tokenmaw 0.3.0 → 0.4.1

package/dist/infra/tools.js

@@ -1,6 +1,6 @@
 import { readFile, writeFile, readdir, mkdir, stat, rename, rm } from 'node:fs/promises';
 import { createHash, randomUUID } from 'node:crypto';
-import { exec, execFile } from 'node:child_process';
+import { exec, execFile, spawn } from 'node:child_process';
 import { promisify } from 'node:util';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from 'node:path';
 import { ToolRegistry } from '../tools/registry.js';
@@ -63,6 +63,36 @@ async function writeViaWorkspace(targetPath, content, ctx) {
     await atomicWrite(absoluteTarget, content);
     return absoluteTarget;
 }
+/**
+ * Staged, all-or-nothing write: content goes to a staging file next to the
+ * target, is verified from disk, and only then is atomically swapped in via
+ * rename. The target is never observable in a partially written or unverified
+ * state, and any failure (including failed readback verification) leaves the
+ * target byte-for-byte unchanged — no post-failure restore pass needed.
+ */
+async function stagedWrite(path, content, ctx, verify) {
+    const absoluteTarget = resolveWriteTarget(path, ctx);
+    const root = workspaceRoot(ctx);
+    const rel = absoluteTarget.startsWith(root)
+        ? relative(root, absoluteTarget)
+        : join('__external__', absoluteTarget.replace(/^([a-zA-Z]:)?[/\\]+/, ''));
+    const workspacePath = join(root, '.agent-workspace', rel);
+    const staging = `${absoluteTarget}.${process.pid}.${randomUUID()}.staging`;
+    await mkdir(dirname(absoluteTarget), { recursive: true });
+    try {
+        await writeFile(staging, content, 'utf8');
+        const written = await readFile(staging, 'utf8');
+        await verify(written);
+        await mkdir(dirname(workspacePath), { recursive: true });
+        await atomicWrite(workspacePath, content);
+        await rename(staging, absoluteTarget);
+    }
+    catch (error) {
+        await rm(staging, { force: true }).catch(() => undefined);
+        throw error;
+    }
+    return absoluteTarget;
+}
 async function atomicWrite(path, content) {
     const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
     await writeFile(temp, content, 'utf8');
@@ -196,6 +226,54 @@ function closestLineHints(content, search) {
         return hints;
     return lineNumbersOf(content, firstLine.slice(0, 24), 3);
 }
+function normalizedForSimilarity(value) {
+    return value.replace(/\r\n/g, '\n').replace(/[\t ]+/g, ' ').trim();
+}
+function editDistance(a, b) {
+    if (a === b)
+        return 0;
+    if (!a.length)
+        return b.length;
+    if (!b.length)
+        return a.length;
+    let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i += 1) {
+        const current = [i];
+        for (let j = 1; j <= b.length; j += 1) {
+            current[j] = Math.min(current[j - 1] + 1, previous[j] + 1, previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        previous = current;
+    }
+    return previous[b.length];
+}
+function closestMatch(content, search) {
+    const requested = search.split('\n');
+    const lines = content.split('\n');
+    const count = requested.length;
+    if (!search.trim() || !lines.length)
+        return undefined;
+    let best;
+    for (let i = 0; i <= lines.length - count; i += 1) {
+        const matched = lines.slice(i, i + count).join('\n');
+        const left = normalizedForSimilarity(search);
+        const right = normalizedForSimilarity(matched);
+        const max = Math.max(left.length, right.length, 1);
+        const similarity = 1 - editDistance(left, right) / max;
+        if (!best || similarity > best.similarity)
+            best = { line: i + 1, matched, similarity };
+    }
+    return best;
+}
+function diagnosticDiff(requested, matched) {
+    const requestedLines = requested.split('\n');
+    const matchedLines = matched.split('\n');
+    const lines = ['```diff', '- requested'];
+    lines.push(...requestedLines.map((line) => `- ${line}`));
+    lines.push('+ matched');
+    lines.push(...matchedLines.map((line) => `+ ${line}`));
+    lines.push('```');
+    return lines.join('\n');
+}
 function stripReadFileLineNumbers(search) {
     const lines = search.split('\n');
     const contentLines = lines.filter((line) => !line.startsWith('... (showing lines '));
@@ -258,7 +336,17 @@ export function getToolPolicy() {
     return clonePolicy(defaultToolPolicy);
 }
 async function withWriteLock(ctx, path, action) {
-    const release = await ctx?.acquireWriteLock?.(path);
+    if (!ctx) {
+        // Bare toolkit call without a runtime context (direct library use): no
+        // lock service exists to consult. Documented as unlocked.
