thincoder 0.12.11 → 0.12.13

package/src/tools/shared.mjs

@@ -17,19 +17,31 @@ export const MAX_OUTPUT_CHARS = 200_000
 const ENCODING_DETECT_MAX_TRIM = 3
 const SYNTAX_CHECK_TIMEOUT = 10000
 export const BASH_TIMEOUT_MS = 120_000
-export const MAX_RESPONSE_BODY_BYTES = 5_000_000
 export const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", ".turbo", "coverage"])
 
-/** SSRF guard: check if a hostname is private/internal. Shared by web.mjs and codemode.mjs. */
+/** SSRF guard: check if a hostname is private/internal. Shared by web.mjs and codemode.mjs.
+ *  Returns TRUE for private hosts — callers block them. */
 export function isPrivateHost(hostname) {
   const h = hostname.toLowerCase()
-  if (h === "localhost" || h === "0.0.0.0" || h.endsWith(".localhost")) return false
-  if (h === "127.0.0.1" || h.startsWith("127.")) return false
+  // Local loopback + link-local names: BLOCK (true). These returned false
+  // before — the guard was inverted for the most common SSRF targets
+  // (localhost/127.x reach internal services unchecked).
+  if (h === "localhost" || h === "0.0.0.0" || h.endsWith(".localhost")) return true
+  if (h === "127.0.0.1" || h.startsWith("127.")) return true
   if (h === "169.254.169.254" || h === "metadata.google.internal") return true
   // IPv6 private ranges — only check if host contains ":"
-  if (h.includes(":") && (h === "::1" || h === "fe80::1" || h.startsWith("fc") || h.startsWith("fd"))) return true
+  // fe80::/10 link-local covers fe80:…febf:… — startsWith("fe80:") is the
+  // practical subset (fe8/fe9/fea/feb all begin fe8/feb — full range regex
+  // would be /^fe[89ab][0-9a-f]:/; startsWith fe8 + fe9 + fea + feb covers it).
+  if (h.includes(":")) {
+    if (h === "::1" || h.startsWith("fc") || h.startsWith("fd")) return true
+    if (/^fe[89ab][0-9a-f]:/.test(h)) return true
+  }
   const m = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
   if (m) {
+    // Octet range is NOT validated (999.10.0.1 parses but matches no private
+    // prefix → treated as public). Intentional: the guard checks known-private
+    // prefixes; invalid IPs are harmless false-negatives for SSRF purposes.
     const [a, b] = [Number(m[1]), Number(m[2])]
     if (a === 10 || (a === 172 && b >= 16 && b <= 31) || a === 192 && b === 168 || a === 169 && b === 254 || a === 0) return true
   }
@@ -69,24 +81,10 @@ export function truncate(text, max = MAX_OUTPUT_CHARS) {
   return text.slice(0, max) + `\n[... truncated: ${text.length - max} chars omitted — redirect to a file if you need the full output]`
 }
 
-/** Read response body with a byte limit */
-export async function readBodyText(response, limit = MAX_RESPONSE_BODY_BYTES) {
-  if (!response.body) return ""
-  const reader = response.body.getReader()
-  const chunks = []
-  let total = 0
-  try {
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
-      if (value) { chunks.push(value); total += value.length }
-      if (total >= limit) { await reader.cancel(); break }
-    }
-  } finally { reader.releaseLock() }
-  return new TextDecoder("utf-8").decode(Buffer.concat(chunks))
-}
-
 /** Streaming decoder: encoding sniffing ASCII→UTF-8→GBK.
+ *  KNOWN LIMITATION (accepted): the fallback is hardcoded to GBK (Chinese) —
+ *  Shift-JIS/EUC-KR pages decode as mojibake. Real-world usage is dominated
+ *  by UTF-8; a charset-aware variant would need the Content-Type header.
  *  Each call creates an independent decoder instance — must not be shared across parallel streams (internal decoder state accumulates). */
 export function makeDecoder() {
   let decoder = null
@@ -154,7 +152,7 @@ export async function autoSyntaxCheck(abs) {
 }
 
