thincoder 0.12.11 → 0.12.12

package/src/prompts/advisor-round2.md

@@ -1,4 +1,4 @@
-You are a code review advisor.
+You are an independent review advisor.
 Verify the prior issue table (provided in the review context).
 You may note obvious new issues introduced by the fixes.
 You have read-only tools to explore the codebase.
@@ -7,8 +7,8 @@ You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 round
 Review workflow:
 1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a fix appears to contradict the task itself.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-table item names them or a fix appears to contradict the task itself.
+4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** Fixes may already be committed — `read` the files named in the prior table regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
 5. Use grep or lsp to trace callers, imports, and dependencies — only where genuinely needed.
 6. Produce your review table.
 
@@ -19,7 +19,9 @@ Rules:
 - Primarily check fix status of items in the prior issue table.
 - For items marked "fixed": verify they were actually fixed.
 - For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- Every "Unfixed" or "New" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
 - You may flag obvious new problems — but only if clearly visible in the reviewed files and would cause crashes, data loss, or logic errors.
 - Do NOT nitpick style or naming.
 - Output a Markdown table listing all remaining problems (old or new):

package/src/prompts/advisor-round3.md

@@ -1,4 +1,4 @@
-You are a code review advisor.
+You are an independent review advisor.
 Strictly verify only the prior issue table (provided in the review context).
 Do NOT look for new issues.
 You have read-only tools to explore the codebase.
@@ -7,8 +7,8 @@ You have a budget of 30 tool rounds (chat turns). Hard mechanical cap: 100 round
 Review workflow:
 1. The affected files are named in the prior issue table — read them in full. The prior issue table is HISTORY from a previous review, not current state.
 2. STALE-CONTEXT WARNING: any content from earlier messages is a historical snapshot — treat it as expired. Only fresh `read` results describe the current state.
-3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs.
-4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** An empty `git diff` does NOT mean nothing changed: fixes may already be committed (`git log -3` shows recent commits) — `read` the files named in the prior table regardless of the diff. Batch independent tool calls in one reply.
+3. Project conventions were established in round 1 — do NOT re-read AGENTS.md / design docs unless a prior-table item names them or a fix appears to contradict the task itself.
+4. **ALWAYS verify current file content with `read` before judging a prior-table item as fixed or unfixed — never decide based on the prior table alone.** Fixes may already be committed — `read` the files named in the prior table regardless. (Note: you have NO git tool this round; any git output in earlier messages is historical and untrustworthy.) Batch independent tool calls in one reply.
 5. Verify fix status of each item in the prior issue table.
 6. Produce your review table.
 
@@ -19,7 +19,9 @@ Rules:
 - Only check fix status of items in the prior issue table.
 - For items marked "fixed": verify they were actually fixed.
 - For items marked "not an issue": evaluate whether the reasoning is sound.
-- Every "Unfixed" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may come from the stale prior table. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- Every "Unfixed" entry MUST quote the exact line content from THIS round's `read` output (e.g. `run.mjs:180: timeoutId = setTimeout(...)`). Line numbers alone are NOT evidence — they may be fabricated or stale. Findings without a fresh quoted line are treated as unverified and will not be accepted.
+- **Host verification**: your `file:line: content` citations are mechanically checked against the CURRENT file state — quote exactly what `read` returned; a mismatch marks the finding unverified.
+- **Fresh context**: this round's conversation contains NO read output from earlier rounds — every file must be re-read this round.
 - Output a Markdown table. Only list items that still have problems:
 | # | Orig# | File | Severity | Status | Notes |
 |---|-------|------|----------|--------|-------|

package/src/prompts/discipline.md

@@ -12,4 +12,4 @@ Debugging strategy:
 - Don't get stuck reading code — write tests, add logs. Trust the runtime over your theories.
 