+        return action();
+    }
+    if (!ctx.acquireWriteLock) {
+        // Never write unlocked when a runtime context is present: a silent
+        // unlocked write would lose updates against concurrent processes.
+        throw new Error(`write lock unavailable for ${path}: the runtime context did not provide acquireWriteLock; refusing unlocked write`);
+    }
+    const release = await ctx.acquireWriteLock(path);
     try {
         return await action();
     }
@@ -535,8 +623,7 @@ function parseStringArray(value) {
         return undefined;
     }
 }
-async function readLineRange(filePath, offset = 1, limit) {
-    const raw = await readFile(filePath, 'utf8');
+function formatLineRange(raw, offset = 1, limit) {
     if (raw === '')
         return '';
     const allLines = raw.split('\n');
@@ -548,11 +635,17 @@ async function readLineRange(filePath, offset = 1, limit) {
         ? `${numbered}\n... (showing lines ${startLine}-${endLine} of ${totalLines}; use offset/limit to read more)`
         : numbered;
 }
+async function readLineRange(filePath, offset = 1, limit) {
+    return formatLineRange(await readFile(filePath, 'utf8'), offset, limit);
+}
 function boundedOutput(value, maxChars = 4 * 1024 * 1024) {
     if (value.length <= maxChars)
         return value;
     return `${value.slice(0, maxChars)}\n... (output truncated at ${maxChars} characters)`;
 }
+function contentVersion(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
 // ── Pure-Node search fallback (used when `rg` is not installed) ──────────────
 // Mirrors the rg invocations in `search_text`/`search_files`: hidden files are
 // included, only `.git` and `node_modules` are skipped.
@@ -934,7 +1027,10 @@ async function executeBuiltinTool(name, args, ctx) {
             const offsetArg = typeof args['offset'] === 'number' ? args['offset'] : undefined;
             const limitArg = typeof args['limit'] === 'number' ? args['limit'] : undefined;
             try {
-                return await readLineRange(resolveToolPath(path, ctx), offsetArg, limitArg);
+                const targetPath = resolveToolPath(path, ctx);
+                const content = await readFile(targetPath, 'utf8');
+                ctx?.recordReadVersion?.(targetPath, contentVersion(content));
+                return formatLineRange(content, offsetArg, limitArg);
             }
             catch (error) {
                 return `Error reading file: ${String(error)}`;
@@ -955,7 +1051,10 @@ async function executeBuiltinTool(name, args, ctx) {
                     continue;
                 }
                 try {
-                    sections.push(`===== ${path} =====\n${await readLineRange(resolveToolPath(path, ctx), 1, maxLines)}`);
+                    const targetPath = resolveToolPath(path, ctx);
+                    const content = await readFile(targetPath, 'utf8');
+                    ctx?.recordReadVersion?.(targetPath, contentVersion(content));
+                    sections.push(`===== ${path} =====\n${formatLineRange(content, 1, maxLines)}`);
                 }
                 catch (error) {
                     sections.push(`===== ${path} =====\nError reading file: ${String(error)}`);
@@ -1006,6 +1105,16 @@ async function executeBuiltinTool(name, args, ctx) {
                 catch (error) {
                     return `Error reading file for edit: ${String(error)}`;
                 }
+                const currentVersion = contentVersion(src);
+                if (ctx?.requirePriorRead) {
+                    const readVersion = ctx.getReadVersion?.(targetPath);
+                    if (!readVersion) {
+                        return `Error: edit_file requires a prior read_file of ${path} in this session. Read the file, then retry the edit.`;
+                    }
+                    if (readVersion !== currentVersion) {
+                        return `Error: edit_file read lease is stale for ${path}; the file changed after it was read. Read it again before editing.`;
+                    }
+                }
                 let parsed;
                 try {
                     if (Array.isArray(editsArg)) {
@@ -1022,13 +1131,18 @@ async function executeBuiltinTool(name, args, ctx) {