 /** Resolve realpath by walking up the directory tree */
-export function realpathNearest(abs) {
+function realpathNearest(abs) {
   let cur = abs
   const tail = []
   while (!existsSync(cur)) {
@@ -167,15 +165,20 @@ export function realpathNearest(abs) {
   catch { return abs }
 }
 
+// cwd is effectively constant per CLI session — the cache never grows in
+// practice. A long-running server with rotating cwds would leak; revisit with
+// an LRU if that usage ever appears.
 const realCwdCache = new Map()
 /** Resolve cwd to realpath, cached */
-export function realCwd(cwd) {
+function realCwd(cwd) {
   if (!realCwdCache.has(cwd)) realCwdCache.set(cwd, realpathNearest(resolve(cwd)))
   return realCwdCache.get(cwd)
 }
 
 /** Assert that a resolved path is inside cwd; throws on escape */
-export function assertInside(cwd, resolved, p) {
+function assertInside(cwd, resolved, p) {
+  // relative() returns platform-native separators; ".." + sep therefore
+  // matches both / and \ traversal on the respective platform.
   const rel = relative(cwd, resolved)
   if (isAbsolute(rel) || rel === ".." || rel.startsWith(".." + sep)) {
     throw new Error(`Access denied outside working directory: ${p}`)
@@ -215,8 +218,11 @@ function blankQuoted(command) {
     const ch = command[i]
     if (quote) {
       if (ch === "\\" && quote !== "'") { out += " "; i++; out += " "; continue }
-      if (ch === quote) quote = null
-      out += " "
+      if (ch === quote) { quote = null; out += " "; continue }
+      // Backticks are COMMAND SUBSTITUTION — the content executes, so it must
+      // stay visible to the redirection check (echo `cat > /tmp/x` writes a
+      // file). Only ' and " are literal regions.
+      out += quote === "`" ? ch : " "
     } else if (ch === "'" || ch === '"' || ch === "`") {
       quote = ch
       out += " "
@@ -227,17 +233,22 @@ function blankQuoted(command) {
   return out
 }
 
-/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions */
+/** Detect shell output/input redirection (> >> < followed by filename) outside quoted regions.
+ *  Backtick contents count (command substitution executes); fd-prefixed forms
+ *  (2> file, 1>> file) count too. */
 export function hasFileRedirection(command) {
   const bare = blankQuoted(command)
-  return /(^|[\s;&|])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|])<\s*\S/.test(bare)
+  return /(^|[\s;&|0-9])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|0-9])<\s*\S/.test(bare)
 }
 
 /** Whether a single command segment is a destructive non-git command (conservative: prefer false positives) */
 export function isDestructiveCommand(seg) {
   const s = seg
-  // rm with both recursive (-r/-R) and force (-f) flags: -rf / -fr / -r -f / -Rf etc.
-  if (/\brm\b/.test(s) && /\s-\S*r/i.test(s) && /\s-\S*f/i.test(s)) return true
+  // rm with recursive (-r/-R/--recursive): destructive WITH or WITHOUT -f
+  // (recursive delete removes trees non-interactively in many setups; -rf is
+  // the classic case). Conservative: prefer blocking. The \s before the flag
+  // requires a separator — "rm-rf" is not a valid command (no such program).
+  if (/\brm\b/.test(s) && (/\s-\S*r/i.test(s) || /\s--recursive\b/i.test(s))) return true
   if (/\brmdir\b/i.test(s)) return true
   if (/\bdel\b/i.test(s) && /\/f\b/i.test(s)) return true
   if (/\brd\b/i.test(s) && /\/s\b/i.test(s)) return true
@@ -251,28 +262,11 @@ export function isDestructiveCommand(seg) {
   return false
 }
 
-/** Whether a single command segment destroys uncommitted changes */
-export function isDestructiveGitSegment(seg) {
-  if (!/^\s*git\s/.test(seg)) return false
-  if (/\scheckout\s+(?:--|\.(?:\s|$))/.test(seg)) return true
-  if (/\sreset\s+--hard\b/.test(seg)) return true
-  if (/\sclean\s+-\S*f/.test(seg)) return true
-  if (/\srestore\s/.test(seg) && (/--worktree/.test(seg) || !/--staged/.test(seg))) return true
-  return false
-}
-
-/** Whether cwd is inside a git repository */
-export function insideGitRepo(cwd) {
-  try {
-    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
-    })
-    return true
-  } catch { return false }
-}
 
