string than the model expects
+ * would be a silent behaviour change. The `text` fallback carries no such
+ * contract, so it is truncated to fit.
+ */
+function callbackDataFor(
+  btn: ButtonSpec,
+): { data: string } | { error: string } {
+  if (btn.callback_data !== undefined) {
+    const bytes = utf8Bytes(btn.callback_data);
+    if (bytes > CALLBACK_DATA_MAX_BYTES) {
+      return {
+        error:
+          `callback_data for button "${btn.text}" is ${bytes} bytes; ` +
+          `Telegram allows at most ${CALLBACK_DATA_MAX_BYTES}. Use a short ` +
+          `token (e.g. "opt_a") and keep the wording in the button text.`,
+      };
+    }
+    return { data: btn.callback_data };
+  }
+  return { data: truncateUtf8(btn.text, CALLBACK_DATA_MAX_BYTES) };
+}
+
+/**
+ * Build an inline keyboard from button rows, enforcing the callback_data
+ * cap. Returns an error message instead of a keyboard when the model
+ * supplied explicit data that cannot be sent.
+ *
+ * Exported as a unit seam — every button path in this module routes
+ * through it, so the cap is testable without a live Bot.
+ */
+export function buildInlineKeyboard(
+  rows: ButtonSpec[][],
+): { keyboard: BuiltButton[][] } | { error: string } {
+  const keyboard: BuiltButton[][] = [];
+  for (const row of rows) {
+    const built: BuiltButton[] = [];
+    for (const btn of row) {
+      if (btn.url) {
+        built.push({ text: btn.text, url: btn.url });
+        continue;
+      }
+      const resolved = callbackDataFor(btn);
+      if ("error" in resolved) return { error: resolved.error };
+      built.push({ text: btn.text, callback_data: resolved.data });
+    }
+    keyboard.push(built);
+  }
+  return { keyboard };
+}
+
 // ── Scheduled sends (persistent) ─────────────────────────────────────────────
 
 /** Longest schedulable delay: 24h. Timers re-arm from the store on boot. */
@@ -26,23 +119,29 @@ const MAX_DELAY_SEC = 24 * 60 * 60;
 /** Deliver one scheduled entry (shared by the live timer and restore). */
 async function fireScheduled(bot: Bot, entry: ScheduledMessage): Promise<void> {
   const chatId = Number(entry.chatId);
+  // `replyTo` is stored in the owning frontend's native shape (Discord keeps
+  // snowflake strings there); Telegram's API wants a number.
+  const replyTo = toPositiveId(entry.replyTo);
   if (entry.rows) {
-    const keyboard = entry.rows.map((row) =>
-      row.map((btn) =>
-        btn.url
-          ? { text: btn.text, url: btn.url }
-          : { text: btn.text, callback_data: btn.callback_data ?? btn.text },
-      ),
-    );
+    // Validated at schedule time; rebuilt here so entries persisted by an
+    // older build (or edited on disk) still can't fail the send.
+    const built = buildInlineKeyboard(entry.rows);
+    if ("error" in built) {
+      logWarn(
+        "bot",
+        `Scheduled message ${entry.id} has bad buttons: ${built.error}`,
+      );
+      await sendText(bot, chatId, entry.text, replyTo);
+      return;
+    }
+    const keyboard = built.keyboard;
     await bot.api.sendMessage(chatId, markdownToTelegramHtml(entry.text), {
       parse_mode: "HTML",
       reply_markup: { inline_keyboard: keyboard },
-      reply_parameters: entry.replyTo
-        ? { message_id: entry.replyTo }
-        : undefined,
+      reply_parameters: replyTo ? { message_id: replyTo } : undefined,
     });
   } else {
-    await sendText(bot, chatId, entry.text, entry.replyTo);
+    await sendText(bot, chatId, entry.text, replyTo);
   }
 }
 
@@ -211,20 +310,11 @@ export const messagingHandlers: TelegramActionHandlers = {
     if (text.length > TELEGRAM_MAX_TEXT)
       return { ok: false, error: `Text too long` };
     const html = markdownToTelegramHtml(text);
-    const rows = body.rows as Array<
-      Array<{ text: string; url?: string; callback_data?: string }>
-    >;
+    const rows = body.rows as ButtonSpec[][];
+    const built = buildInlineKeyboard(rows);
+    if ("error" in built) return { ok: false, error: built.error };
+    const keyboard = built.keyboard;
     gateway.incrementMessages(chatId);
-    const keyboard = rows.map((row) =>
-      row.map((btn) =>
-        btn.url
-          ? { text: btn.text, url: btn.url }
-          : {
-              text: btn.text,
-              callback_data: btn.callback_data ?? btn.text,
-            },
-      ),
-    );
     try {
       const sent = await bot.api.sendMessage(chatId, html, {
         parse_mode: "HTML",
@@ -243,6 +333,12 @@ export const messagingHandlers: TelegramActionHandlers = {
     const text = String(body.text ?? "");
     const replyTo = toPositiveId(body.reply_to_message_id);
     const rows = body.rows as ScheduledMessage["rows"];
+    // Validate buttons now rather than at fire time — a rejection minutes
+    // later, with the turn long over, is invisible to the model.
+    if (rows) {
+      const built = buildInlineKeyboard(rows);
+      if ("error" in built) return { ok: false, error: built.error };
+    }
     // NaN (e.g. delay_seconds: "5m") must fall back to the default, not
     // propagate: setTimeout(fn, NaN) fires immediately.
     const requested = Number(body.delay_seconds ?? 60);

package/src/frontend/telegram/callbacks/metrics.ts

@@ -7,7 +7,7 @@
  */
 
 import type { Context } from "grammy";
-import { getMetrics, getTodayMetrics } from "../../../util/metrics.js";
+import { getMetrics, getTodayMetrics } from "../../../storage/metrics.js";
 import {
   renderMetricsKeyboard,
   renderMetricsPanel,

package/src/frontend/telegram/commands/admin.ts

@@ -24,7 +24,7 @@ import {
 } from "../helpers/index.js";
 import { collectDoctorReport } from "../../../core/doctor.js";
 import { handleAdminCommand } from "../admin.js";
-import { getTodayMetrics } from "../../../util/metrics.js";
+import { getTodayMetrics } from "../../../storage/metrics.js";
 import { isAuthorizedAdmin, type RegisterDeps } from "./state.js";
 import { telegramCommandMenu } from "./definitions.js";
 

package/src/frontend/telegram/formatting.ts

@@ -25,11 +25,67 @@ export function escapeHtml(text: string): string {
   return escapeNative(text);
 }
 