                 catch (error) {
                     return `Error parsing edits JSON: ${String(error)}`;
                 }
-                const noMatchError = (index, search) => {
-                    const hints = closestLineHints(src, search);
+                const noMatchError = (index, search, haystack = content) => {
+                    const hints = closestLineHints(haystack, search);
                     const hint = hints.length > 0 ? `\nFirst line of the search loosely appears near lines: ${hints.join(', ')}.` : '';
-                    return `Error: edit[${index}]: Could not find old text in ${path}. It must match exactly, including whitespace, indentation, and line endings.\nSearch string was:\n${search}${hint}`;
+                    const closest = closestMatch(haystack, search);
+                    const detail = closest
+                        ? `\nClosest normalized window: lines ${closest.line}-${closest.line + search.split('\n').length - 1} (similarity ${closest.similarity.toFixed(3)}).\n${diagnosticDiff(search, closest.matched)}`
+                        : '';
+                    return `Error: edit[${index}]: Could not find old text in ${path}. It must match exactly, including whitespace, indentation, and line endings.\nSearch string was:\n${search}${hint}${detail}\nNext action: resubmit the exact matched text.`;
                 };
                 let content = src;
                 const log = [];
+                const diagnostics = [];
                 const applied = [];
                 for (let i = 0; i < parsed.length; i += 1) {
                     const entry = parsed[i];
@@ -1047,10 +1161,12 @@ async function executeBuiltinTool(name, args, ctx) {
                     const numberedSearch = stripReadFileLineNumbers(search);
                     const unescapedSearch = unescapeEscapes(search);
                     const variants = [search];
-                    if (numberedSearch !== undefined && numberedSearch !== search && !variants.includes(numberedSearch))
-                        variants.push(numberedSearch);
-                    if (unescapedSearch !== search && !variants.includes(unescapedSearch))
-                        variants.push(unescapedSearch);
+                    if (!replaceAll) {
+                        if (numberedSearch !== undefined && numberedSearch !== search && !variants.includes(numberedSearch))
+                            variants.push(numberedSearch);
+                        if (unescapedSearch !== search && !variants.includes(unescapedSearch))
+                            variants.push(unescapedSearch);
+                    }
                     if (replaceAll) {
                         let usedVariant;
                         let count = 0;
@@ -1096,33 +1212,52 @@ async function executeBuiltinTool(name, args, ctx) {
                     content = content.replace(matched, effectiveReplace);
                     applied.push({ search: matched, replace: effectiveReplace, made: 1 });
                     const normalizedLineNumbers = numberedSearch !== undefined && matchedVariant === numberedSearch;
-                    log.push(`edit[${i}]: replaced ${matched.length} chars via ${outcome.strategy}${normalizedLineNumbers ? ' (line-number normalized)' : ''}`);
+                    log.push(`edit[${i}]: replaced ${matched.length} chars via ${outcome.strategy}${normalizedLineNumbers ? ' (line-number normalized)' : ''}${outcome.strategy === 'exact' ? '' : ' [non-exact; use exact text next time]'}`);
+                    if (outcome.strategy !== 'exact' || normalizedLineNumbers) {
+                        diagnostics.push(`edit[${i}] matched span vs requested (strategy: ${outcome.strategy}${normalizedLineNumbers ? ', line-number normalized' : ''}):\n${diagnosticDiff(search, matched)}`);
+                    }
                 }
                 if (content === src) {
                     return `OK: no changes made to ${path}${log.length > 0 ? ` (${log.join('; ')})` : ''}`;
                 }
+                // Optimistic conflict check: while holding the write lock, confirm the
+                // file on disk still matches the content these edits were based on.