 /** Convert glob pattern to regex */
 export function globToRegex(pattern) {
+  // Sentinel chars: \u0001/\u0002 never appear in real glob patterns (they
+  // come from model output or the filesystem) — safe as **/ and ** placeholders.
   const DS = "\u0001", DP = "\u0002"
   const escaped = pattern
     .replace(/\*\*\//g, DS).replace(/\*\*/g, DP)
@@ -283,12 +277,24 @@ export function globToRegex(pattern) {
   return new RegExp(`^${escaped}$`)
 }
 
-/** Strip HTML tags */
+/** Decode a numeric HTML entity to its code point — invalid/out-of-range
+ *  values (e.g. &#999999999999;) must not throw RangeError; keep the source
+ *  text as-is (display-only residue is acceptable). */
+function decodeNumericEntity(_, digits) {
+  const n = Number(digits)
+  return Number.isSafeInteger(n) && n <= 0x10ffff ? String.fromCodePoint(n) : _
+}
+
+/** Strip HTML tags. KNOWN LIMITATION (accepted): the `/<[^>]+>/g` regex treats
+ *  the first `>` (or a `<` inside an attribute value) as the tag boundary —
+ *  `<img alt="a > b">` truncates the match and leaves text residue. A full
+ *  HTML parser is out of scope; real-world HTML with angle brackets in
+ *  attributes is rare and the residue is display-only (never parsed). */
 export function stripTags(html) {
   return html
     .replace(/<[^>]+>/g, "")
-    .replace(/&#0*(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-    .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#0*(\d+);/g, (m, n) => decodeNumericEntity(m, n))
+    .replace(/&#x([0-9a-fA-F]+);/g, (m, h) => decodeNumericEntity(m, parseInt(h, 16)))
     .replace(/&nbsp;|&ensp;/g, " ")
     .replace(/&lt;/g, "<")
     .replace(/&gt;/g, ">")
@@ -308,8 +314,8 @@ export function htmlToText(html) {
     .replace(/<br\s*\/?>/gi, "\n")
     .replace(/<li[^>]*>/gi, "- ")
     .replace(/<[^>]+>/g, "")
-    .replace(/&#0*(\d+);/g, (_, n) => String.fromCodePoint(Number(n)))
-    .replace(/&#x([0-9a-fA-F]+);/g, (_, h) => String.fromCodePoint(parseInt(h, 16)))
+    .replace(/&#0*(\d+);/g, (m, n) => decodeNumericEntity(m, n))
+    .replace(/&#x([0-9a-fA-F]+);/g, (m, h) => decodeNumericEntity(m, parseInt(h, 16)))
     .replace(/&nbsp;|&ensp;/g, " ")
     .replace(/&lt;/g, "<")
     .replace(/&gt;/g, ">")
@@ -325,8 +331,13 @@ export function runGit(cwd, cmdArgs) {
   try {
     return execFileSync("git", cmdArgs, { cwd, encoding: "utf8", maxBuffer: 10 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] }).trim().replace(/\r/g, "")
   } catch (e) {
-    // ERR_CHILD_PROCESS_STDIO_MAXBUFFER: e.stdout contains partial output, return first 200 lines
-    if (e.stdout) return String(e.stdout).trim().replace(/\r/g, "").split("\n").slice(0, 200).join("\n")
+    // maxBuffer overflow: e.stdout contains partial collected output — return it
+    // (callers show "(truncated)"-style tails). ALL OTHER errors (non-git repo,
+    // permission, bad command) return "" — matching gitDiffOne's pattern: a
+    // failed git call must not masquerade as partial success.
+    if (e.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" && e.stdout) {
+      return String(e.stdout).trim().replace(/\r/g, "").split("\n").slice(0, 200).join("\n")
+    }
     return ""
   }
 }

package/src/tui/agent-turn.mjs

@@ -2,11 +2,17 @@ import { runAgent, ContinueError } from "../agent.mjs"
 import { saveSession } from "../session.mjs"
 import { sliceByWidth } from "./render.mjs"
 import { ansi, C } from "./ansi.mjs"
+import { formatToolSummary } from "./tool-summaries.mjs"
+import { ADVISOR_THINKING_PLACEHOLDER } from "../advisor/run.mjs"
 