 Review discipline (standard mode only — engineering mode has its own review timing rules):
-- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies prior table.
+- **Advisor:** call after changing code. Must provide scope: `paths` (files/dirs to review) or `documents` (context). Response table: `| # | Action | Detail |`. Round 2 verifies the prior issue table + flags obvious new issues; round 3+ strictly verifies only the prior issue table (no new-issue hunting). Max 5 rounds total.

package/src/session.mjs

@@ -282,6 +282,22 @@ export function switchToSlot(cwd, slot) {
   return loadSession(cwd)
 }
 
+/** Delete a slot: remove its file and manifest entry. Deleting the active slot
+ *  resets the manifest active pointer (the next claim re-creates one). */
+export function deleteSlot(cwd, slot) {
+  const n = Number(slot)
+  if (!Number.isInteger(n) || n < 1) return false
+  const m = loadManifest(cwd)
+  if (!m.slots[n]) return false
+  delete m.slots[n]
+  delete m.slotSessions?.[n] // orphan session-id entries bloat the manifest forever
+  try { unlinkSync(slotPath(cwd, n)) } catch { /* missing file is fine */ }
+  if (m.active === n) delete m.active
+  saveManifest(cwd, m)
+  return true
+}
+
+
 // ========== legacy transient prefix cleanup ==========
 
 const LEGACY_TRANSIENT_PREFIXES = [
@@ -297,6 +313,8 @@ function isLegacyTransient(m) {
   )
 }
 
+export { isLegacyTransient }
+
 // ========== core read/write ==========
 
 /** Save agent state and display lines to the active slot file (atomic write) */
@@ -396,6 +414,7 @@ export function applySession(agent, data) {
   // (possibly compacted) machine line. Restore each line from its own source — the machine
   // context keeps its compaction savings across resume. Legacy files without contextHistory
   // fall back to seeding the machine line from the full history (it re-compacts when needed).
+  agent.config ??= {} // ACP test mocks may omit config; be defensive like the ??= below
   const full = Array.isArray(data.history) ? data.history : []
   const machine = Array.isArray(data.contextHistory) ? data.contextHistory : full
   agent._fullHistory = [...full]

package/src/tools/file.mjs

@@ -20,6 +20,19 @@ import { join, relative, dirname } from "node:path";
 const MAX_FILE_READ_BYTES = 10_000_000
 const MAX_IMAGE_BYTES = 15_000_000
 
+// ────────────────────────────────────────
+// Dirty-file tracking (read-before-insert guard)
+// ────────────────────────────────────────
+// insert_after anchors on LINE NUMBERS — the most drift-prone addressing.
+// Every write tool marks the file dirty; insert_after refuses to run on a
+// dirty file until the agent reads it again (fresh line numbers). This turns
+// the "read after edit" discipline into a structural guarantee: a stale
+// after_line can never silently land in the wrong place again.
+const dirtyPaths = new Set()
+export function markDirty(abs) { dirtyPaths.add(abs) }
+export function clearDirty(abs) { dirtyPaths.delete(abs) }
+export function isDirty(abs) { return dirtyPaths.has(abs) }
+
 export const readTool = {
   name: "read",
   description: DESC("read"),
@@ -41,6 +54,8 @@ export const readTool = {
     const st = await stat(abs).catch(() => null)
     if (st && st.size > MAX_FILE_READ_BYTES) throw new Error(`File too large (${Math.round(st.size / 1_000_000)}MB > 10MB limit). Use bash with head/tail or grep for targeted extraction.`)
     const content = normalizeEOL(await readFile(abs, "utf8"))
+    // A read refreshes the agent's view — line numbers are fresh again.
+    clearDirty(abs)
     const lines = content.split("\n")
     const offset = Math.max(1, args.offset ?? 1)
     const limit = Math.min(args.limit ?? MAX_READ_LINES, MAX_READ_LINES)
@@ -129,6 +144,7 @@ export const writeTool = {
     const st = await stat(abs).catch(() => null)
     if (st?.isDirectory()) throw new Error(`Path is a directory: ${args.path}`)
     await writeFile(abs, args.content, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Wrote ${args.content.length} chars to ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -175,6 +191,7 @@ export const editTool = {
       // Functional replacement: avoid $-substitution patterns in new_string (match string / backreference) being expanded
       : content.replace(args.old_string, () => args.new_string)
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${args.replace_all ? occurrences : 1} occurrence(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -199,6 +216,17 @@ export const insertAfterTool = {
   touchedPaths(args) { return args.path ? [args.path] : [] },
   async execute(args, ctx) {
     const abs = resolveInCwd(ctx, args.path)
+    // Read-before-insert guard: after_line anchors are line numbers, and any
+    // write since the last read made them stale. Refuse instead of silently
+    // inserting at a drifted position (the failure mode that corrupted test
+    // structure repeatedly). after_regex callers get the same gate — a stale
+    // target line is just as wrong, and the rule is simpler to reason about.
+    if (isDirty(abs)) {
+      throw new Error(
+        `${args.path} was modified since your last read — line numbers may be stale.\n` +
+        `Read the file again (read tool) to refresh line numbers, then retry insert_after.`
+      )
+    }
     const text = normalizeEOL(await readFile(abs, "utf8"))
     const lines = text.split("\n")
 