+                // The cross-process lock excludes other runtime processes, so a
+                // mismatch means an external writer (editor, script) touched the file
+                // between our read and this write — refuse instead of clobbering it.
                 try {
-                    const writtenPath = await writeViaWorkspace(path, content, ctx);
-                    const written = await readFile(writtenPath, 'utf8');
-                    for (const edit of applied) {
-                        if (edit.replace === '') {
-                            if (countOccurrences(written, edit.search) !== 0) {
-                                return `Error: readback verification failed for ${path}: deleted text is still present after write.`;
+                    const fresh = await readFile(targetPath, 'utf8');
+                    if (contentVersion(fresh) !== currentVersion) {
+                        return `Error: ${path} changed underneath this edit (modified by another process after it was read). No changes were applied. Read the file again and retry with fresh content.`;
+                    }
+                }
+                catch {
+                    return `Error: ${path} could not be re-read before applying edits (it may have been deleted externally). No changes were applied.`;
+                }
+                try {
+                    const writtenPath = await stagedWrite(path, content, ctx, (written) => {
+                        for (const edit of applied) {
+                            if (edit.replace === '') {
+                                if (countOccurrences(written, edit.search) !== 0) {
+                                    throw new Error(`readback verification failed for ${path}: deleted text is still present after write.`);
+                                }
+                            }
+                            else if (countOccurrences(written, edit.replace) < edit.made) {
+                                throw new Error(`readback verification failed for ${path}: expected at least ${edit.made} occurrence(s) of the replaced text in the written file.`);
                             }
                         }
-                        else if (countOccurrences(written, edit.replace) < edit.made) {
-                            return `Error: readback verification failed for ${path}: expected at least ${edit.made} occurrence(s) of the replaced text in the written file.`;
-                        }
-                    }
+                    });
                     await gitAutoCommit(writtenPath, `edit: ${path} (${applied.length} change${applied.length === 1 ? '' : 's'})`, ctx);
                     const diff = unifiedDiff(path, src, content);
-                    const sha256 = createHash('sha256').update(written).digest('hex').slice(0, 12);
+                    const sha256 = createHash('sha256').update(content).digest('hex').slice(0, 12);
+                    ctx?.recordWriteVersion?.(targetPath, contentVersion(content));
                     const linesBefore = src.split('\n').length;
-                    const linesAfter = written.split('\n').length;
-                    return [`OK: ${log.join('; ')} (${writtenPath}); ${linesBefore} → ${linesAfter} lines; sha256:${sha256}`, diff].filter(Boolean).join('\n\n');
+                    const linesAfter = content.split('\n').length;
+                    return [`OK: ${log.join('; ')} (${writtenPath}); ${linesBefore} → ${linesAfter} lines; sha256:${sha256}`, diagnostics.join('\n\n'), diff].filter(Boolean).join('\n\n');
                 }
                 catch (error) {
-                    return `Error writing edited file: ${String(error)}`;
+                    const message = error instanceof Error ? error.message : String(error);
+                    return `Error writing edited file: ${message} (target left unchanged)`;
                 }
             });
         }
@@ -1170,6 +1305,15 @@ async function executeBuiltinTool(name, args, ctx) {
                     catch {
                         previous = '';
                     }
+                    // Stale-read check: when this session read the file before and it has
+                    // since changed (another process wrote it), a blind overwrite would
+                    // silently destroy that work. Force a fresh read + retry instead.
+                    if (ctx?.requirePriorRead && existed) {
+                        const readVersion = ctx.getReadVersion?.(targetPath);
+                        if (readVersion && readVersion !== contentVersion(previous)) {
+                            return `Error: ${path} changed after it was read in this session (another process may have written it). Read the file again, then retry write_file.`;
+                        }
+                    }
                     const snapshot = existed ? await snapshotBeforeWrite(targetPath, workspaceRoot(ctx)) : { path: null };
                     const writtenPath = await writeViaWorkspace(path, content, ctx);
                     await gitAutoCommit(writtenPath, `write: ${path}`, ctx);
@@ -1298,3 +1442,105 @@ export function listTools(options = {}) {
 export async function executeTool(name, args, ctx) {
     return toolRegistry.execute(name, args, ctx);
 }
+/** Spawn a command without a shell layer around it, wired for incremental
+ * output: stdout/stderr chunks arrive through callbacks as the process runs,
+ * and `signal` (or the runtime timeout) kills the process tree. */
+function shellSpawn(file, args, options) {
+    return new Promise((resolveExit) => {
+        let settled = false;
+        const settle = (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            resolveExit({ code, signal });
+        };
+        let spawnError;
+        const child = spawn(file, args, {
+            cwd: options.cwd,
+            signal: options.signal,
+            windowsVerbatimArguments: options.windowsVerbatimArguments,
+            env: process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        child.stdout?.on('data', (chunk) => options.onStdout(chunk.toString('utf8')));
+        child.stderr?.on('data', (chunk) => options.onStderr(chunk.toString('utf8')));
+        child.on('error', (error) => {
+            spawnError = error;
+            // Spawn failures (missing shell, bad cwd) behave like a 127 exit.