 /** Tool execution start timestamps (performance.now ms), keyed by tool name. */
 const _toolTicks = Object.create(null)
 
-/** Per-tool streaming preview line limits — tools with verbose output get more lines */
+/** Per-tool streaming preview line limits — tools with verbose output get more lines.
+ *  NOTE: `advisor` is intentionally NOT pruned by the live-line mechanism: its
+ *  streaming returns early (kind-split into _advisorThink/advisorStreaming) and
+ *  is rendered full-length in render-conversation. The entry is kept for
+ *  symmetry with the map's other tools. */
 const LIVE_LINE_LIMITS = {
   bash: 10,
   advisor: 15,
@@ -43,8 +49,7 @@ export async function runAgentTurn(ctx, text) {
   state.status = "Processing..."
   state.streaming = ""
   state.reasoning = ""
-  state.advisorStreaming = ""
-  state._advisorThink = ""
+  state._advisorBlocks = []
   state.subTasks = {}
   state.currentTool = null
   state.processingStarted = Date.now()
@@ -56,6 +61,12 @@ export async function runAgentTurn(ctx, text) {
   }, 1000)
   render()
 
+  // NOTE: advisor buffers (_advisorThink/advisorStreaming) are cleared here too.
+  // Timing safety: onToolResult flushes _advisorThink into history and empties
+  // the buffers BEFORE onTurnEnd can call flushStream (tool result is
+  // dispatched inside executeToolCalls; onTurnEnd fires after the turn loop
+  // resumes). If a future change calls flushStream mid-advisor-execution the
+  // in-progress thinking WOULD be lost — keep the ordering, or flush here too.
   const flushStream = () => {
     if (state.reasoning) {
       const idx = state.lines.length
@@ -77,8 +88,7 @@ export async function runAgentTurn(ctx, text) {
       state._autoExpand.push(idx)
       state.streaming = ""
     }
-    state.advisorStreaming = ""
-    state._advisorThink = ""
+    state._advisorBlocks = []
   }
 