@@ -232,6 +260,7 @@ export const insertAfterTool = {
     lines.splice(targetLine, 0, args.content)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Inserted after line ${targetLine} in ${args.path}${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },
@@ -317,6 +346,7 @@ export const hashlineEditTool = {
     lines.splice(pos, target.length, ...newLines)
     const updated = lines.join("\n")
     await writeFile(abs, updated, "utf8")
+    markDirty(abs)
     const diff = gitDiffOne(ctx.cwd, abs)
     return `Edited ${args.path}: replaced ${target.length} line(s) at L${pos + 1} with ${newLines.length} line(s)${diff ? "\n" + diff : ""}${await autoSyntaxCheck(abs)}`
   },

package/src/tools/insert_after.md

@@ -11,3 +11,4 @@ Notes:
 - Use this instead of `edit` when you're adding a new function, import, or block — no need to fabricate surrounding context for exact matching.
 - The inserted content becomes its own line; it's equivalent to `lines.splice(targetLine, 0, content)`.
 - Returns a diff of the change.
+- **Read-before-insert guard**: if the file was modified by any write tool (write/edit/insert_after/hashline_edit/apply_patch/delete) since your last `read`, this tool REFUSES with an error — line numbers may be stale. Read the file again, then retry. This prevents after_line from silently landing at a drifted position.

package/src/tools/patch.mjs

@@ -3,6 +3,7 @@ import {
   autoSyntaxCheck,
   resolveInCwd
 } from "./shared.mjs";
+import { markDirty } from "./file.mjs";
 import { execFileSync } from "node:child_process";
 import { mkdir } from "node:fs/promises";
 import { readFile } from "node:fs/promises";
@@ -150,6 +151,8 @@ export const applyPatchTool = {
       throw renameError
     }
     const summary = planned.map((p) => `  ${p.isNew ? "created " : "modified"} ${p.path}`).join("\n")
+    // Mark every touched file dirty — insert_after must not run on stale line numbers.
+    for (const p of planned) markDirty(p.abs)
     const syntaxChecks = await Promise.all(planned.map(async (p) => {
       const r = await autoSyntaxCheck(p.abs)
       return r ? `${p.path}:${r.replace("Syntax: ", "")}` : ""
@@ -197,6 +200,7 @@ export const deleteTool = {
     }
     if (tracked && !args.force) throw new Error(`"${args.path}" is git-tracked. Set force=true to delete anyway.`)
     await unlink(abs)
+    markDirty(abs)
     return `Deleted ${args.path}`
   },
 }

package/src/tools/shared.mjs

@@ -17,19 +17,31 @@ export const MAX_OUTPUT_CHARS = 200_000
 const ENCODING_DETECT_MAX_TRIM = 3
 const SYNTAX_CHECK_TIMEOUT = 10000
 export const BASH_TIMEOUT_MS = 120_000
-export const MAX_RESPONSE_BODY_BYTES = 5_000_000
 export const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", ".turbo", "coverage"])
 