+            settle(error.code === 'ENOENT' ? 127 : 1, undefined);
+        });
+        child.on('close', (code, signal) => {
+            if (spawnError)
+                return;
+            settle(code ?? undefined, signal ?? undefined);
+        });
+    });
+}
+/** Run a user-typed `!command` directly in a shell, bypassing the agent loop
+ * and tool policy entirely: the user is the authorizer. Output is streamed to
+ * the TUI via `onChunk` (stdout and stderr interleaved as they arrive), and
+ * `abort` kills the process tree. Like a normal shell, a nonzero exit code is
+ * not an error for the caller — the exit code rides in the result. */
+export function runShellCommand(command, options) {
+    const timeoutMs = Math.max(100, Math.min(Number(options.timeoutMs ?? 300_000), 600_000));
+    const nl = String.fromCharCode(10);
+    const maxChars = 16 * 1024 * 1024;
+    return new Promise((resolveShell) => {
+        const argv0 = process.platform === 'win32'
+            ? { file: process.env.ComSpec ?? 'cmd.exe', args: ['/d', '/s', '/c', command], verbatim: true }
+            : { file: '/bin/sh', args: ['-c', command], verbatim: false };
+        const controller = new AbortController();
+        if (options.signal) {
+            if (options.signal.aborted)
+                controller.abort(options.signal.reason);
+            else
+                options.signal.addEventListener('abort', () => controller.abort(), { once: true });
+        }
+        let output = '';
+        let truncated = false;
+        let timedOut = false;
+        let settled = false;
+        const push = (text) => {
+            if (!text)
+                return;
+            const room = maxChars - output.length;
+            if (room <= 0) {
+                truncated = true;
+                return;
+            }
+            output += text.length > room ? text.slice(0, room) : text;
+            if (text.length > room)
+                truncated = true;
+            options.onChunk?.(text);
+        };
+        const settle = (exitCode, note) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolveShell({ output: `${output}${truncated ? `${nl}(output truncated)` : ''}${note ?? ''}`, exitCode });
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        timer.unref?.();
+        void shellSpawn(argv0.file, argv0.args, {
+            cwd: options.workspaceRoot,
+            signal: controller.signal,
+            windowsVerbatimArguments: argv0.verbatim,
+            onStdout: push,
+            onStderr: push,
+        }).then(({ code, signal }) => {
+            if (timedOut) {
+                settle(undefined, `${nl}Error: command timed out`);
+                return;
+            }
+            if (controller.signal.aborted || signal) {
+                settle(undefined, `${nl}(stopped)`);
+                return;
+            }
+            settle(code ?? 0);
+        });
+    });
+}

package/dist/markdown.js

@@ -1,21 +1,49 @@
 /**
  * markdown.ts — Lightweight terminal markdown renderer.
  *
- * Exported so it can be unit-tested independently of the TUI.
- * No external dependencies — pure string transformation.
+ * Emits Blessed style tags (not raw ANSI) so the TUI renders every highlight
+ * with theme-driven colors, and exports the theme shape so unit tests and the
+ * TUI share one definition. No external dependencies — pure string transform.