   const callbacks = {
@@ -132,7 +142,10 @@ export async function runAgentTurn(ctx, text) {
         scheduleRender()
         return
       }
-      if (name === "advisor") { state.advisorStreaming = ""; state._advisorThink = "" }
+      // Redundant with flushStream() below (it clears both buffers) — kept as
+      // defense-in-depth so a future flushStream change cannot leak advisor
+      // buffers into the next tool's view.
+      if (name === "advisor") { state._advisorBlocks = [] }
       flushStream()
       ensureAssistantLabel()
       state.currentTool = name
@@ -197,7 +210,37 @@ export async function runAgentTurn(ctx, text) {
         const summary = formatToolSummary(name, result)
         if (summary) pushLine(`  ${summary}`, C.dim)
       }
-      if (name === "advisor") { state.advisorStreaming = ""; state._advisorThink = "" }
+      if (name === "advisor") {
+        // The review's thinking must survive into the conversation history like
+        // the main agent's reasoning (flushStream does for state.reasoning) —
+        // discarding it left the thought process visible only mid-review, then
+        // gone. Flush BEFORE the done line so the block sits above it.
+        // NOTE (rendering): the flushed block has NO "│ " gutter prefix while
+        // the live streaming view adds one — same convention as the main
+        // agent's reasoning (live gutter, history plain). Intentional.
+        const blocks = state._advisorBlocks ?? []
+        if (blocks.length > 0) {
+          // Flush the ordered blocks in sequence — thinking and tool progress
+          // alternate in history exactly as they were emitted. The live
+          // "[thinking…]" placeholders are stripped (wait indicators, not
+          // review content); literal replaceAll of the shared constant can
+          // never drift.
+          const text = blocks
+            .map((b) => b.text.replaceAll(ADVISOR_THINKING_PLACEHOLDER, ""))
+            .join("")
+            .replace(/\n{3,}/g, "\n\n")
+            .trim()
+          if (text) {
+            const idx = state.lines.length
+            pushLine(text, C.reason)
+            // Completed review output stays expanded (user is reading it).
+            state.expandedBlocks ??= new Set()
+            state.expandedBlocks.add("long-" + idx)
+            state._autoExpand ??= []
+            state._autoExpand.push(idx)
+          }
+        }
+      }
       // Done line for ALL tools (panel area abolished — inline only).
       if (!isSubagent) {
         const elapsed = _toolTicks[name] ? ` (${Math.round(performance.now() - _toolTicks[name])}ms)` : ""
@@ -217,13 +260,23 @@ export async function runAgentTurn(ctx, text) {
       if (name === "advisor") {
         // Accumulate to buffer — formatTables + wrapText in render-conversation
         // handles markdown formatting, same as main agent response.
-        const raw = typeof chunk === "string" ? chunk : String(chunk?.text ?? "")
-        const kind = typeof chunk === "string" ? "text" : (chunk?.kind ?? "text")
-        if (kind === "think") {
-          state._advisorThink = (state._advisorThink || "") + raw
-        } else {
-          state.advisorStreaming += raw
-        }
+        // NOTE: the advisor tool ALWAYS emits {kind, text} objects (run.mjs's
+        // emit() wrapper) — a raw string chunk is never think; if that ever
+        // changes, plain-string think would land in advisorStreaming.
+        // ORDERED block buffer — preserves the interleaved emission order
+        // (think → tool → think → … → final). Two separate buffers (_advisorThink
+        // vs advisorStreaming) rendered think-block-then-main-block, which
+        // regrouped ALL thinking above ALL tool progress — the alternating
+        // timeline was destroyed. Consecutive chunks of the same kind merge
+        // into one block; kind flips start a new block; render walks the
+        // blocks in order with per-kind colors.
+        const isString = typeof chunk === "string"
+        const raw = isString ? chunk : String(chunk?.text ?? "")
+        const kind = isString ? "text" : (chunk?.kind ?? "text")
+        const blocks = state._advisorBlocks ??= []
+        const last = blocks.at(-1)
+        if (last && last.kind === kind) last.text += raw
+        else blocks.push({ kind, text: raw })
         scheduleRender()
         return
       }
@@ -295,7 +348,11 @@ export async function runAgentTurn(ctx, text) {
         // pushback messages appear in the conversation at the right spot.
         const last = agent.history.at(-1)
         if (last?.role === "user" && typeof last.content === "string" && last.content.startsWith("[System reminder:")) {
-          pushLine(last.content, C.warn)
+          // Reminders can embed long prior tables — show only the first lines
+          // (the full text is in agent.history); 3 lines + ellipsis.
+          const lines = last.content.split("\n")
+          const shown = lines.length > 3 ? lines.slice(0, 3).join("\n") + "\n…" : last.content