-/** SSRF guard: check if a hostname is private/internal. Shared by web.mjs and codemode.mjs. */
+/** SSRF guard: check if a hostname is private/internal. Shared by web.mjs and codemode.mjs.
+ *  Returns TRUE for private hosts — callers block them. */
 export function isPrivateHost(hostname) {
   const h = hostname.toLowerCase()
-  if (h === "localhost" || h === "0.0.0.0" || h.endsWith(".localhost")) return false
-  if (h === "127.0.0.1" || h.startsWith("127.")) return false
+  // Local loopback + link-local names: BLOCK (true). These returned false
+  // before — the guard was inverted for the most common SSRF targets
+  // (localhost/127.x reach internal services unchecked).
+  if (h === "localhost" || h === "0.0.0.0" || h.endsWith(".localhost")) return true
+  if (h === "127.0.0.1" || h.startsWith("127.")) return true
   if (h === "169.254.169.254" || h === "metadata.google.internal") return true
   // IPv6 private ranges — only check if host contains ":"
-  if (h.includes(":") && (h === "::1" || h === "fe80::1" || h.startsWith("fc") || h.startsWith("fd"))) return true
+  // fe80::/10 link-local covers fe80:…febf:… — startsWith("fe80:") is the
+  // practical subset (fe8/fe9/fea/feb all begin fe8/feb — full range regex
+  // would be /^fe[89ab][0-9a-f]:/; startsWith fe8 + fe9 + fea + feb covers it).
+  if (h.includes(":")) {
+    if (h === "::1" || h.startsWith("fc") || h.startsWith("fd")) return true
+    if (/^fe[89ab][0-9a-f]:/.test(h)) return true
+  }
   const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
   if (m) {
+    // Octet range is NOT validated (999.10.0.1 parses but matches no private
+    // prefix → treated as public). Intentional: the guard checks known-private
+    // prefixes; invalid IPs are harmless false-negatives for SSRF purposes.
     const [a, b] = [Number(m[1]), Number(m[2])]
     if (a === 10 || (a === 172 && b >= 16 && b <= 31) || a === 192 && b === 168 || a === 169 && b === 254 || a === 0) return true
   }
@@ -69,24 +81,10 @@ export function truncate(text, max = MAX_OUTPUT_CHARS) {
   return text.slice(0, max) + `\n[... truncated: ${text.length - max} chars omitted — redirect to a file if you need the full output]`
 }
 
-/** Read response body with a byte limit */
-export async function readBodyText(response, limit = MAX_RESPONSE_BODY_BYTES) {
-  if (!response.body) return ""
-  const reader = response.body.getReader()
-  const chunks = []
-  let total = 0
-  try {
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
-      if (value) { chunks.push(value); total += value.length }
-      if (total >= limit) { await reader.cancel(); break }
-    }
-  } finally { reader.releaseLock() }
-  return new TextDecoder("utf-8").decode(Buffer.concat(chunks))
-}
-
 /** Streaming decoder: encoding sniffing ASCII→UTF-8→GBK.
+ *  KNOWN LIMITATION (accepted): the fallback is hardcoded to GBK (Chinese) —
+ *  Shift-JIS/EUC-KR pages decode as mojibake. Real-world usage is dominated
+ *  by UTF-8; a charset-aware variant would need the Content-Type header.
  *  Each call creates an independent decoder instance — must not be shared across parallel streams (internal decoder state accumulates). */
 export function makeDecoder() {
   let decoder = null
@@ -154,7 +152,7 @@ export async function autoSyntaxCheck(abs) {
 }
 