  */
-import chalk from 'chalk';
-const MARKDOWN_THEME = {
+/** Blessed tags quantize hex colors to the terminal palette; chalk's
+ * truecolor SGR sequences are dropped by Blessed's attribute parser, which is
+ * why highlights previously rendered as plain white. */
+export const DEFAULT_MARKDOWN_THEME = {
     text: '#d7e0ea',
     muted: '#7f92a6',
     accent: '#6fb1d6',
-    accentStrong: '#8ac3e6',
+    heading: '#8ac3e6',
+    headingStrong: '#d7e0ea',
     codeBg: '#16212d',
     codeText: '#c7d7e6',
     codeFence: '#5f7388',
-    codeGreen: '#8ebd93',
-    codeRed: '#c97c7c',
+    diffAddBg: '#10281a',
+    diffAddText: '#9fd0a6',
+    diffDelBg: '#2b1215',
+    diffDelText: '#d99f9f',
 };
+let currentTheme = DEFAULT_MARKDOWN_THEME;
+export function setMarkdownTheme(theme) {
+    currentTheme = theme;
+}
+export function getMarkdownTheme() {
+    return currentTheme;
+}
+/** Blessed reserves braces for style tags; escape literal ones. */
+export function escapeTags(text) {
+    return text.replace(/{/g, '{open}').replace(/}/g, '{close}');
+}
+function fg(color, text) {
+    return `{${color}-fg}${text}{/${color}-fg}`;
+}
+/** Italic and strikethrough are not Blessed flags; raw SGR is honored by the
+ * content parser and excluded from width measurement. */
+function italic(text) {
+    return `\x1b[3m${text}\x1b[23m`;
+}
+function strike(text) {
+    return `\x1b[9m${text}\x1b[29m`;
+}
 function isDiffLanguage(lang) {
     return lang.toLowerCase() === 'diff' || lang.toLowerCase() === 'patch';
 }
@@ -31,27 +59,30 @@ export function diffKind(line) {
     return 'context';
 }
 export function renderDiffLine(line) {
+    const theme = getMarkdownTheme();
     switch (diffKind(line)) {
         case 'add':
-            return chalk.hex(MARKDOWN_THEME.codeGreen)(line);
+            return fg(theme.diffAddText, escapeTags(line));
         case 'del':
-            return chalk.hex(MARKDOWN_THEME.codeRed)(line);
+            return fg(theme.diffDelText, escapeTags(line));
         case 'hunk':
-            return chalk.hex(MARKDOWN_THEME.accent)(line);
+            return fg(theme.accent, escapeTags(line));
         case 'file':
-            return chalk.bold.hex(MARKDOWN_THEME.text)(line);
+            return fg(theme.text, escapeTags(line));
         case 'context':
         default:
-            return chalk.hex(MARKDOWN_THEME.muted)(line);
+            return fg(theme.muted, escapeTags(line));
     }
 }
 function renderCodeLine(lang, line) {
-    return isDiffLanguage(lang) ? renderDiffLine(line) : chalk.hex(MARKDOWN_THEME.codeText)(line);
+    return isDiffLanguage(lang) ? renderDiffLine(line) : fg(getMarkdownTheme().codeText, escapeTags(line));
 }
 const ANSI_PATTERN = /\x1b\[[0-9;]*[A-Za-z]/g;
-/** Display width ignoring ANSI escapes, counting East-Asian wide chars as 2 columns. */
+const TAG_PATTERN = /\{[^{}]*\}/g;
+/** Display width ignoring ANSI escapes and style tags, counting East-Asian
+ * wide chars as 2 columns. */
 export function displayWidth(text) {
-    const clean = text.replace(ANSI_PATTERN, '');
+    const clean = text.replace(ANSI_PATTERN, '').replace(TAG_PATTERN, '');
     let width = 0;
     for (const ch of clean) {
         const code = ch.codePointAt(0);
@@ -135,6 +166,7 @@ function truncateToWidth(text, maxWidth) {
 }
 /** Render a parsed table as aligned monospace lines that fit within maxWidth columns. */
 export function renderGfmTable(table, maxWidth) {
+    const theme = getMarkdownTheme();
     const columns = table.header.length;
     const gap = ' │ ';
     const gapWidth = displayWidth(gap);
@@ -153,40 +185,43 @@ export function renderGfmTable(table, maxWidth) {
             overflow -= reduce;
         }
     }
-    const padCell = (rendered, width, align) => {
-        const padding = Math.max(0, width - displayWidth(rendered));
+    const padCell = (plain, width, align) => {
+        const padding = Math.max(0, width - displayWidth(plain));
         if (align === 'right')
-            return ' '.repeat(padding) + rendered;
+            return ' '.repeat(padding) + plain;
         if (align === 'center') {
             const left = Math.floor(padding / 2);
-            return ' '.repeat(left) + rendered + ' '.repeat(padding - left);
+            return ' '.repeat(left) + plain + ' '.repeat(padding - left);
         }
-        return rendered + ' '.repeat(padding);
+        return plain + ' '.repeat(padding);
     };
+    // Pad the plain cell first, then style — so padding never measures tags.