+          pushLine(shown, C.warn)
         }
         if (++n % 5 !== 0) return
         try { saveSessionImpl(agent, state.lines) } catch (e) { console.error(`[session] incremental save failed: ${e.message}`) }
@@ -357,8 +414,7 @@ export async function runAgentTurn(ctx, text) {
     clearInterval(ticker)
     state.processing = false
     state.subTasks = {}
-    state.advisorStreaming = ""
-    state._advisorThink = ""
+    state._advisorBlocks = []
     state.controller = null
     state.status = "Ready"
     // Auto-collapse todo panel when all tasks done (matching kimi-code TUI; agent.tasks are preserved)
@@ -403,107 +459,3 @@ export async function runAgentTurn(ctx, text) {
     return
   }
 }
-
-/** Extract a one-line summary from tool output for the done line */
-function formatToolSummary(name, result) {
-  if (name === "verify") return _verifySummary(result)
-  if (name === "bash") return _bashSummary(result)
-  if (name === "advisor") return _advisorSummary(result)
-  if (name === "read" || name === "read_file") return _readSummary(result)
-  if (name === "write" || name === "write_file") return _writeSummary(result)
-  if (name === "grep" || name === "search") return _grepSummary(result)
-  if (name === "glob") return _globSummary(result)
-  // Default: first non-empty line
-  const first = result.split("\n").find((l) => l.trim())
-  return first ? `${name}: ${first.slice(0, 100)}` : null
-}
-
-function _readSummary(result) {
-  const lines = result.split("\n")
-  // Look for line count in result
-  const countMatch = result.match(/(\d+) lines?/)
-  if (countMatch) return `${countMatch[1]} lines`
-  // Fallback: count actual lines
-  return `${lines.length} lines`
-}
-
-function _writeSummary(result) {
-  // Extract file size or confirmation
-  if (result.includes("wrote") || result.includes("created")) {
-    const sizeMatch = result.match(/(\d+)(?:\s*(?:bytes?|chars?))/i)
-    return sizeMatch ? `wrote ${sizeMatch[1]} bytes` : "wrote file"
-  }
-  const first = result.split("\n").find((l) => l.trim())
-  return first ? first.slice(0, 80) : "wrote"
-}
-
-function _grepSummary(result) {
-  const lines = result.split("\n").filter((l) => l.trim())
-  const count = lines.length
-  if (count === 0) return "no matches"
-  if (count === 1) return "1 match"
-  return `${count} matches`
-}
-
-function _globSummary(result) {
-  const lines = result.split("\n").filter((l) => l.trim())
-  const count = lines.length
-  if (count === 0) return "no files"
-  if (count === 1) return "1 file"
-  return `${count} files`
-}
-
-/**
- * bash result format: "[stdout]:\n<out>\n\n[stderr]:\n<err>\n\n(exit code 0)".
- * The first non-empty line is always the "[stdout]:" marker — useless as a summary.
- * Show the LAST output line (usually the meaningful tail) plus the exit status.
- */
-function _bashSummary(result) {
-  const isMarker = (l) => /^\[(stdout|stderr)\]:$/.test(l) || /^\((exit code|killed)/.test(l)
-  const lines = result.split("\n").map((l) => l.trim()).filter((l) => l && !isMarker(l))
-  const status = result.match(/\((?:exit code|killed)[^)]*\)/)?.[0]
-  const parts = []
-  if (lines.length > 0) parts.push(lines[lines.length - 1].slice(0, 100))
-  if (status) parts.push(status)
-  return parts.length > 0 ? `bash: ${parts.join(" ")}` : null
-}
-
-function _advisorSummary(result) {
-  const text = String(result ?? "")
-  if (/no 🔴|all.*(?:resolved|fixed|pass)/im.test(text)) return "advisor: passed"
-  // Error / skip messages — extract the reason after "Advisor:"
-  const errMatch = text.trimStart().match(/^Advisor:\s*(.+)/)
-  if (errMatch) return `advisor: ${errMatch[1].split(".")[0]}`
-  const critical = (text.match(/\| \d+ \|.*\| 🔴/g) || []).length
-  const advisory = (text.match(/\| \d+ \|.*\| 🟡/g) || []).length
-  const style = (text.match(/\| \d+ \|.*\| 🔵/g) || []).length
-  const parts = []
-  if (critical) parts.push(`${critical} critical`)
-  if (advisory) parts.push(`${advisory} advisory`)
-  if (style) parts.push(`${style} style`)
-  if (parts.length === 0) return null
-  return `advisor: ${parts.join(", ")}`
-}
-
-function _verifySummary(result) {
-  const lines = result.split("\n")
-  const summary = []
-  // Changed files count
-  const changed = lines.find((l) => l.startsWith("Changed files:"))
-  if (changed) {
-    const m = changed.match(/files changed/) ? changed.replace(/^Changed files \(.*?\)/, "Changed files") : changed
-    summary.push(m)
-  }
-  // Syntax check results
-  const syntax = lines.filter((l) => l.startsWith("  ✗"))
-  if (syntax.length > 0) {
-    summary.push(`${syntax.length} syntax error(s)`)
-  }
-  // Test results
-  const testLine = lines.find((l) => l.startsWith("✓ Tests passed.") || l.startsWith("✗ Tests FAILED"))
-  if (testLine) summary.push(testLine.trim())
-  // Task list
-  const taskLine = lines.find((l) => l.startsWith("Task list:"))
-  if (taskLine) summary.push(taskLine)
-  return summary.length > 0 ? `verify: ${summary.join(" — ")}` : ""
-}