 /** Resolve realpath by walking up the directory tree */
-export function realpathNearest(abs) {
+function realpathNearest(abs) {
   let cur = abs
   const tail = []
   while (!existsSync(cur)) {
@@ -167,15 +165,20 @@ export function realpathNearest(abs) {
   catch { return abs }
 }
 
+// cwd is effectively constant per CLI session — the cache never grows in
+// practice. A long-running server with rotating cwds would leak; revisit with
+// an LRU if that usage ever appears.
 const realCwdCache = new Map()
 /** Resolve cwd to realpath, cached */
-export function realCwd(cwd) {
+function realCwd(cwd) {
   if (!realCwdCache.has(cwd)) realCwdCache.set(cwd, realpathNearest(resolve(cwd)))
   return realCwdCache.get(cwd)
 }
 
 /** Assert that a resolved path is inside cwd; throws on escape */
-export function assertInside(cwd, resolved, p) {
+function assertInside(cwd, resolved, p) {
+  // relative() returns platform-native separators; ".." + sep therefore
+  // matches both / and \ traversal on the respective platform.
   const rel = relative(cwd, resolved)
   if (isAbsolute(rel) || rel === ".." || rel.startsWith(".." + sep)) {
     throw new Error(`Access denied outside working directory: ${p}`)
@@ -215,8 +218,11 @@ function blankQuoted(command) {
     const ch = command[i]
     if (quote) {
       if (ch === "\\" && quote !== "'") { out += " "; i++; out += " "; continue }
-      if (ch === quote) quote = null
-      out += " "
+      if (ch === quote) { quote = null; out += " "; continue }
+      // Backticks are COMMAND SUBSTITUTION — the content executes, so it must
+      // stay visible to the redirection check (echo `cat > /tmp/x` writes a
+      // file). Only ' and " are literal regions.
+      out += quote === "`" ? ch : " "
     } else if (ch === "'" || ch === '"' || ch === "`") {
       quote = ch
       out += " "
@@ -227,17 +233,22 @@ function blankQuoted(command) {
   return out
 }
 
-/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions */
+/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions.
+ *  Backtick contents count (command substitution executes); fd-prefixed forms
+ *  (2> file, 1>> file) count too. */
 export function hasFileRedirection(command) {
   const bare = blankQuoted(command)
-  return /(^|[\s;&|])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|])<\s*\S/.test(bare)
+  return /(^|[\s;&|0-9])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|0-9])<\s*\S/.test(bare)
 }
 
 /** Whether a single command segment is a destructive non-git command (conservative: prefer false positives) */
 export function isDestructiveCommand(seg) {
   const s = seg
-  // rm with both recursive (-r/-R) and force (-f) flags: -rf / -fr / -r -f / -Rf etc.
-  if (/\brm\b/.test(s) && /\s-\S*r/i.test(s) && /\s-\S*f/i.test(s)) return true
+  // rm with recursive (-r/-R/--recursive): destructive WITH or WITHOUT -f
+  // (recursive delete removes trees non-interactively in many setups; -rf is
+  // the classic case). Conservative: prefer blocking. The \s before the flag
+  // requires a separator — "rm-rf" is not a valid command (no such program).
+  if (/\brm\b/.test(s) && (/\s-\S*r/i.test(s) || /\s--recursive\b/i.test(s))) return true
   if (/\brmdir\b/i.test(s)) return true
   if (/\bdel\b/i.test(s) && /\/f\b/i.test(s)) return true
   if (/\brd\b/i.test(s) && /\/s\b/i.test(s)) return true
@@ -251,28 +262,11 @@ export function isDestructiveCommand(seg) {
   return false
 }
 