     const renderRow = (cells, style) => cells
         .map((cell, index) => {
         const width = widths[index];
         const plain = displayWidth(cell) > width ? truncateToWidth(cell, width) : cell;
-        return padCell(style(plain), width, table.aligns[index]);
+        return style(padCell(plain, width, table.aligns[index]));
     })
-        .join(chalk.hex(MARKDOWN_THEME.muted)(gap));
-    const header = renderRow(table.header, (cell) => chalk.bold.hex(MARKDOWN_THEME.accent)(inlineMarkdown(cell)));
+        .join(fg(theme.muted, gap));
+    const header = renderRow(table.header, (plain) => fg(theme.accent, `{bold}${inlineMarkdown(plain)}{/bold}`));
     // One uniform border color for every structural character (│, ─, ┼).
-    const separator = chalk.hex(MARKDOWN_THEME.muted)(widths.map((width) => '─'.repeat(width)).join('─┼─'));
-    const body = table.rows.map((row) => renderRow(row, (cell) => inlineMarkdown(cell)));
-    return [header, chalk.hex(MARKDOWN_THEME.muted)(separator), ...body];
+    const separator = fg(theme.muted, widths.map((width) => '─'.repeat(width)).join('─┼─'));
+    const body = table.rows.map((row) => renderRow(row, (plain) => inlineMarkdown(plain)));
+    return [header, separator, ...body];
 }
 export function inlineMarkdown(text) {
-    return text
-        .replace(/\*\*\*(.+?)\*\*\*/g, (_m, t) => chalk.bold.italic(t))
-        .replace(/\*\*(.+?)\*\*/g, (_m, t) => chalk.bold(t))
-        .replace(/__(.+?)__/g, (_m, t) => chalk.bold(t))
-        .replace(/\*(.+?)\*/g, (_m, t) => chalk.italic(t))
-        .replace(/_(.+?)_/g, (_m, t) => chalk.italic(t))
-        .replace(/`([^`]+)`/g, (_m, t) => chalk.bgHex(MARKDOWN_THEME.codeBg).hex(MARKDOWN_THEME.codeText)(` ${t} `))
-        .replace(/~~(.+?)~~/g, (_m, t) => chalk.strikethrough(t));
+    const theme = getMarkdownTheme();
+    return escapeTags(text)
+        .replace(/\*\*\*(.+?)\*\*\*/g, (_m, t) => `{bold}${italic(t)}{/bold}`)
+        .replace(/\*\*(.+?)\*\*/g, (_m, t) => `{bold}${t}{/bold}`)
+        .replace(/__(.+?)__/g, (_m, t) => `{bold}${t}{/bold}`)
+        .replace(/\*(.+?)\*/g, (_m, t) => italic(t))
+        .replace(/_(.+?)_/g, (_m, t) => italic(t))
+        .replace(/`([^`]+)`/g, (_m, t) => `{${theme.codeBg}-bg}{${theme.codeText}-fg} ${t} {/${theme.codeText}-fg}{/${theme.codeBg}-bg}`)
+        .replace(/~~(.+?)~~/g, (_m, t) => strike(t));
 }
 export function renderMarkdown(text, cols = 80) {
+    const theme = getMarkdownTheme();
     const lines = text.split('\n');
     const out = [];
     let inCodeBlock = false;
@@ -203,12 +238,12 @@ export function renderMarkdown(text, cols = 80) {
             }
             else {
                 inCodeBlock = false;
-                const langLabel = codeLang ? chalk.hex(MARKDOWN_THEME.muted).italic(` ${codeLang}`) : '';
-                out.push(chalk.hex(MARKDOWN_THEME.codeFence)('┌' + '─'.repeat(Math.max(2, cols - 2))) + langLabel);
+                const langLabel = codeLang ? fg(theme.muted, italic(` ${escapeTags(codeLang)}`)) : '';
+                out.push(fg(theme.codeFence, '┌' + '─'.repeat(Math.max(2, cols - 2))) + langLabel);
                 for (const cl of codeLines) {