+/**
+ * True when every tag in `html` is closed in the order it was opened.
+ *
+ * The inline formatters below are independent regex passes with no
+ * knowledge of each other's spans, so interleaved delimiters
+ * (`**a _b** c_`) emit crossed tags like `<b><i>x</b></i>`. Telegram
+ * refuses to parse those and 400s the whole message, so the caller
+ * checks before committing to the formatted rendering.
+ *
+ * Only tags this module generates are possible here — everything else
+ * was entity-escaped in step 3 — so a plain stack is sufficient.
+ */
+function isWellFormedHtml(html: string): boolean {
+  const stack: string[] = [];
+  const tag = /<(\/?)([a-zA-Z]+)(?:\s[^>]*)?>/g;
+  let match: RegExpExecArray | null;
+  while ((match = tag.exec(html)) !== null) {
+    const [, closing, name] = match;
+    if (closing) {
+      if (stack.pop() !== name) return false;
+    } else {
+      stack.push(name!);
+    }
+  }
+  return stack.length === 0;
+}
+
+/** Apply the inline delimiter passes to already-escaped text. */
+function applyInlineFormatting(input: string): string {
+  let out = input;
+  // Bold+italic: ***text*** — must run before the ** and * passes, which
+  // would otherwise split it into the crossed pair `<b><i>x</b></i>`.
+  out = out.replace(/\*\*\*(.+?)\*\*\*/g, "<b><i>$1</i></b>");
+  // Bold: **text**
+  out = out.replace(/\*\*(.+?)\*\*/g, "<b>$1</b>");
+  // Italic: *text* (not preceded by another *)
+  out = out.replace(/(?<!\*)\*(?!\*)(.+?)(?<!\*)\*(?!\*)/g, "<i>$1</i>");
+  // Italic: _text_ (surrounded by non-word or start/end)
+  out = out.replace(/(?<!\w)_(.+?)_(?!\w)/g, "<i>$1</i>");
+  // Links: [text](url) — only safe URL schemes become anchors. Both text
+  // and url were already HTML-escaped by step 3 (quotes included, so the
+  // href attribute can't be broken out of); escaping again here corrupted
+  // every & in a query string into &amp;amp;.
+  out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text, url) =>
+    /^https?:\/\//i.test(url) ? `<a href="${url}">${text}</a>` : text,
+  );
+  // Strikethrough: ~~text~~
+  out = out.replace(/~~(.+?)~~/g, "<s>$1</s>");
+  return out;
+}
+
 /**
  * Convert Markdown output to Telegram-safe HTML.
  *
  * Handles: bold, italic, inline code, fenced code blocks, links.
  * Escapes HTML entities in non-formatted text.
+ *
+ * Guarantees well-formed output: when the inline passes would produce
+ * crossed tags, the formatting is dropped rather than emitted, because
+ * Telegram rejects the entire message on a parse error and the caller's
+ * only recourse is a second round-trip with no formatting at all.
  */
 export function markdownToTelegramHtml(text: string): string {
   // Step 1: Extract fenced code blocks to avoid processing their contents.
@@ -59,25 +115,14 @@ export function markdownToTelegramHtml(text: string): string {
   // oxlint-disable-next-line no-control-regex
   processed = processed.replace(/[^`\x00]+/g, (segment) => escapeHtml(segment));
 
-  // Step 4: Apply inline formatting.
-  // Bold: **text**
-  processed = processed.replace(/\*\*(.+?)\*\*/g, "<b>$1</b>");
-  // Italic: *text* (not preceded by another *)
-  processed = processed.replace(
-    /(?<!\*)\*(?!\*)(.+?)(?<!\*)\*(?!\*)/g,
-    "<i>$1</i>",
-  );
-  // Italic: _text_ (surrounded by non-word or start/end)
-  processed = processed.replace(/(?<!\w)_(.+?)_(?!\w)/g, "<i>$1</i>");
-  // Links: [text](url) — only safe URL schemes become anchors. Both text
-  // and url were already HTML-escaped by step 3 (quotes included, so the
-  // href attribute can't be broken out of); escaping again here corrupted
-  // every & in a query string into &amp;amp;.
-  processed = processed.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_, text, url) =>
-    /^https?:\/\//i.test(url) ? `<a href="${url}">${text}</a>` : text,
-  );
-  // Strikethrough: ~~text~~
-  processed = processed.replace(/~~(.+?)~~/g, "<s>$1</s>");
+  // Step 4: Apply inline formatting, but only keep it if the result is
+  // actually parseable. `processed` at this point holds escaped text plus
+  // tag-free placeholders, so it is a safe unformatted fallback.
+  const unformatted = processed;
+  processed = applyInlineFormatting(processed);
+  if (!isWellFormedHtml(processed)) {
+    processed = unformatted;
+  }
 
   // Steps 5+6: Restore code spans and fenced blocks. The replacement MUST
   // go through a function: with a string, String.replace interprets $-