package/src/tui/index.mjs

@@ -60,7 +60,7 @@ export async function startTUI(agent, opts = {}) {
   const state = {
     lines: [], // conversation lines: { text, color }
     streaming: "", // current streaming buffer
-    advisorStreaming: "", // advisor streaming buffer (formatted like main response)
+    _advisorBlocks: [], // advisor ordered blocks: [{ kind: "think"|"text", text }] — preserves emission order (think ↔ tool interleaving)
     input: [], // input buffer (codepoint array)
     cursor: 0,
     history: [],

package/src/tui/markdown.mjs

@@ -5,9 +5,11 @@
  * model replies stop showing literal `**`, `##`, backtick markers (IK5VW3).
  *
  * Design constraints:
- * - Operates on ALREADY-WRAPPED single lines (call after wrapText): inserting ANSI
- *   here cannot break width math, because wrapping already happened.
- * - Uses narrow-scope SGR resets (22 = bold off, 27 = reverse off, 29 = strikethrough off)
+ * - Display-only rendering. renderMarkdownHeading handles multi-line input
+ *   (splits internally); renderMarkdownInline expects single lines (its
+ *   regexes use [^*\n]+ — no cross-line matches). Callers pass pre-wrapped
+ *   lines so the inserted ANSI never skews width math.
+ * - Uses narrow-scope SGR resets (22 = bold off, 24 = underline off, 29 = strikethrough off)
  *   instead of reset(0), so the line's base color (C.text etc.) survives.
  * - Code spans are extracted FIRST: anything inside backticks is styled as code and
  *   its `**`/`__` markers are NOT interpreted (markdown semantics).
@@ -15,6 +17,10 @@
  */
 
 const BOLD = "\x1b[1m"
+// NOTE: \x1b[22m resets BOTH bold and faint/dim (SGR 2). Today no C.reason
+// (dim) line passes through markdown rendering (reasoning/think blocks skip
+// it), so this is latent — if dim text ever gains markdown, bold segments
+// would clear the dim effect after them.
 const BOLD_OFF = "\x1b[22m"
 const UNDERLINE = "\x1b[4m"
 const UNDERLINE_OFF = "\x1b[24m"
@@ -23,7 +29,10 @@ const STRIKE_OFF = "\x1b[29m"
 
 /** Render inline markers on a single text line: `code` spans, **bold**, __bold__, ~~strike~~. */
 export function renderMarkdownInline(line) {
-  if (!line || line.indexOf("*") === -1 && line.indexOf("`") === -1 && line.indexOf("_") === -1 && line.indexOf("~") === -1) {
+  // Single underscore lines (snake_case identifiers) must short-circuit too —
+  // __bold__ needs a DOUBLE underscore; a lone "_" would otherwise run the
+  // whole split/replace pipeline for nothing.
+  if (!line || (line.indexOf("*") === -1 && line.indexOf("`") === -1 && line.indexOf("__") === -1 && line.indexOf("~") === -1)) {
     return line
   }
 
@@ -44,9 +53,18 @@ export function renderMarkdownInline(line) {
   return out
 }
 
-/** Render a heading line: strip leading `#` markers and bold the whole line. Returns original when not a heading. */
+/** Render heading markers: strip leading `#` markers and bold the heading.
+ *  Inline markers inside the heading are stripped too — the heading is already
+ *  fully bold, so `**bold**` inside it would wrap another bold sequence whose
+ *  `\x1b[22m` turns bold OFF for the rest of the heading text.
+ *  Line-by-line (split on \n): without the m flag, `^`/`$` anchor the whole
+ *  string, so a multi-line input never matched and headings stayed raw —
+ *  the old call sites passed single wrapped lines and hid the defect.
+ *  Returns the original text when no line is a heading. */
 export function renderMarkdownHeading(line) {
-  const m = /^\s{0,3}(#{1,6})\s+(.*)$/.exec(line)
-  if (!m || !m[2]) return line
-  return `${BOLD}${m[2]}${BOLD_OFF}`
+  return line.split("\n").map((l) => {
+    const m = /^\s{0,3}(#{1,6})\s+(.*)$/.exec(l)
+    if (!m || !m[2]) return l
+    return `${BOLD}${m[2].replace(/\*\*|__|~~/g, "")}${BOLD_OFF}`
+  }).join("\n")
 }