-                    out.push(chalk.hex(MARKDOWN_THEME.codeFence)('│ ') + renderCodeLine(codeLang, cl));
+                    out.push(fg(theme.codeFence, '│ ') + renderCodeLine(codeLang, cl));
                 }
-                out.push(chalk.hex(MARKDOWN_THEME.codeFence)('└' + '─'.repeat(Math.max(2, cols - 2))));
+                out.push(fg(theme.codeFence, '└' + '─'.repeat(Math.max(2, cols - 2))));
                 codeLang = '';
                 codeLines = [];
             }
@@ -222,19 +257,19 @@ export function renderMarkdown(text, cols = 80) {
         const h2 = raw.match(/^## (.+)/);
         const h3 = raw.match(/^### (.+)/);
         if (h1) {
-            out.push('\n' + chalk.bold.hex(MARKDOWN_THEME.accentStrong)(h1[1]));
+            out.push('\n' + fg(theme.heading, `{bold}${escapeTags(h1[1])}{/bold}`));
             continue;
         }
         if (h2) {
-            out.push('\n' + chalk.bold.hex(MARKDOWN_THEME.text)(h2[1]));
+            out.push('\n' + fg(theme.headingStrong, `{bold}${escapeTags(h2[1])}{/bold}`));
             continue;
         }
         if (h3) {
-            out.push(chalk.bold(h3[1]));
+            out.push(`{bold}${escapeTags(h3[1])}{/bold}`);
             continue;
         }
         if (/^---+$/.test(raw) || /^\*\*\*+$/.test(raw)) {
-            out.push(chalk.hex(MARKDOWN_THEME.muted)('─'.repeat(cols)));
+            out.push(fg(theme.muted, '─'.repeat(cols)));
             continue;
         }
         const tableMatch = matchGfmTable(lines, index);
@@ -245,30 +280,30 @@ export function renderMarkdown(text, cols = 80) {
         }
         const bullet = raw.match(/^(\s*)[*\-+] (.+)/);
         if (bullet) {
-            out.push((bullet[1] ?? '') + chalk.hex(MARKDOWN_THEME.accent)('•') + ' ' + inlineMarkdown(bullet[2] ?? ''));
+            out.push((bullet[1] ?? '') + fg(theme.accent, '•') + ' ' + inlineMarkdown(bullet[2] ?? ''));
             continue;
         }
         const numbered = raw.match(/^(\s*)(\d+)\. (.+)/);
         if (numbered) {
             out.push((numbered[1] ?? '') +
-                chalk.hex(MARKDOWN_THEME.accent)(numbered[2] + '.') +
+                fg(theme.accent, escapeTags(numbered[2] + '.')) +
                 ' ' +
                 inlineMarkdown(numbered[3] ?? ''));
             continue;
         }
         const bq = raw.match(/^> (.+)/);
         if (bq) {
-            out.push(chalk.hex(MARKDOWN_THEME.muted)('│ ') + chalk.italic.hex(MARKDOWN_THEME.muted)(bq[1]));
+            out.push(fg(theme.muted, '│ ') + fg(theme.muted, italic(escapeTags(bq[1]))));
             continue;
         }
         out.push(inlineMarkdown(raw));
     }
     if (inCodeBlock && codeLines.length > 0) {
-        out.push(chalk.hex(MARKDOWN_THEME.codeFence)('┌─'));
+        out.push(fg(theme.codeFence, '┌─'));
         for (const cl of codeLines) {
-            out.push(chalk.hex(MARKDOWN_THEME.codeFence)('│ ') + renderCodeLine(codeLang, cl));
+            out.push(fg(theme.codeFence, '│ ') + renderCodeLine(codeLang, cl));
         }
-        out.push(chalk.hex(MARKDOWN_THEME.codeFence)('└─'));
+        out.push(fg(theme.codeFence, '└─'));
     }
     return out.join('\n');
 }