-/** Whether a single command segment destroys uncommitted changes */
-export function isDestructiveGitSegment(seg) {
-  if (!/^\s*git\s/.test(seg)) return false
-  if (/\scheckout\s+(?:--|\.(?:\s|$))/.test(seg)) return true
-  if (/\sreset\s+--hard\b/.test(seg)) return true
-  if (/\sclean\s+-\S*f/.test(seg)) return true
-  if (/\srestore\s/.test(seg) && (/--worktree/.test(seg) || !/--staged/.test(seg))) return true
-  return false
-}
-
-/** Whether cwd is inside a git repository */
-export function insideGitRepo(cwd) {
-  try {
-    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
-    })
-    return true
-  } catch { return false }
-}
 
 /** Convert glob pattern to regex */
 export function globToRegex(pattern) {
+  // Sentinel chars: \u0001/\u0002 never appear in real glob patterns (they
+  // come from model output or the filesystem) — safe as **/ and ** placeholders.
   const DS = "\u0001", DP = "\u0002"
   const escaped = pattern
     .replace(/\*\*\//g, DS).replace(/\*\*/g, DP)
@@ -283,12 +277,24 @@ export function globToRegex(pattern) {
   return new RegExp(`^${escaped}$`)
 }
 
-/** Strip HTML tags */
+/** Decode a numeric HTML entity to its code point — invalid/out-of-range
+ *  values (e.g. &#999999999999;) must not throw RangeError; keep the source
+ *  text as-is (display-only residue is acceptable). */
+function decodeNumericEntity(_, digits) {
+  const n = Number(digits)
+  return Number.isSafeInteger(n) && n <= 0x10ffff ? String.fromCodePoint(n) : _
+}
+
+/** Strip HTML tags. KNOWN LIMITATION (accepted): the `/<[^>]+>/g` regex treats
+ *  the first `>` (or a `<` inside an attribute value) as the tag boundary —
+ *  `<img alt="a > b">` truncates the match and leaves text residue. A full
+ *  HTML parser is out of scope; real-world HTML with angle brackets in
+ *  attributes is rare and the residue is display-only (never parsed). */
 export function stripTags(html) {
   return html
     .replace(/<[^>]+>/g, "")
-    .replace(/&#0*(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-    .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#0*(\d+);/g, (m, n) => decodeNumericEntity(m, n))
+    .replace(/&#x([0-9a-fA-F]+);/g, (m, h) => decodeNumericEntity(m, parseInt(h, 16)))
     .replace(/&nbsp;|&ensp;/g, " ")
     .replace(/&lt;/g, "<")
     .replace(/&gt;/g, ">")
@@ -308,8 +314,8 @@ export function htmlToText(html) {
     .replace(/<br\s*\/?>/gi, "\n")
     .replace(/<li[^>]*>/gi, "- ")
     .replace(/<[^>]+>/g, "")
-    .replace(/&#0*(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-    .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#0*(\d+);/g, (m, n) => decodeNumericEntity(m, n))
+    .replace(/&#x([0-9a-fA-F]+);/g, (m, h) => decodeNumericEntity(m, parseInt(h, 16)))
     .replace(/&nbsp;|&ensp;/g, " ")
     .replace(/&lt;/g, "<")
     .replace(/&gt;/g, ">")
@@ -325,8 +331,13 @@ export function runGit(cwd, cmdArgs) {
   try {
     return execFileSync("git", cmdArgs, { cwd, encoding: "utf8", maxBuffer: 10 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] }).trim().replace(/\r/g, "")
   } catch (e) {
-    // ERR_CHILD_PROCESS_STDIO_MAXBUFFER: e.stdout contains partial output, return first 200 lines
-    if (e.stdout) return String(e.stdout).trim().replace(/\r/g, "").split("\n").slice(0, 200).join("\n")
+    // maxBuffer overflow: e.stdout contains partial collected output — return it
+    // (callers show "(truncated)"-style tails). ALL OTHER errors (non-git repo,
+    // permission, bad command) return "" — matching gitDiffOne's pattern: a
+    // failed git call must not masquerade as partial success.
+    if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" && e.stdout) {
+      return String(e.stdout).trim().replace(/\r/g, "").split("\n").slice(0, 200).join("\n")
+    }
     return ""
   }
 }